Aug 02 2023

From tech expertise to leadership: Unpacking the role of a CISO

Category: CISO,vCISO — disc7 @ 7:45 am
From tech expertise to leadership: Unpacking the role of a CISO
In your opinion, what are the key characteristics of an effective CISO? How do you balance technical expertise and leadership skills?

A CISO needs to wear many hats across the business and juggle many competing priorities. They need to be a customer support representative, a product partner, a manager, a visionary, a strategist, and of course, a security expert.

I have found that some of the most important characteristics are to be friendly, honest, and emphatic. Being a friend to the organization and people you work with, rather than leading with just policies and demands, is critical to getting more done and the success of your team.

It may sound counterintuitive, but a good CISO must get out from behind the technology and understand the people they are serving. Of course, you must maintain a high level of technology knowledge, but if you find yourself only sitting in front of a firewall console, you’re probably in the wrong job.

Given the rapid rate of technological change, how should CISOs approach building an organization’s security posture?

With the more-rapidly-than-ever changing environment, you can rarely rely solely on multi-year strategies or multi-quarter roadmaps. You must be ready for constant change and quickly adapt to it.

CISOs must create a security strategy built around anticipating outcomes and a feedback loop to gather information during incidents, assessments, threat analysis, and research. The information gathered should then be turned into metrics which will give insights into if the strategy is working, and, if necessary, how to evolve the strategy.

In today’s business environment, a CISO must communicate complex security issues. How can you ensure you’re understood by all stakeholders, including those who aren’t as tech-savvy

Though CISOs play a lead role in managing an organization’s security posture, it is important that cybersecurity efforts manifest as a shared responsibility across an organization. From new hires to the C-suite, cybersecurity should be a communicated priority for all employees. Everyone should care about security, and if they don’t do it, it’s because they don’t understand something about the situation or ask.

Just as much as a CISO needs to learn about the business, they must also educate other business leaders on what’s out there and the landscape of evolving threats. Then, it’s important to connect these threats and the solutions back to the goals of that part of the business so teams can fully understand the role they can play in mitigating risk.

With declining trust in institutions, how can CISOs help organizations build and maintain trust among customers, employees, and stakeholders?

It’s important to prioritize security and proactively communicate initiatives with stakeholders. However, building and maintaining trust isn’t a one-size-fits-all approach. CISOs must possess the ability to effectively communicate and educate all stakeholders about the specific cyber risks relevant to their organization while also proactively outlining how it is prepared to address those risks. Implementing robust, proactive security measures and emphasizing the protection of sensitive data will reassure customers, stakeholders, and employees alike that their information is secure. Swiftly acting on emerging and existing security threats also reinforces trust and demonstrates an organization’s proactive efforts in addressing threats before they become detrimental.

The role of a CISO encompasses a wide range of responsibilities, including compliance, disaster recovery, and stakeholder management. How can a CISO effectively manage such a diverse portfolio of tasks?

There are three ways I manage competing priorities: Focus, transparency, and accountability. A CISO must focus on the tasks that have the biggest ROIs, and not get distracted by the noise. Leading with transparency will make it clear to everyone within the organization why we are making changes or asks. And finally, security posture and response can only be improved when accountability is clear. And not just accountability of the security team, but accountability from across the organization where everyone understands the responsibility.

By making data-driven decisions and conducting continuous risk assessments, CISOs can strategically allocate resources to high-priority tasks. The delicate balance lies in leading these various aspects while leveraging the expertise of a skilled team to ensure comprehensive security protection across the organization. By staffing a knowledgeable team of security experts and empowering them to take ownership of their day-to-day responsibilities, CISOs can focus their time on providing strategic and executive-level oversight on key issues.

Given the constantly evolving threat landscape, how can a CISO maintain its technological expertise while focusing on leadership and collaboration?

From a leadership standpoint, the CISO is so much more than just security. It’s truly a business leader position, they are collaborating with the other business leaders to share the same resources. CISOs must understand the organizational goals, the customer needs, and the capacity of each team to prioritize security in collaboration with product management, IT leaders, CTO, etc.

CISOs must maintain fundamental technology knowledge but rely on the team’s subject matter expertise for deeper technical aspects. It’s important to find the right training, like CISSP, and vendor-specific certifications, without overwhelming yourself.

Chief Information Security Officer

CISSP training course

In what situations would a vCISO or CISOaaS Service be appropriate?

DISC-vCISO-v3-0-1Download

Previous posts on vCISO/CISO

CISO Conversations: The Role of the vCISO

How to Start Your Own Cybersecurity Consulting Business: First-Hand Lessons from a Burned-Out Ex-CISO

InfoSec tools | InfoSec services | InfoSec books

Tags: role of a CISO

Aug 02 2023

HOW TO EASILY HACK TP-LINK ARCHER AX21 WI-FI ROUTER

Category: Hacking,Wi-Fi Security — disc7 @ 7:21 am
How to easily hack TP-Link Archer AX21 Wi-Fi router

TP-Link has released a fix for a severe vulnerability in its Archer AX21 router. This vulnerability might have allowed attackers to take control of the device and carry out arbitrary operations.

This vulnerability, which has been assigned the identifier CVE-2023-31710, was discovered after a heap-based buffer overflow bug was discovered in the TP-Link Archer AX21 router’s /usr/lib/libtmpv2.so component. Xiaobye, an adept security researcher, is the one who discovered this security weakness and exposed it in full, which made it possible for TP-Link to quickly devise a solution to the problem. The absence of input sanitization in relation to the variable content_length is at the heart of the problem that we are now facing. A clever adversary might potentially alter this variable, which provides information on the length of the data included in the TMP packet. This vulnerability may be exploited by a  hacker by submitting a request to the router that was painstakingly designed, which would then cause the router to carry out the commands. Archer routers only allow ‘admin’ users, who are endowed with full root access. This exacerbates the severity of the problem. Therefore, in the event that a threat actor is successful in getting command execution, that actor would therefore take control of the router and acquire administrative capabilities.

This security flaw affects particular router versions, including Archer AX21(US)_V3_1.1.4 Build 20230219 and Archer AX21(US)_V3.6_1.1.4 Build 20230219, among others. Nevertheless, TP-Link has released patches for these versions, which may be found under the names Archer AX21(US)_V3.6_230621 and Archer AX21(US)_V3_230621, respectively. It is recommended that consumers who are affected get their routers up to date as soon as they can.

Xiaobye has continued his commendable efforts to shed light on this matter by publishing a compelling video presentation of exploiting the CVE-2023-31710 vulnerability on his Github repository.

In order to strengthen the safety of your router, you should take additional precautions in addition to updating the firmware on it.

Hacking Exposed Wireless, Third Edition: Wireless Security Secrets & Solutions (Hacking Exposed)

CISSP training course

InfoSec tools | InfoSec services | InfoSec books

Tags: TP-LINK ARCHER AX21

Aug 01 2023

A step-by-step guide for patching software vulnerabilities

Category: Security patching,Security vulnerabilities — disc7 @ 8:59 am
A step-by-step guide for patching software vulnerabilities

The Cyber Threat Index 2023 by the Coalition anticipates a 13% increase in the average rate of Common Vulnerabilities and Exposures (CVEs) compared to 2022, projecting it to surpass 1,900 per month in 2023. This surge in CVEs poses a challenge for organizations as they grapple with managing the release of thousands of patches and updates every month.

Streamline your patch management process

First a quick disclaimer. Proper patch management relies on important factors like size of an organization, complexity of an IT environment, criticality of systems, and number of resources allocated to manage it all, so plan accordingly. Also, this advice assumes you already have some sort of endpoint management solution or function in place for deploying patches. If not, that’s step one.

Assuming you have a solution in place, the next step is to evaluate and prioritize patches.

