• Search for:
    30May, 2023
    What the Email Security Landscape Looks Like in 2023

    Email-based threats have become increasingly sophisticated, how is changing the Email Security Landscape?

    For over a decade, email has been a common source of cybersecurity threats. During that time, email-based threats have become increasingly sophisticated. What started as notes from Nigerian princes that needed large sums of money to help them get home has evolved into bad actors that use refined social engineering tactics to convince the receiver to unknowingly share important information. It’s not likely to stop there.

    Recently, VIPRE Security Group published their Email Security in 2023 report, where they shared insights on the development of email-based threats and how they can impact organizations. What follows is an overview of some of the key findings from the report and some of the thing’s businesses can do to protect their employees and data.

    Email Threats Are Becoming More Sophisticated

    There are a number of ways that email can be leveraged to compromise the security of an organization, but the most prominent approach is phishing. In a phishing attack, an individual receives an email from a sender that seems legitimate with a request to share information, log into a system, or click a link. In this email, the bad actor pretending to be the sender may nefariously capture the individual’s authentication details or prompt a malicious download that then compromises the system. At this point, the bad actor has access to the information they were after.

    Today, according to the Verizon 2022 Data Breach Investigation Report, phishing is one of the leading five tactics used to initiate data breaches. It’s a trend that’s growing. In 2022, email phishing attacks made up 24% of all spam emails — up from 11% in 2021. Given that phishing requires a relatively low lift for attackers, and has a fairly decent rate of return for them, it’s no surprise that there has been an increase in this trend.

    The prevalence of phishing attacks has been bolstered by a number of risk factors, including:

    • Insider threats whereby disgruntled or compromised employees leverage their position in the company to get access to certain items. They can use their corporate email and their insider knowledge to make requests to others using social engineering.
    • Domain compromise, where attackers compromise a website or newly registered domain to create seemingly legitimate communications and links.
    • Phishing-as-a-Service has emerged as a model that’s standardizing the underground economy and making it easier for bad actors to access phishing and hacking services.
    • QR code spoofing. Bad actors are starting to leverage QR codes as part of their email phishing tactics, largely because of how comfortable people got with them over the pandemic.
    • Domain warming, a process through which someone creates a positive reputation for a domain so that its emails don’t get flagged as spam. Bad actors use the domain until it starts getting blocked, and then move onto the next one.

    What Can We Expect in 2023?

    As part of their report, the team at VIPRE made three predictions for the email security landscape this year.

    #1 There will be more remote work-based attacks. Since remote work relies significantly on email as a form of communication, the statistical chance of a successful phishing attack only goes up. In addition, there is also a number of collaboration tools — like Asana, Slack, and Teams — that leverage email as a verification method, and that could be compromised.

    #2 The “as-a-Service” economy is going to keep growing. Cybercriminals are finding out that they don’t need to be technical experts to execute their campaigns anymore. Now they can hire a team to do it for them. The potential of this growing space is dangerous, and companies need to stay on their toes.

    #3 Small businesses are at risk. As bad actors opt for a more agile and efficient approach, they’re turning their attention to “easy” targets: small businesses. As large enterprises focus more on security, they are getting harder to penetrate, and smaller companies require less effort to infiltrate. This ultimately makes them more valuable to hackers.

    Being aware of the threats is an important first step, but organizations need to also be well-positioned to protect themselves from these activities.

    What Companies Can Do to Protect Themselves

    Just as the email threat landscape has evolved over the last decade, the same is true for email security. Today, companies have a wealth of options to choose from when it comes to strengthening their email security posture. These include:

    • Implementing a layered email security strategy that accounts for different types of phishing attacks and dissuades bad actors from attempting an attack.
    • Investing in behavioral-driven analytics so that they can quickly identify any red flags and respond to a behavioral anomaly before it causes any real impact.
    • Securing data in transit to avoid sensitive data being captured in email responses. This can be done using encryption.
    • Deploying email-specific security controls that go beyond traditional security methods, such as dynamic crawl abilities.
    • Protecting all endpoints by building a comprehensive security posture and reviewing all files, processes, and network activity proactively.
    • Training users to be more aware. Education is a key element in building a culture of security, so it’s vital to get employees onboard when rolling out new standards and policies.

    There’s no time like the present to get started with these strategies. Investing in best-in-class systems now will ensure that you’re keeping pace with the ongoing evolution of email threats and keeping your company protected.

