Mar 07 2023

3 simple steps to evaluate a web vulnerability scanner

Category: Web Security — DISC @ 3:38 pm

There are many web vulnerability scanners available on the market and their performance varies widely. Here we show you how you can quickly and objectively evaluate web vulnerability scanners, to help you find the best product for detecting security issues in your web applications.

Evaluating a web vulnerability scanner can be a complex task, but here are some key factors to consider:

  1. Accuracy: The most important factor to consider is the accuracy of the scanner. A good scanner should be able to detect all types of vulnerabilities accurately, without generating false positives or negatives.
  2. Coverage: The scanner should be able to scan all areas of the web application, including dynamic and static content, as well as all types of input fields, including cookies and hidden fields.
  3. Speed: The scanner should be fast and efficient, with the ability to scan large web applications quickly.
  4. Ease of use: The scanner should be easy to use, with a user-friendly interface and clear reporting of vulnerabilities.
  5. Reporting: The scanner should generate detailed reports of vulnerabilities, with clear descriptions of each vulnerability, its severity, and recommendations for remediation.
  6. Integration: The scanner should be able to integrate with other tools, such as bug tracking systems and penetration testing tools.
  7. Support: The vendor should provide good technical support and regularly update the scanner with new vulnerability signatures and features.

It’s also important to test the scanner against known vulnerabilities to see how it performs in real-world scenarios. Additionally, comparing multiple scanners against the same web application can help identify strengths and weaknesses of each scanner.

Burp Vulnerability Scanner | Bugcrowd

It’s easy – follow these 3 simple steps:

1. Choose a web app that will make testing easy

2. Select web vulnerability scanners and scan your apps

3. Determine how well the scanners performed

https://portswigger.net/burp/enterprise/resources/how-to-evaluate-a-web-vulnerability-scanner

Previous posts on Web Security

InfoSec Threats | InfoSec books | InfoSec tools | InfoSec services

Tags: web vulnerability scanner

Mar 07 2023

Diving Deeper Into Windows Event logs for Security Operation Center (SOC) – Guide

Category: Log Management,Security logs,Windows Security — DISC @ 8:13 am
Diving Deeper Into Windows Event logs for Security Operation Center (SOC) – Guide

Cyber Security operations center is protecting organizations and the sensitive business data of customers. It ensures active monitoring of valuable assets of the business with visibility, alerting and investigating threats, and a holistic approach to managing risk.

Analytics service can be an in-house or managed security service. Collecting event logs and analyzing logs with real-world attacks is the heart of the security operation center.

Events – The security operations center

Events are generated by systems that are error codes, devices generate events with success or failure to their normal function. so event logging plays an important role to detect threats. In the organization, there are multiple numbers and flavors of  Windows, Linux, firewalls, IDS, IPS, Proxy, Netflow, ODBC, AWS, Vmware, etc.

These devices usually track attackers’ footprints as logs and forward them to SIEM tools for analysis. In this article, will see how events are pushed to the log collector. To know more about windows events or event ids refer Here.

Windows Event logs

Log Collector

It’s a centralized server to receive logs from any device. Here I have deployed Snare Agent on Windows 10 machine. So we will collect windows event logs and Detect attacks on windows 10 machines attacks using Snare Agent.

The snare is SIEM(SECURITY INCIDENT AND EVENT MANAGEMENT) Solution for log collector and event analyzer in various operating systems Windows, Linux, OSX Apple, and supports database agent MSSQL events generated by Microsoft SQL Server. It supports both Enterprise and Opensource Agents.

Snare Installation

  • For Demo purposes, I have been using no credentials but it is always recommended to use strong passwords to protect logs without a leak.

Snare Web interface:-

  • By default, snare will run at Port 6161.
  • A random port can also be chosen with TCP or UDP or TLS/SSL Protocols.
  • Snare will ask for credentials to log in. Here I have given no authentication.
  • The below figure shows the snare agent install success and provides additional details on screen.

Network & File Destination Configuration

  • Our windows 10 is started sending event logs to the Snare console.
  • Snare console is running at localhost and collecting logs from a windows machine.

NOTE: Logs can be sent to a centralized server, then the centralized server push logs to SIEM (To reduce the load in SIEM this method is used), send snare logs directly to SIEM (If your SIEM is capable of good storage for a long and short-term log retention this method can be deployed), It recommended to configure your SIEM with port details of snare and test connection should be the successor to collect logs.

  • So you can change network destination IP to SIEM IP or LOG COLLECTOR IP.
  • Above figure shows destination is configured with localhost to collect and store event logs in various format SNARE, SYSLOG, CEF (Common Event Format) or LEEF (Log Event Extended Format)
  • By default, it will be collecting logs and saving file with snare format & logs are forwarded to SIEM.

Access Configuration

  • Web server port, authentication for console access, and Web server Protocol can be easily defined according to your environment.
  • The above figure shows a configuration with Web server port 6161, Snare agent port 6262, and HTTP as web server protocol for demo purposes, It is recommended to install a certificate for secure connection to forward logs.

Objective Configuration

  • The objective includes events with different categories which can be windows Log on/Log off, access to file or directory, security policy change, system restart, and shutdown.
  • Modify or delete specific events to assign a priority(Critical, High, Low & Information)

Audit Service Statistics

  • Audit Service ensures snare is connected and sends logs to SIEM.
  • It shows daily average bytes of events transmitted to SIEM.
  • In case of network failures, Soc Administrator can check the status of the service.

Security Certification – The security operations center

  • To make connection encrypted and generate a self-signed certificate to WEB-UI, snare agent, and network destination certificate validation to establish a secure way of forwarding logs to SIEM.
Security operations center

Restart-Service

  • If SIEM is not collecting Event logs from the Snare agent for a while, then it’s time to troubleshoot and retrieve logs from the snare server.
  • The above figure shows Snare services are restarted successfully.

Events – The security operations center

  • Windows 10 is forwarding event logs to your deployed SIEM or events can be viewed in the snare console.
  • Every time you cannot open and lookup for intrusions to your environment with snare, for this reason, we are forwarding logs to SIEM for Intelligence to detect attacks.
  • SIEM will be Intelligent to trap attackers by building an effective correlation rule.
  • Above pictures with Event Ids 4625 which is failed password attempt to Windows 10 machine followed by Successful 4689 Event.
  • List of Windows Event Ids Here

NOTE: Above figures shows failed attempts followed by a successful login.

Correlation rule & Incidents

  • It’s an engine designed to write a defensive rule to detect offensive guys, Each rule will be a unique incident.
  • Example: Assume that you’re writing a rule for a brute-force attempt, Brute-force attempts will have continuous threads with a different passphrase to the server.
  • As per NOTE: failed attempts followed by a successful login.

Correlation Rule : failed password attempts + Followed by successful Login = Brute-force (Incident)

Now your customer environment is ready for Known use case(Brute-force detected), you can also build or write your own use case and deploy in your SIEM to detect sophisticated cyber-attacks !!!

Mastering Windows Security and Hardening: Secure and protect your Windows environment from cyber threats using zero-trust security principles

Previous posts on Security Logs

Tags: Security Operation Center

Mar 06 2023

Browser Security report reveals major online security threats

Category: Information Security,Web Security — DISC @ 12:27 pm
browser safety report 2022

LayerX has published its annual browser security report in which the company highlights the most prominent browser security risks of 2022. The report includes predictions and recommendations for 2023 as well.

