All Posts By

gml_admin

Feb 16
0

2022 – recap

By | Company News | No Comments

As we’ve closed out 2022, we wanted to share some updates and celebrate the success of last year.  With continued growth in both the Commercial and Federal markets, we continue to live the mission to “Protect Life Online” by delivering value and impact to all of our customers.  A few highlights include an exciting contract with the Defense Innovation Unit (DIU) addressing a major security challenge for the Army, increasing our support to the Financial Services Sector in accelerating their cloud journey, and providing support to the ongoing conflict in Ukraine. This included the privilege to talk with ABC News about the cyber warfare and challenges associated with the escalating Ukraine war.

All of this success did not go unnoticed and it was a year of great recognition. We received Inc. Magazine’s award for Fastest Growing Company in the Mid-Atlantic, Best Workplaces – National, and made our debut on the national Inc. 5000.  Building on our B Corp certification, out of all the global B Corps, Grey Market Labs was recognized in the top five “Best for the World” companies for Governance.  Lastly, we were once again awarded a 17&43 award by the University of Delaware – based on revenue, growth, innovation and social impact.  This validation of the hard work of our outstanding team and gives us a great platform to continue growing in 2023.

As we’ve emerged from COVID, we were excited to resume in-person meetings with our customers, across conferences and forums. This included deepening our partnership with the National Cyber Forensics and Training Alliance (NCFTA) as a sponsor at their annual Cyber Crime forum in Pittsburgh and hosting a workshop at the NCTFA New York City offices around “Combatting Financial Crime and Enabling Technology”. The Replica team continued to share our expert insights as part of our New Battlefront Series. After participating this year, we joined the Digital Supply Chain Institute (DSCI), which solidifies our partnership in securing an ever-evolving digital economy.  We closed the year with a celebration of the latest Replica release in October and the inaugural Replica Exchange event. Next year we look forward to more events such as:

SXSW: come see us at the Optiv Cyber House on March 13 https://go.optiv.com/OptivSXSW.html#Register
and hear our CEO and Cofounder – Kris Schroeder at a panel on “National Security Impacts of Ultra-Transparency”

The 2nd Annual Replica Exchange – October 2023

As always, Grey Market Labs and the journey to build Replica would not happen without our amazing customers, team and supporters like you. We look forward to connecting with you in 2023!

___________________________________________________________________________________

Grey Market Labs® is a Certified B-Corp founded with the mission to protect life online. Our Replica™ platform orchestrates, automates, and secures Environments-as-a-Service, making organizations more protected with our patented privacy and Zero Trust architecture and more productive by increasing access to critical data, tools, and workflows simply, on-demand, anywhere. Replica™ support of dozens of use cases that span industries: from disrupting fraud on the dark web, to supporting military operations, combatting human trafficking, and enabling trusted data sharing in healthcare. 

Grey Market Labs® is the first cybersecurity product company recognized as a Certified B-Corp organization.

Contact us to see how we can work together.

Mar 08
1

Ukraine is at war, and so are you

By | Cyber Warfare, Information Security | No Comments

The full-scale invasion of Ukraine was beyond most expectations. Many of us watching the developments felt that Russia would take the easy gains of the eastern separatist region of Ukraine and slowly eat away at the rest of a sovereign nation over the coming years. The brutal and relentless approach Russia is taking instead shows the broad and global power grab taking place.

The Ukraine military is and will continue to put forth a strong fight against an opponent with overwhelming resources. Cyber-attacks including distributed Denial of Service (DDoS) that hit the Ukrainian defense and banking sectors will be launched as often as actual bombs in this war. The lack of widespread reporting of cyber attacks does not mean they aren’t happening. Much like a cancer, cyber is mostly invisible and once the attack is public or the effects seen, it is too late.

Unlike a cancer, this war and associate damage will not stay within the borders of Ukraine. On the digital battlefield, the intensive attacks and methods Russia and Russian-sponsored hacker groups (like Sandworm) use to weaken Ukraine are indiscriminate. These sophisticated attacks automatically and autonomously search out and infect other systems that can be compromised. Once these “worms” are launched, no human has control over where and when these virus’ attack or how far they will reach. Two public and destructive instances have already been used by Russia.