    Resource : https://securityaffairs.com/146141/hacking/email-security-landscape-2023.html

    29May, 2023
    NVIDIA’s next DGX supercomputer is all about generative AI

    NVIDIA CEO Jensen Hiang made a string of announcements during his Computex keynote, including details about the company’s next DGX supercomputer. Given where the industry is clearly heading, it shouldn’t come as a surprise that the DGX GH200 is largely about helping companies develop generative AI models.

    The supercomputer uses a new NVLink Switch System to enable 256 GH200 Grace Hopper superchips to act as a single GPU (each of the chips has an Arm-based Grace CPU and an H100 Tensor Core GPU). This, according to NVIDIA, allows the DGX GH200 to deliver 1 exaflop of performance and to have 144 terabytes of shared memory. The company says that’s nearly 500 times as much memory as you’d find in a single DGX A100 system.

    For comparison, the latest ranking of the Top500 supercomputers lists Frontier at Oak Ridge National Laboratory in Tennessee as the only known exascale system, having reached a performance of nearly 1.2 exaflops on the Linmark benchmark. That’s over twice the peak performance of the second-placed system, Japan’s Fugaku.

    In effect, NVIDIA claims to have developed a supercomputer that can stand alongside the most powerful known system on the planet (Meta is building one that it claims will be the fastest AI supercomputer in the world once it’s fully built out). NVIDIA says the architecture of the DGX GH200 offers 10 times more bandwidth than the previous generation, “delivering the power of a massive AI supercomputer with the simplicity of programming a single GPU.”

    Some big names are interested in the DGX GH200. Google Cloud, Meta and Microsoft should be among the first companies to gain access to the supercomputer to test how it can handle generative AI workloads. NVIDIA says DGX GH200 supercomputers should be available by the end of 2023.

    The company is also building its own supercomputer, Helios, that combines four DGX GH200 systems. NVIDIA expects Helios to be online by the end of the year.

    Huang discussed other generative AI developments during his keynote, including one on the gaming front. NVIDIA Avatar Cloud Engine (ACE) for Games is a service developers will be able to tap into in order to create custom AI models for speech, conversation and animation. NVIDIA says ACE for Games can “give non-playable characters conversational skills so they can respond to questions with lifelike personalities that evolve.”

    Resource : https://www.engadget.com/nvidias-next-dgx-supercomputer-is-all-about-generative-ai-043053544.html

    29May, 2023
    How to turn on Google’s new AI Search Generative Experience

    For some users, Google has completely overhauled Search with AI, pushing what it calls the “Search Generative Experience.” While the experience is limited, some users have the option to turn it on now. Here’s how to turn on Search Generative Experience – SGE – and Google with AI.

    It’s easy to assume most people are used to the Google Search experience we’ve known and appreciated for years on end. While the foundation stays the same, things are starting to shift a little bit, with a Google experience that is bolstered by smarter, more contextual, and more dynamic results.

    Using the progress Google has made with AI up to this point, the company is overhauling Search with several new AI features and tools under the Search Generative Experience umbrella. That includes new AI-powered snapshots, which showcase quick, contextual results for your query or prompt. Rather than rattling off links, Google Search will develop a summary in answer to the question utilizing multiple sources – shown off to the right.

    On top of that, the SGE is meant to facilitate conversations. In effect, this means you can keep asking follow-up questions and get more information as the questions come up. This feature is a breath of fresh air in comparison to standard AI-free Search, which requires additional and alternatively worded searches. Rather than starting over, simply ask for a quick follow-up and get information that’s relevant to the entire conversation.

    Since the program is in its baby stages, there are a couple of criteria that need to be met before users can turn the feature on in Search. Users need to have signed up for Labs and be a Google One Premium (2+ TB) subscriber. These limitations are temporary, but that’s how it stands at the time of writing. Even if you’re not a subscriber, sign up for the free Labs anyway because that restriction might fall eventually.

    We have a full guide on signing up for the SGE Lab, and it takes only a couple of minutes.

    Once you’re signed up for Labs, complete the following:

    1. In Google Search – mobile or web – look for the Labs icon. Click or tap it.
    2. Look for the SGE card. Tap or click the toggle so it’s set to “on.”
    3. Hit I agree.

    Once you do that, you have access to Google’s new AI Generative Search Experience. Our breakdown of the current state of the feature is a helpful guide to using it, though the best approach is to ask natural questions that you wouldn’t normally be able to Google with much success.

