Checkpoint Systems Inc. - Experts & Thought Leaders

Checkpoint Systems introduces SFERO™ RFID Checkout, the first RFID Electronic Article Surveillance (EAS) antenna directly integrated into the checkout lane.  This innovation expands the SFERO™ portfolio and marks a new milestone in store protection by extending security directly to the POS. Designed primarily for grocery and CPG retailers, SFERO™ RFID Checkout illustrates the rapid evolution of RFID applications beyond apparel toward increasingly diverse and complex retail environments.  The innovation will be showcased in preview at the Checkpoint booth (Hall 6 / E23) at the upcoming EuroShop trade show. RFID protection extended to a strategic point Historically restricted to exit-based EAS pedestals, RFID technology is reaching a new milestone by transitioning from the storefront to the heart of the checkout experience. With SFERO™ RFID Checkout, loss prevention doesn’t stop at the exit. It also protects your store right at the checkout, where fraud risk is highest. Directly integrated into the checkout lane, SFERO™ RFID Checkout stands out for its discreet yet highly deterrent design. It enables precise identification of RFID-tagged items in the event of a theft attempt, delivering granular traceability and faster response from store staff. Detection occurs earlier in the shopper journey, facilitating quicker intervention and reducing losses before merchandise even reaches the exit. Designed for seamless integration, the antenna requires no floor cutting or heavy installation work. Cabling is fully integrated into the checkout lane, simplifying store reconfigurations and preserving the store’s visual appeal with clean, uncluttered checkout areas. Process and capabilities SFERO™ RFID Checkout is powered by next-generation electronics, delivering high detection performance and extensive connectivity, enabling integration with other SFERO™ modules as well as third-party solutions such as CCTV systems. Furthermore, it is important to note that Checkpoint already offers a wide range of ALPHA accessories compatible with SFERO™ RFID Checkout solution. Beyond its loss prevention capabilities, the electronics embedded in SFERO™ RFID Checkout can also function as an RFID POS reader. Retailers therefore benefit from a unified checkout solution that combines theft prevention and faster transaction processing. The solution is already undergoing testing with major food retailers. SFERO™, comprehensive RFID EAS platform This new checkout solution completes the SFERO™ ecosystem, joining the existing pedestals and overhead antennas designed for store perimeters. By combining these modular components, retailers can protect entrances up to 10 meters wide with a fully customisable configuration. With this latest addition, the SFERO™ range now offers retailers one of the most comprehensive and flexible RFID EAS platforms on the market, providing seamless protection from the checkout lane to the store exit. Supporting customers with RFID solutions “With SFERO™ RFID Checkout, we are taking a new step forward in securing the store environment, and particularly the checkout lane. This innovation perfectly reflects our ability to anticipate market shifts and support our customers with increasingly intelligent, integrated, and high-performance RFID solutions. At Checkpoint, we don’t simply follow trends—we shape them to help retailers, especially grocery, meet today’s and tomorrow’s challenges,” said Mariano Tudela, VP Sales MAS Worldwide at Checkpoint Systems. Supporting retailers with advanced technologies The continued expansion of the SFERO™ portfolio, including the addition of SFERO™ RFID Checkout, reaffirms Checkpoint’s role as a pioneer in retail RFID. Backed by a strong R&D strategy, the company develops next-generation solutions to improve operational performance, in-store security, and the customer experience. Checkpoint Systems continues its mission to support retailers over the long term with the most advanced technologies on the market.

