• Search for:
    18Sep, 2024
    4 Top Security Automation Use Cases

    With Gartner recently declaring that SOAR (security orchestration, automation, and response) is being phased out in favor of generative AI-based solutions, this article will explore in detail four key security automation use cases.

    1. Enriching Indicators of Compromise (IoCs)

    Indicators of compromise (IoCs), such as suspicious IP addresses, domains, and file hashes, are vital in identifying and responding to security incidents.

    Manually gathering information about these IoCs from various sources can be labor-intensive and slow down the response process.

    Automating the enrichment of IoCs can greatly enhance the efficiency of your security operations.

    Automation workflow:

    • Extract IoCs: Automatically extract relevant IoCs from security logs or alerts using text parsing tools or other automated methods.
    • Submit IoCs to Intelligence Services: Once extracted, the IoCs are automatically submitted to various threat intelligence services, such as VirusTotal, URLScan, and AlienVault, via their APIs. These services can provide additional context, such as whether the IP address has been associated with known threats or if the domain has been flagged for suspicious activity.
    • Aggregate Results: The results from these intelligence services are aggregated into a single, comprehensive report. This step ensures that all relevant information is available in one place, making it easier for security analysts to assess the threat.
    • Deliver Enriched Data: The enriched IoC data is then delivered through communication channels like Slack, or directly added to the relevant incident ticket within the security management system. This ensures that all necessary information is immediately accessible to those who need it.

    2. Monitoring Your External Attack Surface

    The external attack surface of an organization includes all the external-facing assets that could potentially be exploited by attackers.

    These assets include domains, IP addresses, subdomains, exposed services, and more.

    Regular monitoring of these assets is important for identifying and mitigating potential vulnerabilities before they are exploited.

    Automation workflow:

    • Define Target Assets: Start by defining the domains and IP addresses that make up your external attack surface. These should be documented in a file that the automation system can reference.
    • Automated Reconnaissance: Use tools like Shodan to scan these assets on a weekly or monthly basis. Shodan can help identify open ports, exposed services, and other vulnerabilities.
    • Compile and De-duplicate Findings: The results from these scans are automatically compiled into a report. Any duplicate findings are removed to ensure that the report is concise and actionable.
    • Deliver Weekly Reports: The final report is delivered via email, Slack, or another preferred communication channel. This report highlights new or changed assets, potential vulnerabilities, and any redundant applications that may pose a risk.

    3. Scanning for Web Application Vulnerabilities

    Web applications are frequent targets for attackers, making regular vulnerability scans useful for maintaining security.

    Tools like OWASP ZAP and Burp Suite automate the process of identifying common vulnerabilities, including outdated software and misconfiguration.

    These scans also detect input validation vulnerabilities, helping to secure web applications.

    Automation workflow:

    • Define Web Assets: Begin by listing all the domains and IP addresses that host your organization’s web applications. These assets should be documented in a file for easy reference by the automation system.
    • Automated Vulnerability Scanning: The defined web assets are automatically sent to scanning tools like OWASP ZAP and Burp Suite. These tools perform comprehensive scans to identify vulnerabilities, including those that are commonly exploited by attackers.
    • Collect and Prioritize Results: The results from the scans are automatically collected and prioritized based on the severity of the vulnerabilities detected. Critical/severe vulnerabilities are highlighted for immediate action.
    • Deliver Results: The prioritized results are delivered to the relevant teams via Slack or as an enriched ticket within the incident management system. This ensures that the right people are notified of the vulnerabilities and can take appropriate action.

    4. Monitoring Email Addresses For Stolen Credentials

    Monitoring for compromised credentials is an important aspect of an organization’s cybersecurity strategy.

    Have I Been Pwned (HIBP) is a widely used service that aggregates data from various breaches to help individuals and organizations determine if their credentials have been compromised

    Automating the process of checking HIBP for exposed credentials can help organizations quickly identify and respond to potential security incidents.

    Automation workflow:

    • Compile User Emails and Domains: Create a list of user email addresses or domains that need to be monitored. This list should include all relevant user accounts within the organization, especially those with privileged access.
    • Query HIBP API: Automatically query the HIBP API with the compiled list of email addresses or domains. This step involves sending requests to HIBP to check if any of the email addresses have appeared in known data breaches.
    • Aggregate and Analyze Results: Collect the responses from HIBP. If any email addresses or domains are found in breach data, the details of these breaches (such as the breach source, type of exposed data, and date of the breach) are aggregated and analyzed.
    • Deliver Alerts and Reports: If compromised credentials are detected, automatically generate an alert. This alert can be sent via email, Slack, or integrated into the organization’s incident response system as a high-priority ticket. Include detailed information about the breach, such as the affected email addresses, the nature of the exposure, and recommended actions (e.g., forcing password resets).
    • Enforce Immediate Security Actions: Based on the severity of the breach, the system can automatically enforce security actions. For example, it might trigger a password reset for affected accounts, notify the users involved, and increase monitoring on accounts that were compromised.
    • Regular Scheduled Checks: Set up a schedule for regular checks against HIBP, such as weekly or monthly queries. This ensures that the organization remains aware of any new breaches that might involve their credentials and can respond promptly.