Not all vulnerabilities are created equally, which means not all patches are either. But as vulnerabilities like WannaCry demonstrated, delayed patching can have catastrophic consequences. Therefore, it’s important to prioritize updates that have the highest severity of non-superseded vulnerabilities and/or the highest exposure for each environment. For example, if you have an update that impacts only a few devices out of a thousand, and another that impacts 80% of devices, but both are critical, focus on the one that could have the biggest negative impact, and then address the others.

Once the critical updates are addressed, plan to move onto the non-critical patches, which are often driver updates or new software that enhances user experience and prioritize those based on importance to business operations.

Many use the Common Vulnerability Scoring System (CVSS) to help prioritize updates, which is a good starting point. Just remember that many vulnerabilities rated at a medium severity level are ignored – and found to be the source of a breach later.

Once you’ve prioritized the types of updates, the next step is to create guidelines for testing them before they go into production.

The last thing you want to do is break the system. Start by researching the criteria of each update and identifying which components require testing. Next, install each update on at least five off-network devices to be tested against proven success criteria. Record the evidence and have another person review it. Be sure to find out if the update has an uninstaller and use it to ensure complete and safe removal of outdated programs.

If you’re like most organizations, you’ll likely plan on having tons of updates/patches happening all the time. But the more updates installed at any given time increases the risk of end-user disruption (i.e., greater volume of data needing to be downloaded, longer installation times, system reboots, etc.).

Therefore, the next step is to assess your system’s bandwidth, calculate the total number and size of the updates against the total number of devices and types. This can prevent system overloads. When in doubt, just plan to start with five updates and then reassess bandwidth.

Additionally, if you follow any change management best practices (such as ITIL, Prince2, or ServiceNow), it’s important you adhere to those processes for proper reporting and auditability. They usually require documentation on which updates are needed, the impact on a user, evidence of testing, and go-live schedules. Capturing this data properly through the above steps is often required for official approvals as it serves as a single source of truth.

We’ve now gotten to the point of deployment. The next step is to ensure deployment happens safely. I recommend using a patch management calendar when making change requests and when scheduling or reviewing new patch updates. This is where you define the baselines for the number of updates to be deployed and in which order. This should utilize information gathered from previous steps. Once that baseline is set, you can schedule the deployment and automate where necessary.

At last, we’ve made it to the final step: measuring success. This can be handled in a variety of ways. For example, by the number of registered help desk incidents, the ease of which the process can be followed or repeated, or the number of positive reports provided by your toolsets. But ultimately what matters is swift deployment, streamlined repeatable processes, a reduction in manual requirements, and in the end, an organization that is less vulnerable to exploit.

A quick note on where patching often goes awry

Believe it or not, some organizations still allow users to have local admin rights for patching. This creates major attack surfaces, and the reality is, no IT team should rely on end-users for patching (blanket admin rights are just too risky).

Some also rely on free tools, but these often do not deliver all the security needed for patching. They also generally don’t provide the necessary reporting to ensure systems are 100% patched (i.e., validation). And finally, there is an over-reliance on auto-updates. Auto-updates can provide a false sense of security and can impact productivity if they are triggered during work hours.

Conclusion

Whether large or small, organizations continue to struggle with patching. I hope this quick step-by-step guide of key considerations for patch management helps your organization create a new framework or optimize an existing one.

Vulnerability And Patch Management A Complete Guide

CISSP training course

InfoSec tools | InfoSec services | InfoSec books

Tags: Vulnerability Management Program

Jul 31 2023

Tools for cloud transition and securing cloud environments?

Category: Cloud computing,Security Tools — disc7 @ 10:06 am

CISA released a fact-sheet, listing some of the great tools that CISA offers for orgs to transition and secure their cloud environments?

Five tools are described in the fact-sheet, along with other guidance to “…provide network defenders and incident response/analysts open-source tools, methods, and guidance for identifying, detecting, and mitigating cyber threats, known vulnerabilities, and anomalies while operating a cloud or hybrid environment.”

1- The Cyber Security Evaluation Tool – CISA developed the Cyber Security Evaluation Tool (CSET) using industry-recognized standards, frameworks, and recommendations to assist organizations in evaluating their enterprise and asset cybersecurity posture.

2- Secure Cloud Business Applications (SCuBA) project – which provides guidance for FCEB agencies securing their cloud business application environments and protecting federal information created, accessed, shared, and stored in those environments.

3- Untitled Goose Tool – CISA, together with Sandia National Laboratories, developed the Untitled Goose Tool to assist network defenders with hunt and incident response activities in Microsoft Azure, AAD, and M365 environments.

4- Decider – assists incident responders and analysts in mapping observed activity to the MITRE ATT&CK framework.

5- Memory Forensic on Cloud – Memory Forensic on Cloud, developed by JPCERT/CC, is a tool for building a memory forensic environment on Amazon Web Services.

CISA-cloud-tools-for-migrationDownload

CISSP training course

InfoSec tools | InfoSec services | InfoSec books

Tags: CISA security tools

Jul 31 2023

How the best CISOs leverage people and technology to become superstars

Category: CISO,vCISO — disc7 @ 9:48 am
How the best CISOs leverage people and technology to become superstars

Superstar CISOs stand out from the rest due to their acute understanding of the growing threat landscape and the shortage of cybersecurity skills. However, they refuse to succumb to despair and instead leverage their existing assets effectively, notably by recognizing an overlooked security resource: their development teams.

In the era of DevSecOps hype, it’s common to say that security is everyone’s responsibility. But there are limits to what untrained and unmotivated workers – especially those who don’t work in IT – can do to make their organization more secure against cyberthreats.

For example, in the real world, travelers at a busy airport should feel responsible for reporting an unattended bag sitting alone in a suspicious location. However, they aren’t trained to inspect that bag to look for threats or empowered to take any actions on their own. At a company, it’s one thing to make everyone aware of cybersecurity, and another to educate them to make their organization more secure within the context of their role or to use the defensive tools they already have in place to counter threats and squash vulnerabilities.

For that, companies need to invest in upskilling. It’s far better, and oftentimes easier, to invest in the talented, loyal staff that are already a part of your organization than to try and hire new people from the outside. But even then, putting those learning resources in the best place to get the required results is key.

Developers already understand IT since they write much of the code for the programs being used by their organizations. And they are often ready, willing, and able to upskill in cybersecurity to help make them even more amazing at their jobs. Smart CISOs are tapping into that enthusiasm and providing developers with the education pathways they want and need, with the payoff being a reduction in common vulnerabilities (not to mention less pressure on overworked AppSec personnel).

Making sure developers get the right upskilling and support

The best CISOs know that upskilling is critical to success. But not just any training will do, especially for the development community who already have a good baseline understanding of IT. A “check-the-box” program won’t offer much return on investment and will likely frustrate developers into poor performance and a lifelong hatred of working with security teams.

Likewise, any solution that impedes their workflow, fails to stay agile with enterprise security goals, or cannot deliver the right education at the right time in an easily digestible format, is unlikely to result in foundational security awareness or skills.

Other secrets of superstar CISOs

Exemplary CISOs are also able to address other key pain points that traditionally flummox good cybersecurity programs, such as the relationships between developers and application security (AppSec) teams, or how cybersecurity is viewed by other C-suite executives and the board of directors.

For AppSec relations, good CISOs realize that developer enablement helps to shift security farther to the so-called left and closer to a piece of software’s origins. Fixing flaws before applications are dropped into production environments is important, and much better than the old way of building code first and running it past the AppSec team at the last minute to avoid those annoying hotfixes and delays to delivery. But it can’t solve all of AppSec’s problems alone. Some vulnerabilities may not show up until applications get into production, so relying on shifting left in isolation to catch all vulnerabilities is impractical and costly.

There also needs to be continuous testing and monitoring in the production environment, and yes, sometimes apps will need to be sent back to developers even after they have been deployed. A great CISO, with a foot in development and security, can smooth out those relations and keep everyone working as a team.

