Saturday, January 18, 2025
Home Blog Page 21

Finnish Intel warns of Russia’s cyberespionage activities

By
RiSec.Mitch
-
0

The Finnish Security Intelligence Service (SUPO) warns Russia will highly likely intensify its cyber activity over the winter.

According to the SUPO, future NATO membership will make the country a privileged target for Russian intelligence and influence operations.

The intelligence agency states that cyber threats to Finland’s critical infrastructure has increased in both the physical and cyber environments as a result of the Russian invasion of Ukraine. These malicious activities could potentially paralyse infrastructure operations with unpredictable consequences.

“Future NATO membership will make Finland a more interesting target for Russian intelligence and influence operations. One target of particular interest will be the formulation of policy in a militarily allied Finland. Russia’s assessment of what kind of NATO member Finland is becoming determines the aims and methods of influence operations.” reads the unclassified National Security Overview 2022 published last week by the Finnish agency. “Finland is portrayed as a member of a hostile alliance, whose location in the near vicinity of Russia exemplifies the threat of NATO enlargement, a narrative disseminated by the Russian regime.”

According to the report, Russia’s traditional intelligence gathering activity relied on spies with diplomatic cover, but this approach has become substantially more difficult since Russia invaded Ukraine, because many Russian diplomats have been expelled from the West.

The report pointed out that despite the Russian reactions to Finland’s NATO accession process have been restrained for the time being, and Finland was not targeted by any extraordinary influencing in the course of policymaking, the government fears an escalation of the malicious activities.

The agency also warns that these operations mainly target organizations and individuals from Western countries who reside in Finland.

The Russian security and intelligence services were increasingly targeting foreigners who reside in or visit Russia as well as Russians working in the West when they return.

SUPO also warns that Russian citizens working in critical positions in Finland may also be subject to coercion from Russian authorities.

“Russian intelligence services are likely to try to adapt their operations to respond more effectively to changed circumstances. Russia will probably focus its intelligence operations increasingly on the cyber environment. It is also likely that the threat of business espionage will grow as Russia feels the need to begin substitute manufacturing of cutting-edge technology. Russia may seek to acquire NATO-related intelligence through Finland.”

The public intelligence assessment stated.

In December 2020, the Parliament of Finland confirmed that threat actors had access to the email accounts of multiple members of parliament (MPs). 

The attack took place in the fall of 2020, in the same period Russia-linked hackers accessed the emails and data of a small number of Norwegian parliamentary representatives and employees.

Foreign hackers broke into the internal IT system and accessed the email accounts of some MPs.

Suggest an edit to this article

Cybersecurity Knowledge Base

Latest Cybersecurity News

Cybersecurity Academy

Homepage

source

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

  • Globally, 30,000 websites are hacked daily.
  • 64% of companies worldwide have experienced at least one form of a cyber attack.
  • There were 20M breached records in March 2021.
  • In 2020, ransomware cases grew by 150%.
  • Email is responsible for around 94% of all malware.
  • Every 39 seconds, there is a new attack somewhere on the web.
  • An average of around 24,000 malicious mobile apps are blocked daily on the internet.
Bookmark
Please login to bookmarkClose

Ethical hackers say it would take mere hours to empty your network

By
RiSec.Mitch
-
0

Once they’ve broken into an IT environment, most intruders need less than five hours to collect and steal sensitive data, according to a SANS Institute survey of more than 300 ethical hackers. 

The respondents also proved the old adage that it’s not “if” but “when.” Even if their initial attack vector fails, almost 38 percent indicated they can break into an environment “more often than not” by repeated attacks. 

Most SANS surveys focus on the defenders’ perspective – for example asking incident responders how long it took them to detect and respond to a cyberattack. This report, commissioned by offensive security firm Bishop Fox, aimed to “get into the mindset of someone who attacks an organization, and look at those metrics instead,” said author Matt Bromiley, digital forensics and incident response instructor at SANS.

“Now obviously, we can’t call up all of our favorite hackers in the world – I don’t think many countries’ intelligence agencies would take that phone call,” he told The Register.

So the research team went with the next-best option: the ethical hackers tasked with emulating the adversaries. They asked this group of bug hunters and penetration testers about their favorite attack vectors, the tools they use and their speed.

The bulk of the survey respondents (83.4%) work for companies headquartered in the US. And the largest segment (34.2%) said they worked in cybersecurity, with jobs ranging from security analyst to chief information security officer or VP of security or technology.

Of course, your humble vulture can’t verify these respondents are who they claim to be. And the report acknowledges that the respondents, who are generally hired by organizations to “attack” their IT environments, have different motives than what it calls “unsanctioned adversaries” – i.e. the baddies. 

There’s value in knowing how long it takes an ethical hacker to breach an environment, how quickly they can shift gears, and what their favorite tactics are. Because that can help organizations focus their security investments in areas that will yield the greatest return on investment, Bromiley argued. 

“If I have to assume a state of breach, it’s going to be the hardest, most lengthy breach you’ve ever been involved in,” he said. “I’m going to make it so tough for you to get in, that you might just stop. Fingers crossed.”

Speaking of return on investment, the survey found that the oldies but goodies continue to provide the biggest bang for the buck. In response to the question “Which attack vector is most likely to have the greatest return on investment?” social engineering (32.1%) and phishing (17.2%) were the top two answers. Can’t beat the classics.

For comparison, zero-day exploits (3.8%), man-in-the-middle attacks (1.4%) and DNS spoofing (1%) ranked last.

