• Search for:
    29May, 2023
    NVIDIA’s next DGX supercomputer is all about generative AI

    NVIDIA CEO Jensen Hiang made a string of announcements during his Computex keynote, including details about the company’s next DGX supercomputer. Given where the industry is clearly heading, it shouldn’t come as a surprise that the DGX GH200 is largely about helping companies develop generative AI models.

    The supercomputer uses a new NVLink Switch System to enable 256 GH200 Grace Hopper superchips to act as a single GPU (each of the chips has an Arm-based Grace CPU and an H100 Tensor Core GPU). This, according to NVIDIA, allows the DGX GH200 to deliver 1 exaflop of performance and to have 144 terabytes of shared memory. The company says that’s nearly 500 times as much memory as you’d find in a single DGX A100 system.

    For comparison, the latest ranking of the Top500 supercomputers lists Frontier at Oak Ridge National Laboratory in Tennessee as the only known exascale system, having reached a performance of nearly 1.2 exaflops on the Linmark benchmark. That’s over twice the peak performance of the second-placed system, Japan’s Fugaku.

    In effect, NVIDIA claims to have developed a supercomputer that can stand alongside the most powerful known system on the planet (Meta is building one that it claims will be the fastest AI supercomputer in the world once it’s fully built out). NVIDIA says the architecture of the DGX GH200 offers 10 times more bandwidth than the previous generation, “delivering the power of a massive AI supercomputer with the simplicity of programming a single GPU.”

    Some big names are interested in the DGX GH200. Google Cloud, Meta and Microsoft should be among the first companies to gain access to the supercomputer to test how it can handle generative AI workloads. NVIDIA says DGX GH200 supercomputers should be available by the end of 2023.

    The company is also building its own supercomputer, Helios, that combines four DGX GH200 systems. NVIDIA expects Helios to be online by the end of the year.

    Huang discussed other generative AI developments during his keynote, including one on the gaming front. NVIDIA Avatar Cloud Engine (ACE) for Games is a service developers will be able to tap into in order to create custom AI models for speech, conversation and animation. NVIDIA says ACE for Games can “give non-playable characters conversational skills so they can respond to questions with lifelike personalities that evolve.”

    Resource : https://www.engadget.com/nvidias-next-dgx-supercomputer-is-all-about-generative-ai-043053544.html

    29May, 2023
    How to turn on Google’s new AI Search Generative Experience

    For some users, Google has completely overhauled Search with AI, pushing what it calls the “Search Generative Experience.” While the experience is limited, some users have the option to turn it on now. Here’s how to turn on Search Generative Experience – SGE – and Google with AI.

    It’s easy to assume most people are used to the Google Search experience we’ve known and appreciated for years on end. While the foundation stays the same, things are starting to shift a little bit, with a Google experience that is bolstered by smarter, more contextual, and more dynamic results.

    Using the progress Google has made with AI up to this point, the company is overhauling Search with several new AI features and tools under the Search Generative Experience umbrella. That includes new AI-powered snapshots, which showcase quick, contextual results for your query or prompt. Rather than rattling off links, Google Search will develop a summary in answer to the question utilizing multiple sources – shown off to the right.

    On top of that, the SGE is meant to facilitate conversations. In effect, this means you can keep asking follow-up questions and get more information as the questions come up. This feature is a breath of fresh air in comparison to standard AI-free Search, which requires additional and alternatively worded searches. Rather than starting over, simply ask for a quick follow-up and get information that’s relevant to the entire conversation.

    Since the program is in its baby stages, there are a couple of criteria that need to be met before users can turn the feature on in Search. Users need to have signed up for Labs and be a Google One Premium (2+ TB) subscriber. These limitations are temporary, but that’s how it stands at the time of writing. Even if you’re not a subscriber, sign up for the free Labs anyway because that restriction might fall eventually.

    We have a full guide on signing up for the SGE Lab, and it takes only a couple of minutes.

    Once you’re signed up for Labs, complete the following:

    1. In Google Search – mobile or web – look for the Labs icon. Click or tap it.
    2. Look for the SGE card. Tap or click the toggle so it’s set to “on.”
    3. Hit I agree.

    Once you do that, you have access to Google’s new AI Generative Search Experience. Our breakdown of the current state of the feature is a helpful guide to using it, though the best approach is to ask natural questions that you wouldn’t normally be able to Google with much success.

    If you’re not a Google One subscriber, don’t worry. The SGE feature will likely be on its way to others who have signed up for the Lab in preview, though it might take a little time.

    Resource : https://9to5google.com/2023/05/26/turn-on-google-search-ai/

    27May, 2023
    Fake CapCut Websites Spread Information Stealers

    A malware campaign has been found impersonating the CapCut video editing tool to spread different stealers. CapCut is an official video editor, developed by ByteDance. It is popularly used as an editing tool for TikTok videos (also owned by ByteDance) and comes with several features. CapCut has over 500 million downloads on Google Play and its website receives over 30 million monthly hits, making it an attractive target for cyberattacks.

    What’s happening?

    Owing to the nationwide bans in India, Taiwan, and other countries, users are looking for alternative ways to get access to the CapCut app. The popularity of CapCut has made users look for alternative ways of getting the app. To harness this opportunity, attackers have created websites that spread malware disguised as CapCut.

    • The attackers are suspected to be using search ads, black hat SEO, and social media to advertise these malicious sites.
    • They used multiple domains, such as capcut-editor-video[.]com and capcutdownload[.]com, to deliver information stealers to victims’ systems via two different campaigns detailed below.