First, in conjunction with the start of the Ukraine invasion, satellite internet provider Viasat (a U.S. company) had a large outage of its service due to a cyber attack. This affected Ukraine but also tens of thousands of subscribers across EU and NATO countries. More importantly, 5300 wind turbines were knocked offline in Germany and Central Europe. Clearly attributed to Russia, these are examples of the widespread collateral damage of modern cyber warfare.

Second, last Wednesday the U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced that an older threat called “Cyclops Blink” was reactivated and may be able to access more networking devices that originally thought when it was discovered in 2019. Russian-backed hacking groups used similar approaches to deploy malware like WannaCry and NotPetya, which each inflicted worldwide damage costing billions of dollars.

So now, if we consider that these cyber attacks have been as destructive as bombs or guns, Central and Western Europe and a U.S. company have already been attacked and every internet connected country is vulnerable to the cyber battle in Ukraine. Vladimir Putin has declared that a “no-fly zone” or direct military support to Ukraine would be considered an act of war. What do we call a cyber attack that takes out major electricity providers in Germany? Does that not equate to an already launched act of war? The US and our allies need to revisit the rules of what is considered an “act of war” and increase the accountability of any nation that threatens national sovereignty in any domain: land, sea, air, space, and cyberspace. Bring together a coalition to rewrite the rules of engagement for cyber, bring the commercial community (with their experts and skilled Threat Centers) to the table as partners in this effort and as fellow combatants in this war.

Today, we need to continue the pressure and increase support to defeat the Ukraine invasion on both the physical and cyber battlefield. A fallen Ukraine changes the physical security of Europe. Even worse, a fallen Ukraine tells Russia, and others, that there is no consequence for cyber damage, collateral or otherwise. If that is the case, NATO nations should prepare themselves to be the next targets.

___________________________________________________________________________________

Grey Market Labs® is a Certified B-Corp founded with the mission to protect life online. Our Replica™ platform orchestrates, automates, and secures Environments-as-a-Service, making organizations more protected with our patented privacy and Zero Trust architecture and more productive by increasing access to critical data, tools, and workflows simply, on-demand, anywhere. Replica™ support of dozens of use cases that span industries: from disrupting fraud on the dark web, to supporting military operations, combatting human trafficking, and enabling trusted data sharing in healthcare. 

Grey Market Labs® is the first cybersecurity product company recognized as a Certified B-Corp organization.

Contact us to see how we can work together.

Dec 10
5

DNS: Still Insecure By Default

By | Data Privacy, Data Protection, Information Security | No Comments

The use of encryption on the internet has grown tremendously over the past decade; HTTPS has quickly shifted from a technology used primarily to protect e-commerce, to an industry standard for website development.[1]  Many users now know to look for the padlock in their browser’s address bar to confirm that their connection is securely established via HTTPS.  But that padlock is not telling the whole story.

Before your computer ever establishes a connection with a website, it must translate the website address into an IP address.  Your operating system typically handles this task, asking a Domain Name System (DNS) server to look up the address, much like a phonebook.   Unfortunately, the DNS system has changed relatively little since it was originally designed for the needs of the 1980’s internet, when there was little consideration for security or privacy.

Even now, most devices by default will pass these queries to the DNS server configured by the network operator or ISP that you are connected to – and in nonencrypted plain text!   While DNS queries do not expose the content of your internet activity, they do expose which sites you connect to, and when.  Anyone eavesdropping on DNS traffic can ascertain someone’s general browsing history, learn a lot about the device they are using, and the patterns of how they use it.  There is also a potential to block or change DNS records, preventing access to certain web addresses or redirecting your browser to malicious endpoints.  The collection of this data is a huge risk to privacy; earlier this year, a Thai ISP accidentally leaked an astounding 8 billion DNS records they collected about their customers’ internet usage. [2]

Luckily, the industry is starting to address these weaknesses by implementing support for newer DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) standards, both of which encrypt your DNS queries while in transit.  The latest versions of macOS and iOS have added support for encrypted DNS using both protocols [3], and Microsoft is currently testing DoH support for Windows 10 [4].  Unfortunately, these solutions are not turned on by default, and they still assume ultimate trust in the DNS provider, but they are a step in the right direction when configured properly with a provider you trust.