The report focuses on Enterprise environments, but several of its key takeaways apply to small business and home environments as well. The browser security threats of 2022 make up the largest part of the document, but users find predictions, recommendations and an interesting monthly overview of major security events in the report as well.

The nine major threats that LayerX identified in 2022 were the following ones:

  • Phishing attacks via high reputation domains.
  • Malware distribution via file sharing systems.
  • Data leakage through personal browser profiles.
  • Outdated browsers.
  • Vulnerable passwords.
  • Unmanaged devices.
  • High-risk extensions.
  • Shadow SaaS.
  • MFA bypass with AiTM attacks.

Some of these are quite clear, others may require explanation. For phishing attacks, the researchers discovered that threat actors are hosting phishing URLs on legitimate SaaS platforms at an alarming rate. The rate of phishing attacks that use these legitimate platforms has increased by 1100% when compared to 2021, according to a Palo Alto Networks study.

LayerX conducted tests on how well browsers and network security tools protected against 1-day phishing sites. According to the test, the best performing browser had a catch rate of just 36%. Network security software blocked 48% of threats.

Similarly, malware is distributed via sanctioned services such as Google Drive and Microsoft OneDrive, to overcome blocks that may be in place for lesser known services and sites.

An analysis of data leakage in browsers concluded that 29% of users connected work browsers to personal profiles, and that 5.8% of identities were exposed in data breaches.

Outdated browsers are another threat to security, according to LayerX’s report. Ana analysis of 500 Chrome browsers revealed that a good number was either critically outdated or vulnerable to 1-day attacks.

Weak passwords and the reuse of passwords continue to be major issues. According to LayerX’s report, 29% of users use weak or medium strength passwords, and 11% of users reuse passwords regularly. The company noticed that 29% browser profiles were personal and set to sync.

Web browser extensions are another attack vector, as they “can grant excessive permissions once installed”. A recent Incogni study found that almost half of the analysed browser extensions posted either a high security or privacy risk.

The report includes an overview of browser security highlights of the year 2022. It is an interesting account that lists major security events in 2022. Some of these involved attacks, like the January 2022 video player attack that stole credit card information from over a hundred sites. Others highlight security advances, like the passwordless logins announcement by major tech companies in May, or the end of Internet Explorer in June.

The report ends with four predictions and recommendations. Predictions include that browsers will become “the main attack surface”, that attacks will “be increasingly SaaS-based and less file-based”, and that malicious web pages “will become more sophisticated”.

Closing Words

The report offers insights on the browser threat landscape of 2022, and how threats will evolve in 2023 and beyond. While most of it is aimed at Enterprise and large business environments, it may still be of interest to home users and small businesses alike.

The recommendations focus on SaaS and Enterprise-grade protections, but all users may use the listed threats to improve security. For example, outdated browsers may be updated more frequently, and weak or reused passwords may be replaced with unique strong passwords.

The report is available for download here, but a short form needs to be filled out before the download link is made available.

Source:

https://www.ghacks.net/2023/03/05/browser-security-report-reveals-major-online-security-threats/

Previous posts on Web Security

InfoSec Threats | InfoSec books | InfoSec tools | InfoSec services

Web App Security

Tags: browser security

Mar 06 2023

Five Factors That Turn CISOs into Firefighters

Category: CISO,vCISO — DISC @ 10:30 am

Chief information security officers (CISOs) are senior-level executives responsible for overseeing an organization’s information security strategy and operations. They are responsible for identifying, evaluating and mitigating security risks and ensuring the organization’s information assets are protected from cyber threats and attacks.

CISOs play a critical role in protecting an organization’s valuable information assets. As such, they must possess a strong understanding of the latest threats and technologies in the cybersecurity landscape. They must also have strong leadership and communication skills and the ability to work effectively with other organizational executives and stakeholders. But why are they often forced to also play the role of firefighter?

When a CISO is referred to as a “firefighter,” it typically means that they are spending a significant amount of time responding to security incidents and putting out fires rather than being able to focus on proactively preventing those incidents from occurring in the first place. Here are some reasons why a CISO may become a firefighter:
 
1. Lack of resources: A CISO may not have sufficient resources (e.g., budget, staff, or technology) to implement a comprehensive cybersecurity program effectively. This can lead to security incidents that require a reactive response.

2. Insufficient risk management: A CISO may not have a robust risk management program in place, which means that security incidents are more likely to occur. Without proper risk management, a CISO may be caught off guard by security incidents and have to react quickly to mitigate the damage.

3. Lack of security awareness: Employees may not be properly trained on cybersecurity best practices, which can lead to security incidents such as phishing attacks or malware infections. When employees are unaware of the risks, they may inadvertently engage in behaviors that put the organization at risk.

4. Rapidly evolving threat landscape: Cyberthreats constantly evolve, so a CISO must be vigilant and adapt to new threats. If a CISO is not proactive in staying up-to-date with the latest threats, they may be caught off guard when a new threat emerges.

5. Organizational culture: The organizational culture may not prioritize cybersecurity, making it difficult for a CISO to implement a comprehensive cybersecurity program. If the organization does not prioritize cybersecurity, it may not allocate sufficient resources to the CISO to effectively prevent security incidents.
 
To avoid being a firefighter, a CISO must take proactive measures to prevent security incidents from occurring. This includes implementing a comprehensive cybersecurity program, conducting regular risk assessments and educating employees on cybersecurity best practices. By taking a proactive approach, a CISO can reduce the likelihood of security incidents and spend less time reacting to them.

It is important to note that being a firefighter is not necessarily negative, as incident response is a critical component of a comprehensive cybersecurity strategy. While it is important for CISOs to be proactive in identifying and mitigating potential threats, it is also crucial for them to respond quickly and effectively when incidents occur.

Ideally, CISOs should be able to balance their time between proactive prevention efforts and reactive incident response. This requires having a comprehensive security program in place, including technical controls, policies, procedures and employee training programs. By taking a holistic approach to cybersecurity, CISOs can work to reduce the number and severity of security incidents they need to respond to and shift their focus more towards proactive prevention.

Source:

https://www.isaca.org/resources/news-and-trends/isaca-now-blog/2023/five-factors-that-turn-cisos-into-firefighters

Checkout our previous posts on “CISO”

InfoSec Threats | InfoSec books | InfoSec tools | InfoSec services

Tags: CISO Chief Information Security Officer

Mar 06 2023

5 BEST FREE API SECURITY TESTING TOOLS. PROTECTING YOUR CLOUD CI/CD PIPELINE

Category: API security — DISC @ 9:09 am
5 best free API security testing tools. Protecting your cloud CI/CD Pipeline

Applied Programming Interfaces (API) are an essential component of most modern programs and applications. In fact, cloud applications and mobile applications now rely heavily on APIs because they are designed to control various elements. Many large companies have hundreds or even thousands of APIs built into their infrastructure. The number of API interfaces will only increase over time. 

 It’s important to keep your website or web applications foolproof against malicious activities. What you need to do is to use some security testing tools to identify and measure the extent of security issues with your web application(s).