    Frequently Asked Questions

    Below we will answer some frequently asked questions about the automated workflows above and how they can help in a practical way.

    1. Don’t third-party services offer automation workflows anyway?
      Many services provide APIs that allow for automating parts of the workflow, like fetching data. However, building an end-to-end automated workflow typically requires coding and configurations. Replicating the entire workflow with scripts offers flexibility but is less powerful, as changes could break it. Leveraging available APIs with a centralized automation platform provides a stable, scalable solution.
    2. Can’t we just replicate this whole thing with bash scripts?
      Yes, it is possible to write Bash/PowerShell scripts to automate the security tasks mentioned in the article. Scripts offer flexibility that is lacking in manual processes. However, scripts require ongoing maintenance, and any changes could break the workflow. They may also lack advanced features like central management, scheduling, alerting, and reporting, which are offered by dedicated automation platforms like Blink Ops. A proper platform is more reliable and efficient for complex, long-running automation requirements.
    3. How does automating IoC enrichment help?
      Automating IoC enrichment speeds up the response process by gathering threat intelligence on indicators like IPs, domains, and file hashes from multiple sources simultaneously via APIs. This provides security teams with a single comprehensive report with the necessary context to assess threats quickly, rather than spending time manually searching different sources. It improves efficiency and situational awareness, enabling informed decisions to be made quickly.

    Ref: https://www.bleepingcomputer.com/news/security/4-top-security-automation-use-cases-a-detailed-guide/

    6Sep, 2024
    LiteSpeed Cache bug exposes 6 million WordPress sites to takeover attacks

    Yet, another critical severity vulnerability has been discovered in LiteSpeed Cache, a caching plugin speeding up user browsing on over 6 million WordPress sites.

    The flaw, tracked as CVE-2024-44000 and categorized as an unauthenticated account takeover issue, was discovered by Patchstack’s Rafie Muhammad on August 22, 2024. A fix was made available with the release of LiteSpeed Cache version 6.5.0.1.

    Debug feature writes cookies to file

    The vulnerability is tied to the plugin’s debug logging feature, which logs all HTTP response headers into a file, including the “Set-Cookie” header, when enabled.

    Those headers contain session cookies used to authenticate users, so if an attacker can steal them, they can impersonate an admin user and take complete control of the site.

    To exploit the flaw, an attacker must be able to access the debug log file in ‘/wp-content/debug.log.’ When no file access restrictions (such as .htaccess rules) have been implemented, this is possible by simply entering the correct URL.

    Of course, the attacker will only be able to steal the session cookies of users who logged in to the site while the debug feature was active, but this includes even login events from the past if the logs are kept indefinitely and not wiped periodically.

    The plugin’s vendor, LiteSpeed Technologies, addressed the problem by moving the debug log to a dedicated folder (‘/wp-content/litespeed/debug/’), randomizing log filenames, removing the option to log cookies, and adding a dummy index file for extra protection.

    Users of LiteSpeed Cache are recommended to purge all ‘debug.log’ files from their servers to delete potentially valid session cookies that could be stolen by threat actors.

    An .htaccess rule to deny direct access to the log files should also be set, as the randomized names on the new system may still be guessed through multiple attempts/brute-forcing.

    WordPress.org reports that just over 375,000 users downloaded LiteSpeed Cache yesterday, the day v6.5.0.1 was released, so the number of sites remaining vulnerable to these attacks may surpass 5.6 million.

    LiteSpeed Cache under fire

    The particular plugin has remained at the epicenter of security research lately for its massive popularity and because hackers are constantly looking for opportunities to attack websites through it.

    In May 2024, it was observed that hackers were targeting an outdated version of the plugin, impacted by an unauthenticated cross-site scripting flaw tracked as CVE-2023-40000, to create administrator users and take control of sites.

    More recently, on August 21, 2024, a critical unauthenticated privilege escalation vulnerability tracked as CVE-2024-28000 was discovered, with researchers sounding the alarm about how easy it was to exploit.

    It only took threat actors a few hours after the disclosure of the flaw before they started attacking sites en masse, with Wordfence reporting blocking nearly 50,000 attacks.

    Today, two weeks have passed since the initial disclosure, and the same portal reports 340,000 attacks in the past 24 hours.

    Ref: https://www.bleepingcomputer.com/news/security/litespeed-cache-bug-exposes-6-million-wordpress-sites-to-takeover-attacks/

    27Aug, 2024
    Google tags a tenth Chrome zero-day as exploited this year

    Today, Google revealed that it patched the tenth zero-day exploited in the wild in 2024 by attackers or security researchers during hacking contests.