    If you’re not a Google One subscriber, don’t worry. The SGE feature will likely be on its way to others who have signed up for the Lab in preview, though it might take a little time.

    Resource : https://9to5google.com/2023/05/26/turn-on-google-search-ai/

    27May, 2023
    Fake CapCut Websites Spread Information Stealers

    A malware campaign has been found impersonating the CapCut video editing tool to spread different stealers. CapCut is an official video editor, developed by ByteDance. It is popularly used as an editing tool for TikTok videos (also owned by ByteDance) and comes with several features. CapCut has over 500 million downloads on Google Play and its website receives over 30 million monthly hits, making it an attractive target for cyberattacks.

    What’s happening?

    Owing to the nationwide bans in India, Taiwan, and other countries, users are looking for alternative ways to get access to the CapCut app. The popularity of CapCut has made users look for alternative ways of getting the app. To harness this opportunity, attackers have created websites that spread malware disguised as CapCut.

    • The attackers are suspected to be using search ads, black hat SEO, and social media to advertise these malicious sites.
    • They used multiple domains, such as capcut-editor-video[.]com and capcutdownload[.]com, to deliver information stealers to victims’ systems via two different campaigns detailed below.

    Offx Stealer campaign

    The first campaign uses fake CapCut sites with a download button spreading the Offx Stealer on systems. The stealer binary uses PyInstaller and only runs on Windows 8, 10, and 11.

    • Whenever a victim runs the downloaded file, they are shown a fake error message stating that the app launch has failed. However, Offx Stealer keeps operating in the background.
    • The malware attempts to steal credentials and cookies from web browsers and targets data stored in Discord, Telegram, popular cryptocurrency wallet apps (Bytecoin, Atomic, Zcash), and remote access software (AnyDesk and UltraViewer).

    Redline Stealer campaign

    The second campaign uses fake CapCut sites delivering the ‘CapCut_Pro_Edit_Video[.]rar’ file on systems, including a batch script that executes a PowerShell script when opened.

    • The PowerShell script decompresses, decrypts, and loads the final payload – a DotNET executable and Redline Stealer. The DotNET executable bypasses the AMSI Windows security feature.
    • Additionally, the same fake CapCut site serves as a host for BatLoader.

    Resource: https://cyware.com/news/fake-capcut-websites-spread-information-stealers-7ac5436c

    27May, 2023
    Microsoft Security Copilot is a new GPT-4 AI assistant for cybersecurity

    After announcing an AI-powered Copilot assistant for Office apps, Microsoft is now turning its attention to cybersecurity. Microsoft Security Copilot is a new assistant for cybersecurity professionals, designed to help defenders identify breaches and better understand the huge amounts of signals and data available to them daily.

    Powered by OpenAI’s GPT-4 generative AI and Microsoft’s own security-specific model, Security Copilot looks like a simple prompt box like any other chatbot. You can ask “what are all the security incidents in my enterprise?” and it will summarize them. But behind the scenes, it’s making use of the 65 trillion daily signals Microsoft collects in its threat intelligence gathering and security-specific skills to let security professionals hunt down threats.

    Microsoft Security Copilot is designed to assist a security analyst’s work rather than replace it — and even includes a pinboard section for co-workers to collaborate and share information. Security professionals can use the Security Copilot to help with incident investigations or to quickly summarize events and help with reporting.

    Security Copilot accepts natural language inputs, so security professionals could ask for a summary of a particular vulnerability, feed in files, URLs, or code snippets for analysis — or ask for incident and alert information from other security tools. All prompts and responses are saved, so there’s a full audit trail for investigators.

    Results can be pinned and summarized into a shared workspace, so colleagues can all work on the same threat analysis and investigations. “This is like having individual workspaces for investigators and a shared notebook with the ability to promote things you’re working on,” says Chang Kawaguchi, an AI security architect at Microsoft, in an interview with The Verge.

    One of the most interesting aspects of Security Copilot is a prompt book feature. It’s essentially a set of steps or automations that people can bundle into a single easy-to-use button or prompt. That could involve having a shared prompt to reverse engineer a script so security researchers don’t have to wait for someone on their team to perform this type of analysis. You can even use Security Copilot to create a PowerPoint slide that outlines incidents and the attack vectors.

    Much like Bing, Microsoft is also sourcing results clearly when security researchers ask for information on the latest vulnerabilities. Microsoft is using information from the Cybersecurity and Infrastructure Security Agency, the National Institute of Standards and Technology’s vulnerability database, and Microsoft’s own threat intelligence database.

    That doesn’t mean Microsoft’s Security Copilot will always get things right, though. “We know sometimes these models get things wrong, so we’re offering the ability to make sure we have feedback,” says Kawaguchi. The feedback loop is a lot more involved than just the thumbs-up or thumbs-down found on Bing. “It’s a little more complicated than that, because there are a lot of ways it could be wrong,” explains Kawaguchi. Microsoft will let users respond with exactly what’s wrong to get a better understanding of any hallucinations.

    “I don’t think anyone can guarantee zero hallucinations, but what we are trying to do through things like exposing sources, providing feedback, and grounding this in the data from your own context is ensuring that it’s possible for folks to understand and validate the data they’re seeing,” says Kawaguchi. “In some of these examples there’s no correct answer, so having a probabilistic answer is significantly better for the organization and the individual doing the investigation.”

    While Microsoft’s Security Copilot looks like a prompt and chatbot interface like Bing, the company has limited it to just security-related queries. You won’t be able to grab the latest weather information here or ask the Security Copilot what its favorite color is. “This is very intentionally not Bing,” says Kawaguchi. “We don’t think of this as a chat experience. We really think of it as more of a notebook experience than a freeform chat or general purpose chatbot.”

    Security Copilot is the latest example of Microsoft’s big push with AI. The Microsoft 365 Copilot feels like it will forever change Office documents, and Microsoft-owned GitHub is supercharging its own Copilot into more of a chatty assistant to help developers create code. Microsoft doesn’t appear to be slowing down with its Copilot ambitions, so we’re likely to see this AI assistant technology appear throughout the company’s software and services.

    Microsoft is starting to preview this new Security Copilot with “a few customers” today, and the company doesn’t have a date in mind for rolling this out more broadly. “We’re not yet talking about timeline for general availability,” says Kawaguchi. “So much of this is about learning and learning responsibly, so we think it’s important to get it to a small group of folks and start that process of learning and to make this the best possible product and make sure we’re delivering it responsibly.”

    Resource : https://www.theverge.com/2023/3/28/23659711/microsoft-security-copilot-gpt-4-ai-tool-features?&web_view=true

    25May, 2023
    Mirai Variant V3G4 Targets 13 Vulnerabilities to Infect IoT Devices

    During the second half of 2022, a variant of the Mirai malware called V3G4 was seen targeting 13 vulnerabilities to ensnare Internet of Things (IoT) devices into a botnet, Palo Alto Networks reports.

    Following the successful exploitation of the targeted security flaws, the malware takes full control of the vulnerable devices and then abuses them to conduct various types of malicious activities, including distributed denial-of-service (DDoS) attacks.

    Starting July 2022, Mirai variant V3G4 was used in multiple attack campaigns, likely by the same threat actor, based on the used hardcoded command-and-control (C&C) domains, malware downloaders, XOR decryption key, identical functions, and a ‘stop list’.

    To compromise devices, the threat actor targets 13 remote code execution vulnerabilities that allow them to run specific utilities to download and execute the Mirai malware on the target devices.

    The targeted vulnerabilities impact FreePBX Elastix (CVE-2012-4869), Gitorious, FRITZ!Box webcams (CVE-2014-9727), Mitel AWC, Geutebruck IP cameras (CVE-2017-5173), Webmin (CVE-2019-15107), Spree Commerce, FLIR Thermal cameras, DrayTek Vigor (CVE-2020-8515 and CVE-2020-15415), Airspan AirSpot (CVE-2022-36267), Atlassian Confluence (CVE-2022-26134), and C-Data Web Management System (CVE-2022-4257).

    Following successful execution on a vulnerable device, the Mirai variant makes sure that only one instance of the malware runs, then attempts to terminate processes included in the hardcoded ‘stop list’.

    Malware samples collected over the course of three different campaigns showed slight changes in the code. While some Mirai samples spread by brute-forcing weak credentials, others also use embedded exploits, but samples seen between September and December 2022 contain none of these capabilities.

    “The vulnerabilities mentioned above have less attack complexity than previously observed variants, but they maintain a critical security impact that can lead to remote code execution. Once the attacker gains control of a vulnerable device in this manner, they could take advantage by including the newly compromised devices in their botnet to conduct further attacks such as DDoS,” Palo Alto Networks notes.

    Organizations are advised to ensure that all devices in their environments are patched against known vulnerabilities, that they are protected using strong, unique passwords, and that unused ports and services, which are often targeted by cybercriminals, are either blocked or not accessible from the internet.

    Resource : https://www.securityweek.com/mirai-variant-v3g4-targets-13-vulnerabilities-to-infect-iot-devices/

    25May, 2023
    GitLab ‘strongly recommends’ patching max severity flaw ASAP

    GitLab has released an emergency security update, version 16.0.1, to address a maximum severity (CVSS v3.1 score: 10.0) path traversal flaw tracked as CVE-2023-2825.

    GitLab is a web-based Git repository for developer teams that need to manage their code remotely and has approximately 30 million registered users and one million paying customers.

    The vulnerability addressed in the latest update was discovered by a security researcher named ‘pwnie,’ who reported the issue on the project’s HackOne bug bounty program.

    It impacts GitLab Community Edition (CE) and Enterprise Edition (EE) version 16.0.0, but all versions older than this aren’t affected.

    The flaw arises from a path traversal problem that allows an unauthenticated attacker to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups.

    The exploitation of CVE-2023-2825 could expose sensitive data, including proprietary software code, user credentials, tokens, files, and other private information.

    This prerequisite suggests that the issue relates to how GitLab manages or resolves paths for attached files nested within several levels of group hierarchy. However, due to the criticality of the problem and the freshness of its discovery, not many details were disclosed by the vendor this time.

    Instead, GitLab highlighted the importance of applying the latest security update without delay.

    “We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible,” reads GitLab’s security bulletin.

    “When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.”

    A mitigating factor is that the vulnerability can only be triggered under specific conditions, i.e., when there’s an attachment in a public project nested within at least five groups, which is not the structure followed in all GitHub projects.

    Nevertheless, all users of GitLab 16.0.0 are recommended to update to version 16.0.1 as soon as possible to mitigate the risk. Unfortunately, no workarounds are available at this time.

    Resource : https://www.bleepingcomputer.com/news/security/gitlab-strongly-recommends-patching-max-severity-flaw-asap/

    24May, 2023
    API Security Needs a Reset—with People, not Tools

    It is increasingly challenging for developers and security teams to keep the application-development process and application programming interfaces (APIs) secure. But there is no single standard for managing APIs and, thus, teams cannot rely on tools alone to solve security issues. No single product can fix every problem for every language, framework, or context of an API environment.

    So enterprises play mix-and-match. Modern organizations are fixated on tools to respond to their cyberthreat challenges—to the point of lapsing into tunnel vision that impedes progress. A 2022 report showed that large-enterprise security teams oversaw an average of 76 security tools. That’s far too many.

    The focus on security software creates a false sense of security and a failure to address underlying causes. Most data breaches are caused by human error. Our research has found that developers heavily rely upon pre-existing code, for example—with nearly one-half using libraries or frameworks with inherent flaws because they are not tested or evaluated on an ongoing basis for vulnerabilities. To wit, developers assume that because the code exists in a library, it is secure. But this is not always the case.

    That’s why we need to press the reset button. We need to stop constantly seeking the latest shiny object and start focusing more on our people. Yes, security tools have advanced impressively and serve a critical purpose. But software development teams still need to improve their security capabilities to effectively deploy these solutions. The resulting training and policy implementation should focus on the following best practices:

    Assign API Ownership

    By their very nature, APIs are over-permissioned to allow unchecked communications between applications. Frankly, they “talk too much”—leading to a state of oversharing that triggers compromises. We call this “TMI tech.”

    TMI tech persists because we rarely assign ownership of APIs (either to developers or to their app sec cohorts). Accordingly, there is rarely any meticulous monitoring of which API is sharing what.

    To rectify this, managers should assign API ownership to development teams and help them recognize the risks of wide-open (and undocumented) API implementation. When such responsibilities are covered and contextual behavioral baselines are established, it is far easier to shut down these troublesome “conversations.”

    Treat APIs Like Humans

    To extend our first best practice, we can immediately improve access control by applying zero-trust, least-privilege, and role-based authorization to APIs, just as we do with people. If an API is required to perform a specific function, then we limit its permissions to that function only. Similarly, we should further restrict APIs’ time spent accessing—and the volume accessed—as appropriate.

    Incorporate a Test-First Mentality

    Developers need to understand the pitfalls of assumption—but preferably not the hard way. As such, dev teams should regularly test APIs to verify that they are not exploitable (while still functioning as intended). Testing early and often can help reduce bugs, saving time and additional costs in the long run. Plus, security teams will appreciate it.  

    Include Scenario Simulations

    Simulations better equip developer teams to react when different API situations play out. And they seem to be exactly what developers need to improve their secure-coding skills. Research conducted by Secure Code Warrior found that more than nine out of every ten developers acknowledged needed training in security frameworks. Almost a third (30%) reported feeling that they would benefit from practical security-training sessions featuring work-relevant, real-life examples; nearly as many indicated that they would benefit from hands-on interactivity—such as practice sessions in which they attempt to write secure code.

    Change Performance-Review Metrics

    Secure development cannot be rushed. Given the clear consequences, therefore, it is time to cease placing so much emphasis during team-member evaluations on raw speed of feature delivery. Otherwise, the performance-review phase presents developers with a perverse incentive to sacrifice security (if not quality). Instead, organizations should look to reward those who can create quality, secure code within a reasonable time frame.

    A state of optimal protection remains a moving target as attack trends continue to shift rapidly. Application development and API management prove no exception. When we press the reset button to encourage a people-centric focus on secure development, backing it up with comprehensive policy implementation and best practices, we ensure that security is embedded into the development process—instead of being viewed as a roadblock to innovation.

    Keep learning

    Resource : https://techbeacon.com/security/api-security-needs-reset-people-not-tools

    24May, 2023
    5 emerging security technologies set to level the battlefield

    The war between data defenders and data thieves has been described as a cat-and-mouse game. As soon as the white hats counter one form of black-hat malicious behavior, another malevolent form rears its ugly head. How can the playing field be tilted in favor of the infosec warriors? Here are five emerging security technologies that may be able to do that.

    1. Hardware authentication

    The inadequacies of usernames and passwords are well known. Clearly, a more secure form of authentication is needed. One method is to bake authentication into a user’s hardware. Intel is moving in that direction with the Authenticate solution in its new, sixth-generation Core vPro processor. It can combine a variety of hardware-enhanced factors at the same time to validate a user’s identity.

    Intel has built on previous efforts to dedicate a portion of the chipset for security functions to make a device part of the authentication process. Good authentication requires three things from users: what they know, such as a password; who they are, such as a username; and what they have, such as a token. In the case of Authenticate, the device becomes the what-you-have.

    “This isn’t new,” said Scott Crawford, research director for information security at 451 Research. “We’ve seen this in other manifestations, such as licensing technologies and tokens.”

    Hardware authentication can be particularly important for the Internet of Things (IoT) where a network wants to ensure that the thing trying to gain access to it is something that should have access to it.

    However, Crawford noted, “The most immediate application for the technology is for authenticating an endpoint in a traditional IT environment — laptops, desktops, and mobile devices using Intel chipsets.”

    2. User-behavior analytics

    Once someone’s username and password are compromised, whoever has them can waltz onto a network and engage in all kinds of malicious behavior. That behavior can trigger a red flag to system defenders if they’re employing user behavior analytics (UBA). The technology uses big data analytics to identify anomalous behavior by a user.

    “There’s a lot of interest in this in the enterprise,” 451’s Crawford said.

    He explained that the technology addresses a blind spot in enterprise security. “Once an attacker gains entry into an enterprise, what happens then?” he asked. “One of the first things they do is compromise credentials. So then the question becomes, Can you differentiate between a legitimate user’s activity and an attacker who has gained entry, compromised a legitimate user’s credentials and is now looking for other targets?”

    Visibility into activity that does not fit the norm of the legitimate user can close a blind spot in the middle of the attack chain. “If you think of the attack chain as initial penetration, lateral movement, and then compromise, theft, and exfiltration of sensitive data, the middle links in that attack chain have not been very visible to enterprise security pros, and that’s why the interest in user behavior analytics today,” Crawford said.

    Comparing a user’s present behavior to past behavior isn’t the only way UBA can identify a malicious actor. “There’s something called ‘peer analysis’,” explained Steven Grossman, vice president for program management at Bay Dynamics, a threat analytics company. “It compares how someone is behaving compared to people with the same manager or same department. That can be an indicator that the person is doing something they shouldn’t be doing or someone else has taken over their account.”

    In addition, UBA can be a valuable tool for training employees in better security practices. “One of the biggest problems in a company is employees not following company policy,” Grossman said. “To be able to identify those people and mitigate that risk by training them properly is critical.”

    3. Data loss prevention

    A key to data loss prevention is technologies such as encryption and tokenization. They can protect data down to field and subfield level, which can benefit an enterprise in a number of ways:

    • Cyber-attackers cannot monetize data in the event of a successful breach.
    • Data can be securely moved and used across the extended enterprise — business processes and analytics can be performed on the data in its protected form, dramatically reducing exposure and risk.
    • The enterprise can be greatly aided in compliance to data privacy and security regulations for protection of payment card information (PCI), personally identifiable information (PII) and protected health information (PHI).

    “There’s been a lot of security spending over the last several years, and yet the number of records breached in 2015 went up considerably over the prior year,” noted 451’s Crawford. “That’s contributing to the surge in interest in encryption.”

    However, as John Pescatore, director of Emerging Security Trends at the SANS Institute, points out, authentication plays an important role in data loss prevention.

    4. Deep learning

    Deep learning encompasses a number of technologies, such as artificial intelligence and machine learning. “Regardless of what it’s called, there a great deal of interest in it for security purposes,” 451’s Crawford said.

    Like user behavior analytics, deep learning focuses on anomalous behavior. “You want to understand where malicious behavior deviates from legitimate or acceptable behavior in terms of security,” Crawford explained.

    Instead of looking at users, the system looks at “entities,” explained Brad Medairy, a senior vice president with Booz Allen. “Exact business analytics and recent developments in machine-learning models mean we are now able to look at the various entities that exist across the enterprise at the micro to the macro levels. For example, a data center, as an entity, can behave a certain way, similar to a user.”

    Use of machine learning can help stamp out the bane of advanced persistent threats, added Kris Lovejoy, president of Acuity Solutions, maker of an advanced malware detection platform. “With its ability to decipher between good and bad software, at line speed, machine-learning technologies will offer a significant boon to security practitioners who seek to decrease time to advanced threat detection and eradication,” she said.

    Crawford said he expects investments in deep learning for security purposes to continue. He added, however, that “the challenge for enterprises is there are a lot of companies coming to market with similar approaches for the same problem. Differentiating distinctions from one vendor to another is going to be a major challenge for enterprises in the coming year and beyond.”

    5. The cloud

    “The cloud is going to have a transformative impact on the security technology industry generally,” Crawford said.

    He explained that as more organizations use the cloud for what has traditionally been the domain of on-premises IT, more approaches to security that are born in and for the cloud will appear. On-premises techniques will be transitioned to the cloud. Things such as virtualized security hardware, virtualized firewalls, and virtualized intrusion detection and prevention systems. But that will be an intermediate stage.

    “If you think about what an infrastructure-as-a-service provider can do on a very large scale for all of its customers, there may not be the need to pull out all the defenses you need on-prem,” Crawford said. “The infrastructure-as-a-service provider will build that into their platform, which will relieve the need to do that for the individual cloud customer.”

    SANS’ Pescatore added that government agencies and private industry have increased the security of their data centers by using IaaS services such as Amazon and Firehost. “The GSA FedRAMP program is a great example of ‘certified secure-enough’ cloud services that make it easier for the average enterprise to have above-average data center security,” he said.

    These five should help out the infosec warriors get the upperhand. Any we missed? Which technologies do you suggest will move the needle on information security? Weigh in via the comments below.

    Resource : https://techbeacon.com/security/5-emerging-security-technologies-set-level-battlefield

    23May, 2023
    Information disclosure vulnerabilities

    In this section, we’ll explain the basics of information disclosure vulnerabilities and describe how you can find and exploit them. We’ll also offer some guidance on how you can prevent information disclosure vulnerabilities in your own websites.

    Learning to find and exploit information disclosure is a vital skill for any tester. You are likely to encounter it on a regular basis and, once you know how to exploit it effectively, it can help you to improve your testing efficiency and enable you to find additional, high-severity bugs.

    What is information disclosure?

    Information disclosure, also known as information leakage, is when a website unintentionally reveals sensitive information to its users. Depending on the context, websites may leak all kinds of information to a potential attacker, including:

    • Data about other users, such as usernames or financial information
    • Sensitive commercial or business data
    • Technical details about the website and its infrastructure

    The dangers of leaking sensitive user or business data are fairly obvious, but disclosing technical information can sometimes be just as serious. Although some of this information will be of limited use, it can potentially be a starting point for exposing an additional attack surface, which may contain other interesting vulnerabilities. The knowledge that you are able to gather could even provide the missing piece of the puzzle when trying to construct complex, high-severity attacks.

