Jan 21 2021

WordPress Security: The Ultimate Guide

Category: Information Security,Web Security — DISC @ 2:49 pm

WordPress Security: The Ultimate Guide

WordPress security can be intimidating, but it doesn’t hhttps://ithemes.com/wordpress-security-the-ultimate-guide/?ave to be. In this comprehensive guide to WordPress security, we’ve simplified the basics of securing your WordPress website so that any non-technical person can understand and protect their website from hacker attacks.

This guide to WordPress security is broken down into 10 easily digestible sections. Each section will guide you through a specific aspect of WordPress security. By the end of the guide, you will learn the different types of vulnerabilities, the motives of hackers, and how to secure everything from your server to the individual users of your WordPress website.

Source: WordPress Security: The Ultimate Guide

Jan 21 2021

DEF CON 28 Safe Mode IoT Village

Category: Hacking — DISC @ 11:51 am
DEF CON 28 Safe Mode IoT Village – Kat Fitzgerald’s ‘IoT Honeypots And Taming Rogue Appliances’

Jan 20 2021

Health Insurer Fined $5.1M For 17-Month-Long Data Breach

Category: hipaa — DISC @ 11:54 pm
Health Insurer Fined $5.1M for 17-Month-Long Data Breach

An American health insurer has been fined $5.1M for a potential HIPAA violation after a data breach saw more than 9.3 million customers impacted and their personal health information potentially accessed. 

The health insurer was fined after news of a 17-month data breach came to light, which forced the Excellus Health Plan, Inc. to pay the Office for Civil Rights (OCR) a $5.1 million settlement.

The settlement came after the Department of Health and Human Services identified a series of violations of the Health Insurance Portability and Accountability (HIPAA) Act, which aims to protect the confidentiality and integrity of protected health information (PHI). 

Jan 20 2021

Web application firewalls bypasses collection and testing tools

Category: Firewall,Information Security,next generation firewall — DISC @ 11:18 pm
WAF bypass RCE by nil0x42

Jan 20 2021

More Ways To Make Passwords

Category: Password Security — DISC @ 11:06 pm
More Ways To Make Passwords

Jan 20 2021

Sophisticated Watering Hole Attack

Category: Cyber Attack — DISC @ 3:11 pm
Sophisticated Watering Hole Attack

Google’s Project Zero has exposed a sophisticated watering-hole attack targeting both Windows and Android:

Some of the exploits were zero-days, meaning they targeted vulnerabilities that at the time were unknown to Google, Microsoft, and most outside researchers (both companies have since patched the security flaws). The hackers delivered the exploits through watering-hole attacks, which compromise sites frequented by the targets of interest and lace the sites with code that installs malware on visitors’ devices. The boobytrapped sites made use of two exploit servers, one for Windows users and the other for users of Android

The use of zero-days and complex infrastructure isn’t in itself a sign of sophistication, but it does show above-average skill by a professional team of hackers. Combined with the robustness of the attack code — ­which chained together multiple exploits in an efficient manner — the campaign demonstrates it was carried out by a “highly sophisticated actor.”

Jan 20 2021

List of DNSpooq vulnerability advisories, patches, and updates

Category: DNS Attacks,Information Security — DISC @ 11:37 am
DNSpooq

Yesterday, seven Dnsmasq vulnerabilities were disclosed, collectively known as DNSPooq, that attackers can use to launch DNS Cache Poisoning, denial of service, and possibly remote code execution attacks, on affected devices.

Dnsmasq is a widely used open-source Domain Name System (DNS) forwarding application commonly installed on routers, operating systems, access points, and other networking equipment. 

Vendors have started to release information on how customers can protect themselves from DNSPooq. To make it easier to find this information, BleepingComputer will be listing security advisories as they are released. 

The related CVEs from JSOF’s DNSpooq advisory are listed below, along with their descriptions.