The primary function of security testing is to perform functional testing of a web application under observance and find as many security issues as possible that could potentially lead to hacking. All of this is done without the need to access the source code. To prevent API vulnerabilities and weaknesses, security testing is critical. API security testing ensures APIs work as designed and can only do what they are intended to. A particular tool might be the best choice for one company but not another, depending on their respective needs. Below is the list of open source API testing tools. As per cyber security course experts, although open source tools, as a rule, do not have the same support as commercial platforms, experienced developers can easily deploy them, often even for free, to increase the security level of their APIs

TAURUS

Taurus makes it possible to turn autonomous API testing programs into an ongoing testing process. At first look, the tool is easy to use. The user installs it, creates a configuration file and allows the tool to do its job. There are additional functions: the ability to create interactive reports, more complex scripts for testing their APIs, configure failure criteria to immediately begin to eliminate the problems detected.

APACHE JMETER 

Apache JMeter (it is not surprising that it was written in Java) was originally made to test the load on web applications, but recently expanded its capabilities – now it is suitable for testing the operation of any application, program or API. Its functionality allows you to test performance on both static and dynamic resources. The tool can generate a large simulated (but realistic) load of traffic so that developers can understand how their APIs will cope during load testing. Apache JMeter does not require programming skills. It can handle many different types of applications, servers and protocols, and it supports request chaining. Tests can use CSV files to generate heavy loads of realistic traffic that put APIs under pressure.

CRAPI

At the tool craPI is not the most nice name (“crap” – “sucks”), but it efficiently performs its API testing functions. This is one of the few tools that can connect to the target system and use a basic set of tests with a whole set of additional functions to study root client. As per cyber security course experts, the program can do this without the need to create any new connections. Advanced API developers will be able to save a lot of time with cRAPI .

ASTRA 

Astra mainly focuses on the transfer of a representative state (REST) of the API, which can be extremely hard because they are constantly changing. Given that the REST architecture stresses scalability when interacting between components, it can be difficult to ensure the security of the REST API over time. Astra helps solve this problem by offering integration with CI / CD-Pipeline, and by checking that the most common vulnerabilities no longer appear in the supposedly safe REST API . Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during the development cycle.

KARATE

Karate is an open source framework that combines automated API testing, performance testing and mocking into a single framework. While it is implemented in Java, it doesn’t require users to have advanced programming skills. As per cyber security course experts, test definitions can also serve as the functional documentation for the API itself. Karate can be integrated with CI/CD tools.  Additionally, tests can double as performance tests with the addition of Gatling, which verifies if server responses are as expected under load. Karate has extensive documentation, a wide range of test examples and an active user community.

Previous posts on API Security

5 Books Every API Hacker Should Read

API Security: A Complete Guide


InfoSec Threats | InfoSec books | InfoSec tools | InfoSec services

Mar 05 2023

BlackLotus UEFI bootkit disables Windows security mechanisms

Category: Windows Security — DISC @ 7:27 am
BlackLotus UEFI bootkit disables Windows security mechanisms

ESET researchers have published the first analysis of a UEFI bootkit capable of circumventing UEFI Secure Boot, a critical platform security feature. The functionality of the bootkit and its features make researchers believe that it is a threat known as BlackLotus.

UEFI bootkit Windows

BlackLotus investigation

This UEFI bootkit has been sold on hacking forums for $5,000 since at least October 2022. IT can run even on fully up-to-date Windows 11 systems with UEFI Secure Boot enabled.

“Our investigation started with a few hits on what turned out to be (with a high level of confidence) the BlackLotus user-mode component — an HTTP downloader — in our telemetry late in 2022. After an initial assessment, code patterns found in the samples brought us to the discovery of six BlackLotus installers. This allowed us to explore the whole execution chain and to realize that what we were dealing with here is not just regular malware,” says Martin Smolár, the ESET researcher who led the investigation into the bootkit.

What is this UEFI bootkit capable of?

The bootkit exploits a more than one-year-old vulnerability (CVE-2022-21894) to bypass UEFI Secure Boot and set up persistence for the bootkit. This is the first publicly known, in-the-wild abuse of this vulnerability. Although the vulnerability was fixed in Microsoft’s January 2022 update, its exploitation is still possible as the affected, validly signed binaries have still not been added to the UEFI revocation list. BlackLotus takes advantage of this, bringing its own copies of legitimate — but vulnerable — binaries to the system in order to exploit the vulnerability.

BlackLotus can disable operating system security mechanisms such as BitLocker, HVCI, and Windows Defender. Once installed, the bootkit’s main goal is to deploy a kernel driver (which, among other things, protects the bootkit from removal) and an HTTP downloader responsible for communication with the Command and Control server and capable of loading additional user-mode or kernel-mode payloads. Interestingly, some of the BlackLotus installers ESET has analyzed do not proceed with bootkit installation if the compromised host uses locales from Armenia, Belarus, Kazakhstan, Moldova, Russia, or Ukraine.

Not many threat actors are using it yet

BlackLotus has been advertised and sold on underground forums since at least early October 2022. “We can now present evidence that the bootkit is real, and the advertisement is not merely a scam,” says Smolár. “The low number of BlackLotus samples we have been able to obtain, both from public sources and our telemetry, leads us to believe that not many threat actors have started using it yet. We are concerned that things will change rapidly should this bootkit get into the hands of crimeware groups, based on the bootkit’s easy deployment and crimeware groups’ capabilities for spreading malware using their botnets.”

UEFI bootkits pose a significant threat

Many critical vulnerabilities affecting the security of UEFI systems have been discovered in the past few years. Unfortunately, due to the complexity of the whole UEFI ecosystem and related supply-chain problems, many of these vulnerabilities have left systems vulnerable even a long time after the vulnerabilities have been fixed, or at least since we were told they had been fixed.

UEFI bootkits are very powerful threats, having full control over the operating system boot process and thus being capable of disabling various operating system security mechanisms and deploying their own kernel-mode or user-mode payloads in early boot stages. This allows them to operate very stealthily and with high privileges. So far, only a few have been discovered in the wild and publicly described.

UEFI bootkits may lose on stealthiness when compared to firmware implants — such as LoJax, the first in-the-wild UEFI firmware implant, discovered by ESET Research in 2018 — as bootkits are located on an easily accessible FAT32 disk partition. However, running as a bootloader gives them almost the same capabilities, without having to overcome multiple layers of security features protecting against firmware implants.

“The best advice, of course, is to keep your system and its security product up to date to raise the chance that a threat will be stopped right at the beginning, before it’s able to achieve pre-OS persistence,” concludes Smolár.