Getting other C-suite executives onboard with better security might be an even more difficult challenge, with leadership outside the CISO and CIO normally looking at business objectives and profits before anything else. To counter that, superstar CISOs know how to show a direct correlation between better, more mature cybersecurity and increased revenue, and how it can even provide a competitive advantage against the competition.

It’s not easy being a CISO, and certainly more challenging than at any other point in history. But those CISOs who master that adversity are becoming true superstars within their companies and communities. They competently employ agile developer upskilling, champion security culture, streamline relationships between the traditional rivals of development and AppSec teams, and encourage leadership to foster a security-first approach from the top down.

Chief Information Security Officer

CISSP training course

In what situations would a vCISO or CISOaaS Service be appropriate?

DISC-vCISO-v3-0-1Download

Previous posts on vCISO/CISO

CISO Conversations: The Role of the vCISO

InfoSec tools | InfoSec services | InfoSec books

Tags: CISOs

Jul 30 2023

Top 7 Open Source Firewall

Category: Firewall,next generation firewall — disc7 @ 2:39 pm

What is an Open Source Firewall?

An Open Source Firewall refers to a network security solution that is developed and distributed as open-source software. Open-source software is typically released with a license that allows users to view, modify, and distribute the source code freely. This means that anyone can access the inner workings of the firewall, make improvements, and share those improvements with the community.

Open Source Firewalls are popular because they offer several advantages:

  1. Transparency: Since the source code is open and accessible to the public, users can review the code to ensure there are no hidden functionalities or security vulnerabilities.
  2. Customizability: Organizations can modify the firewall’s source code to meet their specific security requirements and network configurations.
  3. Community Support: Open-source projects often have active communities of developers and users who collaborate, share knowledge, and provide support. This community-driven approach can lead to faster bug fixes, updates, and improvements.
  4. Cost-Effectiveness: Open Source Firewalls are typically free to use, reducing licensing costs and making them attractive to organizations with budget constraints.
  5. Stability and Reliability: Many open-source projects have been around for years and have undergone extensive testing and development, resulting in stable and reliable solutions.

Source: https://hackersonlineclub.com/open-source-firewall/

Top 7 open-source firewalls known for their reliability and robust network security features:

1. pfSense:

pfSense is a powerful open-source firewall and routing platform based on FreeBSD. It provides a feature-rich web interface that allows users to configure and manage their network security easily.

Key Features: VPN support, traffic shaping, intrusion detection and prevention, content filtering, and multi-WAN load balancing.

Practical OPNsense: Building Enterprise Firewalls with Open Source

2. OPNsense:

OPNsense is another FreeBSD-based open-source firewall that offers advanced security features and a user-friendly interface. It focuses on providing a secure and stable platform for network protection.

Key Features: Firewall rules, Virtual LAN (VLAN) support, captive portal, SSL decryption, and forward caching proxy.

Practical OPNsense: Building Enterprise Firewalls with Open Source

3. IPFire:

IPFire is a Linux-based  firewall designed with a modular architecture, allowing users to add various add-ons and extensions to enhance functionality.

Key Features: Intrusion detection and prevention system (IDPS), a proxy server, support for Virtual Private Networks (VPN), Quality of Service (QoS) capabilities, and compatibility with Wi-Fi access points.

4. Untangle NG Firewall:

Untangle NG Firewall is a Linux-based open-source solution that provides comprehensive network security and unified threat management (UTM) features.

Key Features: Web filtering, application control, antivirus, spam blocker, and intrusion prevention system.

5. ClearOS:

ClearOS is a Linux-based open-source firewall that offers a range of security features and is suitable for small businesses and home users.

Key Features: Web content filter, antivirus, intrusion protection, Virtual Private Network (VPN), and bandwidth manager.

6. Smoothwall:

Smoothwall is a Linux-based firewall that provides secure internet access and content filtering for schools, businesses, and organizations.

Key Features: Web proxy, bandwidth management, time-based access control, URL filtering, and reporting tools.

7. Endian Firewall Community:

Endian Firewall Community is an open-source UTM solution that offers essential security features to protect networks from various threats.

Key Features: Stateful inspection firewall, antivirus, spam filtering, VPN support, and content filtering.

Smoothwall and Endian Firewall Community have garnered a loyal user base due to their simplicity and effectiveness in securing networks. Regular updates and community support are crucial in maintaining a reliable and secure firewall solution, as with any open-source software.

The important thing is your network’s specific needs, and choose the best firewall that best aligns with your requirements and resources.

Each of the above open-source firewalls comes with its features and capabilities, so the choice as per the specific requirements and the level of complexity needed for your network. Stay updated with the latest releases and security patches to maintain a secure network environment.

When choosing an Open Source Firewall, it’s essential to consider factors such as the size and complexity of your network, the required features, and the level of community support available for the specific project. Proper configuration and ongoing maintenance are critical to ensure the firewall’s effectiveness in protecting your network from various cyber threats.

InfoSec books | InfoSec tools | InfoSec services

Tags: Open Source Firewall

Jul 30 2023

How can we solve cybersecurity talent issue?

Category: Cyber career,Security training — disc7 @ 11:18 am

The cybersecurity talent issue is a significant challenge faced by organizations worldwide. Solving this problem requires a combination of short-term and long-term strategies to attract, develop, and retain skilled cybersecurity professionals. Here are some steps that can help address the cybersecurity talent shortage:

  1. Education and Training: Invest in cybersecurity education and training programs at various levels, from primary education to advanced professional certifications. Collaborate with educational institutions and industry experts to design comprehensive and up-to-date curricula.
  2. Promote Cybersecurity as a Career Choice: Raise awareness about the importance of cybersecurity as a career option. Target students and professionals from diverse backgrounds to encourage them to pursue cybersecurity careers.
  3. Apprenticeships and Internships: Establish apprenticeship and internship programs to provide hands-on experience to aspiring cybersecurity professionals. This can help bridge the gap between theoretical knowledge and practical skills.
  4. Industry Collaboration: Foster collaboration between academic institutions and the private sector. Industry partnerships can help ensure that cybersecurity programs align with current industry needs and practices.
  5. Cyber Range and Simulations: Set up cyber ranges and simulations to provide a safe environment for individuals to practice and enhance their cybersecurity skills. These platforms allow trainees to learn through realistic scenarios without risking real-world systems.
  6. Mentorship Programs: Create mentorship programs where experienced cybersecurity professionals can guide and support newcomers in their career development. This can be especially helpful in retaining talent and promoting professional growth.
  7. Competitive Compensation and Benefits: Offer competitive salaries and benefits to attract skilled cybersecurity professionals. Recognize their value and contribution to the organization’s security posture.
  8. Continuous Professional Development: Encourage and facilitate continuous learning and professional development for existing cybersecurity teams. This can be achieved through regular training, attending conferences, and participating in workshops.
  9. Diversity and Inclusion: Promote diversity and inclusion within the cybersecurity workforce. A diverse team brings varied perspectives and problem-solving approaches, ultimately enhancing the overall security posture.
  10. Public-Private Partnerships: Encourage partnerships between government agencies, private companies, and non-profit organizations to address the talent shortage collectively. Collaboration can lead to resource-sharing and more comprehensive solutions.
  11. Automation and AI Solutions: Implement cybersecurity automation and AI technologies to augment the existing workforce. Automation can handle repetitive tasks, allowing professionals to focus on more complex issues.
  12. Retaining Talent: Focus on employee retention by providing a supportive and rewarding work environment. Recognize and celebrate cybersecurity achievements and milestones within the organization.
  13. Ethical Hacking Competitions and CTFs: Support and sponsor ethical hacking competitions and Capture The Flag (CTF) events. These challenges attract cybersecurity enthusiasts and offer valuable learning experiences.