    Tracked as CVE-2024-7965 and reported by a security researcher known only as TheDog, the now-patched high-severity vulnerability is caused by a bug in the compiler backend when selecting the instructions to generate for just-in-time (JIT) compilation.

    Google describes the vulnerability as an inappropriate implementation in Google Chrome’s V8 JavaScript engine that can let remote attackers exploit heap corruption via a crafted HTML page.

    This was announced in an update to a blog post where the company revealed last week that it had fixed another high-severity zero-day vulnerability (CVE-2024-7971) caused by a V8 type confusion weakness.

    “Updated on 26 August 2024 to reflect the in the wild exploitation of CVE-2024-7965 which was reported after this release,” the company said in today’s update. “Google is aware that exploits for CVE-2024-7971 and CVE-2024-7965 exist in the wild.”

    Google has fixed both zero-days in Chrome version 128.0.6613.84/.85 for Windows/macOS systems and version 128.0.6613.84 Linux users, which have been rolling out to all users in the Stable Desktop channel since Wednesday.

    Even though Chrome will automatically update when security patches are available, you can also speed up this process and apply the updates manually by going to the Chrome menu > Help > About Google Chrome, letting the update finish, and clicking the ‘Relaunch’ button to install it.

    While Google confirmed that the CVE-2024-7971 and CVE-2024-7965 vulnerabilities have been used in the wild, it has yet to share more information regarding these attacks.

    “Access to bug details and links may be kept restricted until a majority of users are updated with a fix,” Google says.

    “We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.”

    Since the start of the year, Google has patched eight other zero-days tagged as exploited in attacks or during the Pwn2Own hacking contest:

    • CVE-2024-0519: A high-severity out-of-bounds memory access weakness within the Chrome V8 JavaScript engine, allowing remote attackers to exploit heap corruption via a specially crafted HTML page, leading to unauthorized access to sensitive information.
    • CVE-2024-2887: A high-severity type confusion flaw in the WebAssembly (Wasm) standard. It could lead to remote code execution (RCE) exploits leveraging a crafted HTML page.
    • CVE-2024-2886: A use-after-free vulnerability in the WebCodecs API used by web applications to encode and decode audio and video. Remote attackers exploited it to perform arbitrary reads and writes via crafted HTML pages, leading to remote code execution.
    • CVE-2024-3159: A high-severity vulnerability caused by an out-of-bounds read in the Chrome V8 JavaScript engine. Remote attackers exploited this flaw using specially crafted HTML pages to access data beyond the allocated memory buffer, resulting in heap corruption that could be leveraged to extract sensitive information.
    • CVE-2024-4671: A high-severity use-after-free flaw in the Visuals component that handles the rendering and displaying content in the browser.
    • CVE-2024-4761: An out-of-bounds write problem in Chrome’s V8 JavaScript engine, which is responsible for executing JS code in the application.
    • CVE-2024-4947: Type confusion weakness in the Chrome V8 JavaScript engine enabling arbitrary code execution on the target device.
    • CVE-2024-5274: A type confusion Chrome’s V8 JavaScript engine that can lead to crashes, data corruption, or arbitrary code execution

    Ref: https://www.bleepingcomputer.com/news/security/google-tags-a-tenth-chrome-zero-day-as-exploited-this-year/

    19Aug, 2024
    Ransomware gang deploys new malware to kill security software

    RansomHub ransomware operators are now deploying new malware to disable Endpoint Detection and Response (EDR) security software in Bring Your Own Vulnerable Driver (BYOVD) attacks.

    Named EDRKillShifter by Sophos security researchers who discovered it during a May 2024 ransomware investigation, the malware deploys a legitimate, vulnerable driver on targeted devices to escalate privileges, disable security solutions, and take control of the system.

    This technique is very popular among various threat actors, ranging from financially motivated ransomware gangs to state-backed hacking groups.

    “During the incident in May, the threat actors – we estimate with moderate confidence that this tool is being used by multiple attackers — attempted to use EDRKillShifter to terminate Sophos protection on the targeted computer, but the tool failed,” said Sophos threat researcher Andreas Klopsch.

    “They then attempted to run the ransomware executable on the machine they controlled, but that also failed when the endpoint agent’s CryptoGuard feature was triggered.”

    While investigating, Sophos discovered two different samples, both with proof-of-concept exploits available on GitHub: one exploiting a vulnerable driver known as RentDrv2 and another exploiting a driver called ThreatFireMonitor, a component of a deprecated system-monitoring package.

    Sophos also found that EDRKillShifter can deliver various driver payloads based on the attackers’ needs and that the malware’s language property suggests it was compiled on a computer with Russian localization.