NameCVSSDescription
CVE-2020-256818.1Dnsmasq versions before 2.83are susceptible to a heap-based buffer overflow in sort_rrset() when DNSSEC is used. This can allow a remote attacker to write arbitrary data into target device’s memory that can lead to memory corruption and other unexpected behaviors on the target device.
CVE-2020-256828.1Dnsmasq versions before 2.83 are susceptible to buffer overflow in extract_name() function due to missing length check, when DNSSEC is enabled. This can allow a remote attacker to cause memory corruption on the target device.
CVE-2020-256835.9Dnsmasq versions before 2.83 are susceptible to a heap-based buffer overflow when DNSSEC is enabled. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in get_rdata() and cause a crash in dnsmasq, resulting in a Denial of Service.
CVE-2020-256875.9Dnsmasq versions before 2.83are vulnerable to a heap-based buffer overflow with large memcpy in sort_rrset() when DNSSEC is enabled. A remote attacker, who can create valid DNS replies, could use this flaw to cause an overflow in a heap-allocated memory. This flaw is caused by the lack of length checks in rfc1035.c:extract_name(), which could be abused to make the code execute memcpy() with a negative size in sort_rrset() and cause a crash in dnsmasq, resulting in a Denial of Service.
CVE-2020-256844A lack of proper address/port check implemented in dnsmasq versions
CVE-2020-256854A lack of query resource name (RRNAME) checks implemented in dnsmasq’s versions before 2.83 reply_query function allows remote attackers to spoof DNS traffic that can lead to DNS cache poisoning.
CVE-2020-256864Multiple DNS query requests for the same resource name (RRNAME) by dnsmasq versions before 2.83 allows for remote attackers to spoof DNS traffic, using a birthday attack (RFC 5452), that can lead to DNS cache poisoning.

BleepingComputer suggests checking this page throughout the coming days to see if new information is available for devices you may be using.

Source: List of DNSpooq vulnerability advisories, patches, and updates

Jan 19 2021

FreakOut botnet target 3 recent flaws to compromise Linux devices

Category: Botnet — DISC @ 10:26 am
FreakOut botnet target 3 recent flaws to compromise Linux devices

The botnet appeared in the threat landscape in November 2020, in some cases the attacks leveraged recently disclosed vulnerabilities to inject OS commands. The attacks aimed at compromising the tarted systems to create an IRC botnet, which can later be used to conduct several malicious activities, including DDoS attacks and crypto-mining campaign.

The attacks observed by Check Point aimed at devices that run one of the following products:

  • TerraMaster TOS(TerraMaster Operating System) – the operating system used for managing TerraMaster NAS (Network Attached Storage) servers
  • Zend Framework –  a collection of packages used in building web application and services using PHP, with more than 570 million installations
  • Liferay Portal – a free, open-source enterprise portal. It is a web application platform written in Java that offers features relevant for the development of portals and websites

Once infected a device, it will be later used as an attacking platform.

Jan 19 2021

Recovering a hacked account

Category: Information Security — DISC @ 12:45 am
https://www.facebook.com/DISCInfoSec/posts/3999192343425213

A step by step guide to recovering an online account

Jan 19 2021

CPRA Compliance

Category: Information Security,Security Compliance — DISC @ 12:24 am
https://www.facebook.com/DISCInfoSec/posts/3997987493545698

This tool enables you to identify your organization’s CPRA (California Privacy Rights Act) compliance gaps, and helps you plan the steps necessary to achieve ongoing compliance.

Jan 18 2021

Crafting the InfoSec PlayBook

Category: Information Security,Security playbook — DISC @ 4:31 pm

Any good attacker will tell you that expensive security monitoring and prevention tools aren’t enough to keep you secure. This practical book demonstrates a data-centric approach to distilling complex security monitoring, incident response, and threat analysis ideas into their most basic elements. You’ll learn how to develop your own threat intelligence and incident detection strategy, rather than depend on security tools alone.

Written by members of Cisco’s Computer Security Incident Response Team, this book shows IT and information security professionals how to create an InfoSec playbook by developing strategy, technique, and architecture.

  • Learn incident response fundamentals—and the importance of getting back to basics
  • Understand threats you face and what you should be protecting
  • Collect, mine, organize, and analyze as many relevant data sources as possible
  • Build your own playbook of repeatable methods for security monitoring and response
  • Learn how to put your plan into action and keep it running smoothly
  • Select the right monitoring and detection tools for your environment
  • Develop queries to help you sort through data and create valuable reports
  • Know what actions to take during the incident response phase

Jan 18 2021

Cell Phone Location Privacy

Category: Information Privacy — DISC @ 3:50 pm
Cell Phone Location Privacy

Jan 18 2021

Introduction to Hacking

Category: Hacking — DISC @ 3:34 pm

This book will show you how Hacking works. You will have a chance to understand how
attackers gain access to your systems and steal information. Also, you will learn what you
need to do in order to protect yourself from all kind of hacking techniques.


Structured on 10 chapters, all about hacking, this is in short what the book covers in its
pages:

  • The type of hackers
  • How the process of Hacking works and how attackers cover their traces
  • How to install and use Kali Linux
  • The basics of CyberSecurity
  • All the information on malware and cyber attacks
  • How to scan the servers and the network
  • WordPress security & Hacking
  • How to do Google Hacking
  • What’s the role of a firewall and what are your firewall options
  • What you need to know about cryptography and digital signatures
  • What is a VPN and how to use it for your own security

Get this book NOW. Hacking is real, and many people know how to do it. You can protect
yourself from cyber attacks by being informed and learning how to secure your computer and
other devices.