By combining these strategies and adopting a long-term perspective, organizations can start making progress in solving the cybersecurity talent issue. Remember that cybersecurity is an ever-evolving field, and continuous efforts are needed to attract and retain skilled professionals.

Blended training course will give you what you need to develop your career and pass the challenging CISSP (Certified Information Systems Security Professional) exam first time.

Cybersecurity and information resilience – BSI Group

Computer Security

InfoSec books | InfoSec tools | InfoSec services

Tags: CISSP, Computer security, Information resilience

Jul 29 2023

is there an underserved market segment in Cyber Security?

Category: cyber security — disc7 @ 4:53 pm

The cybersecurity industry is constantly changing, and market conditions can shift quickly. To identify potential underserved market segments, it is crucial to regularly conduct updated market research. Staying informed about the latest developments helps businesses recognize new opportunities and areas where cybersecurity solutions are in demand but currently lacking.

There are some areas where there might have been or still are underserved market segments in cybersecurity include:

  1. Small and Medium-sized Enterprises (SMEs): Smaller businesses often lack the resources and expertise to implement robust cybersecurity measures. They may not have access to dedicated cybersecurity teams or the budget to invest in expensive security solutions.
  2. Nonprofit Organizations: Nonprofits, especially smaller ones, may face similar challenges as SMEs when it comes to cybersecurity. They might not have the necessary funds or expertise to adequately protect their data and digital assets.
  3. Individuals and Consumers: With the increasing prevalence of cyber threats targeting individuals, there may be a market segment for user-friendly and affordable cybersecurity solutions tailored to the needs of regular consumers.
  4. Internet of Things (IoT) Devices: As the number of IoT devices continues to grow, there is a potential underserved market for specialized cybersecurity solutions designed to secure these devices and the data they generate.
  5. Cloud Security: With the widespread adoption of cloud computing, ensuring the security of cloud-based data and services has become critical. There may be opportunities for specialized cloud security solutions catering to different industries and use cases.
  6. Critical Infrastructure: Industries such as energy, transportation, and healthcare that rely heavily on interconnected systems and technologies may have specific cybersecurity needs that could be underserved.
  7. Emerging Technologies: As new technologies like artificial intelligence, blockchain, and quantum computing gain traction, there may be a need for cybersecurity solutions that address the unique risks associated with these technologies.
  8. Cybersecurity Workforce Development: With the growing demand for cybersecurity professionals, there may be an underserved market segment for training and educational programs to address the workforce shortage in the industry.

It’s important to note that while some segments may have been underserved, the cybersecurity industry is competitive, and companies are continually looking for new opportunities. As the threat landscape changes, new niche areas may emerge, and existing underserved segments may receive more attention from cybersecurity companies and entrepreneurs.

Cyber Security Innovation for the Digital Economy

Digital Disruption: Implications and opportunities for Economies, Society, Policy Makers and Business Leaders

InfoSec books | InfoSec tools | InfoSec services

Tags: Cyber Security Innovation, underserved market

Jul 29 2023

My Adventures as the World’s Most Wanted Hacker 

Category: Hacking — disc7 @ 4:12 pm

“Ghost in the Wires” is an autobiography written by Kevin Mitnick, co-authored by William L. Simon, published in 2011. The book details the life and adventures of Kevin Mitnick, one of the most famous and notorious hackers in computer history. Mitnick’s story is not only a thrilling tale of hacking, intrigue, and escapes but also provides valuable insights into the world of cybersecurity, privacy, and the vulnerabilities of information systems.

The book showcases Mitnick’s skills as a hacker, which allowed him to gain unauthorized access to computer networks and systems of major companies during the 1980s and 1990s. He used various techniques to exploit security weaknesses and evade detection by law enforcement agencies. Mitnick’s activities led to a high-profile chase by the FBI and other authorities as they tried to capture him.

The “Ghost in the Wires” title alludes to Mitnick’s ability to remain elusive and undetected, much like a ghost haunting the digital realm. The book delves into the tactics he used to cloak his identity, manipulate phone switches, and navigate through complex computer and cellular networks, staying one step ahead of the authorities.

Throughout the story, Mitnick shares the mindset and strategies he employed, giving readers an insight into the mind of a hacker and how cybersecurity measures were inadequate in that era. It also highlights the need for companies to reevaluate their security protocols and protect their sensitive information from cyber threats.

As a hacker turned cybersecurity consultant, Mitnick ultimately uses his experiences to shed light on the importance of improved security practices, awareness, and the dangers of social engineering. The book serves as a cautionary tale for individuals and organizations alike, emphasizing the need to stay vigilant and proactive in the face of evolving cyber threats.

Overall, “Ghost in the Wires” is not only an enthralling tale of a skilled hacker’s escapades but also a valuable resource for understanding cybersecurity and the significance of protecting digital information in the age of Big Data and pervasive surveillance.

“Mitnick manages to make breaking computer code sound as action-packed as robbing a bank.” — NPR

Tags: Kevin Mitnick, World's Most Wanted Hacker

Jul 29 2023

NEW ATTACK TECHNIQUE TO HACK APACHE TOMCAT SERVERS

Category: Cyber Attack,Hacking,Web Security — disc7 @ 11:56 am
New attack technique to hack Apache Tomcat Servers

The article discusses a new cyberattack targeting Apache Tomcat servers, a popular open-source web server environment written in Java. Apache Tomcat supports various technologies and is widely used by developers.

The attack is orchestrated by the Mirai botnet and bitcoin miners, specifically targeting improperly configured Apache Tomcat servers lacking sufficient security measures. The research, conducted by Aqua, involved setting up Tomcat server honeypots to monitor the attacks over a two-year period.

During the research, more than 800 attacks were recorded, with an overwhelming 96% of them linked to the Mirai botnet. Out of these attempts, 20% (152 attacks) utilized a web shell script named “neww,” originating from 24 different IP addresses. Interestingly, 68% of these attacks were attributed to a single IP address, 104.248.157[.]218. Fortunately, the attacks using the “neww” web shell script were unsuccessful in compromising the targeted servers.

A brute force attack was carried out by the threat actor against the scanned Tomcat servers in order to acquire access to the web application management using a variety of different credential combinations.

After successfully gaining entrance, threat actors will install a WAR file containing a web shell called ‘cmd.jsp’ on the Tomcat server that has been hacked. This will allow for remote command execution.

The “downloading and running” of the “neww” shell script is an integral part of the whole attack chain. The “rm -rf” command is then used to remove the script once it has been executed. The software then retrieves 12 binary files that are customized to the architecture of the system that is being attacked.

While all of these components work together to expedite the web app deployment on compromised Tomcat servers in an effective manner.

The last step of the malware is a variation of the Mirai botnet that uses infected systems for the purpose of coordinating distributed denial-of-service (DDoS) assaults.

Threat actor infiltrates web app manager by using legitimate credentials, uploads disguised web shell in WAR file, remotely executes commands, and starts the attack.The statistics shed light on the profitable expansion of cryptocurrency mining, which is projected to have a 399% increase and 332 million cryptojacking assaults worldwide in H1 2023.

Flaw in Apache Tomcat forces server to perform DoS attacks against itself & the network

Recommendation
In order to protect against attacks of this kind, specialists in the field of cybersecurity suggested the following measures:

Make sure that each of your environments has the appropriate configuration.
Be careful to do regular scans of your servers to look for any dangers.
Cloud-native tools that scan for vulnerabilities and misconfigurations should be made available to your development, DevOps, and security teams so that they can better do their jobs.
It is imperative that you use runtime detection and response technologies.