    The loader’s execution involves three steps: first, the attacker launches the EDRKillShifter binary with a password string to decrypt and execute an embedded resource named BIN in memory. This code then unpacks and executes the final payload, which drops and exploits a vulnerable, legitimate driver to escalate privileges and disable active EDR processes and services.

    “After the malware creates a new service for the driver, starts the service, and loads the driver, it enters an endless loop that continuously enumerates the running processes, terminating processes if their name appears in a hardcoded list of targets,” Klopsch added.

    “It is also worth noting that both variants exploit legitimate (though vulnerable) drivers, using proof-of-concept exploits available on Github. We suspect that the threat actors copied portions of these proofs-of-concept, modified them, and ported the code to the Go language.”

    Sophos recommends enabling tamper protection in endpoint security products, maintaining a separation between user and admin privileges to prevent attackers from loading vulnerable drivers, and keeping systems updated, given that Microsoft keeps de-certifying signed drivers known to have been misused in previous attacks.

    Last year, Sophos spotted another EDR-killing malware, dubbed AuKill, which abused a vulnerable Process Explorer driver in Medusa Locker and LockBit ransomware attacks. AuKill is similar to an open-source tool known as Backstab, which also exploits a vulnerable Process Explorer driver and has been used by the LockBit gang in at least one attack observed by Sophos X-Ops.

    Ref: https://www.bleepingcomputer.com/news/security/ransomware-gang-deploys-new-malware-to-kill-security-software/

    15Aug, 2024
    Kicking cyber security down the road can come back to bite you

    The consequences of a successful cyber attack can be disastrous. They can lead to untold operational disruption from substantial financial loss to significant reputational damage. Yet despite the clear and present danger, some businesses continue to deprioritize cyber security, with a concerning 15% failing to invest in cyber security measures. Whether this is a calculated decision or a matter of managing risk, it exposes the businesses’ data and processes to attack.

    Large corporations like Microsoft and AT&T, both of which recently experienced cyber breaches, are particularly vulnerable. These very public incidents can feed the perception that small and medium-sized businesses are unlikely to be targeted by cybercriminals. However, this does not ring true when compared to a recent government survey which showed that 45% of medium-sized businesses, and 50% of all companies in the UK, have suffered some breach or cyber attack in the past 12 months.

    For these smaller businesses, implementing simple security procedures is a strong start. Some quick market research can also highlight that engaging with the right managed services provider (MSP) can be a cost-effective way of enhancing security and reducing cyber risk. Despite this, convincing business leaders to invest in cyber defenses can be an uphill battle – even if decisions to delay only amplify the risk. Turning a blind eye could lead to devastating consequences.

    An overshadowed priority

    Despite a shared understanding of cyber threats among security leaders and the C-suite, cyber security often gets overlooked. The root of this lies in a misalignment of priorities. Immediate business concerns like revenue growth, market expansion, and customer acquisition overshadow cyber security, which has historically been viewed as a cost center, rather than a revenue driver.

    This misalignment relegates security measures to a secondary issue, to be addressed only after a breach occurs. Alarmingly, a third of security leaders only prioritize cyber security expertise after an attack has happened.

    This reactive approach to cyber security is fraught with risk. Neglecting proactive cyber security measures can lead to a raft of negative consequences, including financial repercussions. The immediate costs from a breach might include ransom payments, remediation expenses, and legal fees, while long-term impacts can involve lost business, regulatory fines, and increased insurance premiums.

    Staff retention can also take a hit following a cyber attack – over half of employees indicate they would leave companies that have suffered from a breach. They are often driven by insecurity about the company’s future or frustration over inadequate security measures, leading to higher turnover rates.

    The repercussions also extend to business relationships. Larger or partner companies, particularly those with stringent security standards, may be unwilling to engage with businesses that fail to meet their security expectations, limiting opportunities for growth and collaboration. Similarly, the same could be said for potential customers who might shy away from businesses that have suffered a breach, further isolating the business from lucrative partnerships and contracts.

    Securing buy-in

    To ensure cyber security is prioritized, it is vital to convey to the C-suite the very real implications of not mitigating cyber security risks. The most effective way to get this message across is by using business metrics to show the potential financial impact of cyber attacks.

    Presenting case studies of similar organizations that have suffered financial losses from breaches and providing relevant statistics showing the financial and reputational cost can be very powerful to enhance your pitch. It is also key to highlight the benefits that strong cyber security affords a business. This includes building customer confidence, reputational protection, regulatory compliance, and financial security.

    Starting with baseline measures can help secure initial support from the C-suite. Simple steps, such as regular software updates, staff cyber awareness training, and using Endpoint Detection & Response (EDR) tools to quickly identify threats like ransomware can substantially reduce exposure to cyberattacks.

    Even simple changes to a company’s security posture can have long-lasting effects. Many threat actors and hackers are looking for easy targets – companies with exposed vulnerabilities. For example, one of the most common breach points is overlooked or underestimated aspects like poor password security.