    Offx Stealer campaign

    The first campaign uses fake CapCut sites with a download button spreading the Offx Stealer on systems. The stealer binary uses PyInstaller and only runs on Windows 8, 10, and 11.

    • Whenever a victim runs the downloaded file, they are shown a fake error message stating that the app launch has failed. However, Offx Stealer keeps operating in the background.
    • The malware attempts to steal credentials and cookies from web browsers and targets data stored in Discord, Telegram, popular cryptocurrency wallet apps (Bytecoin, Atomic, Zcash), and remote access software (AnyDesk and UltraViewer).

    Redline Stealer campaign

    The second campaign uses fake CapCut sites delivering the ‘CapCut_Pro_Edit_Video[.]rar’ file on systems, including a batch script that executes a PowerShell script when opened.

    • The PowerShell script decompresses, decrypts, and loads the final payload – a DotNET executable and Redline Stealer. The DotNET executable bypasses the AMSI Windows security feature.
    • Additionally, the same fake CapCut site serves as a host for BatLoader.

    Resource: https://cyware.com/news/fake-capcut-websites-spread-information-stealers-7ac5436c

    27May, 2023
    Microsoft Security Copilot is a new GPT-4 AI assistant for cybersecurity

    After announcing an AI-powered Copilot assistant for Office apps, Microsoft is now turning its attention to cybersecurity. Microsoft Security Copilot is a new assistant for cybersecurity professionals, designed to help defenders identify breaches and better understand the huge amounts of signals and data available to them daily.

    Powered by OpenAI’s GPT-4 generative AI and Microsoft’s own security-specific model, Security Copilot looks like a simple prompt box like any other chatbot. You can ask “what are all the security incidents in my enterprise?” and it will summarize them. But behind the scenes, it’s making use of the 65 trillion daily signals Microsoft collects in its threat intelligence gathering and security-specific skills to let security professionals hunt down threats.

    Microsoft Security Copilot is designed to assist a security analyst’s work rather than replace it — and even includes a pinboard section for co-workers to collaborate and share information. Security professionals can use the Security Copilot to help with incident investigations or to quickly summarize events and help with reporting.

    Security Copilot accepts natural language inputs, so security professionals could ask for a summary of a particular vulnerability, feed in files, URLs, or code snippets for analysis — or ask for incident and alert information from other security tools. All prompts and responses are saved, so there’s a full audit trail for investigators.

    Results can be pinned and summarized into a shared workspace, so colleagues can all work on the same threat analysis and investigations. “This is like having individual workspaces for investigators and a shared notebook with the ability to promote things you’re working on,” says Chang Kawaguchi, an AI security architect at Microsoft, in an interview with The Verge.

    One of the most interesting aspects of Security Copilot is a prompt book feature. It’s essentially a set of steps or automations that people can bundle into a single easy-to-use button or prompt. That could involve having a shared prompt to reverse engineer a script so security researchers don’t have to wait for someone on their team to perform this type of analysis. You can even use Security Copilot to create a PowerPoint slide that outlines incidents and the attack vectors.

    Much like Bing, Microsoft is also sourcing results clearly when security researchers ask for information on the latest vulnerabilities. Microsoft is using information from the Cybersecurity and Infrastructure Security Agency, the National Institute of Standards and Technology’s vulnerability database, and Microsoft’s own threat intelligence database.

    That doesn’t mean Microsoft’s Security Copilot will always get things right, though. “We know sometimes these models get things wrong, so we’re offering the ability to make sure we have feedback,” says Kawaguchi. The feedback loop is a lot more involved than just the thumbs-up or thumbs-down found on Bing. “It’s a little more complicated than that, because there are a lot of ways it could be wrong,” explains Kawaguchi. Microsoft will let users respond with exactly what’s wrong to get a better understanding of any hallucinations.

    “I don’t think anyone can guarantee zero hallucinations, but what we are trying to do through things like exposing sources, providing feedback, and grounding this in the data from your own context is ensuring that it’s possible for folks to understand and validate the data they’re seeing,” says Kawaguchi. “In some of these examples there’s no correct answer, so having a probabilistic answer is significantly better for the organization and the individual doing the investigation.”

    While Microsoft’s Security Copilot looks like a prompt and chatbot interface like Bing, the company has limited it to just security-related queries. You won’t be able to grab the latest weather information here or ask the Security Copilot what its favorite color is. “This is very intentionally not Bing,” says Kawaguchi. “We don’t think of this as a chat experience. We really think of it as more of a notebook experience than a freeform chat or general purpose chatbot.”

    Security Copilot is the latest example of Microsoft’s big push with AI. The Microsoft 365 Copilot feels like it will forever change Office documents, and Microsoft-owned GitHub is supercharging its own Copilot into more of a chatty assistant to help developers create code. Microsoft doesn’t appear to be slowing down with its Copilot ambitions, so we’re likely to see this AI assistant technology appear throughout the company’s software and services.

    Microsoft is starting to preview this new Security Copilot with “a few customers” today, and the company doesn’t have a date in mind for rolling this out more broadly. “We’re not yet talking about timeline for general availability,” says Kawaguchi. “So much of this is about learning and learning responsibly, so we think it’s important to get it to a small group of folks and start that process of learning and to make this the best possible product and make sure we’re delivering it responsibly.”