“Crafting a spear-phishing email or getting someone to click a link is relatively inexpensive, compared to writing your own piece of malware,” Bromiley pointed out, adding that this should send a straightforward message to security teams.

“Focus on the basics,” he advised. “Don’t forget that humans are involved in your security program. I do not blame the person who clicks in an email, but I do encourage that we train people to be vigilant. So user education has got to be part of our security program.”

This should also influence companies’ security spending, he added. “If I had to pick and choose between giving everyone in the company YubiKeys versus buying some fancy new thing with amazing taglines, I’d go the route of YubiKey,” Bromiley declared. “I’d go the route of forced multifactor token auth or something like that that covers more of the basics.”

Need for speed

The survey also asked several questions related to speed, and found 57 percent of the ethical hackers claimed to be able to discover an exploitable flaw within ten hours. 

More than half of respondents (over 57%) stated they could successfully discover an exploitable exposure in ten hours or less. About 25 percent said it took them between three and five hours, while 27.6 percent said they weren’t sure how long it would take.

“The time periods are where a lot of readers can get the most value,” Bromiley said. “What is the difference between an adversary that takes one hour to break into an organization versus an adversary needing six hours to break in? That’s five hours of patch time. That’s five hours of preparedness. That’s five hours of hardening your environment. Then that appreciation of time periods can travel down through the rest of the intrusion.”

Once they’ve found a hole, 58 percent said they could exploit it in five hours or less. After breaking in, 36 percent of respondents said they could escalate or move laterally within three to five hours, while 20 percent said it takes them two hours or less. 

And once they’ve gained access to target systems and data, 22.7 percent said they can collect and exfiltrate data in three to five hours. Meanwhile, 40.7 said they can do this in two hours or less.

“Exfiltration is not the place to focus your detections,” Bromiley concluded. “It’s a place to have detections, but it’s not a place to focus them. Focus on the spots of the intrusion where the adversary needs the most time. This is where you have the best opportunity for detecting them, because they’re in there the longest.”

Suggest an edit to this article

Cybersecurity Knowledge Base

Latest Cybersecurity News

Cybersecurity Academy

Homepage

source

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

  • Globally, 30,000 websites are hacked daily.
  • 64% of companies worldwide have experienced at least one form of a cyber attack.
  • There were 20M breached records in March 2021.
  • In 2020, ransomware cases grew by 150%.
  • Email is responsible for around 94% of all malware.
  • Every 39 seconds, there is a new attack somewhere on the web.
  • An average of around 24,000 malicious mobile apps are blocked daily on the internet.
Bookmark
Please login to bookmarkClose

FBI Arrests Former NSA Employee For Trying to Sell Top Secret Documents

By
RiSec.Mitch
-
0

The former employee used encrypted email to communicate with someone he thought was a foreign spy, who was actually an FBI agent.

A former NSA employee who worked at the agency for less than a month is accused of attempting to sell top secret documents to a foreign agent, who was actually an undercover FBI agent, according to the Department of Justice.

On Thursday, the DOJ announced that the FBI had arrested Jareh Sebastian Dalke, 30, who worked at the NSA as an Information Systems Security Designer from June 6, 2022, to July 1, 2022.

Dalke allegedly used encrypted email to communicate with someone he believed was a foreign spy, offering to sell classified NSA documents in exchange for cryptocurrency. After Dalke sent excerpts of the documents to the FBI agent, he agreed to meet him to transfer more documents, according to the press release.

“Dalke told that individual that he had taken highly sensitive information relating to foreign targeting of U.S. systems, and information on U.S. cyber operations, among other topics,” the press release read. “Dalke requested compensation via a specific type of cryptocurrency in exchange for the information he possessed and stated that he was in financial need.”

Dalke asked for $85,000 for the documents, and told the FBI agent that he would be able to get more information and documents in the future. When all this happened Dalke wasn’t working at the NSA anymore, but he re-applied to work at the agency in August of 2022, according to the feds. 

The FBI arrested Dalke on Sept. 28, when he went to a location in Denver, thinking he was going to meet the foreign agent, according to the press release.

The NSA did not immediately respond to a request for comment.

Suggest an edit to this article

Cybersecurity Knowledge Base

Latest Cybersecurity News

Cybersecurity Academy

Homepage

source

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

  • Globally, 30,000 websites are hacked daily.
  • 64% of companies worldwide have experienced at least one form of a cyber attack.
  • There were 20M breached records in March 2021.
  • In 2020, ransomware cases grew by 150%.
  • Email is responsible for around 94% of all malware.
  • Every 39 seconds, there is a new attack somewhere on the web.
  • An average of around 24,000 malicious mobile apps are blocked daily on the internet.
Bookmark
Please login to bookmarkClose

Never-before-seen malware has infected hundreds of Linux and Windows devices

By
RiSec.Mitch
-
0

Researchers have revealed a never-before-seen piece of cross-platform malware that has infected a wide range of Linux and Windows devices, including small office routers, FreeBSD boxes, and large enterprise servers.

Black Lotus Labs, the research arm of security firm Lumen, is calling the malware Chaos, a word that repeatedly appears in function names, certificates, and file names it uses. Chaos emerged no later than April 16, when the first cluster of control servers went live in the wild. From June through mid-July, researchers found hundreds of unique IP addresses representing compromised Chaos devices. Staging servers used to infect new devices have mushroomed in recent months, growing from 39 in May to 93 in August. As of Tuesday, the number reached 111.