    Since the human factor is such a large part of attacks, regular cyber awareness training sessions for all employees help to build a foundational understanding of cyber threats and safe practices. When everyone in the organization is vigilant and informed, the overall security posture is strengthened. For password security in particular, companies can also implement multi-factor authentication tools to ensure employees accessing the network are who they say they are.

    There is a myriad of cyber security tools out there to help secure your systems. Wading through the industry jargon can be tough and is often a daunting task. Tools such as Network Detection and Response (NDR) and Security Incident and Event Management (SIEM) require teams of specialists to constantly monitor and modify settings to maximize efficiency. Achieving this in a small and medium-sized business can be difficult and expensive. This can be overcome by partnering with an MSP who can provide expert advice and technical support to deliver a comprehensive security solution to your organization.

    It is time to implement cyber security measures now

    By deprioritising cyber security, businesses are essentially deferring costs. Every organization accrues a cyber security debt, which can be managed in two ways: it can either be paid upfront through continuous support and rigorous cyber security measures, or it will inevitably be paid later, often at a much higher cost when a breach occurs.

    A proactive approach to cyber security that adopts even simple cyber security solutions can better protect businesses from the risk and cost of a breach and help them build a reputation as a secure and dependable partner.

    Investing in cyber security today is not just about avoiding future costs; it’s about ensuring the long-term success and sustainability of the business.

    Ref: Link

    14Aug, 2024
    Delta vs. CrowdStrike: The duties vendors owe to customers – or do they?

    In a potentially groundbreaking dispute, Delta Air Lines is threatening to sue CrowdStrike, a leading cybersecurity firm, for alleged negligence and breach of contract. This case brings to the forefront critical questions about the duties vendors owe to their customers in an increasingly digital world.

    As cybersecurity threats evolve, the expectations placed on vendors to safeguard sensitive data and maintain robust security measures are higher than ever, but these vendors cannot be responsible for every aspect of their customers’ environments. How can cybersecurity vendors and their customers balance these responsibilities effectively and minimize risk?

    The dispute

    At the end of July, Delta’s CEO indicated that the CrowdStrike-Microsoft event cost the airline $500M because the IT outage stranded thousands of customers and caused them to cancel more than 6,000 flights. This cost includes not only lost revenue but also “the tens of millions of dollars per day in compensation and hotels” for delays stretching over a period of six days.

    Delta states that they have no choice but to seek damages from CrowdStrike for the disruptions due to the high costs incurred by the outage. Delta expected all technology deployed in their ecosystem to be thoroughly tested before release into their mission-critical environment. Unfortunately, CrowdStrike’s testing did not identify the issue.

    Do the legal arguments hold?

    Media reports thus far indicate that Delta believes CrowdStrike was negligent, which they argue is shown by the seemingly weak initial CrowdStrike apology. Delta had to manually reset 40,000 servers to resolve the issue and took longer to bounce back to normal operations than its competitors, sparking an investigation by the US Department of Transportation’s Office of Aviation Consumer Protection. That investigation may result in additional costs for Delta on top of the reputational hits the airline has already endured.

    CrowdStrike, on the other hand, argues that Delta’s claims are meritless and emphasizes their own efforts to appropriately assist vendors with recovery from the outage, satisfying the cybersecurity company’s duty of care to its customers and vendors in the event of a systems failure. If CrowdStrike is found to be negligent in its performance of the Delta contract, a court could declare that the damage caps in its contract moot, thus entitling Delta and other similarly impacted CrowdStrike customers to a much larger financial recovery.

    It remains to be seen whether Delta will file a lawsuit, but such a case may be difficult to win, particularly if CrowdStrike can show that it reasonably fulfilled its contractual obligations. In some respects, the negligence argument is analogous to claiming that a sprinkler system provider should ensure a building can never have a fire, highlighting the unrealistic expectations sometimes placed on cybersecurity vendors.

    This event highlights the challenging dynamic for Delta and any other CrowdStrike customer seeking damages, even though the incident made it impossible for them to operate their business effectively. Incidents like these are a harsh reminder that accidents, just like cyberattacks, can have serious impacts, and customers may still be on the hook for losses.

    Responsibility includes accountability and trust

    Regardless of the allegations from Delta, CrowdStrike appears to be holding up to its responsibility as a cybersecurity vendor. For example, this past week the company released a root cause analysis of the incident detailing the lessons learned, including how they are improving their process and identifying steps to enhance resilience.

    Without question, a lot of things went wrong on July 19. This public volleying between CrowdStrike and Delta highlights the challenges for cybersecurity vendors and their customers in digital environments reliant on multiple integrations and interdependencies. To protect cybersecurity vendors and their customers effectively, both parties must hold themselves accountable and act as trustworthy partners in protecting against cyber and business continuity risks.