Web Security for Developers: Real Threats, Practical Defense

InfoSec books | InfoSec tools | InfoSec services

Tags: APACHE TOMCAT SERVERS, web security

Jul 28 2023

VERSIONS OF UBUNTU PRIOR TO 23.04 CAN BE HACKED THANKS TO THESE 2 SEVERE SECURITY FLAWS

Category: Hacking,Linux Security — disc7 @ 9:43 am
Versions of Ubuntu prior to 23.04 can be hacked thanks to these 2 severe security flaws

Two vulnerabilities in the Linux operating system Ubuntu have been found by researchers. Both of these vulnerabilities have the ability to offer attackers elevated privileges.There have been indications that a vulnerability that allows for an increase in privilege may be detected in the OverlayFS module of Ubuntu operating systems.

A Linux filesystem known as OverlayFS has seen significant adoption in the container industry. OverlayFS makes it possible to deploy dynamic filesystems while maintaining compatibility with pre-built images.

CVE-2023-23629

When invoking the ovl_do_setxattr function on Ubuntu kernels, the ovl_copy_up_meta_inode_data module has the potential to bypass permission checks. This vulnerability occurs as a result. This vulnerability has been assigned a CVSS score of 7.8, which is considered to be High.

CVE-2023-2640

There is a flaw in Ubuntu known as SAUCE: overlayfs bypass permission checks for trusted that leads to this vulnerability.overlayfs. * xattrs. * xattrs.

This vulnerability may be exploited by an attacker who does not have rights by establishing privileged extended attributes on the mounted files and then setting them on the other files without necessary checks being performed. This vulnerability has been assigned a CVSS score of 7.8, which is considered to be High.

The Ubuntu Patch from 2018 is in Conflict with the Linux Kernel Project from 2019 and 2022.

Since the OverlayFS module may be used by non-privileged users via user namespaces, it is a perfect candidate for local privilege escalation. In 2018, Ubuntu released patches that addressed these security flaws.

Despite this, researchers working for Wix discovered that the Linux Kernel Project released many new versions in the years 2019 and 2022.

There was a problem between the older patches and the most recent version as a direct consequence of the changes that were made to the OverlayFS module.

These exploits are already accessible to the public in their exploitable forms. It is strongly advised that anyone using Ubuntu versions earlier than 23.04 update to the most recent release in order to prevent these vulnerabilities from being exploited. On the other hand, the majority of cloud security providers (CSPs) have been using insecure versions of the Ubuntu Operating System as their default system.

Researchers believe that around forty percent of computers running Ubuntu might have been affected by the issue, making the anticipated scope a large one. According to Canonical, the business that is responsible for Ubuntu and also operates for profit, the desktop version of the software was installed more than 20 million times in 2017. Ubuntu has issued a security alert that addresses many vulnerabilities and gives credit to the researchers who discovered them.

Mastering Linux Security and Hardening: Protect your Linux systems from intruders, malware attacks, and other cyber threats

InfoSec books | InfoSec tools | InfoSec services

Tags: Mastering Linux Security and Hardening, UBUNTU

Jul 27 2023

HOW YOU’RE BEING TRACKED ONLINE AND MEASURES TO PREVENT IT

Category: Cyber Espionage,Information Privacy — disc7 @ 8:14 am
How You’re Being Tracked Online and Measures to Prevent It

There’s just about no one that can say they’ve never been online or used online services. We spend a significant part of our daily lives online, which can bring various risks. It’s simple for apps, websites, and hackers to track and use your online activity for their own purposes. However, we look into useful tools like rotating residential proxies and more to help prevent others from tracking you.

HOW OTHERS TRACK YOU ONLINE?

People are often surprised to find out how much they’re being tracked online. With devices like your smartphone, tablet, and desktop, various apps, websites, and hackers can track your online activities. These activities could expose sensitive information like your physical location, personal information, financial information, and more.

Others can track you using the following methods:

  • Your IP address
  • Cross-tracking between your devices
  • Cursor tracking software/Tattleware
  • Email exchanges
  • Frequently visited accounts on devices
  • Location software like map apps
  • Your search history

WHY ARE YOU TRACKED ONLINE?

The benign reason that others track you online is to learn your shopping habits and provide more targeted marketing. While this can feel invasive and result in spam emails, it’s ultimately not harmful. However, cybercriminals and hackers can also track you using the above methods and learn more confidential information, like your social security number, home address, and habits.

Ultimately, if hackers and scammers have this information, they can also more easily scam you. Phishing attempts, false advertisements, and more are all ways you can be conned out of your money when your habits and information are known.

MEASURES TO PREVENT FROM BEING TRACKED

Whether it’s to avoid targeted marketing and prevent your personal information from being vulnerable or to stay safe from hackers, there are various methods you can use to protect yourself online.

MULTIPLE BROWSERS

Using multiple browsers to create accounts and browse the internet is a simple way of making it difficult to track you. That’s because you split your activity over various browsers that don’t share information. It also limits your exposure to web tracking, keeps your various activities separate, and you can delete information easier.

MIXING USER AGENTS WITH EXTENSIONS

A user agent is the software that tells the website which browser you’re using, your rendering engine, and your operating systems. This information is shared to ensure the version of the website you see is optimized for your browser and device. You can change the user agent to confuse any trackers on these websites.

A user-agent switcher is a tool you can use to switch the type of user agent you have, making it look like you’re using a different browser and device. You also have access to various privacy extensions which work with this user-agent switcher to protect against tracking.

STAY PRIVATE IN PUBLIC

Don’t use public networks to browse the internet when you’re in public. While free Wi-Fi seems beneficial, these open networks can leave a gap in your device’s defenses for hackers to sneak through. Instead, stay on your private network, and ensure you don’t give strangers access to that network or your device.

ADJUST PRIVACY SETTINGS

It’s best to adjust your privacy settings on your devices and browsers to avoid online websites and hackers tracking you. Enable “Do Not Track” on your browsers and devices to keep the device from tracking you. While it won’t stop a determined hacker, it helps lessen the tracking cookies on your browsers. 

Also, ensure that mobile apps don’t have permission to track your location, as this is another avenue that reveals your activities to others. Only use apps that require your location when using a proxy that helps block malicious websites, connections, and more.

DON’T SAVE COOKIES

While we’re on the subject of cookies, another good step is not to accept website cookies. These cookies track your activity on the website, leaving a digital footprint behind. It can also reveal your habits, likes, IP addresses, and more.

USE ROTATING PROXIES

Using rotating residential proxies is an easy way to keep yourself from being tracked. Residential proxy servers contact the website on your behalf, so you’re never directly contacting it. The IP addresses it uses are from actual home devices, making you look like a natural person and enabling you to browse the web safely. 

Rotating residential servers use a new IP address each time you make a new connection. These rotating IP addresses make it extremely difficult to track you, as the proxy takes care of the cookies and leaves no digital footprint behind to exploit.

RATHER STAY SAFE THAN BEING TRACKED

While there are various ways to try and avoid being tracked, there’s no way to ensure it won’t happen as long as you use the internet. Rotating residential proxies is an excellent preventative and protective measure, but we advise you never to log into your Google, Apple, Facebook, or other essential accounts while browsing unprotected. You can never be truly certain how you’re being tracked, as such you should implement as many different measures as you can to protect your privacy.

How to Disappear: Erase Your Digital Footprint, Leave False Trails, And Vanish Without A Trace

InfoSec books | InfoSec tools | InfoSec services

Tags: How to Disappear, TRACKED ONLINE

Jul 26 2023

MikroTik vulnerability could be used to hijack 900,000 routers (CVE-2023-30799)

Category: Security vulnerabilities — disc7 @ 9:26 am
MikroTik vulnerability could be used to hijack 900,000 routers (CVE-2023-30799)

While exploting it does require authentication, acquiring credentials to access the routers is not that difficult.

“RouterOS [the underlying operating system] ships with a fully functional ‘admin’ user. Hardening guidance tells administrators to delete the ‘admin’ user, but we know a large number of installations haven’t,” Baines explained. “We probed a sample of hosts on Shodan (n=5500) and found that nearly 60% still used the default admin user.”