Tags:  Computer Security, Hacking, CyberSecurity, Cyber Security, Hacker, Malware, Kali Linux, Security, Hack, Hacking with Kali Linux, Cyber Attack, VPN, Cryptography

Jan 18 2021

Apple paid a $50,000 bounty to two bug bounty hunters for hacking its hosts

Category: Bug Bounty,Hacking — DISC @ 3:22 pm
Apple paid a $50,000 bounty to two bug bounty hunters for hacking its hosts

Jan 17 2021

President Biden’s Peloton exercise equipment under scrutiny

Category: Information Security — DISC @ 11:36 pm

President Joe Biden can’t bring his Peloton exercise equipment to the White House due to security reasons.

Peloton devices are connected online and are equipped with a camera and microphone that give the users an immersive experience and communications capabilities. On the other side, these features pose a potential risk to the user in case of a hack, and President Joe Biden is a privileged target.

To secure the exercise equipment, Biden’s Peloton may have to be modified, removing the microphone, camera and networking equipment.

“If you really want that Peloton to be secure, you yank out the camera, you yank out the microphone, and you yank out the networking equipment … and you basically have a boring bike,” Max Kilger, Ph.D., director of the Data Analytics Program and Associate Professor in Practice at the University of Texas at San Antonio, told Popular Mechanics. “You lose the shiny object and the attractiveness.”

Source: President Biden’s Peloton exercise equipment under scrutiny

So long Peloton Joe Biden may need new exercise equipment when he moves
httpv://www.youtube.com/watch?v=m7VjoflLL8k&ab_channel=InsideNews




Jan 03 2021

Backdoor account discovered in more than 100,000 Zyxel firewalls, VPN gateways

Category: Backdoor,Firewall — DISC @ 11:11 am

The username and password (zyfwp/PrOw!aN_fXp) were visible in one of the Zyxel firmware binaries.

More than 100,000 Zyxel firewalls, VPN gateways, and access point controllers contain a hardcoded admin-level backdoor account that can grant attackers root access to devices via either the SSH interface or the web administration panel.

The backdoor account, discovered by a team of Dutch security researchers from Eye Control, is considered as bad as it gets in terms of vulnerabilities.

Device owners are advised to update systems as soon as time permits.

Security experts warn that anyone ranging from DDoS botnet operators to state-sponsored hacking groups and ransomware gangs could abuse this backdoor account to access vulnerable devices and pivot to internal networks for additional attacks

Source: Backdoor account discovered in more than 100,000 Zyxel firewalls, VPN gateways | ZDNet



[Tech News] Backdoor Account Discovered in More Than 100,000 Zyxel Firewalls, VPN Gateways podcast
httpv://www.youtube.com/watch?v=tQeBp_oim4A






Dec 30 2020

Ransomware Is Headed Down a Dire Path

Category: Ransomware — DISC @ 4:39 pm

2020 was a great year for ransomware gangs. For hospitals, schools, municipal governments, and everyone else, it’s going to get worse before it gets better.

AT THE END of September, an emergency room technician in the United States gave WIRED a real-time account of what it was like inside their hospital as a ransomware attack raged. With their digital systems locked down by hackers, health care workers were forced onto backup paper systems. They were already straining to manage patients during the pandemic; the last thing they needed was more chaos. “It is a life-or-death situation,” the technician said at the time.

The same scenario was repeated around the country this year, as waves of ransomware attacks crashed down on hospitals and health care provider networks, peaking in September and October. School districts, meanwhile, were walloped by attacks that crippled their systems just as students were attempting to come back to class, either in person or remotely. Corporations and local and state governments faced similar attacks at equally alarming rates.

Ransomware has been around for decades, and it’s a fairly straightforward attack: Hackers distribute malware that mass-encrypts data or otherwise blocks access to a target’s systems, and then demand payment to release the digital hostages. It’s a well-known threat, but one that’s difficult to eradicate—something as simple as clicking a link or downloading a malicious attachment could give attackers the foothold they need. And even without that type of human error, large corporations and other institutions like municipal governments still struggle to devote the resources and expertise necessary to lay down basic defenses. After watching these attacks in 2020, though, incident responders say that the problem has escalated and that the ransomware forecast for next year looks pretty dire.

Source: Ransomware Is Headed Down a Dire Path



Dealing with a Ransomware Attack: A full guide
httpv://www.youtube.com/watch?v=g0yXmQx89x4&ab_channel=ThePCSecurityChannel






Dec 26 2020

Fake Amazon gift card emails deliver the Dridex malware

Category: Malware,Pen Test — DISC @ 1:56 pm

The Dridex malware gang is delivering a nasty gift for the holidays using a spam campaign pretending to be Amazon Gift Cards.