Check Point® Software Technologies Ltd., a pioneering AI-powered, cloud-delivered cyber security platform provider, has published its Global Threat Index for July 2024. Despite a significant drop in June, LockBit re-emerged last month to become the second most prevalent ransomware group, while RansomHub retained the top spot. Meanwhile, researchers identified both a campaign distributing Remcos malware following a CrowdStrike update issue, and a series of new FakeUpdates tactics, which once again ranked first on the top malware list for July. An issue in the CrowdStrike Falcon sensor for Windows led to cybercriminals distributing a malicious ZIP file named crowdstrike-hotfix.zip. This file contained HijackLoader, which subsequently activated Remcos malware, which was ranked as the seventh most wanted malware in July. The campaign targeted businesses using Spanish-language instructions and involved the creation of fake domains for phishing attacks. Check Point’s index Researchers found a series of new tactics using FakeUpdates, ended malware ranking for month Meanwhile, researchers uncovered a series of new tactics employing FakeUpdates, which topped the malware ranking for another month. Users visiting compromised websites encountered fake browser update prompts, leading to the installation of Remote Access Trojans (RATs) like AsyncRAT, currently ranked ninth on Check Point’s index. Alarmingly, cybercriminals have now started exploiting BOINC, a platform meant for volunteer computing, to gain remote control over infected systems. Maya Horowitz, VP of Research at Check Point Software, said: “The continued persistence and resurgence of ransomware groups like Lockbit and RansomHub underscores cybercriminals’ continued focus on ransomware, a significant ongoing challenge for organisations with far-reaching implications for their operational continuity and data security."  Security software update "The recent exploitation of a security software update to distribute Remcos malware further highlights the opportunistic nature of cybercriminals to deploy malware, thereby further compromising organisations’ defences." "To counter these threats, organisations will need to adopt a multi-layered security strategy that includes robust endpoint protection, vigilant monitoring and user education to reduce the onslaught of these growingly massive cyberattacks,” said Maya Horowitz, VP of Research at Check Point Software. Top malware families The arrows relate to the change in rank compared to the previous month. FakeUpdates was the most prevalent malware last month with an impact of 7% worldwide organisations, followed by Androxgh0st with a global impact of 5%, and AgentTesla with a global impact of 3%. ↔ FakeUpdates – FakeUpdates (AKA SocGholish) is a downloader written in JavaScript. It writes the payloads to disk prior to launching them. FakeUpdates led to further compromise via many additional malware, including GootLoader, Dridex, NetSupport, DoppelPaymer, and AZORult. ↔ Androxgh0st – Androxgh0st is a botnet that targets Windows, Mac, and Linux platforms. For initial infection, Androxgh0st exploits multiple vulnerabilities, specifically targeting-the PHPUnit, Laravel Framework, and Apache Web Server. The malware steals sensitive information such as Twilio account information, SMTP credentials, AWS key, etc. It uses Laravel files to collect the required information. It has different variants which scan for different information. ↔ AgentTesla – AgentTesla is an advanced RAT functioning as a keylogger and information stealer, which is capable of monitoring and collecting the victim’s keyboard input, system keyboard, taking screenshots, and exfiltrating credentials to a variety of software installed on a victim’s machine (including Google Chrome, Mozilla Firefox and the Microsoft Outlook email client). ↑ Formbook – Formbook is an Infostealer targeting the Windows OS and was first detected in 2016. It is marketed as Malware as a Service (MaaS) in underground hacking forums for its strong evasion techniques and relatively low price. FormBook harvests credentials from various web browsers, collects screenshots, monitors and logs keystrokes, and can download and execute files according to orders from its C&C. ↓ Qbot – Qbot AKA Qakbot is a multipurpose malware that first appeared in 2008. It was designed to steal a user’s credentials, record keystrokes, steal cookies from browsers, spy on banking activities, and deploy additional malware. Often distributed via spam email, Qbot employs several anti-VM, anti-debugging, and anti-sandbox techniques to hinder analysis and evade detection. Commencing in 2022, it emerged as one of the most prevalent Trojans. ↔ Remcos – Remcos is a RAT that first appeared in the wild in 2016. Remcos distributes itself through malicious Microsoft Office documents, which are attached to SPAM emails, and is designed to bypass Microsoft Windows UAC security and execute malware with high-level privileges. ↔ Phorpiex – Phorpiex is a botnet known for distributing other malware families via spam campaigns as well as fuelling large-scale Sextortion