Today, Cloudflare announced a new proposed standard: Oblivious DoH (ODoH) [5].  This proposal takes DoH one step further, by adding a proxy between your device and the DNS server.  This approach aims to further increase privacy by hiding the identity of the request from the DNS server.  But, like any new internet protocol, it will likely be years before we see widespread adoption.

DNS is a foundational part of the internet and is critical to its security and privacy.  At Grey Market Labs, we think it is important to build solutions with security and privacy by design, and we hope to see the industry do the same with DNS.

____________________________________________________________________________________

Grey Market Labs is a Public Benefit Corporation founded with the social mission to protect life online. We build revolutionary software and hardware products, and partner with like-minded industry leaders, to create a future with “privacy-as-a-service”.

Simply: we prevent data from being compromised and protect our customers work, online.

Contact us to see how we can work together.

 

 

Nov 04
4

The New Dirty Word: Default

By | Data Privacy, Information Security | No Comments

It’s 10PM and you’re ending your day but hackers are just getting started. Maybe a cup of brute-force strength hacking techniques to start their day? Before you drift to sleep, you can’t help but start thinking about that new corporate application you installed today. Did you configure everything correctly with the right passwords, settings, and certificates? You can check tomorrow but business doesn’t stop and with employees working from home, “business hours” are a thing of the past. Besides, everything you tested worked great and did what it was supposed to do so you know things will probably work fine. And they do for months… until something strange starts happening and you see that new competitors are taking your business by selling a product that looks eerily similar to yours. How could they have copied it so well? You suspect that you may have a mole in your organization and so you begin analyzing the network traffic of all your employees. But what you end up seeing is something unexpected, outside traffic not tied to any of your users is coming in and stealing your internal corporate data. How is this happening? After much investigation and discussions with the provider of the application, you discover that there were default settings you had to change and you are told it’s your fault for not changing them.

It was recently reported by Hacker News that over 200,000 businesses were susceptible to being hacked because of not changing a default setting in Fortigate VPN.  Customers have been told that it’s unfortunate they didn’t follow instructions but nothing is going to change.  “For its part, Fortinet said it has no plans to address the issue, suggesting that users can manually replace the default certificate and ensure the connections are safe from MitM attacks.”  I don’t know about you but if I have 200,000 clients buying a VPN that can be hacked because my clients aren’t aware of what they need to configure, then something needs to change. “‘The Fortigate issue is only an example of the current issues with security for the small-medium businesses, especially during the epidemic work-from-home routine,’ Hertz and Tashimov noted.  ‘These types of businesses require near enterprise grade security these days, but do not have the resources and expertise to maintain enterprise security systems. Smaller businesses require leaner, seamless, easy-to-use security products that may be less flexible, but provide much better basic security.’”

This is akin to the early days of home Wi-Fi where every router was public and not password protected. A common tactic of wardriving forced the consumer router industry to wake up and make their routers private and put default random passwords on the box like happypuppy632.  Perhaps this bad publicity will force a change to the default behavior for Fortigate VPN but that remains to be seen. For liability, Fortinet may publicly be pushing a hard line but perhaps changes will be quietly made in future releases. It defeats the purpose of an application explicitly designed for privacy to be insecure out of the box when so many will just plug it in and start using it while unaware of the dangers.

 

At Grey Market Labs we believe you shouldn’t need a computer science degree to be safe online. That’s why our solutions are built with Security and Privacy by Design, striving toward our mission to protect life online. Our products accelerate your business and work online and in the cloud, making you more productive and ensuring privacy and security especially with in a world of remote work.

Simply: we prevent data from being compromised and protect our customers work, online.

Contact us to see how we can work together.

Oct 13
4

Not all Scraping is Created Equal

By | Data Privacy | No Comments

CREXi and CoStar Group both sell real estate information to help customers follow trends and more accurately value properties. Having the right information when buying or selling a commercial property worth $100M can make or break a deal and shift profits into the hands of those with more knowledge.