BlackLotus UEFI bootkit: Mitigations and remediation

ESET researchers offer the following advice:

  • It is essential to ensure that both your system and its security software are regularly updated. This increases the likelihood of thwarting a threat in its early stages, before it can establish pre-OS persistence.
  • In order to prevent the exploitation of known vulnerable UEFI binaries to bypass UEFI Secure Boot, it is necessary to revoke them in the UEFI revocation database (dbx). On Windows systems, updates to the dbx should be disseminated through Windows Updates.
  • The issue with revoking widely used Windows UEFI binaries is that it can render thousands of outdated systems, recovery images, or backups incapable of booting. As a result, revocation can often be a time-consuming process.
  • Note that revocation of the Windows applications used by BlackLotus would prevent installation of the bootkit, but as the installer would replace the victim’s bootloader with the revoked one, it could make the system unbootable. In such a scenario, the issue can be resolved by either reinstalling the operating system or recovering the ESP.
  • If the revocation would happen after BlackLotus persistence is set, the bootkit would remain functional, as it uses a legitimate shim with custom MOK key for persistence. In this case, the safest mitigation solution would be to reinstall Windows and remove the attackers’ enrolled MOK key by using the mokutil utility (physical presence is required to perform this operation due to necessary user interaction with the MOK Manager during the boot).

Tags: BlackLotus UEFI bootkit

Mar 03 2023

Blue Team Tools

Category: Blue team,Security Tools — DISC @ 4:21 pm

Blue Team Tools – Ethical Hackers Academy

Blue-Team-Tools-Ethical-Hackers-Academy-1-1Download

Blue Team Field Manual (BTFM) (RTFM)

Previous posts on Blue Team

InfoSec Threats | InfoSec books | InfoSec tools | InfoSec services

Tags: Blue Team Field Manual, BTFM, Rtfm, security tools

Mar 03 2023

‘DECIDER’ AN OPEN-SOURCE TOOL THAT HELPS TO GENERATE MITRE ATT&CK MAPPING REPORTS

Category: Security Tools — DISC @ 11:50 am
‘Decider’ an open-source tool that helps to generate MITRE ATT&CK mapping reports

Decider is a new, free tool that was launched today by CISA. It is designed to assist the cybersecurity community in mapping the behavior of threat actors to the MITRE ATT&CK framework. Through the use of guided questions, a powerful search and filter function, and a cart functionality that allows users to export results to commonly used formats, Decider helps make mapping both quick and accurate. It was developed in collaboration with the Homeland Security Systems Engineering and Development Institute (HSSEDI) and MITRE.

To get started with Decider, network defenders, analysts, and researchers may get started by viewing the video, information sheet, and blog posted by CISA. CISA strongly recommends that users of the community make use of the tool in tandem with the newly revised Best Practices for MITRE ATT&CK Mapping guidance. The MITRE ATT&CK framework is a lens that network defenders can use to analyze the behavior of adversaries, and it directly supports “robust, contextual bi-directional sharing of information to help strengthen the security of our systems, networks, and data,” as CISA Executive Assistant Director Eric Goldstein noted in his June 2021 blog post on the framework. Since it offers a standardized vocabulary for the evaluation of threat actors, the CISA strongly recommends that the cybersecurity community make use of the framework.

This revision of the best practices was made in collaboration with the Homeland Security Systems Engineering and Development InstituteTM (HSSEDI), which is a research and development facility owned by the Department of Homeland Security and run by MITRE. Since CISA first released the best practices in June 2021, the update addresses the modifications that the MITRE ATT&CK team has made to the framework as a result of those improvements. Moreover, frequent analytical biases, mapping problems, and particular ATT&CK mapping guidelines for industrial control systems are included in this version (ICS).

This tool leads users through a mapping process by asking them a series of guided questions concerning enemy behavior. The purpose of these questions is to assist users in determining the appropriate strategy, technique, or sub-technique. In addition to the application itself, users are given access to a data sheet and a short film that will acquaint them with the most important capabilities and features that Decider offers.

Previous posts on Security Tools

InfoSec Threats | InfoSec books | InfoSec tools | InfoSec services

Tags: Mitre Att&ck Mapping, Open-Source Tools

Mar 02 2023

10 Best Penetration Testing tools

Category: Pen Test,Security Tools — DISC @ 3:15 pm
Penetration Testing

Best Penetration Testing tools

Penetration testing, also known as pen testing, is a process of assessing the security of a computer system or network by simulating an attack from a malicious outsider or insider. The goal is to identify vulnerabilities and weaknesses that can be exploited by attackers to gain unauthorized access to the system.

There are many penetration testing tools available that can help security professionals and ethical hackers to perform effective tests. Here are some of the best penetration testing tools:

  1. Metasploit Framework: It is an open-source penetration testing framework that provides a range of exploits, payloads, and auxiliary modules. It is widely used by penetration testers and security professionals to identify vulnerabilities and exploit them.
  2. Nmap: It is a network exploration and security auditing tool that can be used to scan networks and identify hosts, ports, and services. It can also be used to detect operating systems and versions.
  3. Wireshark: It is a network protocol analyzer that allows you to capture and analyze network traffic. It can be used to detect and analyze network attacks and vulnerabilities.
  4. Burp Suite: It is an integrated platform for performing web application security testing. It includes a proxy server, a scanner, a spider, and other tools that can be used to identify vulnerabilities in web applications.
  5. Aircrack-ng: It is a suite of tools that can be used to crack wireless network passwords. It includes tools for capturing and analyzing network traffic, as well as tools for cracking encryption keys.
  6. John the Ripper: It is a password cracking tool that can be used to test the strength of passwords. It can be used to crack passwords for a range of operating systems and applications.
  7. SQLmap: It is an open-source penetration testing tool that can be used to test the security of SQL-based web applications. It can be used to detect and exploit SQL injection vulnerabilities.
  8. Hydra: It is a password cracking tool that can be used to test the strength of passwords for a range of protocols, including HTTP, FTP, and Telnet.
  9. Nessus: It is a vulnerability scanner that can be used to scan networks and identify vulnerabilities. It can also be used to generate reports and prioritize vulnerabilities based on their severity.
  10. OWASP Zap: The world’s most popular free web security tool, actively maintained by a dedicated international team of volunteers.
  11. Kali Linux: It is a Linux distribution that is specifically designed for penetration testing and ethical hacking. It includes a range of tools for network analysis, vulnerability testing, password cracking, and more.

Latest Pen Testing Titles

Cobalt’s Pentest as a Service (PtaaS) platform, coupled with an exclusive community of testers, delivers the real-time insights you need to remediate risk quickly and innovate securely.

Previous Pen Testing Posts

We’d love to hear from you! If you have any questions, comments, or feedback, please don’t hesitate to contact us. Our team is here to help and we’re always looking for ways to improve our services. You can reach us by email (info@deurainfosec.com), or through our website’s contact form.

InfoSec Threats | InfoSec books | InfoSec tools | InfoSec services

Tags: Penetration Testing tools

Mar 02 2023

ProtonVPN launches extensions for Chrome and Firefox browsers

Category: Email Security — DISC @ 10:54 am
ProtonVPN launches extensions for Chrome and Firefox browsers

You can now connect to ProtonVPN with just one tap of a button.

Proton VPN has launched its new browser extension for Chrome and Firefox, fulfilling one of the most sought-after features requested by its user community. This new extension provides users with a more flexible way to protect their online privacy and bypass censorship.

The Proton VPN browser extension is a standalone platform that encrypts internet traffic and browsers without needing to install Windows or Mac applications. This distribution method allows users in countries with blocked app stores to access Proton VPN.

ProtonVPN launches extensions for Chrome and Firefox browsers

With this new extension, users can easily protect their browser traffic without affecting the speeds or IP addresses of other applications on their devices. The extension can be used across multiple browsers, and each browser can be connected to a different server, allowing for up to ten simultaneous VPN connections.

