STE WILLIAMS

Microsoft today released 93 fixes and two advisories as part of its monthly Patch Tuesday update. Of these, 64 were categorized as Important in severity and 29 were ranked Critical.

Patching priority should be given to two “wormable” remote code execution (RCE) vulnerabilities that could allow future malware to spread across vulnerable machines without user interaction.

CVE-2019-1181 and CVE-2019-1182 affect Windows 8.1, Windows 7 SP1, Windows Server 2008 R2 SP1, Windows Server 2012, Windows Server 2012 R2, and all supported versions of Windows 10, including server versions. They do not affect Windows XP, Windows Server 2008, Windows Server 2008, or the Remote Desktop Protocol (RDP) itself. Like the BlueKeep RDP vulnerability patched this year, both could let an attacker remotely install and spread malware.

The vulnerabilities exist in Remote Desktop Services, formerly known as Terminal Services, when an unauthenticated attacker connects to a target system using RDP and sends specially crafted requests. Because they don’t require authentication or user interaction, an attacker could install programs; view, edit, or delete data; or create new accounts with full user rights.

To exploit CVE-2019-1181 and CVE-2019-1182, an attacker would have to use RDP to send a specially crafted request to the target system’s RDS. Today’s update corrects how Remote Desktop Services handles connection requests. Neither bug has been seen in the wild.

“These vulnerabilities were discovered by Microsoft during hardening of Remote Desktop Services as part of our continual focus on strengthening the security of our products,” writes Simon Pope, director of incident response for Microsoft’s Security Response Center. “At this time, we have no evidence that these vulnerabilities were known to any third party.”

Pope also points to a “partial mitigation” on affected systems with Network Level Authentication (NLA) enabled. Because NLA requires authentication before the flaw can be exploited, these systems are protected from wormable malware, he says. However, they are still vulnerable to RCE if attackers possess valid credentials they can use to authenticate.

Two additional vulnerabilities patched today, CVE-2019-1222 and CVE-2019-1226, are also Critical RCE bugs in RDS but, unlike the previously mentioned bugs, they’re not wormable.

Those aside, patches issued today address bugs in Windows, Edge, Internet Explorer, Microsoft Office, Microsoft Office Services and Web Apps, ChakraCore, Azure DevOps Server, Visual Studio, Online Services, and Microsoft Dynamics. None were publicly known or under attack.

Another vulnerability worth noting is CVE-2019-1201, a Critical RCE bug in Microsoft Word resulting from improper handling of objects in memory. An attacker could exploit this by creating a specially crafted Word file and convincing a victim to open it, either by attaching it to an email or hosting it on a malicious website. Outlook’s Reading/Preview Pane is an attack vector, meaning victims wouldn’t have to open an attachment to be exploited; they could simply view the email. If successful, an attacker could achieve the same permissions a target user has on the system.

It was a big month for patching, especially RCE vulnerabilities: Microsoft also fixed RCE bugs in the Chakra Scripting Engine, Microsoft Graphics, Hyper-V, Outlook, Word, the Windows DHCP client, Scripting Engine, and the VBScript Engine.

Related Content:

• Researchers Show How SQLite Can Be Modified to Attack Apps
• Security Flaws Discovered in 40 Microsoft-Certified Device Drivers
• 2019 Pwnie Award Winners (And Those Who Wish They Weren’t)
• DEF CON Voting Village: It’s About ‘Risk’

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/endpoint/microsoft-patches-wormable-rce-vulns-in-remote-desktop-services/d/d-id/1335514?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Enterprise organizations are scanning more applications for security vulnerabilities than ever before, but, troublingly, they are remediating fewer of their discoveries because of the sheer volume.

As it has for the past 13 years, WhiteHat Security recently analyzed data from the results of application security tests the company performed at customer locations last year.

The analysis showed that US organizations tested 20% more applications last year for security issues than they did in 2017. Yet they remediated barely half (50.7%) of all critical vulnerabilities discovered in their application software during dynamic application security tests (DAST) in 2018 and just 37% of the high severity flaws.