These companies have trade secrets on how they gather the information, aggregate it, model with it, and produce recommendations, charts, reports, etc. Recently, CoStar Group sued CREXi for “massive” copyright infringement and intellectual property theft [1]. It is alleged that CREXi employees were creating fake accounts to access CoStar’s data. Generally, creating a “fake” account is a violation of the terms of service. It’s even more egregious if it is being done to steal (or scrape) data and reuse/sell it for profit.

In a similar manner, Google scrapes many sites at varying intervals. They keep the news results fairly up to date, and when displaying things like the news, they have advertisements. Is Google stealing someone else’s copyrighted works so they can sell ads? Google has a News Initiative [2] that is drawing attention from France and Australia [3], to name a few. Selling someone else’s news is illegal in some countries and jurisdictions. There’s got to be a limit to what one can “borrow” from another before it’s the equivalent of stealing, copyright infringement, or just not classic “fair use.”  Is it OK for Google to scrape a news site for information that it then monetizes indirectly (via advertisements) but not OK for CREXi to scrape CoStar’s website and resell that information directly? There’s clearly a difference, but like many of these differences, they’re not black or white; context is required, and they’re usually a shade of grey.

 

Grey Market Labs is a Public Benefit Corporation founded with the social mission to protect life online. We build revolutionary software and hardware products, and partner with like-minded industry leaders, to create a future with “privacy-as-a-service”.

Simply: we prevent data from being compromised and protect our customers work, online.

Contact us to see how we can work together.

Sep 02
4

Do you control YOUR data and how exactly do you “control” it?

By | Data Privacy, Data Protection | No Comments

Privacy legislation has been on the horizon for almost as long as security legislation. Every year, digital tracking techniques get better (or creepier, depending on your perspective).  What if all these privacy rules/regulations actually came to fruition? What does “controlling your data” really mean – for the end user and corporations alike?

It’s hard to imagine what the internet would be like without advertisement supported projects like the Google search engine. That search engine is good because it uses data from a variety of sources to improve it. Microsoft uses data from Microsoft 365 (formerly Office 365) and its operating systems (e.g. Windows 10) to “improve user experience.” LinkedIn uses data about users to bolster professional networks (and in many cases social networks). What if all the data about your enterprise – including all your users—was configurable by you, and Google, Microsoft, Facebook, Apple, nation states, hackers, data brokers, etc. couldn’t see any of it. Maybe you’ve never thought you could control your enterprise user data to that extent … but we help make that happen.

There are speculations on what the technology landscape could look like when you start to control your own data, including this recent article from CMS Wire. The author mentions that some cookies are on the chopping block (3rd party cookies specifically). Fortunately for big tech they already have workarounds. Facebook has been allowing 1st party cookies for a while now but back-end data sharing agreements (which you probably agreed to with the Terms of Service) will continue to be a ripe source of data. Unfortunately for the end users, there’s really no functional change in the data that is exposed, stored, mined and monetized — even with GDPR and CCPA in full effect.

Truly controlling your enterprise data, including effectively masking your external enterprise footprint, is what we at Grey Market Labs enable with our Opaque platform. We expose privacy controls that administrators can understand and integrate with your existing infrastructure. Opaque is your “easy button” for digital privacy to the outside world (i.e. outside your corporate footprint).  Sometimes you need to control what users within and outside your organization have access to. We recently announced a partnership with Virtru to bring their TDF-enabled encryption and access controls to Opaque. Share data from within our platform to a user in another cloud, manage their access as desired, and get full audit of when they access it. If you need more granular controls (such as preventing a user from copying text you shared) you can share the data to have it open within Opaque directly – completely clientless. Our Virtru integration is a welcome layer of our defense in depth strategy.

Aug 18
2

Grey Market Labs® and Virtru Partner to Deliver Secure Analytics

By | Data Privacy, Data Protection | No Comments

Even with technological advancements in data processing, machine learning, and other analytics, organizations face challenges when sharing valuable data with collaborators due to a lack of transparency and ownership of data once it leaves its source point. Enterprises and agencies often rely on virtual machines to safely collaborate on their most sensitive information without losing control and giving up access to third parties, but existing solutions restrict the ways in which data can be classified, protected, audited, and shared across different platforms.