In a statement, Proton VPN explained that they understand the importance of online privacy and freedom of access, and this new extension is designed to provide more options for users to protect their online activity. They also emphasized that they take user feedback seriously and strive to implement new features that cater to their needs.

The Proton VPN browser extension is available for Chromium-based browsers (such as Google Chrome, Brave, Microsoft Edge, Chromium, Opera, and Vivaldi) and Firefox-based browsers (including Firefox itself, LibreWolf, and Waterfox).

ProtonVPN

Proton VPN is a well-known and reputable VPN provider based in Switzerland that has been praised for its strong security measures and privacy protections. The company’s commitment to expanding its offerings and providing users with more control over their online privacy is a significant step forward in the fight for digital rights.

Secure email that protects your privacy

InfoSec Threats | InfoSec books | InfoSec tools | InfoSec services

Tags: Email Security, ProtonEmail, ProtonMail, ProtonVPN

Mar 02 2023

In what situations would a vCISO or CISOaaS Service be appropriate?

Category: CISO,vCISO — DISC @ 12:06 am
5 Reasons Why a Virtual CISO (vCISO) May Be Right for Your Business - Pratum

A virtual Chief Information Security Officer (vCISO) service or (CISOaaS) may be appropriate for a variety of scenarios, including:

Your clients, collaborators (partners) and some regulatory requirements anticipate the presence of an individual fulfilling the position of Chief Information Security Officer (CISO).
  1. Companies without an in-house CISO: Small and medium-sized companies may not have the budget or need for a full-time CISO. A vCISO service can provide these companies with access to a seasoned cybersecurity professional without having to hire a full-time employee.
  1. Companies experiencing rapid growth or change: Companies that are growing quickly or undergoing significant changes, such as mergers or acquisitions, may benefit from the expertise of a vCISO to help them navigate the cybersecurity implications of these changes.
  1. Companies with limited cybersecurity resources: Some companies may have an IT team but lack dedicated cybersecurity resources. A vCISO can help fill this gap by providing strategic guidance and oversight of the company’s cybersecurity program.
  1. Compliance requirements: Companies in regulated industries, such as healthcare or financial services, may require a CISO to meet regulatory requirements. A vCISO can help these companies meet compliance requirements with standards (ISO 27001) and regulations (PCI, HIPAA, NIST CSF, etc.) without having to hire a full-time CISO.
  1. Cybersecurity incident response: In the event of a cybersecurity incident, a vCISO can provide expertise and guidance to help the company respond effectively and minimize the impact of the incident.

Overall, a vCISO service can be a cost-effective way for companies to gain access to the expertise of a seasoned cybersecurity professional without having to hire a full-time employee.

CISOaaS

Organizations committed to prioritizing security encounter the difficulty of locating a Chief Information Security Officer (CISO) possessing the appropriate skills and knowledge. It becomes necessary for someone to take charge of the security and compliance strategy, but this requirement often surpasses the expertise possessed by operational IT/CIO.

What is CISOaaS?
Chief Information Security Officer-as-a-Service (CISOaaS) provides information security leadership from an appropriate pool of expertise. CISOaaS provides security guidance to senior management and drives the organization’s information security program.

Cert-In issues new guidelines for government bodies, mandates appointment of CISO
https://lnkd.in/db6PsxYQ, Read more at: https://lnkd.in/dKcdHMtP

Process:

Scoping -> Assessment (business, legal and contractual reqs) -> Gap analysis (based on stds and regulations) -> provide a roadmap to-be state -> implementation of roadmap -> Evaluation and Continual improvement (of security program)

The benefits of our CISOaaS

  • Gain access to a diverse pool of highly experienced and specialized senior cyber security professionals.
  • Rapidly access valuable resources and eliminate the necessity of retaining talent.
  • Reduce your expenses by paying solely for the necessary support, effectively minimizing costs.
  • Based on CISOaaS being engaged for four days a month annually at current prices. ($37,000 per year)
  • Based on your requirements, you can hire a vCISO 5-10 hours a week or per month. ($125 per hour)
  • Mitigate your risk by strengthening your cyber and information strategy through the implementation of a clearly defined roadmap, thereby enhancing your overall security posture.
  • Acquire valuable experience in effectively educating and presenting to board members, and non-technical senior staff across functional diverse backgrounds.
  • Leverage our independent perspective and established credibility to secure comprehensive cross-business support and successfully accomplish your information security objectives.

Collaborate with government authorities

DISC-vCISO-v3-0-1Download

Previous posts on vCISO/CISO

CISO Conversations: The Role of the vCISO

Cybersecurity: The CISO’s View

We’d love to hear from you! If you have any questions, comments, or feedback, please don’t hesitate to contact us. Our team is here to help and we’re always looking for ways to improve our services. You can reach us by email (info@deurainfosec.com), or through our website’s contact form.

InfoSec Threats | InfoSec books | InfoSec tools | InfoSec services

Tags: CISOaaS, FractionalCISO, vCISO

Mar 01 2023

Best GRC tools in 2023

Category: GRC,Security Risk Assessment — DISC @ 1:28 pm

Best GRC tools

GRC (Governance, Risk, and Compliance) online tools are designed to help organizations manage their internal processes, risk assessments, compliance, and audits. Here are some of the best GRC online tools available:

  1. ZenGRC: ZenGRC is a cloud-based GRC tool that offers risk management, compliance management, and vendor management solutions. It allows users to streamline compliance tasks, track risks, and manage third-party vendors.
  2. LogicManager: LogicManager is a GRC platform that helps businesses identify, assess, and manage risks. It offers a variety of modules, including regulatory compliance, vendor risk management, and incident management.
  3. RSA Archer: RSA Archer is an enterprise GRC platform that helps businesses manage risk, compliance, and audit processes. It offers a variety of modules, including risk management, compliance management, and policy management.
  4. SAP GRC: SAP GRC is a suite of GRC tools that helps businesses manage risk, compliance, and audit processes. It offers a variety of modules, including access control, process control, and risk management.
  5. MetricStream: MetricStream is a cloud-based GRC platform that helps businesses manage compliance, risk, and audit processes. It offers a variety of modules, including regulatory compliance, risk management, and quality management.
  6. NAVEX Global: NAVEX Global is a GRC platform that helps businesses manage compliance, risk, and ethics. It offers a variety of modules, including policy management, incident management, and third-party risk management.
  7. Compliance 360: Compliance 360 is a GRC platform that helps businesses manage compliance, risk, and audit processes. It offers a variety of modules, including risk management, compliance management, and incident management.

Each of these tools offers unique features and benefits, so it’s important to evaluate your organization’s specific needs before choosing the best GRC tool for your business.

Cybersecurity Risk and Strategy

Gain the frameworks and vocabulary to make better strategic decisions that boost your organization’s cyber resilience from top to bottom.

ISO 27001/ISO 22301 RISK ASSESSMENT TOOLKIT

InfoSec Threats | InfoSec books | InfoSec tools | InfoSec services

Tags: GRC, GRC tools

Mar 01 2023

5 open source Burp Suite penetration testing extensions you should check out

Category: Security Tools — DISC @ 11:25 am
5 open source Burp Suite penetration testing extensions you should check out

How does Burp Suite extensions help in Penetration Testing…

Burp Suite is a popular web application security testing tool that can be extended through the use of various plugins and extensions. These extensions provide additional functionality and capabilities that can assist in the penetration testing process. Here are some ways that Burp Suite extensions can help in penetration testing:

  1. Automated vulnerability scanning: Burp Suite extensions can automate the process of scanning for vulnerabilities in web applications. These extensions can identify common vulnerabilities such as SQL injection, cross-site scripting (XSS), and file inclusion vulnerabilities.
  2. Customized payloads: Some Burp Suite extensions allow for the creation of customized payloads that can be used in testing for specific vulnerabilities. These payloads can help identify vulnerabilities that may be missed by standard scanning tools.
  3. Integration with other tools: Burp Suite extensions can integrate with other tools used in the penetration testing process, such as vulnerability scanners and exploit frameworks. This integration can streamline the testing process and make it more efficient.
  4. Brute-force attacks: Burp Suite extensions can automate brute-force attacks against web applications. This can help identify weak passwords or authentication mechanisms that could be exploited by an attacker.
  5. Fuzz testing: Burp Suite extensions can perform fuzz testing to identify vulnerabilities caused by unexpected or invalid input. This can help identify vulnerabilities such as buffer overflows or other memory-related issues.

In summary, Burp Suite extensions can greatly enhance the functionality and capabilities of the tool for penetration testing. These extensions can automate tasks, provide customized payloads, integrate with other tools, and help identify vulnerabilities that may be missed by standard scanning tools.

When it comes to assessing the security of computer systems, penetration testing tools are critical for identifying vulnerabilities that attackers may exploit. Among these tools, Burp Suite stands out as one of the most popular and widely used options among security professionals and enthusiasts alike.

Here’s a collection of Burp Suite extensions to make it even better.

Burp Suite extensions

Auth Analyzer

The Auth Analyzer extension helps you find authorization bugs. Navigate through the web application as a privileged user and let the Auth Analyzer repeat your requests for any defined non-privileged user. With the possibility to define parameters, the extension is able to extract and replace parameter values automatically.

Burp Suite extensions

Autowasp

Autowasp is a Burp Suite extension that integrates Burp issues logging with the OWASP Web Security Testing Guide (WSTG) to provide a web security testing flow. This tool will guide new penetration testers to understand the best practices of web application security and automate OWASP WSTG checks.

Burp Suite extensions

Burp_bug_finder

Burp_bug_finder is a Burp Suite plugin (written in Python) that makes the discovery of web vulnerabilities accessible. This version focuses only on XSS, and error-based SQLi. There’s no need to send XSS payload either for reflected or stored payload manually. You need to browse the pages where you want to check XSS vulnerability or error-based SQL injection.

Burp Suite extensions

Nuclei

Nuclei is a simple extension that allows you to run Nuclei scanner directly from Burp Suite and transforms JSON results into the issues.

Burp Suite extensions

Pentest Mapper

Pentest Mapper is a Burp Suite extension that integrates the Burp Suite request logging with a custom application testing checklist. The extension provides a straightforward flow for application penetration testing. The extension includes functionalities allowing users to map the application flow for pentesting to analyze the application and its vulnerabilities better. The API calls from each flow can be connected with the function or flow name. The extension allows users to map or connect each flow or API to vulnerability with the custom checklist.

Burp Suite extensions

Our Previous posts on Security Tools

Burp Suite Cookbook: Practical recipes to help you master web penetration testing with Burp Suite

We’d love to hear from you! If you have any questions, comments, or feedback, please don’t hesitate to contact us. Our team is here to help and we’re always looking for ways to improve our services. You can reach us by email (info@deurainfosec.com), or through our website’s contact form.

InfoSec Threats | InfoSec books | InfoSec tools | InfoSec services

Tags: burp suite, Penetration Testing

Feb 28 2023

Transition plan from ISO 27001 2013 to ISO 27001 2022

Category: ISO 27k — DISC @ 11:10 pm

How to create a transition plan from ISO 27001 2013 to ISO 27001 2022

Transitioning from ISO 27001:2013 to ISO 27001:2022 involves updating your Information Security Management System (ISMS) to meet the new requirements specified in the latest version. Here are some steps you can take to help ensure a smooth transition:

  1. Review the changes: The first step is to familiarize yourself with the changes made in the 2022 version. Some of the key changes include a more risk-based approach, more emphasis on leadership, and greater alignment with other ISO management system standards. You can find a detailed list of changes on the ISO website.
  2. Identify gaps: Once you have reviewed the changes, identify any gaps between your current ISMS and the new requirements. This may involve reviewing your policies, procedures, and controls to ensure they align with the new standard.
  3. Develop an action plan: Based on the gaps you identified, develop an action plan to address them. This may involve updating policies and procedures, implementing new controls, or conducting additional training.
  4. Train staff: It is important to ensure that all relevant staff members are trained on the new requirements and how they impact their roles and responsibilities.
  5. Conduct internal audits: Conduct internal audits to ensure that your updated ISMS is effectively implemented and meets the new requirements.
  6. Seek certification: Once you are confident that your updated ISMS meets the new requirements, seek certification from an accredited certification body.
  7. Monitor and continually improve: Finally, monitor your ISMS and continually improve it to ensure that it remains effective and aligned with the latest best practices.

Overall, transitioning to the new version of ISO 27001 requires careful planning and execution. By following these steps, you can help ensure a successful transition and maintain the security of your organization’s information assets.

ISO 27001 2022 strategy

ISO 27001 2022 Changes

Previous posts on ISO 27k

Certified ISO 27001:2022 ISMS Transition Self-Paced Online Training Course

Detailed explanation of 11 new security controls in ISO 27001:2022

6 Pocket eBooks every ISO professional should read | ISO 27001/2 Titles

We’d love to hear from you! If you have any questions, comments, or feedback, please don’t hesitate to contact us. Our team is here to help and we’re always looking for ways to improve our services. You can reach us by email (info@deurainfosec.com), or through our website’s contact form.

Contact DISC InfoSec if you need further assistance in your ISO 27001 2022 transition Plan

InfoSec Threats | InfoSec books | InfoSec tools | InfoSec services

Tags: ISO 27001 2013, ISO 27001 2022

Feb 28 2023

Rapid7 XDR vs competitors

Category: XDR — DISC @ 2:26 pm

Rapid7 XDR (Extended Detection and Response) is a security solution designed to help organizations detect, investigate, and respond to advanced cyber threats. It offers a range of features and capabilities that differentiate it from its competitors. Here are some key differences between Rapid7 XDR and its competitors:

  1. Platform Coverage: Rapid7 XDR provides coverage across multiple platforms, including endpoints, networks, cloud environments, and SaaS applications. This comprehensive coverage allows for more effective detection and response to threats across the entire IT environment.
  2. Automated Threat Detection and Response: Rapid7 XDR uses machine learning and behavioral analytics to automate threat detection and response. This allows for faster and more accurate detection and response to threats.
  3. Integrations: Rapid7 XDR integrates with a wide range of security technologies and tools, including SIEMs, firewalls, and endpoint protection solutions. This allows for a more cohesive security ecosystem and faster threat response.
  4. User and Entity Behavior Analytics (UEBA): Rapid7 XDR includes UEBA capabilities that can detect anomalous user behavior and help prevent insider threats.
  5. Threat Intelligence: Rapid7 XDR includes threat intelligence capabilities that can provide context around threats and help identify their source and potential impact.