Despite higher awareness of application security issues, the vulnerability remediation rates last year were actually lower than those reported in 2017 (nearly 57% and 46%, respectively) — which, in turn, was lower than the prior year.

The overall average number of critical vulnerabilities per website was 3.2 — about the same as it has been in the past three years. Information technologies companies ironically had more than double that, at seven critical vulnerabilities per site. Others with an above-average number of critical vulnerabilities on their websites included organizations in the manufacturing sector, with 6.7, retail organizations (6.9) and mining (7).

On average, US organizations took nearly 149 days, or about five months, to fix critical vulnerabilities and some 235 days to fix the ones deemed of high importance. The window of exposure — or the length of time that an application has a serious vulnerability that can be exploited — was especially worrisome among organizations in the IT and retail sectors.  

WhiteHat’s data showed that a startling 56.9% of applications in IT organizations and 55.4% of those at companies in the retail sector were always vulnerable to attack.

Suboptimal State
“The state of application security continues to be suboptimal,” says Setu Kulkarni, vice president of corporate strategy at WhiteHat Security. “While this is not unexpected, it is surprising given that the number of applications and their criticality is increasing at an unprecedented rate.”

Web application security has become a top concern for enterprise organizations. Many recent breaches have resulted from attackers exploiting security flaws in Web applications. A DevSecOps community study that Sonatype conducted earlier this year, in fact, showed that more than one in four organizations (26%) have already experienced a data breach because of a Web application security issue.

In many cases, Sonatype found that the breaches were tied to inherited vulnerabilities in open source and third-party components that software development organizations frequently use in their applications.

WhiteHat’s study showed that such embeddable components were responsible for one-third of all discovered application security vulnerabilities last year. The biggest risk to organizations was from using unpatched third-party libraries, which increased 50% in number in just the past year.

“As companies are chasing shorter time to market, they’re relying more on open source and third-party components,” Kulkarni says. Consequently, production apps are inheriting significant risks. “Organizations need to perform more software composition analysis [SCA] to identify these inherited vulnerabilities before apps are moved into production,” he says.

One big takeaway from WhiteHat’s report is that companies that implement DevSecOps practices tend to fare significantly better than those that don’t. For instance, organizations using a DevSecOps approach had a much higher critical vulnerability remediation rate (89%) compared with companies without one (50.7%).

Only about 22% of the applications in organizations with a formal DevSecOps approach were always vulnerable to threats, compared with 50% of apps, on average, for organizations that didn’t use the approach. Similarly, the average time to fix critical vulnerabilities was 22 days in organizations that had implemented DevSecOps, comparedwith 149 days in other organizations.

“The organizations that succeeded in improving their security posture last year are the ones that embraced a robust, phased DevSecOps approach,” Kulkarni says.

In such organizations application security testing is embedded into each stage of the development life cycle, he notes. Five years ago, such DevSecOps practices were still more philosophy than practical.

“Now we see it being built into best practices and processes that are measurable and helping organizations improve their security posture,” he notes.

Related Content:

• A New Approach to Application Security Testing
• Taming the Chaos of Application Security: ‘We Built an App for That’
• Web App Vulnerabilities Flying Under Your Radar
• 2019 Pwnie Award Winners (And Those Who Wish They Weren’t)

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/application-security/orgs-doing-more-app-security-testing-but-fixing-fewer-vulns/d/d-id/1335515?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Could extraversion make you more vulnerable to social engineering attacks? It’s a possibility, as seen in research investigating links between personality traits and vulnerability to cybercrime.

The study, compiled by ESET and the Myers-Briggs company, drills down into the “human factor” responsible for many security breaches. Verizon’s DBIR found 20% of security incidents originate from people within an organization; separate data from Dtex shows nearly two-thirds (64%) of insider threats come from people who put the company at risk with careless behavior.