In addition to this, until October 2021, the default “admin” password was an empty string and there was no prompt for admins to change it.

“Even when an administrator has set a new password, RouterOS doesn’t enforce any restrictions. Administrators are free to set any password they choose, no matter how simple. That’s particularly unfortunate because the system doesn’t offer any brute force protection (except on the SSH interface),” he added.

About CVE-2023-30799

The interesting thing about CVE-2023-30799 is not that it’s a bug that allows elevation of privilege, but that it allow attackers to achieve “super-admin” privileges, which allows them to full access to the device’s OS and to, potentially, make undetectable changes to it.

Even though the vulnerability received a CVE number this year, its existence has been known since June 2022, when Ian Dupont and Harrison Green of Margin Research released an exploit called FOISted that can obtain a root shell on the RouterOS x86 virtual machine.

The vulnerability had been fixed in the RouterOS stable branch later that year (the fix was shipped in v6.49.7), but not in the RouterOS Long-term branch, which consists of less current but still widely used version of the OS.

A patch for RouterOS Long-term was released last week, after the researchers ported and demonstrated the FOISted exploit working on MIPS-based MikroTik devices either via its web or Winbox interface.

What to do?

“In total, Shodan indexes approximately 500,000 and 900,000 RouterOS systems vulnerable to CVE-2023-30799 via their web and/or Winbox interfaces respectively,” Baines noted.

They haven’t made the exploit public, but the race is on; in the past, attackers have been compromising MikroTik routers for a variety of nefarious ends (cryptojacking, setting up C2 communication proxies, exploit delivery).

Also, it’s possible that attackers have already developed an exploit and have been using it without getting noticed.

“Under normal circumstances, we’d say detection of exploitation is a good first step to protecting your systems. Unfortunately, detection is nearly impossible. The RouterOS web and Winbox interfaces implement custom encryption schemes that neither Snort or Suricata can decrypt and inspect. Once an attacker is established on the device, they can easily make themselves invisible to the RouterOS UI,” Baines shared.

“Microsoft published a toolset that identifies potential malicious configuration changes, but configuration changes aren’t necessary when the attacker has root access to the system.”

Admins/users of MikroTik routers are advised to upgrade to a fixed version (either Stable or Long-term) and, in general, to minimize the attack surface to prevent this type and similar attacks by remote actors.

They can do that by removing MikroTik administrative interfaces from the internet, restricting which IP addresses administrators can log in from, or by disabling the Winbox and the web interfaces, says Baines. “Only use SSH for administration. Configure SSH to use public/private keys and disable passwords.”

InfoSec books | InfoSec tools | InfoSec services

Tags: CVE-2023-30799

Jul 25 2023

Lack of resources to security pose a risk?

Category: Information Security,Security Awareness — disc7 @ 4:01 pm

The lack of resources can pose significant risks to security in various contexts, including personal, organizational, and national security. Here are some ways in which a lack of resources can impact security:

  1. Cybersecurity: Inadequate resources for implementing robust cybersecurity measures can make systems and networks vulnerable to cyber threats. Without sufficient investments in cybersecurity tools, training, and personnel, organizations and individuals may become easy targets for cyberattacks, data breaches, and hacking incidents.
  2. Physical Security: Insufficient resources for physical security measures, such as access control systems, surveillance cameras, and security personnel, can lead to vulnerabilities in critical infrastructure, public spaces, and private properties. This could result in increased risks of theft, vandalism, and unauthorized access.
  3. National Security: Nations with limited resources may struggle to maintain a strong defense posture. A lack of funding for military and intelligence agencies can hinder efforts to protect against external threats, terrorism, and cyber warfare, potentially compromising national security.
  4. Emergency Preparedness: When resources are scarce, emergency services and disaster response teams may face challenges in adequately preparing for and responding to crises. This can exacerbate the impact of natural disasters, pandemics, or other emergencies, potentially putting lives and property at risk.
  5. Personal Safety: On an individual level, lack of resources can jeopardize personal safety. For example, individuals living in impoverished or unsafe neighborhoods may not have access to adequate home security systems, leading to increased risks of burglary and assault.
  6. Public Health: In the context of public health, insufficient resources for medical facilities, research, and disease surveillance can hinder efforts to detect and respond to health threats effectively. This was particularly evident during the COVID-19 pandemic when some regions struggled to provide sufficient medical equipment, testing, and healthcare resources.
  7. Information Security: In organizations, a lack of resources for employee training and awareness programs can result in employees being unaware of security best practices. This can lead to accidental data leaks, falling for phishing scams, or other security breaches caused by human error.

To mitigate these risks, it’s crucial for individuals, organizations, and governments to recognize the importance of investing in security measures and resource allocation. Proactive planning and strategic allocation of resources can help strengthen security and reduce vulnerabilities in various domains.

InfoSec books | InfoSec tools | InfoSec services

Tags: Cyber risk

Jul 25 2023

TWO SERIOUS ZERO-DAY VULNERABILITIES ALLOW HACKING IPHONE, IPAD AND MAC

Category: Smart Phone,Zero day — disc7 @ 9:38 am
Two serious zero-day vulnerabilities allow hacking iPhone, iPad and Mac

Recent news reports have brought attention to two serious zero-day vulnerabilities that pose a risk to the digital security of Apple products sold in every region of the world. Both of these vulnerabilities, which have been given the CVE identifiers CVE-2023-37450 and CVE-2023-38606, were found to be present in Apple’s WebKit browser engine and kernel component for several platforms. Both vulnerabilities have been actively exploited, which makes it imperative that quick attention be paid to these security flaws. WebKit has a security vulnerability that has been identified as CVE-2023-37450. If exploited, this vulnerability might enable malicious actors to execute arbitrary code on susceptible devices, giving them control of such devices. The attack begins when a victim visits a malicious website without their knowledge while using a device that has already been infected. The iPhone 8 and subsequent models, as well as all versions of the iPad Pro, iPad Air (3rd generation and later), iPad 5th generation and later, and iPad mini 5th generation and later, are included in the list of impacted devices. MacOS Ventura is also involved. A researcher who wishes to remain nameless discovered and reported this problem.

Apple Siri is again recording all your intimate conversation & sending them to be outsourced companies

As a direct reaction to this vulnerability, Apple has strengthened its security mechanism against it by including more checks with iOS 16.6, iPadOS 16.6, and macOS Ventura 13.5. In spite of this, the corporation continues to exercise extreme caution, admitting in its security warnings that there is evidence suggesting that this vulnerability may have been actively exploited. The business disclosed this information in security warnings that described the vulnerability. “Apple is aware of a report that this issue may have been actively exploited,” the company said.

A KERNEL ZERO-DAY BUG WITH THE IDENTIFIER CVE-2023-38606

Experts from Kaspersky discovered the second vulnerability, which was given the identifier CVE-2023-38606. If this kernel issue were exploited, it would allow attackers to “modify sensitive kernel state” on iPhones and Macs, which would give them the ability to possibly take control of these devices. The technology giant disclosed this information in security advisories explaining the vulnerability. “Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1,” the firm said.

The danger affects a broad variety of Apple products, such as the macOS Big Sur, Monterey, and Ventura operating systems, as well as all iPhone models beginning with the iPhone 6s and moving forward. All versions of the iPad Pro, iPad Air starting with the 3rd generation, iPad starting with the 5th generation, iPad mini starting with the 5th generation, and the iPod touch starting with the 7th generation are all susceptible.

Apple has strengthened its state management in response to this vulnerability, which the company discovered very quickly. On the other hand, the tech giant has issued a warning that versions of iOS that were launched prior to iOS 15.7.1 may have been vulnerable to this bug.