    4 ways to manage these risks

    Given the ever-present cyber risks and potential for downtime events that pose a serious threat to business continuity, it makes sense for companies to identify alternative ways to manage these risks.

    1. Understand how incidents like these can impact business and operations. It is now critical to fully understand how an outage could impact the business and enable internal teams to focus on impact mitigation strategies in addition to typical incident response.

    2. Know the status quo when negotiating contracts with vendors to the greatest extent possible. At the beginning of a vendor relationship, consider the impact if that vendor fails to the extent that the customer can’t deliver on its own business obligations. If Delta could have foreseen this event and its impact, they could have negotiated higher limitations of liability in the contract (although unlikely to come anywhere close to the $500M mark).

    3. Consider insurability. Based on various insurance industry estimates, it appears that insurance recovery for this event will only be a fraction of the total estimated losses. Additionally, many cyber insurance policies are designed to primarily cover malicious events, which this event was not. That said, coverage is available for losses of this type and companies should be reviewing their policies right now and seeking to amend coverage as desired.

    4. Evaluate whether it makes sense to have redundant or alternative capabilities in place in case of a vendor failure. It may turn out that entirely redundant capabilities are cost prohibitive or impractical, but by not at least considering the question and understanding the tradeoffs, the business is not fulfilling its own duty of care.

    A new shared responsibility model

    Minimizing risk requires vendors and their customers to work together. No cybersecurity vendor has control over the environments in which their solutions are deployed, but they can and must do their best to minimize the risk that their solutions, intended to protect their customers, do not cause massive IT outages.

    Customers, on the other hand, must maintain a modern IT infrastructure, stay up to date on available software patches, and be prepared for diverse risk scenarios. There is not a shared responsibility model defined for these types of relationships yet, but this may be the defining event that prompts one to emerge.

    Ref: Link

    13Aug, 2024
    Criminal IP and Maltego Collaborate to Broaden Threat Intelligence Data Search

    Criminal IP, an expanding Cyber Threat Intelligence (CTI) search engine from AI SPERA, has recently completed its technology integration with Maltego, a global all-in-one investigation platform that specializes in visualized analysis of combined cyber data.

    This collaboration integrates Criminal IP’s comprehensive database of malicious IPs, domains, and CVEs directly into Maltego’s unified user interface and adds Criminal IP to Maltego’s marketplace, Transform Hub.

    Maltego translates Criminal IP data into a visual data graph, allowing users to easily recognize relationships between each entity and associated risks by adjusting the layouts and assigning weights to them.

     Criminal IP’s C2 tag and vulnerability data visualized through Maltego

    Criminal IP-Maltego Introduces New Features: Visualizing, Tracking Cyber Threat Information

    Now through its partnership with Criminal IP, its trusted data source, and an OSINT CTI tool, Maltego users can also harness Criminal IP’s comprehensive threat intelligence search functionalities to instantly visualize data.

    New key features in Maltego allow users to visualize vulnerabilities by importing Criminal IP’s comprehensive data, including CVEs, assets’ reputation, botnets, Command & Control servers (C2), domain phishing information, and more.

    They can also track exposed personal information in banner data, such as API keys, token values, bank account numbers, and Bitcoin wallet addresses, ensuring prompt identification.

    The tool visually verifies relationships between IP addresses and domains, facilitating rapid response and effective threat tracking.

    Criminal IP’s Domain and IP data visualized through Maltego 

    Maltego: Speeding up Cyber Investigations in a Single Interface

    Maltego is an integration platform with a high impact on the field of threat intelligence and has integrations with several well-known products, including Microsoft Sentinel, IBM QRadar, and Google Maps Geocoding.

    Its existing features drastically accelerate complex cyber investigation by enabling quick preliminary OSINT investigations for digital profiling with Maltego Search as well as complex link analysis for large datasets with Maltego Graph.

    Through Maltego Evidence and Maltego Monitor, the platform enables investigators to collect, monitor, and preserve social media intelligence in real time for prosecution and public safety.

    About AI SPERA

    AI SPERA, renowned for its advanced solutions, has expanded internationally with ‘Criminal IP’ as its flagship offering. Operating in 150+ countries, ‘Criminal IP’ is backed by enterprise-grade security solutions like ‘Criminal IP ASM’ and ‘Criminal IP FDS’. Strategic partnerships with global leaders such as Cisco, VirusTotal, and Quad9 have significantly enhanced ‘Criminal IP’s capabilities. Recently, AI SPERA’s ‘Criminal IP’ has entered the marketplace of major US data warehousing platforms including Amazon Web Services (AWS), Microsoft Azure, and Snowflake, expanding its global reach for threat data.

    Ref: Link

    31Jul, 2024
    Surging data breach disruption drives costs to record highs

    Security teams are getting better at detecting and responding to breach incursions, but attackers are inflicting greater pain on organizations’ bottom lines. IBM’s recent Cost of a Data Breach Report 2024 found the global average breach hit a record $4.88 million. That’s a 10% increase from 2023 and the largest spike since the pandemic.

    While the study notes that organizations, on average, improved their time to identify and contain breaches, rising business costs drove the global average breach cost higher. Among the largest contributors were lost business costs, expenses from post-breach customer support (such as setting up help desks and credit monitoring services), and paying regulatory fines. Some 70% of the 604 organizations studied reported that their operations were either significantly or moderately disrupted.

    The new research, conducted independently by Ponemon Institute and analyzed by IBM, studied breached organizations from 16 countries and regions and across 17 industries. It also included interviews with 3,556 security and business professionals from the breached organizations. In its 19th year, the Cost of a Data Breach Report provides actionable insights and up-to-date research, making it a critical benchmark for the industry.

    While the report’s findings suggest some damages from a breach are unavoidable, they also highlight several risk areas that security teams can and should address. For instance, the findings underscore the growing importance of security AI and automation technologies for mitigating breach impacts and lowering costs associated with those breaches.

    Below are those takeaways and several others from the Cost of a Data Breach Report 2024.

    AI and automation in security most effective at reducing average costs

    More organizations are adopting AI and automation in their security operations, up 10% from the 2023 report. And most promising, the use of AI in prevention workflows had the highest impact in the study, reducing the average cost of a breach by $2.2 million, compared to organizations that didn’t deploy AI in prevention.

    Two out of three organizations in the study deployed AI and automation technologies across their security operations center. This factor may also have contributed to the overall decrease in average response times – those using AI and automation saw their time to identify and contain a breach lowered by nearly 100 days on average.

    Only 20% of organizations said they are using gen AI security tools, yet those that did saw a positive impact, with gen AI security tools shown to mitigate the average cost of a breach by more than $167,000. Read the report

    Security staffing shortages led to higher breach costs and more security investment

    Staffing shortages in security departments continued to grow, with 53% of organizations facing a high-level skills shortage, up 26% from 2023. The industry-wide skills shortage could be expensive for organizations. Those with severe staffing shortages experienced breach costs that were $1.76 million higher on average than those with low-level or no security staffing issues.

    These staffing shortages may be contributing to the increasing use of security AI and automation, which has been shown to reduce data breach costs. At the same time, staffing shortages may see some ease, as businesses reported they intend to increase security investments as a result of the breach. Organizations planned investments including threat detection and response tools like SIEM, SOAR, and EDR, according to the report. Organizations also plan to increase investments in identity access management, and data protection tools.

    These additional investments could pay off in mitigating future breach costs. More organizations in 2024 identified the breach with their own security teams and tools (42%) compared to last year (33%), and those organizations had lower than average breach costs, including nearly $1 million lower on average than breaches that were identified by the attacker, such as in an extortion attack.

    Cloud and data security issues remained prominent

    Forty percent of breaches involved data stored across multiple environments including public cloud, private cloud, and on-premise. These multi-environment breaches cost more than $5 million on average and took the longest to identify and contain (283 days), highlighting the challenge of tracking and safeguarding data, including shadow data, and data in AI workloads, which can be unencrypted.

    The types of data records stolen in these breaches underscored the growing importance of protecting an organization’s most sensitive data, including customer personal identifying information (PII) data, employee PII, and intellectual property (IP). Costs associated with customer PII and employee PII records were the highest on average.

    Customer PII was involved in more breaches than any other type of record (46% of breaches). However, IP may grow even more accessible as gen AI initiatives bring this data out in the open. With critical data becoming more dynamic and available across environments, businesses will need to assess the specific risks of each data type and their applicable security and access controls.

    What else is new in the 2024 Cost of a Data Breach Report

    Each year poses new data security challenges as threats and technologies emerge, and this report evolved to reflect these changes. New research conducted for the first time this year in the 2024 Cost of a Data Breach Report included:

    • Organizations experiencing long-term operational disruption, and the time it takes to restore data, systems, or services to their pre-breach state
    • To what extent organizations are using AI and automation in each of four areas of security operations: prevention, detection, investigation, and response
    • How long it took organizations to report the breach if they were mandated to do so
    • Whether organizations that involved law enforcement following a ransomware attack paid the ransom

    Of course, the report continues to showcase the top costliest geographies and industries, the initial causes of data breaches and their costs, and much more. Importantly, the report continues to provide recommendations from IBM experts, addressing the report findings, to help organizations understand the risks and how to mitigate the impacts and potential costs of a data breach.

    Ref: Link

    26Jul, 2024
    Researchers Claim Anyone Can Access Deleted, Private GitHub Repository Data

    Cybersecurity researchers have revealed a GitHub design flaw that allows access to deleted and private repository data. Learn how the issue, dubbed Cross Fork Object Reference (CFOR), puts sensitive information at risk and what it means for open-source security.