Myers-Briggs’ goal in this research is to determine whether individuals’ personality traits make them more susceptible to different types of security threats. As part of an ongoing study, it has so far polled 520 respondents who had completed the Myers-Briggs Type Indicator (MBTI) questionnaire. John Hackston, head of thought leadership for the company, argues the MBTI is a practical starting point for personality-based research as many people and businesses already use it for self-development.

If you’re not familiar, the MBTI quantifies “best-fit” personality type using four traits: extraversion/introversion (E/I), which shows where you get energy; sensing/intuition (S/N), which indicates how you learn information; thinking/feeling (T/F), which tells how you make decisions; and judging/perceiving (J/P), which indicates whether you prefer a more structured or open-ended lifestyle. For the security-focused study, respondents also answered questions about their jobs, biographical data, cybersecurity habits, phishing experiences, and overall security knowledge.

“Everybody in an organization is an insider risk when it comes to cybersecurity,” says Hackston. “We want to look at how MBTI relates to those to give people guidelines … so they can have guidelines to say ‘What things should I look out for?’ and ‘What things might be my particular downfalls if I’m not careful?'”

There is no single personality type that’s more security-savvy than the others, he explains. Similarly, being security-savvy doesn’t necessarily mean someone is a lower-risk employee. Oftentimes, security practices boil down to the two middle letters of the MBTI type, which are intended to dictate how an individual processes data and how they make decisions.

As an example, Hackson points to the personality type INTP: a logical, analytical, detail-oriented and introverted person. Myers-Briggs’ research shows people who are INTPs score higher on questions about cybersecurity knowledge; unfortunately, they’re also more likely to think rules don’t apply to them. An ESTP, an extraverted type who focuses on facts and logic, is also likely to flout rules.

The way a phishing attack is communicated can make a difference in which types fall for it, Hackston adds. An email that seems factual and promises someone can save money or be more efficient, for example, will be more effective on the objective, analytical “ST” types. The trusting, loyal “SF” type may be more likely to respond to an email that claims to be from an authority figure, and the warm, altruistic “NF” may fall for a phishing attack disguised as a charity email.

In general, researchers found, extraverts are more likely to fall for social engineering attacks. Their need to stay in tune with the world is “both a boon and a curse,” Hackston says. While they’re informed of new threats, extraverts’ tendency to focus on people puts them at risk. A desire to build a personal connection may lure an extravert into a social engineering trap.

The Big 5

Of course, the MBTI isn’t the only way to classify personality. Dr. Margaret Cunningham, principal research scientist for human behavior with Forcepoint X-Labs, has explored security risk alongside the “Big 5” personality traits: neuroticism, extraversion, openness, agreeableness, and conscientiousness, and she agrees extraversion can prove risky.

“We find in the Big 5 personality [traits] that agreeable people tend to be more willing to share information, which makes them more susceptible to social engineering attacks,” she adds. When asked what they’re doing, an extravert is more likely to be immediately transparent.

Conscientious people lean toward the practical side and use greater caution, she says. “These are the people who read service agreements,” she jokes. “They’re going to check the settings on a cookie pop-up. Those people tend to be a little less likely to [fall for] phishing attempts.”

At the same time, it’s important to note personality is a spectrum, Cunningham emphasizes. It’s the people who exhibit the extremes of different personality facets who are easiest to associate with predictive behavior. You can be a detail-oriented extravert, for example, or an introvert who accidentally spills too much information to an attacker or falls for a phishing email.

“Knowing that these are the things that push our buttons helps us to be more wary,” says Hackston. Security awareness training isn’t a “one size fits all” project, and while organizations can’t be expected to build different training programs for each personality type, it helps to inform employees where their weaknesses may lie so they’re attuned to potential threats. As Cunningham says, people will continue to make mistakes even if they are informed of the risk.

“No matter how aware we are, we will continue to make mistakes and be phished,” she says. “We’ll continue to click not because of personality, but the limitations we have in cognitive skills like memory and attention.”