campaigns. ↑ Vidar – Vidar is an infostealer malware operating as malware-as-a-service that was first discovered in the wild in late 2018. The malware runs on Windows and can collect a wide range of sensitive data from browsers and digital wallets. Additionally, malware is used as a downloader for ransomware. ↓ AsyncRat – Asyncrat is a Trojan that targets the Windows platform. This malware sends out system information about the targeted system to a remote server. It receives commands from the server to download and execute plugins, kill processes, uninstall/update itself, and capture screenshots of the infected system. ↓ NJRat – NJRat is a remote access Trojan, targeting mainly government agencies and organisations in the Middle East. The Trojan has first emerged on 2012 and has multiple capabilities: capturing keystrokes, accessing the victim's camera, stealing credentials stored in browsers, uploading and downloading files, performing process and file manipulations, and viewing the victim's desktop. NJRat infects victims via phishing attacks and drive-by downloads, and propagates through infected USB keys or networked drives, with the support of Command & Control server software. Top exploited vulnerabilities  ↑ Command Injection Over HTTP (CVE-2021-43936, CVE-2022-24086) – A command Injection over HTTP vulnerability has been reported. A remote attacker can exploit this issue by sending a specially crafted request to the victim. Successful exploitation would allow an attacker to execute arbitrary code on the target machine.  ↑ Zyxel ZyWALL Command Injection (CVE-2023-28771) – A command injection vulnerability exists in Zyxel ZyWALL. Successful exploitation of this vulnerability would allow remote attackers to execute arbitrary OS commands in the effected system. ↔ HTTP Headers Remote Code Execution (CVE-2020-10826, CVE-2020-10827, CVE-2020-10828, CVE-2020-1375) – HTTP headers let the client and the server pass additional information with an HTTP request. A remote attacker may use a vulnerable HTTP Header to run arbitrary code on the victim machine.  ↔ Apache HTTP Server Directory Traversal (CVE-2021-41773) – A directory traversal vulnerability exists in Apache HTTP Server. Successful exploitation of this vulnerability could allow an attacker to access arbitrary files on the affected system. ↓ Web Servers Malicious URL Directory Traversal (CVE-2010-4598, CVE-2011-2474, CVE-2014-0130, CVE-2014-0780, CVE-2015-0666, CVE-2015-4068, CVE-2015-7254, CVE-2016-4523, CVE-2016-8530, CVE-2017-11512, CVE-2018-3948, CVE-2018-3949, CVE-2019-18952, CVE-2020-5410, CVE-2020-8260) – There exists a directory traversal vulnerability on different web servers. The vulnerability is due to an input validation error in a web server that does not properly sanitise the URI for the directory traversal patterns. Successful exploitation allows unauthenticated remote attackers to disclose or access arbitrary files on the vulnerable server. ↓ TP-Link Archer AX21 Command Injection (CVE-2023-1389) – A command injection vulnerability exists in TP-Link Archer AX21. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system. ↑ MVPower CCTV DVR Remote Code Execution (CVE-2016-20016) – A remote code execution vulnerability exists in MVPower CCTV DVR. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system. ↓ Dasan GPON Router Authentication Bypass (CVE-2024-3273) – A command injection vulnerability exists in PHPUnit. Successful exploitation of this vulnerability would allow remote attackers to execute arbitrary commands in the affected system. ↔ PHP Easter Egg Information Disclosure (CVE-2015-2051) – An information disclosure vulnerability has been reported in the PHP pages. The vulnerability is due to incorrect web server configuration. A remote attacker can exploit this vulnerability by sending a specially crafted URL to an affected PHP page. ↑ NETGEAR DGN Command Injection – A command injection vulnerability exists in NETGEAR DGN. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system. Top mobile malware Last month Joker was in first place in the most prevalent mobile malware, followed by Anubis and AhMyth. ↔ Joker – An android Spyware in Google Play, designed to steal SMS messages, contact lists and device information. Furthermore, the malware signs the victim silently for premium services in advertisement websites. ↔ Anubis – Anubis is a banking Trojan malware designed for Android mobile phones. Since it was initially detected, it has gained additional functions including Remote Access Trojan (RAT) functionality, keylogger, audio recording capabilities and various ransomware features. It has been detected on hundreds of different applications available in the Google Store. ↔ AhMyth – AhMyth is a Remote Access Trojan (RAT) discovered in 2017. It is distributed through Android apps that can be found on app stores and various websites. When a user installs one of these infected apps, the malware can collect sensitive information from the device and perform actions such as keylogging, taking screenshots, sending SMS messages, and activating the camera, which is usually used to