Some of the competitors of Rapid7 XDR include CrowdStrike, Palo Alto Networks, Symantec, McAfee, and Cisco. While these solutions may offer similar features and capabilities, the key differentiators between them will depend on the specific needs and requirements of the organization.

The 2023-2028 World Outlook for Endpoint Detection and Response Solutions

InfoSec Threats | InfoSec books | InfoSec tools | InfoSec services

Tags: Rapid7 XDR

Feb 28 2023

CISOs struggle with stress and limited resources

Category: CISO,vCISO — DISC @ 1:10 pm

94% of CISOs report being stressed at work, with 65% admitting work-related stress issues are compromising their ability to protect their organization, according to Cynet.

CISOs struggle with stress and limited resources

Why CISO struggles with stress:

CISOs (Chief Information Security Officers) often face high levels of stress due to the nature of their role. Here are some reasons why CISOs may struggle with stress:

  1. High-stakes responsibility: CISOs are responsible for protecting their organization’s sensitive information and ensuring that the organization’s systems and data are secure from cyber threats. The stakes are high, as a breach could have severe financial, legal, and reputational consequences for the organization. This level of responsibility can create significant stress for CISOs.
  2. Constantly evolving threats: Cyber threats are constantly evolving, which means that CISOs need to stay up-to-date with the latest security trends and technologies. This can be challenging and stressful, as they need to stay one step ahead of cybercriminals.
  3. Budget constraints: CISOs often struggle with limited budgets for their security programs, which can create stress as they need to make tough decisions about where to allocate resources and how to prioritize their security efforts.
  4. Talent shortages: There is a shortage of skilled cybersecurity professionals, which means that CISOs often struggle to find and retain talented staff. This can create stress as they need to find ways to manage their workload and keep their security programs running effectively.
  5. Balancing business needs and security: CISOs need to balance the needs of the business with the need for security, which can create stress as they need to find ways to enable business initiatives while still maintaining a secure environment.

All of these factors can contribute to the high levels of stress that CISOs often experience. To cope with this stress, CISOs may need to develop strong coping strategies such as seeking support from colleagues, practicing self-care, and prioritizing their workload. Additionally, organizations can help by providing their CISOs with adequate resources and support to help them manage their responsibilities effectively.

drown

Among the CISOs surveyed, 100% said they needed additional resources to adequately cope with current IT security challenges.

Stress issues

The lack of bandwidth and resources is not only impacting CISOs, but their teams as well. According to the report, 74% say they are losing team members because of work-related stress issues, with 47% of these CISOs having more than one team member exit their role over the last 12 months.

Relentless stress levels are also affecting recruitment efforts with 83% of CISOs admitting they have had to compromise on the staff they hire to fill gaps left by employees who have quit their job. More than a third of the CISOs surveyed said they are either actively looking for or considering a new role.

“The results from our mental health survey are devastating but it’s not all doom and gloom. Our research found that CISOs know exactly what they need to reduce stress levels: more automated tools to manage repetitive tasks, better training, and the ability to outsource some work responsibilities,” said Eyal Gruner, CEO, Cynet.

“One of the most eye-opening insights from the report was the fact that more than 50% of the CISOs we surveyed said consolidating multiple security technologies on a single platform would decrease their work-related stress levels,” Gruner added.

Key findings from the report include:

  • 77% of CISOs believe that their limited bandwidth and lack of resources has led to important security initiatives falling to the wayside, with 79% of these CISOs claiming they have received complaints from board members, colleagues or employees that security tasks are not being handled effectively.
  • 93% of CISOs believe they are spending too much time on tactical tasks instead of performing strategic, high-value work and management responsibilities. Among the CISOs who believe they are overly invested in tactical tasks, more than a quarter report spending their workday almost exclusively on tactical/operational tasks.
  • 84% of CISOs say they have had to cancel a vacation due to an urgent work matter and 64% report they’ve missed a private event because of work fatigue. More than 90% consistently work 40+ hours per week with no break.

The impact of work-related stress on everyday life

The major takeaway from the survey is that CISOs – and their teams – are suffering from overwhelming amounts of stress and it’s affecting everything from the security of their company to their day-to-day work routines and, ultimately, their life outside of work.

In fact, 77% of CISOs said that work-related stress was directly impacting their physical health, mental health, and sleep patterns.

The company surveyed chief information security officers (CISO) at small to midsize businesses with security teams of five employees or less to better understand their levels of work-related stress and how their mental health is impacting their work life and personal life.

To find out how you can reverse rising CISO work stress levels and better protect your business, download Cynet’s full report now: 2023 Implications of Stress on CISOs 2023 Survey.

Previous posts on CISO

Cybersecurity: The CISO’s View

InfoSec Threats | InfoSec books | InfoSec tools | InfoSec services

Tags: Chief Information Security Officer, CISO

Feb 28 2023

HACKERS HAD CONTROL OF DOW JONES, FOX NEWS, THE SUN, AND MARKETWATCH COMPANIES NETWORKS FOR 2 YEARS

Category: Data Breach,data security — DISC @ 9:44 am
Hackers had control of Dow Jones, FOX News, The Sun, and MarketWatch companies networks for 2 years

it is not uncommon for large organizations to face cyber attacks or data breaches, and it is important for them to have strong cybersecurity measures in place to prevent such incidents and mitigate their impact if they do occur. However, If such an incident did occur, the affected companies would likely conduct a thorough investigation and take appropriate steps to address the situation and prevent similar incidents from happening in the future.

The massive media and publishing business News Corp reported a data breach in February 2022, disclosing that its journalists had been the focus of an attack on a software supply chain. The breach revealed that the journalists had been hacked. The assets owned by News Corp. include a variety of prominent news sources, such as Dow Jones, FOX News, The Sun, and MarketWatch, amongst others. It is important to note that in March of 2019, the Dow Jones made news for disclosing a “screening list” that included critical information on terrorists, criminals, and shady enterprises. This information included names, addresses, and phone numbers. 

The leak of thirteen million data took place on the FOX News website in April of 2022. The fifty-eight terabytes’ worth of information consisted of a variety of different things, including the company’s internal documents, the personally identifiable information (PII) of its workers, and many other things. Prior to the time when the firm was made aware of the occurrence, these documents continued to be accessible to the general public.

Today, the business has disclosed new information saying that the security breach really took place in February of 2020. This indicates that the hackers were present on the network for a period of two years before being discovered. Mandiant, which is now owned by Google, was the cybersecurity company that helped News Corp. back then. Because the perpetrators had access to the system for two years before they were discovered, it is highly likely that they were able to get away with stealing more information than was initially thought. Since no one knew it had been stolen, they would not have been on heightened alert for any potential attacks during that time.