Related Content:

• 2019 Pwnie Award Winners (And Those Who Wish They Weren’t)
• History Doesn’t Repeat Itself in Cyberspace
• New Vulnerability Risk Model Promises More-Efficient Security
• Modern-Day SOCs: People, Process Technology

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/endpoint/does-personality-make-you-vulnerable-to-cybercrime/d/d-id/1335516?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Last week at Black Hat USA, Ivan Krstić, Apple’s head of security engineering and architecture, announced a massive expansion of the company’s bug-bounty program. In addition to expanding the program from iOS to all of Apple’s operating systems, the new program dramatically increases the bounties on offer, to a maximum of $1.5 million under certain circumstances.

“Apple is demonstrating that it understands the importance of finding bugs, not just when they’re in the hands of customers, but also in the production cycle,” says Casey Ellis, CTO and founder of Bugcrowd. He points out that Apple now finds itself competing with offensive exploit buyers — those who will pay researchers for exploits that they will then use against victims in the real world.

“Most other industry players don’t face this hurdle, and this in combination with their focus on product security is a telling sign of why payouts are so large,” Ellis says. “The skills to find the types of bugs Apple is targeting are rare and often tied up in the offensive market, and this is another indication of why payouts are high.”

Apple has long had a bug-reporting program for iOS but has limited payouts for exploits in other systems to a relative handful of prescreened and invited researchers. Now the program will be applied to macOS, tvOS, and watchOS as well as iOS.

While impressive, the bounties are not the only part of the enhanced program. Apple also announced the iOS Security Research Device Program — specially unlocked iPhones available to certain invited researchers who will be able to use the devices to find vulnerabilities and develop exploits. The security research devices are intended to be authorized, official alternatives to the “dev fused” altered phones available for thousands of dollars on the black market.

Apple is balancing two competing demands for the new program. On the one hand, Ellis says that expanded access to the program should bring talented new researchers into the Apple security field. On the other hand, “Crowd sourcing can be quite effective but also quite noisy,” he explains, saying that a company can end up wading through many low-quality exploits or repeats of existing vulnerabilities from new researchers if it doesn’t carefully stage the new researchers into the program.

That “noise” is part of the reason that not everyone is convinced that Apple is on the right track with the new program. “Apple’s new $1 million bug bounty has more potential to wreak havoc on the defensive security ecosystem than it does to protect users,” says Katie Moussouris, founder and CEO of Luta Security. “While some exploits may be acquired this way, and some new talent may come forward, this ultimately isn’t a sustainable payout for defense.”

Moussouris says that Apple may have gone beyond the point at which it creates what she calls “perverse incentives” in the market. She specifies three things that concern her about the scale of the bounties:

“1. Offense prices will simply increase as a direct result, so this doesn’t ‘compete’ with that market; rather, it invigorates it.

“2. For another, this may be enough of an incentive for insiders to collude with outsiders. …

“3. Finally, they may be sacrificing their own hiring pipeline possibly even their current internal retention of employees.”

Apple obviously wants to increase the number of researchers working on its platforms. Moussouris says that she hopes the program succeeds in bringing excellent research and new talent to the market. Ellis agrees and says that Apple has created a program that can pull that off. “The number of people who can effectively create exploits is small. Now, there’s the reward and the test bed to let them build valuable experience.”

Related content:

• Black Hat QA: Cracking Apple’s T2 Security Chip
• New MacOS Malware Discovered
• Researchers Finds Thousands of iOS Apps Ignoring Security
• How iOS App Permissions Open Holes for Hackers
• White-Hat Bug Bounty Programs Draw Inspiration from the Old West

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/apples-new-bounty-program-has-huge-incentives-big-risks/d/d-id/1335517?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Hotel franchisor Choice Hotels has confirmed a breach in which attackers stole 700,000 guest records from a publicly available MongoDB database without a password or any authentication.