Grey Market Labs® and Virtru solve this problem by enabling data owners to maintain full lifecycle control over their sensitive information and securely share it for approved analysis. Grey Market Labs®’ Opaque platform offers patented secure virtual environments in which individuals can view and manipulate their TDF-protected data without ever having to expose this sensitive information.

Virtru’s Trusted Data Platform (TDP) is powered by the Trusted Data Format (TDF)—an open standard for object-level encryption created by Virtru Co-Founder and CTO, Will Ackerly, that keeps data protected and under the owner’s control. This technology ensures that companies can send information in a secure way that limits exposure risks.  Combined with the Opaque platform collaborators can have the assurance that content will always remain under their ownership, protected from misuse or unauthorized access.

Together, Virtru and Grey Market Labs® provide the ability to:

  • Share data more securely by adding persistent protections and attribute-based access control (ABAC). The Opaque platform uses TDF protections to ensure the integrity of sensitive data as it is shared from its original owner, so it can be trusted to inform business decisions and remain protected regardless of how it is analyzed or manipulated. Data owners can revoke, expire, or audit access to information at any point in its lifecycle, making it easier to share and collaborate with multiple parties. With ABAC, data created by different organizations in different applications can carry the same protections and access policies—whether the content is being collaborated on within a secure enclave, shared in transit, or brought outside of Opaque for offline consumption.
  • Improve performance with expanded access to analytic tools. By enabling granular audit of users and data activity, Opaque makes it easy for organizations to provide assurances that information can securely travel across environments and systems it might not otherwise be permitted to reach. As a result, end-users can ingest and analyze their most sensitive data using a broad array of collaboration and analytic tools, whether desktop, web-based, or cloud-based. Each Opaque virtual environment can be preloaded with the applications needed for an individual data analyst to perform his or her work and since each environment is isolated, owners are granted administrative rights to their virtual environments enabling them to safely configure instances on-demand.
  • Increase data transparency and accountability. By increasing transparency into where and how data is being shared, organizations can enhance trust and ensure they are safeguarding private information while providing the defensible audit of data to ensure regulatory compliance or third-party audits.

For more information, please contact Kris Schroeder, CEO at Grey Market Labs.

Aug 04
2

The Challenge of In-House Data Protection and Privacy

By | Data Privacy, Data Protection | No Comments

If you are a mid-size or larger business, you have an overworked security team. Those teams have responsibility across dozens of business areas, from executive protections, to cyber defense, to insider threat and more, many with competing priorities. Increasingly, security practitioners recognize that protecting customer or individual privacy is the most proactive way to protect the most important and sensitive activities of an organization (Apple Declines new API’s Due to Privacy Concerns).

The challenge is in the implementation – some companies with in-house engineering skill, or the resources to hire consulting firms, have tried to enact “enterprise privacy” by cobbling together integrations of “no track” VPN providers, isolated browsers, and imposing increasingly strict firewall and application rules. The end result is an increasingly costly environment to maintain and, in the end, a net decrease of the end user productivity with restrictions on internet services. In fact, these environments can be so brittle they actually increase the chance of compromise, since failure of one piece in this puzzle. For example, last month seven ‘no log’ Hong Kong VPN providers were accused of leaking 1.2TB of user logs onto the internet via unsecured Elasticsearch cluster (“No track” UFO VPN exposes user data). If any company or individual employees used those servers during that time, they were exposed and were ripe targets for hacking. Whether this was a misconfiguration or something worse, exposed VPNs are just one example of the fragility that comes with home-grown privacy solutions.

The goal should be to isolate external-facing internet activity and implement an architecture that enables zero-trust. While that sentence is buzzword heavy, the isolation approach limits exposure of any one component of a system, so if a VPN is compromised it doesn’t necessarily mean the company will be impacted. Also, when you bring in zero-trust concepts to a completely controlled environment, a company can increase the level of data sharing that is available while at the same time increasing data protection and privacy. Expect and ask more from the tech industry.

Grey Market Labs is a Public Benefit Corporation founded with the social mission to protect life online. We build revolutionary software and hardware products, and partner with like-minded industry leaders, to create a future with “privacy-as-a-service”.

Simply: we prevent data from being compromised and protect our customers work, online.