steal sensitive information. Top-attacked industries Last month Education/Research remained in first place in the attacked industries globally, followed by Government/Military and Communications. Education/Research Government/Military Communications Top ransomware groups  The data is based on insights from ransomware "shame sites" run by double-extortion ransomware groups that posted victim information. RansomHub is the most prevalent ransomware group this month, responsible for 11% of the published attacks, followed by Lockbit3 with 8% and Akira with 6%. RansomHub – RansomHub is a Ransomware-as-a-Service (RaaS) operation that emerged as a rebranded version of the previously known Knight ransomware. Surfacing prominently in early 2024 in underground cybercrime forums, RansomHub has quickly gained notoriety for its aggressive campaigns targeting various systems including Windows, macOS, Linux, and particularly VMware ESXi environments. This malware is known for employing sophisticated encryption methods. Lockbit3 – LockBit is a ransomware, operating in a RaaS model, first reported in September 2019. LockBit targets large enterprises and government entities from various countries and does not target individuals in Russia or the Commonwealth of Independent States. Akira – Akira Ransomware, first reported in the beginning of 2023, targets both Windows and Linux systems. It uses symmetric encryption with CryptGenRandom() and Chacha 2008 for file encryption and is similar to the leaked Conti v2 ransomware. Akira is distributed through various means, including infected email attachments and exploits in VPN endpoints. Upon infection, it encrypts data and appends a ".akira" extension to file names, then presents a ransom note demanding payment for decryption.

Bart Bednar has joined ALCEA as an ALWIN Sales Engineer for North America. With more than 26 years of engineering and integration experience, he is based in Irving, Texas, and reports directly to Michael Woody, the company’s Technical Service and Customer Success Manager. ALCEA offers a wide range of critical infrastructure security solutions and access management systems as the internal systems integrator partner of ASSA ABLOY Global Solutions. In 2023, the company introduced ALWIN security management software to customers in the United States. The robust software platform combines ASSA ABLOY security locks, ABLOYÒ PROTEC 2 padlocks and cylinders, and CLIQ access software with video management and intrusion detection to bring real-time visibility and access management to critical infrastructure customers. Prior roles of Bednar  That’s the world Bednar has experience in prior to joining ALCEA. During the first 15 years of his career, while living in Minneapolis, Denver, Houston and Freehold, N.J, he was a field systems integrator at Checkpoint Security Systems, Inc. He assisted in the installation, service and project management of BA Security, Fire Alarm and Access Control, along with analog and IP cameras at retail giants like Apple/Uniqlo, Best Buy, Kohls, Target and many others. Bednar set and certified integrators and OPTEX’s six regional sales managers for a unique client base He served the last 11 years as a Field Application Manager at OPTEX America, a world-pioneering manufacturer of high-performance sensing technologies that include indoor and outdoor high-security applications. Throughout the U.S. and Canada, Bednar developed and certified integrators and OPTEX’s six regional sales managers for a unique client base. ALWIN and CLIQ access software systems Bednar supported over 50 product lines and worked with high-profile customers such as Amazon Web Services/Google, Con Edison and Duke Energy, as well as a handful of the most wealthiest people in the world with devices at their homes.  “I was also involved with the installations at every one of the Apple retail stores in Manhattan, and worked with various transportation agencies including Bay Area Rail Transit (BART) in the Bay area of northern California, the Metropolitan Transportation Authority (MTA) in the boroughs of New York City, and with the Chicago Transit Authority.” In his new position, Bednar is working with ALCEA sales personnel to promote and support the ALWIN and CLIQ access software systems. Introduce ALWIN to North America “My goal is to help increase sales and introduce ALWIN to North America. I want it to be as successful here as it is in France,” he remarked. ALWIN currently integrates or interfaces with over 100 pioneering technology manufacturers of access devices, readers and video systems. “ALWIN,” he continued, “is a different type of technology, but in the same market I have experience with the last few years in the area of critical infrastructure.” In his free time, Bednar enjoys many activities. He was a ski instructor in Colorado when he met his wife, Diane, and they enjoy traveling to Europe with friends. A motorcyclist, he is a huge fan of the Green Bay Packers and New York Yankees and loves to spend time with “Jersey”, their three-year-old toy golden doodle who accompanies him on motorcycle rides around Texas.