The unsecured server, which the hotel chain says belonged to a third-party vendor, contained multiple databases holding more than 5.6 million records. Choice Hotels says most of this was “test data,” including fields referring to reservation details, passwords, and payment cards. Most of the 700,000 compromised records were in a database of 2.4 million records labeled “privacy log” and located in the same MongoDB instance. Exposed consumer data included names, physical and email addresses, phone numbers, and consent statuses, Comparitech reports.

Security researcher Bob Diachenko found the database on July 2, shortly after it was indexed by search engine BinaryEdge, and worked with Comparitech to analyze it. A ransom note demanding 0.4 Bitcoin was already there, likely left by an automated script targeting publicly accessible MongoDB databases, he believes. Diachenko notified Choice Hotels following his discovery; the firm secured the database on July 2 and began an investigation on July 28.

Choice Hotels says it will not be collaborating with this vendor in the future, and it’s taking a closer look at its vendor relationships to put additional controls in place. It also plans to implement a responsible disclosure program to learn of future security incidents.

Read more details here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/cloud/700k-guest-records-stolen-in-choice-hotels-breach/d/d-id/1335507?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

In 2018, when businesses were preparing for the European Union’s General Data Privacy Regulation (GDPR), California quietly and quickly passed its own legislation: the California Consumer Privacy Act (CCPA). This regulation, with its emphasis on consumer privacy rights, has an interesting history of grassroots consumer advocacy coupled with swift legislative action provoked by the fear of a ballot initiative. But what security professionals may have missed is that the CCPA contains a surprise in the form of a provision devoted to “reasonable” cybersecurity procedures and policies.

Many businesses hope that the CCPA will change — serious amendments remain in the California legislative pipeline and should hit the governor’s desk this fall. However, the meat of the CCPA will likely remain the same. Now is the time to start preparing, especially for the cybersecurity standards, as the regulation goes into effect on January 1, 2020, with enforcements starting July 1, 2020.

Who Is Affected?
Not every business is covered by the CCPA; instead, it defines affected businesses in this way:

• Businesses with annual gross revenues in excess of $25 million dollars
• Those that purchase, sell, or share data from more than 50,000 consumers, households, or devices
• Those that derive 50% or more of their annual revenue from selling consumers’ personal information

There is no physical requirement for businesses to be based in California. If your business interacts with California residents — even through a website — and has gross revenues in excess of $25 million, you should start preparing for the CCPA.

The Hidden Security “Duty” in the Private Cause of Action
Tucked into the CCPA’s provision on consumers having a private right of action to sue businesses when their “nonencrypted or nonredacted personal information” is subjected to “unauthorized access, theft, or disclosure” is the security requirement. The CCPA specifies that people can sue “as a result of the business’ violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information.” This is, in effect, a regulatory mic drop. Suddenly, baked into the CCPA is a business’s “duty” to maintain “reasonable security procedures and practices” appropriate to the sliding scale of the sensitivity of the information. Unfortunately, those reasonable security procedures and practices are left undefined in the CCPA itself.

The CCPA now specifies penalties of $100 to $750 per incident per consumer plus actual damages plus injunctive relief. However, now a judge may consider a defendant’s “assets, liabilities, and net worth” in determining the damages.

Defining Duty and Reasonable Measures from Earlier California Laws
Arguably, under California common law (made by cases rather than by statutes), the duties articulated in the CCPA already existed. In 2016, the Office of the Attorney General in California published a document called the “Data Breach Report.”  The Attorney General’s Data Breach Report articulated reasonable security practices, citing the Center for Internet Security’s 20 security controls as the baseline for an information security program.

Without additional guidance from the California legislature or Attorney General, businesses will need to build reasonable security measures from additional sources, including the National Institute of Standards and Technology’

But that’s not enough; the CCPA also states that a business must have various policies in place as well. The Act remains silent as to what policies beyond specific mentions of updating privacy policies, but it is clear that the Act also intends that businesses dust off ancient incident response plans, bring your own device policies, and various other security policies to make certain they are up to date.