Black Lotus has observed interactions with these staging servers from both embedded Linux devices as well as enterprise servers, including one in Europe that was hosting an instance of GitLab. There are more than 100 unique samples in the wild.

“The potency of the Chaos malware stems from a few factors,” Black Lotus Labs researchers wrote in a Wednesday morning blog post. “First, it is designed to work across several architectures, including: ARM, Intel (i386), MIPS and PowerPC—in addition to both Windows and Linux operating systems. Second, unlike largescale ransomware distribution botnets like Emotet that leverage spam to spread and grow, Chaos propagates through known CVEs and brute forced as well as stolen SSH keys.”

CVEs refer to the mechanism used to track specific vulnerabilities. Wednesday’s report referred to only a few, including CVE-2017-17215 and CVE-2022-30525 affecting firewalls sold by Huawei, and CVE-2022-1388, an extremely severe vulnerability in load balancers, firewalls, and network inspection gear sold by F5. SSH infections using password brute-forcing and stolen keys also allow Chaos to spread from machine to machine inside an infected network.

Chaos also has various capabilities, including enumerating all devices connected to an infected network, running remote shells that allow attackers to execute commands, and loading additional modules. Combined with the ability to run on such a wide range of devices, these capabilities have led Black Lotus Labs to suspect Chaos “is the work of a cybercriminal actor that is cultivating a network of infected devices to leverage for initial access, DDoS attacks and crypto mining,” company researchers said.

Black Lotus Labs believes Chaos is an offshoot of Kaiji, a piece of botnet software for Linux-based AMD and i386 servers for performing DDoS attacks. Since coming into its own, Chaos has gained a host of new features, including modules for new architectures, the ability to run on Windows, and the ability to spread through vulnerability exploitation and SSH key harvesting.

Infected IP addresses indicate that Chaos infections are most heavily concentrated in Europe, with smaller hotspots in North and South America and Asia-Pacific.

Black Lotus Labs researchers wrote:

Over the first few weeks of September, our Chaos host emulator received multiple DDoS commands targeting roughly two dozen organizations’ domains or IPs. Using our global telemetry, we identified multiple DDoS attacks that coincide with the timeframe, IP and port from the attack commands we received. Attack types were generally multi-vector leveraging UDP and TCP/SYN across multiple ports, often increasing in volume over the course of multiple days. Targeted entities included gaming, financial services and technology, media and entertainment, and hosting. We even observed attacks targeting DDoS-as-a-service providers and a crypto mining exchange. Collectively, the targets spanned EMEA, APAC and North America.

One gaming company was targeted for a mixed UDP, TCP and SYN attack over port 30120. Beginning September 1 – September 5, the organization received a flood of traffic over and above its typical volume. A breakdown of traffic for the timeframe before and through the attack period shows a flood of traffic sent to port 30120 by approximately 12K distinct IPs – though some of that traffic may be indicative of IP spoofing.

A few of the targets included DDoS-as-a-service providers. One markets itself as a premier IP stressor and booter that offers CAPTCHA bypass and “unique” transport layer DDoS capabilities. In mid-August, our visibility revealed a massive uptick in traffic roughly four times higher than the highest volume registered over the prior 30 days. This was followed on September 1 by an even larger spike of more than six times the normal traffic volume.

The two most important things people can do to prevent Chaos infections are to keep all routers, servers, and other devices fully updated and to use strong passwords and FIDO2-based multifactor authentication whenever possible. A reminder to small office router owners everywhere: Most router malware can’t survive a reboot. Consider restarting your device every week or so. Those who use SSH should always use a cryptographic key for authentication.

Suggest an edit to this article

Cybersecurity Knowledge Base

Latest Cybersecurity News

Cybersecurity Academy

Homepage

source

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

  • Globally, 30,000 websites are hacked daily.
  • 64% of companies worldwide have experienced at least one form of a cyber attack.
  • There were 20M breached records in March 2021.
  • In 2020, ransomware cases grew by 150%.
  • Email is responsible for around 94% of all malware.
  • Every 39 seconds, there is a new attack somewhere on the web.
  • An average of around 24,000 malicious mobile apps are blocked daily on the internet.
Bookmark
Please login to bookmarkClose

Most Attackers Need Less Than 10 Hours to Find Weaknesses

By
Steven Black (n0tst3)
-
0

Vulnerable configurations, software flaws, and exposed Web services allow hackers to find exploitable weaknesses in companies’ perimeters in just hours, not days.

The average ethical hacker can find a vulnerability that allows the breach of the network perimeter and then exploit the environment in less than 10 hours, with penetration testers focused on cloud security gaining access most quickly to targeted assets. And further, once a vulnerability or weakness is found, about 58% of ethical hackers can break into an environment in less than five hours.

That’s according to a survey of 300 experts by the SANS Institute and sponsored by cybersecurity services firm Bishop Fox, which also found that the most common weaknesses exploited by the hackers include vulnerable configurations, software flaws, and exposed Web services, survey respondents stated.

The results mirror metrics for real-world malicious attacks and highlight the limited amount of time that companies have to detect and respond to threats, says Tom Eston, associate vice president of consulting of Bishop Fox.

“Five or six hours to break in, as an ethical hacker myself, that is not a huge surprise,” he says. “It matches up to what we are seeing the real hackers doing, especially with social engineering and phishing and other realistic attack vectors.”

The survey is the latest data point from cybersecurity companies’ attempts to estimate the average time organizations have to stop attackers and interrupt their activities before significant damage is done.

Cybersecurity services firm CrowdStrike, for example, found that the average attacker “breaks out” from their initial compromise to infect other systems in less than 90 minutes. Meanwhile, the length of time that attackers are able to operate on victim’s networks before being detected was 21 days in 2021, slightly better than the 24 days in the prior year, according to cybersecurity services firm Mandiant.

Organizations Not Keeping Up

Overall, nearly three-quarters of ethical hackers think most organizations lack the necessary detection and response capabilities to stop attacks, according to the Bishop Fox-SANS survey. The data should convince organizations to not just focus on preventing attacks, but aim to quickly detect and respond to attacks as a way to limit damage, Bishop Fox’s Eston says.

“Everyone eventually is going to be hacked, so it comes down to incident response and how you respond to an attack, as opposed to protecting against every attack vector,” he says. “It is almost impossible to stop one person from clicking on a link.”

In addition, companies are struggling to secure many parts of their attack surface, the report stated. Third parties, remote work, the adoption of cloud infrastructure, and the increased pace of application development all contributed significantly to expanding organizations’ attack surfaces, penetration testers said.

Yet the human element continues to be the most critical vulnerability, by far. Social engineering and phishing attacks, together, accounted for about half (49%) of the vectors with the best return on hacking investment, according to respondents. Web application attacks, password-based attacks, and ransomware account for another quarter of preferred attacks.

“[I]t should come as no surprise that social engineering and phishing attacks are the top two vectors, respectively,” the report stated. “We’ve seen this time and time again, year after year — phishing reports continually increase, and adversaries continue to find success within those vectors.”

Just Your Average Hacker

The survey also developed a profile of the average ethical hacker, with nearly two-thirds of respondents having between a year and six years of experience. Only one in 10 ethical hackers had less than a year in the profession, while about 30% had between seven and 20 years of experience.

Most ethical hackers have experience in network security (71%), internal penetration testing (67%), and application security (58%), according to the survey, with red teaming, cloud security, and code-level security as the next most popular types of ethical hacking.

The survey should remind companies that technology alone cannot solve cybersecurity problems — solutions require training employees to be aware of attacks, Eston says.

“There is not a single blinky-box technology that is going to repel all the attacks and keep your organization safe,” he says. “It is a combination of people process and technology, and that has not changed. Organizations gravitate toward the latest and greatest tech … but then they ignore security awareness and training their employees to recognize social engineering.”

With attackers focused on exactly those weaknesses, he says, organizations need to change how they are developing their defenses.

source

Suggest an edit to this article

Go to Cybersecurity Knowledge Base

Got to the Latest Cybersecurity News

Go to Cybersecurity Academy

Go to Homepage

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

  • Globally, 30,000 websites are hacked daily.
  • 64% of companies worldwide have experienced at least one form of a cyber attack.
  • There were 20M breached records in March 2021.
  • In 2020, ransomware cases grew by 150%.
  • Email is responsible for around 94% of all malware.
  • Every 39 seconds, there is a new attack somewhere on the web.
  • An average of around 24,000 malicious mobile apps are blocked daily on the internet.

Bookmark
Please login to bookmarkClose

The Evolution of Vulnerability Scanning and Pentesting

By
RiSec.Mitch
-
0

An awareness of unprotected vulnerabilities and risks is the starting point for determining the best way to align resources with cybersecurity. By conducting regular real-world attack testing, security operations can illuminate weaknesses while gaining control over risks. Cybersecurity testing is deployed to eliminate risk, improve business continuity and meet compliance requirements. At a minimum, cybersecurity testing should be conducted whenever there are new network changes or user groups, new system configurations or app releases. An organization’s security risk tolerances must be aligned with a testing solution that finds, scans, exploits and reports on their specific risks.

The challenge in testing is finding any exploitable vulnerability within an organization’s environment that poses real risks and that is easily prioritized for mitigation.

This risk-based approach validates and proves business risks through real-world exploitation testing. That said, let’s explore the various solutions.

Vulnerability Scanning

Using a database of known vulnerabilities or probes for common flaws, vulnerability scanners look for misconfigurations or code flaws that pose potential cybersecurity risks. They scan website elements, applications, networks and file systems and inventory each system and network device with their associated vulnerabilities.

Scanners generate thousands of vulnerabilities, all of which are included in the report because they are in the tool’s database of known vulnerabilities. They list common vulnerabilities and exposure (CVE) references and common vulnerability scoring system (CVSS) scores. However, because there is no context within the report, the security team has no insight into how to prioritize vulnerabilities or assess the potential impact.

Manual Penetration Testing

Cybersecurity testing should be conducted as if a real hacker was trying to infiltrate a system or network. Manual penetration testing conducts detailed reconnaissance and examination by highly skilled security professionals. They attempt to detect and exploit various weaknesses within the network and connected systems and assess the extent to which an unauthorized bad actor might gain access.

Pentesting and red teaming play an important role in identifying exposures, vulnerabilities and weaknesses in an organization’s cyberdefenses. Therefore, it should be conducted by vetted service providers with qualified certifications.

Unfortunately, many organizations only test annually or on an ad hoc basis, and it’s not uncommon for a year to pass between tests. This is primarily due to the high costs and time required for planning, contracting, scoping, documenting use cases, testing, reporting and following up on issues found. A pentest represents a snapshot in time after an update, upgrade or system change. In fact, it can take weeks or months to receive a final report. By that time it may be stale, as new updates, misconfigurations and other vulnerabilities can enter the environment.

Automated Pentesting

Rather than contracting third-party pentesting services, automated pentesting is managed by internal IT. There is no need for highly skilled security experts, as the IT admin can run the tests. Just like a human pentester, auto pentesting looks for a system to seize and install an agent or AI-driven bot. Once established, they can then pivot across the network to application programming interfaces (APIs) and front-end/back-end servers to uncover other areas susceptible to attacks.

Cybersecurity risk encompasses system vulnerabilities, internal and external threats, and asset protection. To eliminate risk, auto pentesting conducts four primary steps: The discovery of active assets; scanning and reporting on discovered assets and network infrastructure attack surfaces; exploitation using ethical hacking skills learned from human testers; and post-exploit verification using testing techniques like privilege escalation, Pass-the-Hash and others.

Every time a new attack surface is discovered, AI-powered algorithms use real-time information to generate dynamic attack strategies. As more information is gathered from targets and other attack surfaces, the platform adjusts its techniques on-the-fly to conduct iterative attacks. By finding real, exploitable risks IT and security teams gain clarity to prioritize remediation. By scoring risks, organizations can more logically identify issues and prioritize those that may have the largest impact.

Auto pentesting attack bots plug into the network, scanning, probing and analyzing that can be conducted around the clock. It becomes a virtual red team for which companies of any size can quickly and cost-effectively evaluate systems to uncover risks and vulnerabilities.

Because of the high costs associated with each manual pentest, a human pentester typically has one network entry point. Conversely, auto pentesting can run the same test multiple times from different entry points to uncover susceptible paths and monitor different impact scenarios.

Security Testing Tool Sprawl to Help with Vulnerabilities

For years, organizations have incorporated security testing tools like Burp Suite, Metasploit, Nmap and others, to help discover system vulnerabilities. Whether testing tools are in data centers or clouds, the functional capabilities need to be better integrated. Layering these tools only increases costs, blind spots and additional manual effort trying to cobble together a meaningful report.

Simply having more testing tools doesn’t equate to a stronger security posture. In fact, they impair visibility and create coverage gaps. While manual pentesting uses multiple tools, auto pentesting hides this complexity with an embedded fabric of multiple interconnected testing capabilities.

Eliminating risks from growing exploits across expanding threat surfaces requires threat and vulnerability validation, and reports with hard evidence. These challenges don’t bode well for organizations already suffering from a lack of skilled cybersecurity personnel spending much of their time generating manual reports from disparate tools.

Digital Transformation is Accelerating Security Testing

Relying upon manual interventions to defend against highly sophisticated threats is like fighting a fast-spreading fire with a squirt gun. Without automation, organizations become hamstrung and limit their ability to scale security operations to meet new threats.

The shortage in skilled security professionals is tasking security teams with having to do more with less. Automation can reduce the testing time and effort in identifying and prioritizing attack surfaces from days or weeks to just minutes. Auto pentesting allows organizations to validate new implementations throughout the DevOps cycle and integrate into the CI/CD pipeline. Testing across the development lifecycle allows security personnel to focus on remediation, rather than manually testing each process. And because pen testing is highly accurate, security personnel will spend less time manually triaging false positives.

source

Suggest an edit to this article

Go to Cybersecurity Knowledge Base

Got to the Latest Cybersecurity News

Go to Cybersecurity Academy

Go to Homepage

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

  • Globally, 30,000 websites are hacked daily.
  • 64% of companies worldwide have experienced at least one form of a cyber attack.
  • There were 20M breached records in March 2021.
  • In 2020, ransomware cases grew by 150%.
  • Email is responsible for around 94% of all malware.
  • Every 39 seconds, there is a new attack somewhere on the web.
  • An average of around 24,000 malicious mobile apps are blocked daily on the internet.
Bookmark
Please login to bookmarkClose

UK may fine TikTok $29 million for failing to protect children’s privacy

By
RiSec.Mitch
-
0

Sept 26 (Reuters) – Britain could fine TikTok 27 million pounds ($28.91 million) following an investigation that found the short-form video app may have breached UK’s data protection law by failing to safeguard privacy of children using the platform.

The investigation found that TikTok could have processed data of children under the age of 13 without appropriate parental consent and failed to provide proper information to its users in a transparent way.

The Information Commissioner’s Office (ICO) has issued TikTok and TikTok Information Technologies UK Ltd with a “notice of intent”, the regulator said in a statement.

“Companies providing digital services have a legal duty to put those protections in place, but our provisional view is that TikTok fell short of meeting that requirement,” Information Commissioner John Edwards said.

“While we respect the ICO’s role in safeguarding privacy in the UK, we disagree with the preliminary views expressed and intend to formally respond to the ICO in due course,” a TikTok spokesperson said in a emailed statement to Reuters.

ICO’s provisional view suggests that TikTok breached UK data protection law between May 2018 and July 2020.

In July, the U.S. Senate Commerce Committee voted to approve a measure that would raise the age children are given special online privacy protections to 16 and bar targeted advertising to children by companies such as TikTok and Snapchat (SNAP.N) without consent

Suggest an edit to this article

Go to Cybersecurity Knowledge Base

Got to the Latest Cybersecurity News

Go to Cybersecurity Academy

Go to Homepage

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

  • Globally, 30,000 websites are hacked daily.
  • 64% of companies worldwide have experienced at least one form of a cyber attack.
  • There were 20M breached records in March 2021.
  • In 2020, ransomware cases grew by 150%.
  • Email is responsible for around 94% of all malware.
  • Every 39 seconds, there is a new attack somewhere on the web.
  • An average of around 24,000 malicious mobile apps are blocked daily on the internet.
Bookmark
Please login to bookmarkClose

5+ Things to teach your kids about Social Media

By
Steven Black (n0tst3)
-
0
Cybersecurity

With children now back at school, it’s time to think about social media, and their use of it.