Contact us to see how we can work together.

Apr 15
3

Security Considerations for Enterprise Remote Access

By | Data Privacy, Data Protection, Information Security | No Comments

Remote-access technologies are top-of-mind for most IT professionals now, and remote work is a trend which is likely here to stay for the long term. If you’re looking to update your organization’s security policy, NIST has recently published an excellent bulletin outlining some of the unique security challenges posed by remote work.

NIST categorizes remote-access technologies into four main categories: Tunneling, Portals, Direct Application Access, and Remote Desktop Access.  With the rise of BYOD (bring your own device) policies and cloud-based applications, it has become common for organizations to employ multiple solutions for remote access, each with their own unique security considerations.   Regardless of which remote-access technologies your organization is using, it is important to continually ensure each is being used in a way that protects data from compromise.

The NIST bulletin highlights a few important points:

  • Organizations should assume that devices used for remote work will be compromised. Make sure that sensitive data is encrypted, or better yet, implement solutions that don’t store any sensitive data on client devices.
  • Devices used in external environments are under greater risk for compromise than devices in enterprise environments, so tighter security controls are advisable. Security controls can also vary widely by device, so you may need to give more specific security guidance for BYOD devices used for remote work.
  • Each additional form of remote access that is exposed increases the risk of compromise. This can be mitigated by implementing tiers of access for different client devices, and by situating remote access servers so they serve as a single point of entry.

Grey Market Labs is a Public Benefit Corporation with the mission to “protect life online”. Our Advisory services can help you navigate the conflicting and overwhelming enterprise privacy and data protection guidance. Our products provide cost-effective and comprehensive privacy-as-a-service, delivering proactive internet protection for remote work and distributed teams. Simply: we prevent data from being compromised, establish trust between users and protect our customers work, online. CONTACT US to see how we can solve some hard problems together.

Apr 03
2

The Risks with Increased Use of Virtual Environments

By | Data Privacy | No Comments

On Wednesday, the FBI released a PSA (I-040120-PSA) on threats associated with the increased use of virtual environments (https://www.ic3.gov/media/2020/200401.aspx). With the massive increase in remote and telework, the attack surface (i.e. the available prey for hackers hunting online) has massively increased. The term “shooting fish in a barrel” is very relevant and likely underestimates the risk to businesses and governments. A few things stand out:

  1. Terms of Service – read them! As the recent Zoom issues highlighted, free software is not free. If you or your organization aren’t paying a license fee, then you and your data are how those companies are making their money. The data sharing economy has made this freemium model ubiquitous. As a leader in your organization, make sure your security, IT and/or risk leaders have read the terms of service for each product in use – you will be surprised how many tools claim ownership of your corporate data. Choose ones that prioritize protection of their customers and their data.
  2. Immature Security – while online collaboration tools have security features, most weren’t designed to protect against sophisticated Chinese or Russian attacks. With the rapid increase in the use of tools like Zoom, they have become a lucrative target for nation-state hackers. Look for tools that have supported Federal Government customers, especially the DoD, as they have usually gone through strict vetting procedures.
  3. Limited or Shared Resources – to keep costs low or to rapidly grow capacity, organizations regularly purchase refurbished equipment, allow Bring Your Own Device (BYOD) or, in cloud computing, share resources with other companies. In both scenarios, you are opening your company to threats from poorly maintained or recycled equipment, or from data leakage with poorly designed collaboration tools. Focus on systems that allow single tenancy (one organization per installation), comprehensive isolation (beyond browsers and applications) and leverage virtual desktop interfacing (VDI) or similar as they can mitigate the issues of poorly refurbished or employee provided computers.

Finally, many of the suggestions in the FBI letter rely on your employees and system users to be vigilant for recognizing scams and suspicious online activity. The more platforms and technology can automate these best practices, the more proactive our defenses will become and the less we will have to worry about human error.

As a Public Benefit Corporation, Grey Market Labs was created to help protect life online. If you are concerned about Data Privacy and Employee Protection (especially for your most sensitive work), please reach to us directly: info@greymarketlabs.com. We can guide you through these privacy and cybersecurity challenges and, if our products are not the best fit, recommend one of our vetted partners to best meet your needs.