    Resource : https://www.theverge.com/2023/3/28/23659711/microsoft-security-copilot-gpt-4-ai-tool-features?&web_view=true

    25May, 2023
    Mirai Variant V3G4 Targets 13 Vulnerabilities to Infect IoT Devices

    During the second half of 2022, a variant of the Mirai malware called V3G4 was seen targeting 13 vulnerabilities to ensnare Internet of Things (IoT) devices into a botnet, Palo Alto Networks reports.

    Following the successful exploitation of the targeted security flaws, the malware takes full control of the vulnerable devices and then abuses them to conduct various types of malicious activities, including distributed denial-of-service (DDoS) attacks.

    Starting July 2022, Mirai variant V3G4 was used in multiple attack campaigns, likely by the same threat actor, based on the used hardcoded command-and-control (C&C) domains, malware downloaders, XOR decryption key, identical functions, and a ‘stop list’.

    To compromise devices, the threat actor targets 13 remote code execution vulnerabilities that allow them to run specific utilities to download and execute the Mirai malware on the target devices.

    The targeted vulnerabilities impact FreePBX Elastix (CVE-2012-4869), Gitorious, FRITZ!Box webcams (CVE-2014-9727), Mitel AWC, Geutebruck IP cameras (CVE-2017-5173), Webmin (CVE-2019-15107), Spree Commerce, FLIR Thermal cameras, DrayTek Vigor (CVE-2020-8515 and CVE-2020-15415), Airspan AirSpot (CVE-2022-36267), Atlassian Confluence (CVE-2022-26134), and C-Data Web Management System (CVE-2022-4257).

    Following successful execution on a vulnerable device, the Mirai variant makes sure that only one instance of the malware runs, then attempts to terminate processes included in the hardcoded ‘stop list’.

    Malware samples collected over the course of three different campaigns showed slight changes in the code. While some Mirai samples spread by brute-forcing weak credentials, others also use embedded exploits, but samples seen between September and December 2022 contain none of these capabilities.

    “The vulnerabilities mentioned above have less attack complexity than previously observed variants, but they maintain a critical security impact that can lead to remote code execution. Once the attacker gains control of a vulnerable device in this manner, they could take advantage by including the newly compromised devices in their botnet to conduct further attacks such as DDoS,” Palo Alto Networks notes.

    Organizations are advised to ensure that all devices in their environments are patched against known vulnerabilities, that they are protected using strong, unique passwords, and that unused ports and services, which are often targeted by cybercriminals, are either blocked or not accessible from the internet.

    Resource : https://www.securityweek.com/mirai-variant-v3g4-targets-13-vulnerabilities-to-infect-iot-devices/

    25May, 2023
    GitLab ‘strongly recommends’ patching max severity flaw ASAP

    GitLab has released an emergency security update, version 16.0.1, to address a maximum severity (CVSS v3.1 score: 10.0) path traversal flaw tracked as CVE-2023-2825.

    GitLab is a web-based Git repository for developer teams that need to manage their code remotely and has approximately 30 million registered users and one million paying customers.

    The vulnerability addressed in the latest update was discovered by a security researcher named ‘pwnie,’ who reported the issue on the project’s HackOne bug bounty program.

    It impacts GitLab Community Edition (CE) and Enterprise Edition (EE) version 16.0.0, but all versions older than this aren’t affected.

    The flaw arises from a path traversal problem that allows an unauthenticated attacker to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups.

    The exploitation of CVE-2023-2825 could expose sensitive data, including proprietary software code, user credentials, tokens, files, and other private information.

    This prerequisite suggests that the issue relates to how GitLab manages or resolves paths for attached files nested within several levels of group hierarchy. However, due to the criticality of the problem and the freshness of its discovery, not many details were disclosed by the vendor this time.

    Instead, GitLab highlighted the importance of applying the latest security update without delay.

    “We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible,” reads GitLab’s security bulletin.

    “When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.”

    A mitigating factor is that the vulnerability can only be triggered under specific conditions, i.e., when there’s an attachment in a public project nested within at least five groups, which is not the structure followed in all GitHub projects.

    Nevertheless, all users of GitLab 16.0.0 are recommended to update to version 16.0.1 as soon as possible to mitigate the risk. Unfortunately, no workarounds are available at this time.

    Resource : https://www.bleepingcomputer.com/news/security/gitlab-strongly-recommends-patching-max-severity-flaw-asap/

    24May, 2023
    API Security Needs a Reset—with People, not Tools

    It is increasingly challenging for developers and security teams to keep the application-development process and application programming interfaces (APIs) secure. But there is no single standard for managing APIs and, thus, teams cannot rely on tools alone to solve security issues. No single product can fix every problem for every language, framework, or context of an API environment.

    So enterprises play mix-and-match. Modern organizations are fixated on tools to respond to their cyberthreat challenges—to the point of lapsing into tunnel vision that impedes progress. A 2022 report showed that large-enterprise security teams oversaw an average of 76 security tools. That’s far too many.

    The focus on security software creates a false sense of security and a failure to address underlying causes. Most data breaches are caused by human error. Our research has found that developers heavily rely upon pre-existing code, for example—with nearly one-half using libraries or frameworks with inherent flaws because they are not tested or evaluated on an ongoing basis for vulnerabilities. To wit, developers assume that because the code exists in a library, it is secure. But this is not always the case.

    That’s why we need to press the reset button. We need to stop constantly seeking the latest shiny object and start focusing more on our people. Yes, security tools have advanced impressively and serve a critical purpose. But software development teams still need to improve their security capabilities to effectively deploy these solutions. The resulting training and policy implementation should focus on the following best practices:

    Assign API Ownership

    By their very nature, APIs are over-permissioned to allow unchecked communications between applications. Frankly, they “talk too much”—leading to a state of oversharing that triggers compromises. We call this “TMI tech.”