Are they already firing out tweets, chatting in Discord channels, or even just looking to set up a Tik-Tok account? Now is the time to consider giving your kids some security and privacy tips for all their social media needs.

1. Get to grips with default settings

Most sites are in the business of making your data their business. EULAs and privacy policies are frequently terribly confusing for grown ups. Expecting a child to make sense of 1,000 very legal words is unfeasible. Social networks are absolutely in the business of providing services for free, and then using analytics to drive advertising on their sites.

Often, privacy settings are defaulted in a way which makes it easier for marketing/advertising/data-gulping to take place. Some examples:

  • Allow third party/relevant advertising tailored to your interests
  • GPS location set to on (usually ties into the targeted advertising point above)
  • Find your friends (in other words, import your address book and make connections between email addresses and social media profiles)

These are things which may sound helpful, and no doubt are to some, but everybody using an app does not need any or all of these enabled by default. With this in mind, here’s what to tell your kid about default settings:

Look out for anything mentioning offers, location, advertising, relevant content, and finding friends. All of these options and settings help the site you’re using to operate, but they’re not necessarily going be helpful for you too. Before you start posting, ensure options like location in particular are disabled unless you have a very good reason for needing it.

2. It’s all about location

We touched on this briefly above, but this is a key component of your “Please watch out for these things” conversation. Trolling. Doxxing (grabbing personal details in a way which identifies an individual and then publishing them online). Swatting (sending fake emergency calls to law enforcement which results in armed officers crashing through your door). All of these things are very bad, and you don’t want your child getting tangled up in any of it.

Sadly, location services on social networks can cause problems in this area. Sometimes location is kept private for the user only. Other times, the location is in full view. It may be somewhat generic and say a major city like London, or it may drill down to a street.

Even without tech related issues or troublesome settings, the real-world can also give details away. Thanks to open-source tools, reverse image searches, and crowd-sourcing data, it’s never been easier to give the locational game away:

  • A letter in a photograph with your address on it
  • Unique identifiers (views outside a window, for example)
  • Regional dialects or other specific references in the background of video footage

Almost anything can provide somebody with the clue to get an idea of where your child may be living. Here’s what to tell your child:

Pay close attention to the world around you if you’re a fan of streaming, Tik-Tok, or selfies. Keep your home, identifiable locations, and anything with your name and address on it out of shot. Even grown ups make these mistakes, so it’s very easy to accidentally do it yourself. Oh, and if you’re going on holiday you may wish to reference it only once you’ve returned home. Tales of empty houses being broadcast to the world at large on social media may not end well.

3. The value of anonymity

Back in the olden days, most of us were online using a pseudonym. It wasn’t massively common to have your real name or other potentially unique identifiers following you around from site to site. In fact, for the first few years of my security career, writers and journalists referred to me as my online handle because they didn’t actually know my name.

This is a far cry from what we currently have, with real names everywhere, verified profiles, authentication, and the common refrain that only people with something to hide don’t use their real name.

The reality is, people don’t use their real name online for all sorts of valid reasons. There might be domestic abuse or harassment issues. They may live somewhere where free speech or being critical of their government is frowned upon.

However, it’s important to note that you don’t have to be in one of the above awful scenarios to insist on anonymity of one form or another. Indeed, going down the anonymous route from the get-go may help ward off potentially unpleasant situations at a future date anyway.

Most sites will allow you to use whatever visible username you like. A few insist on real names, but it’s unlikely your kids are currently hanging out on Facebook. While you’re usually asked to put a real name alongside your online handle, it’s not mandatory and there’s a good chance nobody will ever check what you put there. Nor are the platforms likely to suddenly lock an account and demand additional verification of some kind at a later date. Here’s what you should tell your children about this issue:

There’s nothing wrong with being anonymous on social media, and unless the site explicitly asks for a real name and additional information you shouldn’t feel pressured into handing it over. Keeping yourself anonymous also helps to ward off some of the issues related to location oversharing. Pick the level of generic anonymity that you’re comfortable with.

4. Watch out for the fakers

Social media is rife with scams, and scammers will happily target anyone in front of them. In fact, some will actively target children specifically because of their likely inexperience in spotting a fake-out. Kids are also unlikely to use additional security measures like two-factor authentication. This means less work for the attacker. Fortunately you can help with this.

Any platform you can think of has scams particularly suited to it. Instagram is awash with Bitcoin scams and bogus competitions. Twitter has lots of phishing, NFT scams, bogus video game downloads, and get rich quick schemes. Facebook sees a fair amount of fake PlayStation sales and more generic Messenger scams. Compromised verified accounts, which add legitimacy to fraud, are common across all platforms.

What you should tell your kids:

Every site has its own groups of scammers, each with their own preferred method of attack. Spend a few minutes reading the site’s security pages to ensure you keep your account safe from harm. If an offer or deal sounds too good to be true, it probably is. Very few social media giveaways are genuine.

If you receive direct messages from strangers, or you’ve been notified that you violated a website policy and need to re-verify your identity, come and tell us and we’ll take a look for you. Never, ever grant someone access to your account…even if they claim to be employees for the site. This is never going to be a genuine request from a member of staff and you may lose your account.

5. Be honest and respect privacy

Many times, young children and teens don’t want the hassle of locking everything down and micromanaging passwords or security settings. They may already have email addresses and various social media accounts. Are those email addresses locked down? Using two-factor authentication? Do your kids know their way around the various security settings across all of their logins? How about password managers?

In these cases, parents often offer to help. Where younger children are concerned, I know some parents who use one of their pre-locked down email addresses to tie social media accounts to. Most of the time, you don’t really need to do much with whatever address you link to Twitter or Tik-Tok or anywhere else, you just need it to tie your username to. As a result, hooking the accounts to a secure email managed by parents can be a quick and easy win for everybody.

Of course, there are privacy issues here to consider. The older the child, the more likely they may be to send other social media users direct messages. Parents should be open about this; some platforms send a digest of all private messages to the connected email account. You can turn this feature on and off in Twitter, for example, but every site is different. You should see how your child feels about this. Some may not care, but others most definitely will. What to tell them:

I’m happy to micromanage the security practices behind the scenes. The trade-off is that some, or all, of what you do may be sent back to me through the email used to register the account. We can check how the site in question works in relation to this, and set it in a way you’d be comfortable with. Remember that sites often change existing features or add new ones, and we may have to adjust as we go.

What Can Parents Do?

It’s important to be aware of what your kids do online. But snooping can alienate them and damage the trust you’ve built together. The key is to stay involved in a way that makes your kids understand that you respect their privacy but want to make sure they’re safe.

Tell your kids that it’s important to:

  • Be nice. Mean behavior is not OK. Make it clear that you expect your kids to treat others with respect, and to never post hurtful or embarrassing messages. And ask them to always tell you about any harassing or bullying messages that others post.
  • Think twice before hitting “enter.” Remind kids that what they post can be used against them. For example, letting the world know that you’re off on vacation or posting your home address gives would-be robbers a chance to strike. Kids also should avoid posting specific locations of parties or events, as well as phone numbers.
  • Follow the “WWGS?” (What Would Grandma Say?) rule. Teach kids not to share anything on social media that they wouldn’t want their teachers, college admissions officers, future bosses — and yes, grandma — to see.
  • Use privacy settings. Privacy settings are important. Go through them together to make sure your kids understand each one. Also, explain that passwords are there to protect them against things like identity theft. They should never share them with anyone, even a boyfriend, girlfriend, or best friend.
  • Don’t “friend” strangers. “If you don’t know them, don’t friend them.” This is a plain, simple — and safe — rule of thumb. Let them know that kids who follow friends are generally happier than those who follow strangers.

Closing out the Summer

It’s not easy getting kids ready to go back to school. It’s even trickier to ensure they keep themselves safe from harm online. We hope the advice above will be helpful to you in getting one of those two gargantuan tasks off the table. Stay safe out there!

source

Suggest an edit to this article

Go to Cybersecurity Knowledge Base

Got to the Latest Cybersecurity News

Go to Cybersecurity Academy

Go to Homepage

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

  • Globally, 30,000 websites are hacked daily.
  • 64% of companies worldwide have experienced at least one form of a cyber attack.
  • There were 20M breached records in March 2021.
  • In 2020, ransomware cases grew by 150%.
  • Email is responsible for around 94% of all malware.
  • Every 39 seconds, there is a new attack somewhere on the web.
  • An average of around 24,000 malicious mobile apps are blocked daily on the internet.
Bookmark
Please login to bookmarkClose

New WhatsApp 0-Day Bug Let Hackers Execute Code & Take Full App Control Remotely

By
RiSec.Mitch
-
0

WhatsApp silently fixed two critical zero-day vulnerabilities that affect both Android & iOS versions allowing attackers to execute an arbitrary code remotely.

Facebook-owned privacy-oriented messenger WhatsApp is one of the Top-ranked Messenger apps with more than Billion users around the world in both Android and iPhone.

Both vulnerabilities are marked under “critical” severity with a CVE Score of 10/10 and found by the WhatsApp internal security Team.

Simplifying these following vulnerabilities, Whatsapp could cause your device to be hacked by receiving a Video File or When on a Video call.

CVE-2022-36934 –  Integer Overflow Bug

An Integer overflow bug that affects WhatsApp allows attackers to execute the specially crafted arbitrary code during an established Video call without any sort of user interaction.

An integer overflow also know as “wraparound” occurs when an integer value is incremented to a value that is too large to store in the associated representation.

This RCE bug affects an unknown code of the WhatsApp component Video Call Handler, which allows an attacker to manipulate the bug to trigger a heap-based buffer overflow and take complete control of WhatsApp Messenger.

“A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().”

Hackers can take advantage of this remote code execution vulnerability to deploy the malware on the user’s device to steal sensitive files and also used for surveillance purposes.

According to WhatsApp Advisory “An integer overflow in WhatsApp for Android prior to v2.22.16.12, Business for Android prior to v2.22.16.12, iOS prior to v2.22.16.12, Business for iOS prior to v2.22.16.12 could result in remote code execution in an established video call.”

CVE-2022-27492 – Integer Underflow Bug

An Integer Underflow vulnerability (CVE-2022-27492) allows attackers to execute the arbitrary code remotely, and user interaction is required to exploit this bug successfully.

“Integer underflow” is sometimes used to identify signedness errors in which an originally positive number becomes negative as a result of subtraction. However, there are cases of bad subtraction in which unsigned integers are involved, so it’s not always a signedness issue.