What to Do Now
Reach out for help. Start by consulting with a lawyer to create a compliance plan of attack based on your business needs. This doesn’t need to be expensive, but it’s time to pick up the phone and ask questions. Many businesses took data inventories to comply with GDPR and now it’s time to begin that process again, searching out California resident data. Specifically, this summer you should look hard at your security program to see if it would be considered reasonable to a California judge and jury. If the answer is no, use the CCPA as the impetus to begin in earnest the changes necessary to bring your business into compliance.

Related Content:

• The State of IT Operations and Cybersecurity Operations
• 6 Actions That Made GDPR Real in 2019
• Demystifying New FIDO Standards Innovations
• Companies’ ‘Anonymized’ Data May Violate GDPR, Privacy Regs
• Answer These 9 Questions to Determine if Your Data Is Safe

Beth Burgin Waller is a lawyer who knows how to navigate between the server room and the board room. As chair of the cybersecurity data privacy practice at Woods Rogers, she advises clients on cybersecurity and on data privacy concerns. In this capacity, she … View Full Bio

Article source: https://www.darkreading.com/endpoint/the-california-consumer-privacy-acts-hidden-surprise-has-big-legal-consequences-/a/d-id/1335458?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

An Internet Society-backed effort to thwart malicious Internet traffic and abuse now tracks routing incidents online via a free tool that also shows how much of its agreed-upon set of routing security and resiliency practices that network providers worldwide have adopted to date.

The Mutually Agreed Norms for Routing Security (MANRS) initiative’s new MANRS Observatory turns up the heat on network providers’ compliance to filtering incorrect or malicious routing information; preventing spoofed source IP addresses; validating routing information; and coordinating among other network operators. MANRS, which launched in 2014, includes members such as Comcast, Google, and Microsoft, with more than 200 network operator members and 35 Internet exchange points. The initiative hopes to quell attacks on the Internet’s routing infrastructure.

There were some 12,000 routing outages or attacks worldwide in 2018, the group says. One particularly painful incident last November misrouted Google’s traffic through China after a Nigerian ISP misconfigured a routing protocol filter. The mistake ultimately took down the Net in several regions and raised privacy concerns. 

“Routing security remains a problem,” says Andrei Robachevsky, senior technology program manager at the Internet Society. “Routing is often a target to affect other services” on the Internet, he says.

The MANRS Observatory in part is intended to give members a visual reality-check on where they stand in advancing the security and resiliency of the Internet routing infrastructure, according to Robachevsky. “We need to work at being more transparent and more measurable,” he says. “It [puts] internal pressure on participants so they cannot hide behind state websites” of routing statistics.

Observatory has both a private and public interface, and it aggregates data from a number of third-party sources into a dashboard that helps spot trouble areas for network providers. “The tool allows you to see by region and country for your individual network,” he says, and gives a read on the security of the provider’s routing infrastructure.

Economic Challenges
Internet security expert Paul Vixie says one hurdle for network providers in adopting routing security practices such as source address validation is that it benefits their competitors. “If you’re investing in making your network cleaner, you will not be the primary beneficiary. Your competitors will be, and that’s often a tough sell.”

He says the MANRS Observatory should help the initiative gain more traction. “MANRS makes it formal what it means to not be ‘that guy'” with the insecure routing infrastructure, says Vixie, founder and CEO of Farsight Security.

Meanwhile, MANRS plans to recruit content delivery network providers and more equipment vendors, and to continuously evolve and expand Observatory with greater measurement capabilities and other functions.

“We see Observatory as a performance barometer,” Robachevsky says. It can help network providers see routing problems they didn’t know they had in certain regions, for example. “Another thing is social responsibility, the cornerstone of MANRS. Being transparent.”

Related Content:

• Internet Routing Security Effort Gains Momentum
• NIST Releases Draft on BGP Security
• 8 Free Tools to Be Showcased at Black Hat and DEF CON
• The 10 Essentials of Infosec Forensics

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/analytics/internet-routing-security-initiative-launches-online-observatory/d/d-id/1335509?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple