5 tips for better cloud security
This blog post is a summary of this weeks Information Security News put together by our Security Incident Response Team (SIRT). Read more
Posts
Blocking cyber attacks; Why you should understand adversary playbooks
This blog post is a summary of this weeks Information Security News put together by our Security Incident Response Team (SIRT).
It’s time to get off the treadmill: Why you should understand adversary playbooks
“Flipping the equation on known adversaries by developing and deploying controls at locations on the intrusion kill chain designed specifically for these known playbooks will increase a company’s ability to block an attack. The cybersecurity industry must collaborate to identify all know adversary playbooks and share this knowledge with each other and the public.”
Read more..
Top 5 Security links
- Scrappy ‘Silence’ Cybercrime Gang Refines Its Bank Attacks
- USB Drives shipped with Schneider Solar Products were infected with malware
- Spyware Company Exposed ‘281 Gigabytes’ of Children’s Photos Online
- Mikrotik routers pwned en masse, send network data to mysterious box
- Hacking The Hacker. Stopping a big botnet targeting USA, Canada and Italy
Security is Not a One-Person Job
“Security is not a one-person job. It can’t be accomplished with one person, it can’t be accomplished with one company,” says Walls. “So we need partners, and we need friends in the industry to work together.” No statement could better summarize what building a culture of security looks like. Learn more about how Walls and Prime Therapeutics implemented DLP to protect highly sensitive data for millions of people.
Read more..
Top 5 Security links
- New Apache Struts Vulnerability Leaves Major Websites Exposed
- Vulnerability in OpenSSH “for two decades” (no, the sky isn’t falling!)
- Intel rips up microcode security fix license that banned benchmarking
- $1.1M is Lost to Cybercrime Every Minute of Every Day
- Evolution of Android Security Updates
BF-SIRT Newsletter 2018-16
State-Sponsored Cyber Actors do State-Sponsored Cyber Actor stuff
US-CERT published a joint Technical Alert (TA) resulting from efforts between the Department of Homeland Security (DHS), the Federal Bureau of Investigation (FBI), and the United Kingdom’s National Cyber Security Centre (NCSC) providing information on the worldwide cyber exploitation of network infrastructure devices (e.g., router, switch, firewall, Network-based Intrusion Detection System (NIDS) devices) by Russian state-sponsored cyber actors. And they provide some nice concrete information that can be reacted to. The fact that this happens is not new, and there is no reason to think Russia is the only ones who does this, they are not doing anything spectacular or fancy either. Check for the indicators provided, keep calm and carry on.
In a separate note, Oracle announces 250 security fixes in quarterly patch update, Cisco published important and critical security advisories for Firepower, ASA and WebEx.
Top 5 Security links
RSA 2018 Keynote – The Five Most Dangerous New Attack Techniques
PCI Council Releases Guidelines for Cloud Compliance
Hacking charge for URL-manipulation in Canada
Drupalgeddon 2 Vulnerability Used to Infect Servers With Backdoors & Coinminers
Tech Firms Sign ‘Digital Geneva Accord’ Not to Aid Governments in Cyberwar
BF-SIRT Newsletter 2018-15
On Tuesday and Wednesday this week, Mark Zuckerberg took part of congressional hearings regarding Cambridge Analytica and privacy concerns regarding Facebook. There are multiple news outlets covering the story, and KrebsonSecurity also wrote an article about how one should not trust these type of quizzes and such may receive data about you and your friends when you do them (which is how Cambridge Analytica got a hold of information about more than 50 million users when they approved access to the app “This is your digital life”).
Facebook has since added a website that allows you to check if your information was leaked or not, and they have also added additional privacy information on what type of data you have uploaded to Facebook with regards to Contacts, Call and Text history if you allowed Messenger or Facebook on your mobile to do so.
Facebook has also updated their bug bounty program and now offers a $40,000 bounty if you find evidence of Data Leaks.a
Top 5 Security links
Finland hit by a data breach affecting over 130,000 users
Drupal CVE-2018-7600 PoC is Public
Outlook bug allowed hackers to use .rtf files to steal windows passwords
Your Windows PC can get hacked by simply visiting a website if you don’t update
PowerHammer lets hackers steal data from air-gapped computers through power lines
BF-SIRT Newsletter 2018-14
Intel tells remote keyboard users to delete app after critical bug found.
On Tuesday, Intel warned of a critical escalation of privilege vulnerability (CVE-2018-3641) in all versions of the Intel Remote Keyboard that allows a network attacker to inject keystrokes as if they were a local user.
The vulnerability received a Common Vulnerabilities and Exposure (CVE) score of 9.0 out of 10.
As part of the same advisory, Intel shared two additional Remote Keyboard vulnerabilities, both rated high. The bugs (CVE-2018-3645 and CVE-2018-3638) allow an “authorized local attacker to execute arbitrary code as a privileged user” and had CVE scores of 8.8 and 7.2, according to Intel.
An Intel spokesperson told Threatpost the product had already been scheduled for discontinuation, and the discontinuation is not related to the security advisory. Despite being discontinued, Intel still maintains a Remote Keyboard product page for the app and it is still available for download via Apple’s App Store and Google Play. According to Google Play, the app has been installed over 500,000 times.
Top 5 Security links
https://blog.cloudflare.com/announcing-1111/
https://www.elastic.co/blog/gdpr-personal-data-pseudonymization-part-1
https://krebsonsecurity.com/2018/04/secret-service-warns-of-chip-card-scheme/
https://blog.infostruction.com/2018/04/02/feodo-banking-trojan-dropper-analysis/
https://www.commondreams.org/news/2018/04/05/not-50-million-not-87-million-facebook-admits-data-most-its-2-billion-users
BF-SIRT Newsletter 2018-12
Bitcoins blockchain poisoned
Researchers from the RWTH Aachen University and Goethe University, Germany, have uncovered images and links to child pornography in cryptocurrency Bitcoin’s blockchain. The analysis found that certain content, such as illegal pornography, would render the mere possession of a blockchain illegal, with data distributed to all Bitcoin participants.
Version 7 of CIS Controls released
“CIS Controls Version 7” was released Monday by the Center for Internet Security, including steps for mapping the well-known “high-priority short list” of defensive actions to the National Institute of Standards and Technology’s framework of cybersecurity standards.
Top 5 Security links
Pirate Websites Expose Users to More Malware, Study Finds
AMD Will Release the Patches for the Recently Discovered Flaws Very Soon
Dragonfly Compromises Core Router to Attack Critical Infrastructure
Firefox Master Password System Has Been Poorly Secured for the Past 9 Years
EXCLUSIVE: ‘Lone DNC Hacker’ Guccifer 2.0 Slipped Up and Revealed He Was a Russian Intelligence Officer
BF-SIRT Newsletter 2018-11
AMD Vulnerabilities
This week, CTS-Labs sent out an advisory regarding AMD Vulnerabilities.
What’s worth noting about this is that the vulnerabilities all require local administrator access to exploit, and if an attacker already got that access it means that it’s basically game over in either case. There are also concerns that this was done in order to manipulate stock prices, and the fact that CTS-Labs only gave AMD a one day heads up before going public (instead of the regular 30 – 90 days) have set off red flags for some parties.
Top 5 Security links
Let’s have a sober look at these ‘ere annoying AMD chip security flaws
APT Hackers Infect Routers to Covertly Implant Slingshot Spying Malware
ISPs Caught Injecting Cryptocurrency Miners and Spyware In Some Countries
Pre-Installed Malware Found On 5 Million Popular Android Phones
Update Samba Servers Immediately to Patch Password Reset and DoS Vulnerabilities
BF-SIRT Newsletter 2018-10
Netflix could pwn 2020s IT security – they need only reach out and take
The container is doomed, killed by serverless. Containers are killing Virtual Machines (VM). Nobody uses bare metal servers. Oh, and tape is dead. These, and other clichés, are available for a limited time, printed on a coffee mug of your choice alongside a complimentary moon-on-a-stick for $24.99. Snark aside, what does the future of containers really look like?
- No one company is going to dominate IT security in the 2020s, but there is an empire to be built on building the very best workload wrapper money can buy.
- VMware has all components to build this puzzle piece. Unfortunately, they’re trapped in whatever hell befell Microsoft in 2005.
- Red Hat has most of the required components, but it will probably take them at least a decade to integrate all of it into systemd.
- Nobody is going to build an empire on containers, because containers are only one part of a more important puzzle piece.
- Netflix gave the world the Chaos Monkey, and then decided to build a full-scale Simian Army.
- Which vendor(s) will pull it together and dominate that niche?
Top 5 Security links
https://nakedsecurity.sophos.com/2018/03/08/smart-traffic-lights-cause-jams-when-fed-spoofed-data/
https://arstechnica.com/information-technology/2018/03/it-just-got-much-easier-to-wage-record-breaking-ddoses/
https://devco.re/blog/2018/03/06/exim-off-by-one-RCE-exploiting-CVE-2018-6789-en/
https://threatpost.com/pos-malware-found-at-160-applebees-restaurant-locations/130281/
https://www.theregister.co.uk/2018/03/08/dutch_police_detail_how_they_became_the_admins_for_hansa_dark_web_market/
BF-SIRT Newsletter 2018-09
Memcrashed – Major amplification attacks from UDP port 11211
Over last couple of days we’ve seen a big increase in an obscure amplification attack vector – using the memcached protocol, coming from UDP port 11211.
The general idea behind all amplification attacks is the same. An IP-spoofing capable attacker sends forged requests to a vulnerable UDP server. The UDP server, not knowing the request is forged, politely prepares the response. The problem happens when thousands of responses are delivered to an unsuspecting target host, overwhelming its resources – most typically the network itself.
- A discovery of a new amplification vector though, allowing very great amplification, happens rarely. This new memcached UDP DDoS is definitely in this category.
- In total we’ve seen only 5,729 unique source IPs of memcached servers. We’re expecting to see much larger attacks in future, as Shodan reports 88,000 open memcached servers
- Github DDos incident on 28 Feb 2018, they received at peaks 1.35Tbps via 126.9 million packets per second.
- Please ensure that your memcached servers are firewalled from the internet!
Top 5 Security links
https://cybersins.com/howto-resposible-disclosure-with-security-txt/
https://www.bleepingcomputer.com/news/security/23-000-users-lose-ssl-certificates-in-trustico-digicert-spat/
https://www.theregister.co.uk/2018/03/01/us_researchers_apply_spectrestyle_tricks_to_break_intels_sgx/
https://nakedsecurity.sophos.com/2018/02/28/single-sign-on-authentication-the-bug-that-let-you-logon-as-someone-else/
https://threatpost.com/bug-in-hp-remote-management-tool-leaves-servers-open-to-attack/130189