Dridex phishing campaign wants to send a gift

When distributing malware, malware gangs commonly use current events and the holidays as themes for phishing campaigns to lure people into opening malicious attachments.

Such is the case in a recent phishing campaign discovered by cybersecurity firm Cyberreason that pretends to be an Amazon gift certificate sent via email.

These emails, shown below, pretend to be a $100 gift certificate that users must redeem by clicking on a phishing email button.

Source: Fake Amazon gift card emails deliver the Dridex malware



Fake Amazon Email Scam 2020 | How to Detect & Defend | Alert | Windows 10 | Beginners Guide |
httpv://www.youtube.com/watch?v=LXPehYw-D0E






Tags: AWS security

Dec 21 2020

SUPERNOVA, a backdoor found while investigating SolarWinds hack

Category: Hacking — DISC @ 5:48 pm

While investigating the recent SolarWinds Orion supply-chain attack security researchers discovered another backdoor, tracked SUPERNOVA.

The investigation of the SolarWinds Orion supply-chain attack revealed the existence of another backdoor that was likely used by a separate threat actor.

After the initial disclosure of the SolarWinds attack, several teams of researchers mentioned the existence of two second-stage payloads.

Security experts from Symantec, Palo Alto Networks, and Guidepoint reported that threat actors behind the SolarWinds attack were also planting a .NET web shell dubbed Supernova.

Researchers from Palo Alto Networks revealed that the malicious code is a tainted version of the legitimate .NET library “app_web_logoimagehandler.ashx.b6031896.dll” included in the SolarWinds Orion software.

“In the analysis of the trojanized Orion artifacts, the .NET .dll app_web_logoimagehandler.ashx.b6031896.dll was dubbed SUPERNOVA, but little detail of its operation has been publicly explored.” reads the analysis published by Palo Alto Networks.

“SUPERNOVA differs dramatically in that it takes a valid .NET program as a parameter. The .NET class, method, arguments and code data are compiled and executed in-memory. There are no additional forensic artifacts written to disk, unlike low-level webshell stagers, and there is no need for additional network callbacks other than the initial C2 request. In other words, the SolarStorm attackers have constructed a stealthy and full-fledged .NET API embedded in an Orion binary, whose user is typically highly privileged and positioned with a high degree of visibility within an organization’s network.”

Source: SUPERNOVA, a backdoor found while investigating SolarWinds hack



Learning about .NET Malware by Going Over the SUNBURST SolarWinds Backdoor
httpv://www.youtube.com/watch?v=cMauHTV-lJg




Tags: Backdoor, SolarWinds hack, SUPERNOVA

Dec 13 2020

Suspected Russian hackers spied on U.S. Treasury emails

Category: Cyber Espionage,Cyber Spy,Cyber surveillance,Digital cold war,Hacking,Information Warfare — DISC @ 4:27 pm

Hackers believed to be working for Russia have been monitoring internal email traffic at the U.S. Treasury Department and an agency that decides internet and telecommunications policy, according to people familiar with the matter.

Three of the people familiar with the investigation said Russia is currently believed to be behind the attack.

Two of the people said that the breaches are connected to a broad campaign that also involved the recently disclosed hack on FireEye, a major U.S. cybersecurity company with government and commercial contracts.

“The United States government is aware of these reports and we are taking all necessary steps to identify and remedy any possible issues related to this situation,” said National Security Council spokesman John Ullyot.

The hack is so serious it led to a National Security Council meeting at the White House on Saturday, said one of the people familiar with the matter.

Source: Suspected Russian hackers spied on U.S. Treasury emails – sources


    Active Exploitation of SolarWinds Software

    Emergency directive: Global governments issue alert after FireEye hack is linked to SolarWinds supply chain attack

    SolarWinds Security Advisory

    Massive suspected Russian hack is 21st century warfare

    The government has known about the vulnerabilities that allowed the SolarWinds attack since the birth of the internet—and chose not to fix them.

    WATCH: Trump refuses to acknowledge that Russia meddled in US elections



RUSSIAN GOVERNMENT HACKING GROUP ‘APT29’ BEHIND CYBER HACK ON US GOVERNMENT
httpv://www.youtube.com/watch?v=FM66FgFk6Ls



U.S. Agencies Hit in Brazen Cyber-Attack by Suspected Russian Hackers
httpv://www.youtube.com/watch?v=vlVGnu7i0tY



#Sandworm: A New Era of #Cyberwar and the Hunt for the #Kremlin’s Most #Dangerous #Hackers Paperback




Tags: APT29, cyber hacking, FireEye, Greenburg, Russian cyber attack, Russian espionage, Russian hackers, Sandworm, U.S. Treasury

« Previous Page — Next Page »