The firm disclosed in a breach notice that the threat actors responsible for the incident gained access to its email and document storage system. This system is used by a variety of News Corp companies. The impacted workers’ personal and health information was obtained; nevertheless, the corporation has said that it does not seem that the activity was centered on exploiting personal information in any way.
The Wall Street Journal, the New York Post, and its news operations in the United Kingdom were among the News Corp publications that were compromised as a result of the security hack. Names, birth dates, social security numbers, driver’s license numbers, passport numbers, information about bank accounts, as well as information on medical and health insurance, were some of the pieces of personally identifiable information that were accessed.

News Corporation has indicated in the past that the assailants had links to China and were probably engaged in espionage operations to gather information for the benefit of China’s objectives.

Lawsuit: Fox News group hacked, surveilled, and stalked ex-host Andrea Tantaros

The New York Post admitted that it had been hacked in October 2022, after discovering that its website and Twitter account had been exploited to distribute inappropriate information that targeted a number of different politicians in the United States. The newspaper eventually disclosed that one of its own workers was responsible for the incident, and that individual was terminated once their role in the scandal was uncovered.

Tags: DOW JONES, FOX NEWS, THE SUN

Feb 27 2023

Researchers Share New Insights Into RIG Exploit Kit Malware’s Operations

Category: Malware — DISC @ 1:09 pm
RIG Exploit Kit

The RIG exploit kit (EK) touched an all-time high successful exploitation rate of nearly 30% in 2022, new findings reveal.

“RIG EK is a financially-motivated program that has been active since 2014,” Swiss cybersecurity company PRODAFT said in an exhaustive report shared with The Hacker News.

“Although it has yet to substantially change its exploits in its more recent activity, the type and version of the malware they distribute constantly change. The frequency of updating samples ranges from weekly to daily updates.”

Exploit kits are programs used to distribute malware to large numbers of victims by taking advantage of known security flaws in commonly-used software such as web browsers.

The fact that RIG EK runs as a service model means threat actors can financially compensate the RIG EK administrator for installing malware of their choice on victim machines. The RIG EK operators primarily employ malvertising to ensure a high infection rate and large-scale coverage.

As a result, visitors using a vulnerable version of a browser to access an actor-controlled web page or a compromised-but-legitimate website are redirected using malicious JavaScript code to a proxy server, which, in turn, communicates with an exploit server to deliver the appropriate browser exploit.

The exploit server, for its part, detects the user’s browser by parsing the User-Agent string and returns the exploit that “matches the pre-defined vulnerable browser versions.”

“The artful design of the Exploit Kit allows it to infect devices with little to no interaction from the end user,” the researchers said. “Meanwhile, its use of proxy servers makes infections harder to detect.”

Since arriving on the scene in 2014, RIG EK has been observed delivering a wide range of financial trojans, stealers, and ransomware such as AZORult, CryptoBit, Dridex, Raccoon Stealer, and WastedLoader. The operation was dealt a huge blow in 2017 following a coordinated action that dismantled its infrastructure.

For more details:

https://thehackernews.com/2023/02/researchers-share-new-insights-into-rig.html

Tags: Exploit Kit, Malware Analysis

Feb 27 2023

Understanding Cyber Risk Quantification: The Buyer’s Guide” by Jack Jones

Category: Risk Assessment,Security Risk Assessment — DISC @ 11:42 am

Version 2 Updated for Release – February 2023. 

From Jack Jones, Chairman of the FAIR Institute and creator of the FAIR model for cyber risk quantification (CRQ) — the definitive guide to understanding CRQ: What it is (and isn’t), its value proposition and limitations, and facts regarding the misperceptions that are commonplace. 

If you’re considering or are actively shopping for an analysis solution that treats cyber risk in financially-based business terms, Jack’s extensive, jargon-free guide — including an evaluation checklist — will give you the objective and practical advice you need.

And just in time. There’s never been more interest or, frankly, confusion in the marketplace over what exactly is cyber risk quantification. As you’ll read in this buyer guide, many solutions may count vulnerabilities, provide ordinal values, or deliver numeric “maturity” scores but don’t measure risk, let alone put a financial value on it to help make business decisions.

This paper answers questions such as:

  • What does CRQ provide that I’m not already getting from other cyber risk-related measurements?
  • What makes CRQ reliable? Why should I believe the numbers?
  • Do I have enough data to run an analysis?

Jack also provides red flags to look out for in CRQ solutions, such as:

  • Mis-identification of risks.
  • Mis-use of control frameworks as risk measurement tools.
  • Over-simplification that can result in poorly-informed decisions, especially when performed at scale.

The ‘Understanding Cyber Risk Quantification’ guide is designed to be of use to security and risk executives, industry analysts, consultants, auditors, investors, and regulators–essentially anyone who has a stake in how well cyber risk is managed.

Download Below

DOWNLOAD NOW

Tags: CRQ, cyber risk quantification

Feb 27 2023

Hacker Claim Telecom Provider Data Including Source Code, Employee Data Stolen

Category: Data Breach,Hacking — DISC @ 11:29 am
Hacker Claim Telecom Provider Data Including Source Code, Employee Data Stolen

Telus, a Canadian national telecommunications company is looking into whether employees’ data as well as the source code for the system were stolen and then sold on a dark web marketplace.

Subsequently, the threat actor published screenshots that appear to depict the company’s payroll data and private source code repositories.

“We are investigating claims that a small amount of data related to internal Telus source code and select Telus team members’ information has appeared on the dark web,” Richard Gilhooley, director of public affairs at Telus said in an email. 

“We can confirm that to this point our investigation, which we launched as soon as we were made aware of the incident, has not identified any corporate or retail customer data.”

Source Code, Employee Data Stolen

A threat actor offered what they claimed to be TELUS’ employee list (including names and email addresses) for sale on a data breach forum on February 17.

“Today we’re selling email lists of Telus employees from a very recent breach. We have over 76k unique emails and on top of this have internal information associated with each employee scraped from Telus’ API”, the forum post says.

The post provides what looks to be a list of email addresses for Telus employees as proof. “It isn’t known if these are the current or former staff — or even real”.

Later on Tuesday, February 21, the same threat actor published a new forum post with an offer to sell TELUS’ private GitHub repositories, source code, and payroll data.

“In the repositories are the backend, frontend, middleware [information,] AWS keys, Google auth keys, Source Code, Testing Apps, Staging/Prod/testing, and more!” says the seller’s latest post.

Forum post with TELUS sample data set
The claimed TELUS data and source code are posted in a second forum post

The seller also stated that the company’s “sim-swap-api,” which is supposed to allow attackers to conduct SIM swap attacks, was included in the stolen source code.

Despite the malicious attacker calling this a “Full breach” and stating that they will sell “anything related to Telus,” it is still too soon to say whether an event actually happened at TELUS or whether a breach at a third-party vendor actually occurred.

“It’s important to note that it’s not clear whether the data being sold is real”, commented Brett Callow, a British Columbia-based threat analyst for Emsisoft. 

“If it is real, this is a potentially serious incident which exposes Telus’ employees to increased risk of phishing and social engineering and, by extension, exposes the company’s customers to risk”. 

“The alleged exposure of the private Github repositories, supposedly including a sim-swap API, represents an additional tier of potentially significant risk.”

Tags: data breach, telecom security incidents

« Previous Page — Next Page »