    Cybersecurity researchers at Truffle Security, an open-source security software company, have found that anyone can access deleted and private repository data on GitHub, and it’s available forever.

    This issue, known as Cross Fork Object Reference (CFOR), allows users to directly access commit data from another fork, including data from private and deleted forks.

    According to Truffle Security, this is not a bug, but rather an intentional design feature of GitHub’s repository architecture. This means that any code committed to a public repository may be accessible forever, even if the original repository is deleted, as long as there is at least one fork of that repository.

    The researchers demonstrated three scenarios where this issue can be exploited:

    Accessing Deleted Fork Data: When a user forks a public repository, commits code to it, and then deletes the fork, the committed code is still accessible forever. This is because GitHub stores repositories and forks in a repository network, and deleting a fork does not delete the committed data.

    Accessing Deleted Repo Data: When a public repository is deleted, GitHub reassigns the root node role to one of the downstream forks. This means that all commits from the original repository still exist and are accessible via any fork, even if the fork never synced with the original repository.

    Accessing Private Repo Data: When a private repository is open-sourced, any code committed between the time the internal fork was created and when the repository was made public is accessible on the public repository. This is because the private fork and public repository are part of the same repository network.

    To access the data, an attacker only needs to know the commit hash https://github.com/<user/org>/<repo>/commit/<commit_hash>, which can be brute-forced through GitHub’s UI or obtained through the public events API endpoint. This means that confidential data and secrets may be inadvertently exposed on an organization’s public GitHub repositories.

    Truffle Security has submitted their report titled “Anyone can Access Deleted and Private Repository Data on GitHub” to GitHub via their Vulnerability Disclosure Program, and GitHub has responded that their architecture is designed to work this way. While GitHub is transparent about their architecture, the average user may not understand the implications of this design, and the act of deletion does not necessarily mean that the data is deleted.

    Truffle Security recommends that users take steps to securely remediate leaked keys on public GitHub repositories through key rotation. They also note that secret scanning tools will need to be updated to handle these scenarios and that users should be aware that deleted data may still be accessible.

    This issue is not unique to GitHub, and other version control system products may also be affected. As the use of open-source software continues to grow, users must understand the security implications of how these systems work.

    25Jul, 2024
    Chinese SMS Phishing Group Hits iPhone Users in India Post Scam

    The notorious Chinese Smishing Triad gang, known for its SMS phishing attacks against Pakistan, the US, and European nations, has now set its sights on iPhone users in India. The group is exploiting iMessage and the government-owned India Post in a sophisticated phishing scam.

    FortiGuard Labs has revealed a sophisticated Smishing (SMS Phishing) campaign targeting users of India Post, the country’s government-operated postal system. The scam, attributed to a China-based threat actor known as the Smishing Triad, involves sending deceptive iMessages to iPhone users, claiming that a package is waiting for them at an India Post warehouse.

    The fraudulent messages often contain a short URL leading to a fake website designed to mimic the official India Post site. Victims are then prompted to provide sensitive personal information, such as their name, residential address, email ID, and phone number. In some cases, the scammers even request credit card details under the guise of a small redelivery fee.

    FortiGuard Labs’ investigation revealed that between January and July 2024, over 470 domain names were registered to impersonate India Post’s official domain. Notably, 296 of these domains were registered through a Chinese registrar, Beijing Lanhai Jiye Technology Co., Ltd., raising concerns about the intentions behind the campaign.

    The Smishing Triad has previously targeted other regions, including the US, UK, EU, UAE, KSA, and Pakistan. Their modus operandi involves using third-party email addresses, such as Hotmail, Gmail, or Yahoo, to create Apple IDs and send phishing messages via iMessage. This tactic allows the scammers to bypass traditional email security measures and reach users directly on their iPhones.

    According to Fortinet Labs’ report shared with Hackread.com ahead of its publication on Thursday, the phishing campaign is quite sophisticated and well planned. The investment in registering the malicious domain names alone exceeds USD 1500.

    Jason Soroko, Senior Vice President of Product at Sectigo, commented on the issue, stating, “The use of third-party email addresses on iMessage facilitates these attacks, highlighting a need for increased awareness and robust security measures among users to mitigate potential financial losses and data breaches.”

    Stephen Kowski, Field CTO at SlashNext Email Security+, emphasized the need for comprehensive mobile web threat protection, stating, “As smishing attacks become increasingly sophisticated, organizations must prioritize educating their users on how to identify and report suspicious messages, while also implementing robust security measures that can inspect and mitigate threats in real-time, regardless of the communication channel used.”

    To protect themselves from such scams, users are advised to be cautious of unexpected emails or messages, verify URLs before clicking on them, and avoid sharing personal information via email or messaging apps. Enabling multi-factor authentication and keeping software up to date can also help strengthen account security.

    Ref:https://hackread.com/chinese-sms-phishing-group-iphone-users-india-post-scam/