    Occasionally, sensitive information might be carelessly leaked to users who are simply browsing the website in a normal fashion. More commonly, however, an attacker needs to elicit the information disclosure by interacting with the website in unexpected or malicious ways. They will then carefully study the website’s responses to try and identify interesting behavior.

    What are some examples of information disclosure?

    Some basic examples of information disclosure are as follows:

    • Revealing the names of hidden directories, their structure, and their contents via a robots.txt file or directory listing
    • Providing access to source code files via temporary backups
    • Explicitly mentioning database table or column names in error messages
    • Unnecessarily exposing highly sensitive information, such as credit card details
    • Hard-coding API keys, IP addresses, database credentials, and so on in the source code
    • Hinting at the existence or absence of resources, usernames, and so on via subtle differences in application behavior

    In this topic, you will learn how to find and exploit some of these examples and more.

    Read more

    How to find and exploit information disclosure vulnerabilities

    How do information disclosure vulnerabilities arise?

    Information disclosure vulnerabilities can arise in countless different ways, but these can broadly be categorized as follows:

    • Failure to remove internal content from public content. For example, developer comments in markup are sometimes visible to users in the production environment.
    • Insecure configuration of the website and related technologies. For example, failing to disable debugging and diagnostic features can sometimes provide attackers with useful tools to help them obtain sensitive information. Default configurations can also leave websites vulnerable, for example, by displaying overly verbose error messages.
    • Flawed design and behavior of the application. For example, if a website returns distinct responses when different error states occur, this can also allow attackers to enumerate sensitive data, such as valid user credentials.

    What is the impact of information disclosure vulnerabilities?

    Information disclosure vulnerabilities can have both a direct and indirect impact depending on the purpose of the website and, therefore, what information an attacker is able to obtain. In some cases, the act of disclosing sensitive information alone can have a high impact on the affected parties. For example, an online shop leaking its customers’ credit card details is likely to have severe consequences.

    On the other hand, leaking technical information, such as the directory structure or which third-party frameworks are being used, may have little to no direct impact. However, in the wrong hands, this could be the key information required to construct any number of other exploits. The severity in this case depends on what the attacker is able to do with this information.

    How to assess the severity of information disclosure vulnerabilities

    Although the ultimate impact can potentially be very severe, it is only in specific circumstances that information disclosure is a high-severity issue on its own. During testing, the disclosure of technical information in particular is often only of interest if you are able to demonstrate how an attacker could do something harmful with it.

    For example, the knowledge that a website is using a particular framework version is of limited use if that version is fully patched. However, this information becomes significant when the website is using an old version that contains a known vulnerability. In this case, performing a devastating attack could be as simple as applying a publicly documented exploit.

    It is important to exercise common sense when you find that potentially sensitive information is being leaked. It is likely that minor technical details can be discovered in numerous ways on many of the websites you test. Therefore, your main focus should be on the impact and exploitability of the leaked information, not just the presence of information disclosure as a standalone issue. The obvious exception to this is when the leaked information is so sensitive that it warrants attention in its own right.

    Exploiting information disclosure

    We’ve put together some more practical advice to help you identify and exploit these kinds of vulnerabilities. You can also practice these techniques using our interactive labs.

    How to prevent information disclosure vulnerabilities

    Preventing information disclosure completely is tricky due to the huge variety of ways in which it can occur. However, there are some general best practices that you can follow to minimize the risk of these kinds of vulnerability creeping into your own websites.

    • Make sure that everyone involved in producing the website is fully aware of what information is considered sensitive. Sometimes seemingly harmless information can be much more useful to an attacker than people realize. Highlighting these dangers can help make sure that sensitive information is handled more securely in general by your organization.
    • Audit any code for potential information disclosure as part of your QA or build processes. It should be relatively easy to automate some of the associated tasks, such as stripping developer comments.
    • Use generic error messages as much as possible. Don’t provide attackers with clues about application behavior unnecessarily.
    • Double-check that any debugging or diagnostic features are disabled in the production environment.
    • Make sure you fully understand the configuration settings, and security implications, of any third-party technology that you implement. Take the time to investigate and disable any features and settings that you don’t actually need.

    Resourse : https://portswigger.net/web-security/information-disclosure