In order for users to defend themselves against these attacks, it is strongly recommended that they upgrade their devices to the most recent versions of iOS, iPadOS, and macOS as quickly as they can.

iOS Hacker’s Handbook

InfoSec books | InfoSec tools | InfoSec services

Tags: HACKING IPHONE, iOS Hacker's Handbook, IPAD AND MAC

Jul 24 2023

Cybersecurity measures SMBs should implement

Category: cyber security — disc7 @ 8:32 am
Cybersecurity measures SMBs should implement

Small and medium-sized businesses (SMBs) are targeted by cyberattackers as much as large companies, the 2023 Verizon Data Breach Investigations Report (DBIR) has revealed; here are some cybersecurity controls they should prioritize.

Company size does not matter to cyber attackers

SMBs often underestimate their appeal as a potential target. They assume they are “little fish” not worth the attackers’ effort and that their data holds little value. But that’s not true: their systems store sensitive information, including employee and customer data and financial information.

What’s more, they are often used to access systems at larger organizations (partners, customers or suppliers) – and as a recent Proofpoint study has shown, cybercriminals frequently target SMBs (especially through regional MSPs) as a means to breach larger agencies and organizations in the public and private sectors.

Unfortunately, SMBs typically allocate only a small fraction of their budget to strengthening their cybersecurity defenses, and are often ill-equipped to effectively combat cyber threats.

One critical factor exacerbating SMBs’ vulnerability is the shortage of dedicated security personnel; bigger organizations can offer bigger salaries to cybersecurity professionals and smaller companies can’t compete on that front.

With limited staff and expertise, SMBs face an uphill battle in defending themselves against sophisticated cyberattacks.

How can SMBs up their cybersecurity game?

But not all hope is lost.

First and foremost, the notion that cybersecurity is solely the responsibility of the IT department must be dispelled; every individual within an organization plays a vital role in minimizing the risk of cyber incidents.

The Verizon 2023 DBIR report outlines three essential cybersecurity controls that will help SMBs with limited IT and cybersecurity expertise thwart general, non-targeted attacks:

  • Security awareness and skills training – Make sure employees have the skills and knowledge to minimize general cybersecurity risks
  • Data recovery – Create data recovery practices that can restore business assets to their original, trusted state in case of attack
  • Access control management – Create processes for creating, assigning, managing and revoking access credentials and privileges for user, administrator and service accounts for enterprise assets and software.

Once essential cyber hygiene is achieved with those and after a company begins moving closer to the larger end of the SMB scale and has more resources available, it’s time to add other security controls:

  • Incident response management – Establish and sustain an incident response program for prompt attack response
  • Application software security – Identify and address vulnerabilities in internally developed, hosted, or acquired software to prevent potential harm to the company
  • Penetration testing – Test the efficacy and resilience of enterprise assets and implemented controls by simulating attackers’ actions

“Now that you’ve already looked at the Controls and prioritized them, you know what you’re most likely to be hit with and you’re working your way through to the end—your ducks are almost all in a row. You have balanced preventive and detective capabilities and are on your way to being able to not only detect when something bad has happened but also respond quickly and appropriately. You have moved from the basics of putting your plan together to implementing a road map,” Verizon’s analysts pointed out.

“A few final things to consider at this point: Are you looking at aligning with a particular compliance framework? Do you track metrics around security in your environment? Do your efforts result in ongoing improvements to your security posture, or do they just provide a point-in-time snapshot that says, ‘I was good at this moment, but then things changed’? There is quite a bit you can do when you use good information about what is happening in your organization to steer your security strategy.”

The Essential Guide to Cybersecurity for SMBs

InfoSec books | InfoSec tools | InfoSec services

Tags: Cybersecurity for SMBs, The Essential Guide to Cybersecurity for SMBs

Jul 23 2023

Citrix ADC zero-day exploitatation: CISA releases details about attack on CI organization (CVE-2023-3519)

Category: CISA,Zero day — disc7 @ 9:40 am
Citrix ADC zero-day exploitatation: CISA releases details about attack on CI organization (CVE-2023-3519)

The exploitation of the Citrix NetScaler ADC zero-day vulnerability (CVE-2023-3519) was first spotted by a critical infrastructure organization, who reported it to the Cybersecurity and Infrastructure Security Agency (CISA).

“In June 2023, threat actors exploited this vulnerability as a zero-day to drop a webshell on a critical infrastructure organization’s non-production environment NetScaler ADC appliance. The webshell enabled the actors to perform discovery on the victim’s active directory (AD) and collect and exfiltrate AD data. The actors attempted to move laterally to a domain controller but network-segmentation controls for the appliance blocked movement,” the agency shared in an advisory published on Thursday.

IoCs, IR and mitigation advice

The attack was reported to CISA and Citrix in July 2023, and Citrix announced fixes for it on July 18.

The security bulletin mentioned that “exploits of CVE-2023-3519 on unmitigated appliances have been observed,” but no additional details about the attacks or how to check whether an organizations had been a target had been publicly shared.

A list of indicators of compromise (IoCs) had been shared with select organizations, under the understanding that the info would not be widely shared (i.e., that the contents would be restricted to those organization and shared with its clients “on a need-to-know basis”).

“As we hear from the Citrix community, more and more attacked systems are being found. The first exploits have also been available for purchase on the dark web for some time,” German IT consultant Manuel Winkel said on July 19.

He shared advice on how to check whether one’s organization has been hit, and advised on what to do if the result is positive.

CISA’s advisory offers more details about the threat actor activity in the attack detected at the critical infrastructure organization, delineates attack detection methods, and offers advice on incident response if compromise is detected.

In-the-wild exploitation of CVE-2023-3519

Greynoise has created a tag to show in-the-wild probing of internet-facing NetScaler ADC platforms and Gateways with authentication attempts through CVE-2023-3519, but so far there have been no detections.

Standalone and Nmap scripts for identifying vulnerable installations have been published on GitHub.

If what Winkel says is true – namely, that first exploits for CVE-2023-3519 have been available for purchase on the dark web for a while – it’s possible that there are many compromised organizations out there who didn’t manage to block the attackers’ lateral movement.

It’s currently impossible to say what the attackers’ ultimate goal is, but affected organizations may discover it soon if they don’t react quickly.

UPDATE (July 22, 2023, 10:55 a.m. ET):

Technical analyses of the flaw are now public and threat actors could use them to create a reliable exploit soon. Patch quickly!

Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon


InfoSec books | InfoSec tools | InfoSec services

Tags: Citrix ADC, Countdown to Zero Day, CVE-2023-3519, Stuxnet, zero Day

Jul 22 2023

TOP 5 FREE CLOUD SECURITY TOOLS, THAT CAN PROTECT YOUR AWS & AZURE CLOUD DATA FROM HACKERS

Category: Cloud computing,Security Tools — disc7 @ 1:14 pm
Top 5 free cloud security tools, that can protect your AWS & Azure cloud data from hackers

The Cybersecurity and Infrastructure Security Agency (CISA) has come up with a list of free tools that businesses may use to protect themselves in cloud-based settings. According to the article published by CISA, these tools will assist incident response analysts and network defenders in mitigating, identifying, and detecting threats, known vulnerabilities, and abnormalities that occur in settings that are cloud-based or hybrid.During an attack, threat actors have generally focused their attention on servers located on the premises. However, several threat actors have been drawn in by the fast expansion of cloud migration in order to target cloud systems due to the vast number of attack vectors that are available when it comes to the cloud.

5 best free API security testing tools. Protecting your cloud CI/CD Pipeline

Organizations who do not have the essential capabilities to protect themselves against cloud-based attacks may benefit from the tools that are supplied by CISA. These technologies may assist users in securing their cloud resources from data theft, information exposure, and information theft respectively.
The Cloud Industry Security Alliance (CISA) stated that companies should use the security features supplied by Cloud Service Providers and combine them with the free tools that were recommended by the CISA in order to defend themselves from these attacks. The following is a list of the tools that the CISA provides:

  1. Cybersecurity Evaluation Tool (CSET).
  2. The SCuBAGear tool.
  3. The Untitled Goose Tool
  4. Decider Tool
  5. Memory Forensic on Cloud (JPCERT/CC) is an offering of Japan CERT.