This issue affects an unknown code block of the component Video File Handler. The manipulation with an unknown input leads to a memory corruption vulnerability.

According to the WhatsApp advisory “An integer underflow in WhatsApp for Android prior to v2.22.16.2, WhatsApp for iOS v2.22.15.9 could have caused remote code execution when receiving a crafted video file.”

To exploit this vulnerability, attackers drop a crafted video file on the user’s WhatsApp messenger. The successful execution with the help of user interaction let hackers gain complete access to the messenger and steal sensitive data from your mobile device.

Whatsapp fixed the bugs and released a security advisory for 2 vulnerabilities that affects both Android & iOS version of Following:

CVE-2022-36934

  • Android prior to v2.22.16.12
  • Business for Android prior to v2.22.16.12
  • iOS prior to v2.22.16.12
  • Business for iOS prior to v2.22.16.12

CVE-2022-27492

  • Android prior to v2.22.16.2
  • iOS v2.22.15.9

So far, no technical details are available for these critical WhatsApp Vulnerabilities, and an exploit is not available at this moment. As 0-day the estimated underground price was around $5k-$25k per vulnerability.

A spokesperson from WhatsApp told GBHackers that there is no evidence found for these vulnerabilities that have been exploited.

“WhatsApp is constantly working to improve the security of our service. We make public, reports on potential issues we have fixed consistently with industry best practices. In this instance, there is no reason to believe users were impacted.”

Users are advised to update the latest version of WhatsApp Messenger to prevent your devices from these critical RCE bugs.

source

Suggest an edit to this article

Go to Cybersecurity Knowledge Base

Got to the Latest Cybersecurity News

Go to Cybersecurity Academy

Go to Homepage

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

  • Globally, 30,000 websites are hacked daily.
  • 64% of companies worldwide have experienced at least one form of a cyber attack.
  • There were 20M breached records in March 2021.
  • In 2020, ransomware cases grew by 150%.
  • Email is responsible for around 94% of all malware.
  • Every 39 seconds, there is a new attack somewhere on the web.
  • An average of around 24,000 malicious mobile apps are blocked daily on the internet.
Bookmark
Please login to bookmarkClose

RCE in Sophos Firewall is being exploited in the wild (CVE-2022-3236)

By
Steven Black (n0tst3)
-
0

Sophos has patched an actively exploited remote code execution vulnerability (CVE-2022-3236) in its Firewall solutions, and has pushed the fix to customers who have an automatic installation of hotfixes enabled.

If this news triggers a feeling of déjà vu, there’s a good reason: earlier this year, another zero-day (CVE-2022-1040) in the same component was leveraged by attackers against “a small set of specific organizations, primarily in the South Asia region” – and this time around is the same.

About CVE-2022-3236

CVE-2022-3236 is a code injection vulnerability in the User Portal and Webadmin of Sophos Firewall. If successfully exploited, it allows for remote code execution (RCE) on the targeted vulnerable installation.

It affects Sophos Firewall v19.0 MR1 (19.0.1) and older. Sophos published hotfixes for a variety of them, and has included the fix in v18.5 MR5 (18.5.5), v19.0 MR2 (19.0.2), and v19.5 GA.

The hotfixes have been pushed to customers with the “Allow automatic installation of hotfixes” feature enabled on remediated versions (the feature is enabled by default).

Customers who don’t have the featured enabled are advised to get the hotfix or to upgrade to a newer version. If none of that is possible, they can protect themselves from external attackers by disabling WAN access to the User Portal and Webadmin. As an alternative for remote access and management, they can use VPN and/or the Sophos Central cloud management platform.

“Users of older versions of Sophos Firewall are required to upgrade to receive the latest protections, and this fix,” the company said.

What about the attacks?

CVE-2022-3236 has been added to CISA’s Known Exploited Vulnerabilities Catalog, which means that US federal civilian executive branch agencies are required to remediate it.

Sophos did not name the organizations that have been compromised by attackers via CVE-2022-3236, but said that they “informed each of these organizations directly.”

According to Volexity researchers, CVE-2022-1040 was used by a Chinese APT group dubbed “Drifting Cloud” in early March 2022.

“DriftingCloud is an effective, well-equipped, and persistent threat actor targeting five-poisons-related targets. They are able to develop or purchase zero-day exploits to achieve their goals, tipping the scales in their favor when it comes to gaining entry to target networks,” the researchers noted.

source

Suggest an edit to this article

Go to Cybersecurity Knowledge Base

Got to the Latest Cybersecurity News

Go to Cybersecurity Academy

Go to Homepage

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today.

Remember, CyberSecurity Starts With You!

  • Globally, 30,000 websites are hacked daily.
  • 64% of companies worldwide have experienced at least one form of a cyber attack.
  • There were 20M breached records in March 2021.
  • In 2020, ransomware cases grew by 150%.
  • Email is responsible for around 94% of all malware.
  • Every 39 seconds, there is a new attack somewhere on the web.
  • An average of around 24,000 malicious mobile apps are blocked daily on the internet.
Bookmark
Please login to bookmarkClose
1...202122...79Page 21 of 79

Editor Picks

Featured

Cyber Academy

ABOUT US

RiSec represents an autonomous, non-profit alliance comprising of individuals dedicated to enhancing cybersecurity awareness and education. Read more

Contact us: security@realinfosec.net

Social

Subscribe for weekly updates

Copyright © RiSec 2023 All rights reserved.
All trademarks, logos, images and brand names are the property of their respective owners.