    TMI tech persists because we rarely assign ownership of APIs (either to developers or to their app sec cohorts). Accordingly, there is rarely any meticulous monitoring of which API is sharing what.

    To rectify this, managers should assign API ownership to development teams and help them recognize the risks of wide-open (and undocumented) API implementation. When such responsibilities are covered and contextual behavioral baselines are established, it is far easier to shut down these troublesome “conversations.”

    Treat APIs Like Humans

    To extend our first best practice, we can immediately improve access control by applying zero-trust, least-privilege, and role-based authorization to APIs, just as we do with people. If an API is required to perform a specific function, then we limit its permissions to that function only. Similarly, we should further restrict APIs’ time spent accessing—and the volume accessed—as appropriate.

    Incorporate a Test-First Mentality

    Developers need to understand the pitfalls of assumption—but preferably not the hard way. As such, dev teams should regularly test APIs to verify that they are not exploitable (while still functioning as intended). Testing early and often can help reduce bugs, saving time and additional costs in the long run. Plus, security teams will appreciate it.  

    Include Scenario Simulations

    Simulations better equip developer teams to react when different API situations play out. And they seem to be exactly what developers need to improve their secure-coding skills. Research conducted by Secure Code Warrior found that more than nine out of every ten developers acknowledged needed training in security frameworks. Almost a third (30%) reported feeling that they would benefit from practical security-training sessions featuring work-relevant, real-life examples; nearly as many indicated that they would benefit from hands-on interactivity—such as practice sessions in which they attempt to write secure code.

    Change Performance-Review Metrics

    Secure development cannot be rushed. Given the clear consequences, therefore, it is time to cease placing so much emphasis during team-member evaluations on raw speed of feature delivery. Otherwise, the performance-review phase presents developers with a perverse incentive to sacrifice security (if not quality). Instead, organizations should look to reward those who can create quality, secure code within a reasonable time frame.

    A state of optimal protection remains a moving target as attack trends continue to shift rapidly. Application development and API management prove no exception. When we press the reset button to encourage a people-centric focus on secure development, backing it up with comprehensive policy implementation and best practices, we ensure that security is embedded into the development process—instead of being viewed as a roadblock to innovation.

    Keep learning

    Resource : https://techbeacon.com/security/api-security-needs-reset-people-not-tools

    24May, 2023
    5 emerging security technologies set to level the battlefield

    The war between data defenders and data thieves has been described as a cat-and-mouse game. As soon as the white hats counter one form of black-hat malicious behavior, another malevolent form rears its ugly head. How can the playing field be tilted in favor of the infosec warriors? Here are five emerging security technologies that may be able to do that.

    1. Hardware authentication

    The inadequacies of usernames and passwords are well known. Clearly, a more secure form of authentication is needed. One method is to bake authentication into a user’s hardware. Intel is moving in that direction with the Authenticate solution in its new, sixth-generation Core vPro processor. It can combine a variety of hardware-enhanced factors at the same time to validate a user’s identity.

    Intel has built on previous efforts to dedicate a portion of the chipset for security functions to make a device part of the authentication process. Good authentication requires three things from users: what they know, such as a password; who they are, such as a username; and what they have, such as a token. In the case of Authenticate, the device becomes the what-you-have.

    “This isn’t new,” said Scott Crawford, research director for information security at 451 Research. “We’ve seen this in other manifestations, such as licensing technologies and tokens.”

    Hardware authentication can be particularly important for the Internet of Things (IoT) where a network wants to ensure that the thing trying to gain access to it is something that should have access to it.

    However, Crawford noted, “The most immediate application for the technology is for authenticating an endpoint in a traditional IT environment — laptops, desktops, and mobile devices using Intel chipsets.”

    2. User-behavior analytics

    Once someone’s username and password are compromised, whoever has them can waltz onto a network and engage in all kinds of malicious behavior. That behavior can trigger a red flag to system defenders if they’re employing user behavior analytics (UBA). The technology uses big data analytics to identify anomalous behavior by a user.

    “There’s a lot of interest in this in the enterprise,” 451’s Crawford said.

    He explained that the technology addresses a blind spot in enterprise security. “Once an attacker gains entry into an enterprise, what happens then?” he asked. “One of the first things they do is compromise credentials. So then the question becomes, Can you differentiate between a legitimate user’s activity and an attacker who has gained entry, compromised a legitimate user’s credentials and is now looking for other targets?”

    Visibility into activity that does not fit the norm of the legitimate user can close a blind spot in the middle of the attack chain. “If you think of the attack chain as initial penetration, lateral movement, and then compromise, theft, and exfiltration of sensitive data, the middle links in that attack chain have not been very visible to enterprise security pros, and that’s why the interest in user behavior analytics today,” Crawford said.

    Comparing a user’s present behavior to past behavior isn’t the only way UBA can identify a malicious actor. “There’s something called ‘peer analysis’,” explained Steven Grossman, vice president for program management at Bay Dynamics, a threat analytics company. “It compares how someone is behaving compared to people with the same manager or same department. That can be an indicator that the person is doing something they shouldn’t be doing or someone else has taken over their account.”

    In addition, UBA can be a valuable tool for training employees in better security practices. “One of the biggest problems in a company is employees not following company policy,” Grossman said. “To be able to identify those people and mitigate that risk by training them properly is critical.”