THE CYBERSECURITY EVALUATION TOOL, ALSO KNOWN AS THE CSET.


For the purpose of assisting enterprises in the assessment of their cybersecurity posture, the CISA created this tool, which makes use of standards, guidelines, and recommendations that are widely accepted in the industry. Multiple questions about operational rules and procedures, as well as queries on the design of the system, are asked by the tool.This information is then utilized to develop a report that gives a comprehensive insight into the strengths and shortcomings of the businesses, along with suggestions to remedy them. The Cross-Sector Cyber Performance Goals (CPG) are included in the CSET version 11.5. These goals were established by the National Institute of Standards and Technology (NIST) in collaboration with the Computer Security Industry Association (CISA).

M365 SECURE CONFIGURATION BASELINE ASSESSMENT TOOL, SCUBAGEAR


SCuBAGear is a tool that was developed as a part of the SCuBA (Secure Cloud Business Applications) project. This project was started as a direct reaction to the Supply Chain hack that occurred with SolarWinds Orion Software. SCuBA is a piece of automated software that does comparisons between the Federal Civilian Executive Branch (FECB) and the M365 Secure configurations of the CISA. CISA, in conjunction with SCuBAGear, has produced a number of materials that may serve as a guide for cloud security and are of use to all types of enterprises. This tool resulted in the creation of three different documents:

SCuBA Technical Reference Architecture (TRA) — Offers fundamental building blocks for bolstering the safety of cloud storage environments. Cloud-based business apps (for SaaS models) and the security services that are used to safeguard and monitor them are both included in the purview of TRA.
The Hybrid Identity Solutions Architecture provides the best possible methods for tackling identity management in an environment that is hosted on the cloud.
M365 security configuration baseline (SCB) — offers fundamental security settings for Microsoft Defender 365, OneDrive, Azure Active Directory, Exchange Online, and other services.This application generates an HTML report that details policy deviations outlined in the M365 SCB guidelines and presents them.

UNTITLED GOOSE TOOL


The tool, which was created in collaboration with Sandia National Laboratories, is designed to assist network defenders in locating harmful behaviors in Microsoft Azure, Active Directory, and Microsoft 365. Additionally, it enables the querying, exporting, and investigating of audit logs.Organizations who do not import these sorts of logs into their Security Incident and Event Management (SIEM) platform will find this application to be quite helpful. It was designed as an alternative to the PowerShell tools that were available at the time since those tools lacked the capability to gather data for Azure, AAD, and M365.

This is a tool that Network Defenders may use to,

Extraction of cloud artifacts from Active Directory, Microsoft Azure, and Microsoft 365
The Unified Audit Logs (UAL) should have time bounding performed on them.
Collect data making use of the time-bounding feature of the MDE (Microsoft Defender Endpoint) data Decider Tool.
Incident response analysts may find it useful to map malicious actions using this tool in conjunction with the MITRE ATT&CK methodology. In addition to this, it makes their methods more accessible and offers direction for laying out their actions in the appropriate manner.

DECIDER TOOL

This tool, much like the CSET, asks a number of questions in order to give relevant user inquiries for the purpose of selecting the most effective identification technique. Users now have the ability to, given all of this information:

Export heatmaps from the ATT&CK Navigator.
Publish reports on the threat intelligence you have collected.
Determine and put into effect the appropriate preventative measures.
Prevent Exploitation
In addition, the CISA has given a link that describes how to use the Decider tool.

MEMORY FORENSIC ON CLOUD (JPCERT/CC)


It was built for constructing and analyzing the Windows Memory Image on AWS using Volatility 3, which was the reason why it was developed. In addition, Memory Forensics is necessary when it comes to the recently popular LOTL (Living-Off-the-Land) attacks, which are also known as fileless malware. 
Memory image analysis may be helpful during incident response engagements, which often call for the use of high-specification equipment, a significant amount of time, and other resources in order to adequately prepare the environment.

Practical Cloud Security: A Guide for Secure Design and Deployment

InfoSec books | InfoSec tools | InfoSec services

Tags: Free CLOUD SECURITY TOOLS, Practical Cloud Security

Jul 21 2023

12 open-source penetration testing tools you might not know about

Category: Hacking,Pen Test,Security Tools — disc7 @ 12:19 pm
12 open-source penetration testing tools you might not know about

Red Siege has developed and made available many open-source tools to help with your penetration testing work.

The company plans to continue to support the tools listed below, whether in the form of bug fixes or new features. Give them a try, they’re all available on GitHub for free.

“I find joy in writing code, turning it into a logic puzzle to create powerful software tools. The satisfaction of seeing my creations in action, like EyeWitness, brings a sense of pride and saves valuable time. Motivated by the possibility of filling a software gap, I open source my creations, hoping they’ll benefit others as they did for me,” Chris Truncer, Senior Security Consultant & Director of Training, Red Siege, told Help Net Security.

AutoFunkt

AutoFunkt is a Python script for automating the creation of serverless cloud redirectors from Cobalt Strike malleable C2 profiles.

C2concealer

C2concealer is a command line tool that generates randomized C2 malleable profiles for use in Cobalt Strike.

DigDug

Dig Dug works by appending words from a dictionary to an executable. This dictionary is appended repeatedly until the final desired size of the executable is reached. Some AV & EDR engines may measure entropy to determine if an executable is trustworthy for execution. Other vendors inspect executables for signs of null byte padding.

dumpCake

dumpCake will dump password authentication attempts to the SSH daemon. Every SSHD child process will get attached to and at the completetion of the process, the attempted passwords and connection logs will be dumped to the script.

EyeWitness

EyeWitness takes screenshots of websites, collects server header info, and identifies default credentials if possible. Saves a lot of time triaging web sites on large tests. This tool is very commonly used by penetration testers looking to sift through a long list of websites.

EDD – Enumerate Domain Data

Enumerate Domain Data is designed to be similar to PowerView but in .NET. PowerView is essentially the ultimate domain enumeration tool. This tool was largely put together by viewing implementations of different functionality across a wide range of existing projects and combining them into EDD.

GPPDeception

This script generates a groups.xml file that mimics a real GPP to create a new user on domain-joined computers. Blue teams can use this file as a honeyfile. By monitoring for access to the file, Blue Teams can detect pen testers or malicious actors scanning for GPP files containing usernames and cpasswords for lateral movment.

Just-Metadata

Just-Metadata is a tool that gathers and analyzes metadata about IP addresses. It attempts to find relationships between systems within a large dataset. It is used to gather intelligence information passively about a large number of IP addresses, and attempt to extrapolate relationships that might not otherwise be seen.

ProxmarkWrapper

ProxmarkWrapper is a wrapper around the Proxmark3 client that will send a text alert (and/or email if warranted) if a RFID card is captured.

Wappybird

Wappybird is a ultithreaded Wappalyzer CLI tool to find web technologies, with optional CSV output. You can also provide a directory and all scraped data will be saved with a subfolder per host.

WMImplant

WMImplant is a PowerShell based tool that leverages WMI to both perform actions against targeted machines, but also as the C2 channel for issuing commands and receiving results. WMImplant requires local administrator permissions on the targeted machine.

WMIOps

WMIOps is a powershell script that uses WMI to perform a variety of actions on hosts, local or remote, within a Windows environment. It’s designed primarily for use on penetration tests or red team engagements.

Security Controls Evaluation, Testing, and Assessment Handbook

InfoSec books | InfoSec tools | InfoSec services

Tags: Open source, Penetration Testing tools

« Previous Page — Next Page »