    3. Data loss prevention

    A key to data loss prevention is technologies such as encryption and tokenization. They can protect data down to field and subfield level, which can benefit an enterprise in a number of ways:

    • Cyber-attackers cannot monetize data in the event of a successful breach.
    • Data can be securely moved and used across the extended enterprise — business processes and analytics can be performed on the data in its protected form, dramatically reducing exposure and risk.
    • The enterprise can be greatly aided in compliance to data privacy and security regulations for protection of payment card information (PCI), personally identifiable information (PII) and protected health information (PHI).

    “There’s been a lot of security spending over the last several years, and yet the number of records breached in 2015 went up considerably over the prior year,” noted 451’s Crawford. “That’s contributing to the surge in interest in encryption.”

    However, as John Pescatore, director of Emerging Security Trends at the SANS Institute, points out, authentication plays an important role in data loss prevention.

    4. Deep learning

    Deep learning encompasses a number of technologies, such as artificial intelligence and machine learning. “Regardless of what it’s called, there a great deal of interest in it for security purposes,” 451’s Crawford said.

    Like user behavior analytics, deep learning focuses on anomalous behavior. “You want to understand where malicious behavior deviates from legitimate or acceptable behavior in terms of security,” Crawford explained.

    Instead of looking at users, the system looks at “entities,” explained Brad Medairy, a senior vice president with Booz Allen. “Exact business analytics and recent developments in machine-learning models mean we are now able to look at the various entities that exist across the enterprise at the micro to the macro levels. For example, a data center, as an entity, can behave a certain way, similar to a user.”

    Use of machine learning can help stamp out the bane of advanced persistent threats, added Kris Lovejoy, president of Acuity Solutions, maker of an advanced malware detection platform. “With its ability to decipher between good and bad software, at line speed, machine-learning technologies will offer a significant boon to security practitioners who seek to decrease time to advanced threat detection and eradication,” she said.

    Crawford said he expects investments in deep learning for security purposes to continue. He added, however, that “the challenge for enterprises is there are a lot of companies coming to market with similar approaches for the same problem. Differentiating distinctions from one vendor to another is going to be a major challenge for enterprises in the coming year and beyond.”

    5. The cloud

    “The cloud is going to have a transformative impact on the security technology industry generally,” Crawford said.

    He explained that as more organizations use the cloud for what has traditionally been the domain of on-premises IT, more approaches to security that are born in and for the cloud will appear. On-premises techniques will be transitioned to the cloud. Things such as virtualized security hardware, virtualized firewalls, and virtualized intrusion detection and prevention systems. But that will be an intermediate stage.

    “If you think about what an infrastructure-as-a-service provider can do on a very large scale for all of its customers, there may not be the need to pull out all the defenses you need on-prem,” Crawford said. “The infrastructure-as-a-service provider will build that into their platform, which will relieve the need to do that for the individual cloud customer.”

    SANS’ Pescatore added that government agencies and private industry have increased the security of their data centers by using IaaS services such as Amazon and Firehost. “The GSA FedRAMP program is a great example of ‘certified secure-enough’ cloud services that make it easier for the average enterprise to have above-average data center security,” he said.

    These five should help out the infosec warriors get the upperhand. Any we missed? Which technologies do you suggest will move the needle on information security? Weigh in via the comments below.

    Resource : https://techbeacon.com/security/5-emerging-security-technologies-set-level-battlefield

    23May, 2023
    Information disclosure vulnerabilities

    In this section, we’ll explain the basics of information disclosure vulnerabilities and describe how you can find and exploit them. We’ll also offer some guidance on how you can prevent information disclosure vulnerabilities in your own websites.

    Learning to find and exploit information disclosure is a vital skill for any tester. You are likely to encounter it on a regular basis and, once you know how to exploit it effectively, it can help you to improve your testing efficiency and enable you to find additional, high-severity bugs.

    What is information disclosure?

    Information disclosure, also known as information leakage, is when a website unintentionally reveals sensitive information to its users. Depending on the context, websites may leak all kinds of information to a potential attacker, including:

    • Data about other users, such as usernames or financial information
    • Sensitive commercial or business data
    • Technical details about the website and its infrastructure

    The dangers of leaking sensitive user or business data are fairly obvious, but disclosing technical information can sometimes be just as serious. Although some of this information will be of limited use, it can potentially be a starting point for exposing an additional attack surface, which may contain other interesting vulnerabilities. The knowledge that you are able to gather could even provide the missing piece of the puzzle when trying to construct complex, high-severity attacks.

    Occasionally, sensitive information might be carelessly leaked to users who are simply browsing the website in a normal fashion. More commonly, however, an attacker needs to elicit the information disclosure by interacting with the website in unexpected or malicious ways. They will then carefully study the website’s responses to try and identify interesting behavior.

    What are some examples of information disclosure?

    Some basic examples of information disclosure are as follows:

    • Revealing the names of hidden directories, their structure, and their contents via a robots.txt file or directory listing
    • Providing access to source code files via temporary backups
    • Explicitly mentioning database table or column names in error messages
    • Unnecessarily exposing highly sensitive information, such as credit card details
    • Hard-coding API keys, IP addresses, database credentials, and so on in the source code
    • Hinting at the existence or absence of resources, usernames, and so on via subtle differences in application behavior

    In this topic, you will learn how to find and exploit some of these examples and more.

    Read more

    How to find and exploit information disclosure vulnerabilities

    How do information disclosure vulnerabilities arise?

    Information disclosure vulnerabilities can arise in countless different ways, but these can broadly be categorized as follows:

    • Failure to remove internal content from public content. For example, developer comments in markup are sometimes visible to users in the production environment.
    • Insecure configuration of the website and related technologies. For example, failing to disable debugging and diagnostic features can sometimes provide attackers with useful tools to help them obtain sensitive information. Default configurations can also leave websites vulnerable, for example, by displaying overly verbose error messages.
    • Flawed design and behavior of the application. For example, if a website returns distinct responses when different error states occur, this can also allow attackers to enumerate sensitive data, such as valid user credentials.

    What is the impact of information disclosure vulnerabilities?

    Information disclosure vulnerabilities can have both a direct and indirect impact depending on the purpose of the website and, therefore, what information an attacker is able to obtain. In some cases, the act of disclosing sensitive information alone can have a high impact on the affected parties. For example, an online shop leaking its customers’ credit card details is likely to have severe consequences.

    On the other hand, leaking technical information, such as the directory structure or which third-party frameworks are being used, may have little to no direct impact. However, in the wrong hands, this could be the key information required to construct any number of other exploits. The severity in this case depends on what the attacker is able to do with this information.

    How to assess the severity of information disclosure vulnerabilities

    Although the ultimate impact can potentially be very severe, it is only in specific circumstances that information disclosure is a high-severity issue on its own. During testing, the disclosure of technical information in particular is often only of interest if you are able to demonstrate how an attacker could do something harmful with it.

    For example, the knowledge that a website is using a particular framework version is of limited use if that version is fully patched. However, this information becomes significant when the website is using an old version that contains a known vulnerability. In this case, performing a devastating attack could be as simple as applying a publicly documented exploit.

    It is important to exercise common sense when you find that potentially sensitive information is being leaked. It is likely that minor technical details can be discovered in numerous ways on many of the websites you test. Therefore, your main focus should be on the impact and exploitability of the leaked information, not just the presence of information disclosure as a standalone issue. The obvious exception to this is when the leaked information is so sensitive that it warrants attention in its own right.

    Exploiting information disclosure

    We’ve put together some more practical advice to help you identify and exploit these kinds of vulnerabilities. You can also practice these techniques using our interactive labs.

    How to prevent information disclosure vulnerabilities

    Preventing information disclosure completely is tricky due to the huge variety of ways in which it can occur. However, there are some general best practices that you can follow to minimize the risk of these kinds of vulnerability creeping into your own websites.

    • Make sure that everyone involved in producing the website is fully aware of what information is considered sensitive. Sometimes seemingly harmless information can be much more useful to an attacker than people realize. Highlighting these dangers can help make sure that sensitive information is handled more securely in general by your organization.
    • Audit any code for potential information disclosure as part of your QA or build processes. It should be relatively easy to automate some of the associated tasks, such as stripping developer comments.
    • Use generic error messages as much as possible. Don’t provide attackers with clues about application behavior unnecessarily.
    • Double-check that any debugging or diagnostic features are disabled in the production environment.
    • Make sure you fully understand the configuration settings, and security implications, of any third-party technology that you implement. Take the time to investigate and disable any features and settings that you don’t actually need.

    Resourse : https://portswigger.net/web-security/information-disclosure

    23May, 2023
    SQL injection

    In this section, we’ll explain what SQL injection (SQLi) is, describe some common examples, explain how to find and exploit various kinds of SQL injection vulnerabilities, and summarize how to prevent SQL injection.

    What is SQL injection (SQLi)?

    SQL injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It generally allows an attacker to view data that they are not normally able to retrieve. This might include data belonging to other users, or any other data that the application itself is able to access. In many cases, an attacker can modify or delete this data, causing persistent changes to the application’s content or behavior.

    In some situations, an attacker can escalate a SQL injection attack to compromise the underlying server or other back-end infrastructure, or perform a denial-of-service attack.

    SQL injection

    In this section, we’ll explain what SQL injection (SQLi) is, describe some common examples, explain how to find and exploit various kinds of SQL injection vulnerabilities, and summarize how to prevent SQL injection.

    What is the impact of a successful SQL injection attack?

    A successful SQL injection attack can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-profile data breaches in recent years have been the result of SQL injection attacks, leading to reputational damage and regulatory fines. In some cases, an attacker can obtain a persistent backdoor into an organization’s systems, leading to a long-term compromise that can go unnoticed for an extended period.

    SQL injection examples

    There are a wide variety of SQL injection vulnerabilities, attacks, and techniques, which arise in different situations. Some common SQL injection examples include:

    Blind SQL injection vulnerabilities

    Many instances of SQL injection are blind vulnerabilities. This means that the application does not return the results of the SQL query or the details of any database errors within its responses. Blind vulnerabilities can still be exploited to access unauthorized data, but the techniques involved are generally more complicated and difficult to perform.

    Depending on the nature of the vulnerability and the database involved, the following techniques can be used to exploit blind SQL injection vulnerabilities:

    • You can change the logic of the query to trigger a detectable difference in the application’s response depending on the truth of a single condition. This might involve injecting a new condition into some Boolean logic, or conditionally triggering an error such as a divide-by-zero.
    • You can conditionally trigger a time delay in the processing of the query, allowing you to infer the truth of the condition based on the time that the application takes to respond.
    • You can trigger an out-of-band network interaction, using OAST techniques. This technique is extremely powerful and works in situations where the other techniques do not. Often, you can directly exfiltrate data via the out-of-band channel, for example by placing the data into a DNS lookup for a domain that you control.

    SQL injection

    In this section, we’ll explain what SQL injection (SQLi) is, describe some common examples, explain how to find and exploit various kinds of SQL injection vulnerabilities, and summarize how to prevent SQL injection.

    SQL injection

    Labs

    If you’re already familiar with the basic concepts behind SQLi vulnerabilities and just want to practice exploiting them on some realistic, deliberately vulnerable targets, you can access all of the labs in this topic from the link below.View all SQL injection labs

    What is SQL injection (SQLi)?

    SQL injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It generally allows an attacker to view data that they are not normally able to retrieve. This might include data belonging to other users, or any other data that the application itself is able to access. In many cases, an attacker can modify or delete this data, causing persistent changes to the application’s content or behavior.

    In some situations, an attacker can escalate a SQL injection attack to compromise the underlying server or other back-end infrastructure, or perform a denial-of-service attack.

    https://youtube.com/watch?v=wX6tszfgYp4%3Forigin%3Dhttps%3A

    What is the impact of a successful SQL injection attack?

    A successful SQL injection attack can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-profile data breaches in recent years have been the result of SQL injection attacks, leading to reputational damage and regulatory fines. In some cases, an attacker can obtain a persistent backdoor into an organization’s systems, leading to a long-term compromise that can go unnoticed for an extended period.

    SQL injection examples

    There are a wide variety of SQL injection vulnerabilities, attacks, and techniques, which arise in different situations. Some common SQL injection examples include:

    Retrieving hidden data

    Consider a shopping application that displays products in different categories. When the user clicks on the Gifts category, their browser requests the URL:https://insecure-website.com/products?category=Gifts

    This causes the application to make a SQL query to retrieve details of the relevant products from the database:SELECT * FROM products WHERE category = 'Gifts' AND released = 1

    This SQL query asks the database to return:

    • all details (*)
    • from the products table
    • where the category is Gifts
    • and released is 1.

    The restriction released = 1 is being used to hide products that are not released. For unreleased products, presumably released = 0.

    The application doesn’t implement any defenses against SQL injection attacks, so an attacker can construct an attack like:https://insecure-website.com/products?category=Gifts'--

    This results in the SQL query:SELECT * FROM products WHERE category = 'Gifts'--' AND released = 1

    The key thing here is that the double-dash sequence -- is a comment indicator in SQL, and means that the rest of the query is interpreted as a comment. This effectively removes the remainder of the query, so it no longer includes AND released = 1. This means that all products are displayed, including unreleased products.

    Going further, an attacker can cause the application to display all the products in any category, including categories that they don’t know about:https://insecure-website.com/products?category=Gifts'+OR+1=1--

    This results in the SQL query:SELECT * FROM products WHERE category = 'Gifts' OR 1=1--' AND released = 1

    The modified query will return all items where either the category is Gifts, or 1 is equal to 1. Since 1=1 is always true, the query will return all items.

    Warning

    Take care when injecting the condition OR 1=1 into a SQL query. Although this may be harmless in the initial context you’re injecting into, it’s common for applications to use data from a single request in multiple different queries. If your condition reaches an UPDATE or DELETE statement, for example, this can result in an accidental loss of data.

    LAB

    APPRENTICESQL injection vulnerability in WHERE clause allowing retrieval of hidden data

    Subverting application logic

    Consider an application that lets users log in with a username and password. If a user submits the username wiener and the password bluecheese, the application checks the credentials by performing the following SQL query:SELECT * FROM users WHERE username = 'wiener' AND password = 'bluecheese'

    If the query returns the details of a user, then the login is successful. Otherwise, it is rejected.

    Here, an attacker can log in as any user without a password simply by using the SQL comment sequence -- to remove the password check from the WHERE clause of the query. For example, submitting the username administrator'-- and a blank password results in the following query:SELECT * FROM users WHERE username = 'administrator'--' AND password = ''

    This query returns the user whose username is administrator and successfully logs the attacker in as that user.

    LAB

    APPRENTICESQL injection vulnerability allowing login bypass

    Retrieving data from other database tables

    In cases where the results of a SQL query are returned within the application’s responses, an attacker can leverage a SQL injection vulnerability to retrieve data from other tables within the database. This is done using the UNION keyword, which lets you execute an additional SELECT query and append the results to the original query.

    For example, if an application executes the following query containing the user input “Gifts”:SELECT name, description FROM products WHERE category = 'Gifts'

    then an attacker can submit the input:' UNION SELECT username, password FROM users--

    This will cause the application to return all usernames and passwords along with the names and descriptions of products.

    Read more

    SQL injection UNION attacks

    Examining the database

    Following initial identification of a SQL injection vulnerability, it is generally useful to obtain some information about the database itself. This information can often pave the way for further exploitation.

    You can query the version details for the database. The way that this is done depends on the database type, so you can infer the database type from whichever technique works. For example, on Oracle you can execute:SELECT * FROM v$version

    You can also determine what database tables exist, and which columns they contain. For example, on most databases you can execute the following query to list the tables:SELECT * FROM information_schema.tables

    Read more

    Examining the database in SQL injection attacksSQL injection cheat sheet

    Blind SQL injection vulnerabilities

    Many instances of SQL injection are blind vulnerabilities. This means that the application does not return the results of the SQL query or the details of any database errors within its responses. Blind vulnerabilities can still be exploited to access unauthorized data, but the techniques involved are generally more complicated and difficult to perform.

    Depending on the nature of the vulnerability and the database involved, the following techniques can be used to exploit blind SQL injection vulnerabilities:

    • You can change the logic of the query to trigger a detectable difference in the application’s response depending on the truth of a single condition. This might involve injecting a new condition into some Boolean logic, or conditionally triggering an error such as a divide-by-zero.
    • You can conditionally trigger a time delay in the processing of the query, allowing you to infer the truth of the condition based on the time that the application takes to respond.
    • You can trigger an out-of-band network interaction, using OAST techniques. This technique is extremely powerful and works in situations where the other techniques do not. Often, you can directly exfiltrate data via the out-of-band channel, for example by placing the data into a DNS lookup for a domain that you control.

    Read more

    Blind SQL injection

    How to detect SQL injection vulnerabilities

    The majority of SQL injection vulnerabilities can be found quickly and reliably using Burp Suite’s web vulnerability scanner.

    SQL injection can be detected manually by using a systematic set of tests against every entry point in the application. This typically involves:

    • Submitting the single quote character ' and looking for errors or other anomalies.
    • Submitting some SQL-specific syntax that evaluates to the base (original) value of the entry point, and to a different value, and looking for systematic differences in the resulting application responses.
    • Submitting Boolean conditions such as OR 1=1 and OR 1=2, and looking for differences in the application’s responses.
    • Submitting payloads designed to trigger time delays when executed within a SQL query, and looking for differences in the time taken to respond.
    • Submitting OAST payloads designed to trigger an out-of-band network interaction when executed within a SQL query, and monitoring for any resulting interactions.

    SQL injection in different parts of the query

    Most SQL injection vulnerabilities arise within the WHERE clause of a SELECT query. This type of SQL injection is generally well-understood by experienced testers.

    But SQL injection vulnerabilities can in principle occur at any location within the query, and within different query types. The most common other locations where SQL injection arises are:

    • In UPDATE statements, within the updated values or the WHERE clause.
    • In INSERT statements, within the inserted values.
    • In SELECT statements, within the table or column name.
    • In SELECT statements, within the ORDER BY clause.

    SQL injection in different contexts

    In all of the labs so far, you’ve used the query string to inject your malicious SQL payload. However, it’s important to note that you can perform SQL injection attacks using any controllable input that is processed as a SQL query by the application. For example, some websites take input in JSON or XML format and use this to query the database.

    These different formats may even provide alternative ways for you to obfuscate attacks that are otherwise blocked due to WAFs and other defense mechanisms. Weak implementations often just look for common SQL injection keywords within the request, so you may be able to bypass these filters by simply encoding or escaping characters in the prohibited keywords. For example, the following XML-based SQL injection uses an XML escape sequence to encode the S character in SELECT:

    Second-order SQL injection

    First-order SQL injection arises where the application takes user input from an HTTP request and, in the course of processing that request, incorporates the input into a SQL query in an unsafe way.

    In second-order SQL injection (also known as stored SQL injection), the application takes user input from an HTTP request and stores it for future use. This is usually done by placing the input into a database, but no vulnerability arises at the point where the data is stored. Later, when handling a different HTTP request, the application retrieves the stored data and incorporates it into a SQL query in an unsafe way.

    Second-order SQL injection often arises in situations where developers are aware of SQL injection vulnerabilities, and so safely handle the initial placement of the input into the database. When the data is later processed, it is deemed to be safe, since it was previously placed into the database safely. At this point, the data is handled in an unsafe way, because the developer wrongly deems it to be trusted.

    Database-specific factors

    Some core features of the SQL language are implemented in the same way across popular database platforms, and so many ways of detecting and exploiting SQL injection vulnerabilities work identically on different types of database.

    However, there are also many differences between common databases. These mean that some techniques for detecting and exploiting SQL injection work differently on different platforms. For example:

    • Syntax for string concatenation.
    • Comments.
    • Batched (or stacked) queries.
    • Platform-specific APIs.
    • Error messages.

    How to prevent SQL injection

    Most instances of SQL injection can be prevented by using parameterized queries (also known as prepared statements) instead of string concatenation within the query.

    The following code is vulnerable to SQL injection because the user input is concatenated directly into the query:String query = "SELECT * FROM products WHERE category = '"+ input + "'"; Statement statement = connection.createStatement(); ResultSet resultSet = statement.executeQuery(query);

    This code can be easily rewritten in a way that prevents the user input from interfering with the query structure:PreparedStatement statement = connection.prepareStatement("SELECT * FROM products WHERE category = ?"); statement.setString(1, input); ResultSet resultSet = statement.executeQuery();

    Parameterized queries can be used for any situation where untrusted input appears as data within the query, including the WHERE clause and values in an INSERT or UPDATE statement. They can’t be used to handle untrusted input in other parts of the query, such as table or column names, or the ORDER BY clause. Application functionality that places untrusted data into those parts of the query will need to take a different approach, such as white-listing permitted input values, or using different logic to deliver the required behavior.

    For a parameterized query to be effective in preventing SQL injection, the string that is used in the query must always be a hard-coded constant, and must never contain any variable data from any origin. Do not be tempted to decide case-by-case whether an item of data is trusted, and continue using string concatenation within the query for cases that are considered safe. It is all too easy to make mistakes about the possible origin of data, or for changes in other code to violate assumptions about what data is tainted.

    Resourse : https://portswigger.net/web-security/sql-injection