• Search for:
    10Dec, 2022
    Why is Robust API Security Crucial in eCommerce?

    API attacks are on the rise. One of their major targets is eCommerce firms like yours.

    APIs are a vital part of how eCommerce businesses are accelerating their growth in the digital world.

    ECommerce platforms use APIs at all customer touchpoints, from displaying products to handling shipping. Owing to their increased use, APIs are attractive targets for hackers, as the following numbers expose:

    • API attack traffic increased by 681% in 2021
    • 77% of retail respondents experienced API security incidents in 2021– according to Noname security

    If left unaddressed, API abuse can damage your reputation, harm consumers, and affect the bottom line. Hence API security is worthy of consideration for eCommerce stakeholders.

    Why do eCommerce companies need APIs?

    API makes it easy for retailers and eCommerce platforms to handle product listings and orders. It transformed the static website into a completely customizable headless store. Retailers use APIs for various functions, including login, product catalog, shipping, and subscription.

    It empowers businesses to enhance customer experience. While making purchases, one service handles orders; another calculates tax; another enables shipping, and so on.

    But customers have no idea what is happening behind the screen. API connects these decoupled elements and helps to share data seamlessly.

    Key benefits of APIs in eCommerce

    • It streamlines operations and ensures seamless customer engagements
    • It is effective for data monitoring and analytics, a vibrant factor for retailers
    • It enables communication with chatbots
    • Connects eCommerce platform with 3rd party marketplaces

    Why Is API Security Crucial for Ecommerce?

    APIs are easy to use and integrate for businesses. Even though most APIs are not intended for public use, they often have full access to all sensitive assets and information.

    Customers enter PII while purchasing on online sites like emails, passwords, credit card details, and phone numbers. They also share transaction details like bonuses, balances, and rewards. This increases the opportunity for attackers to steal the data.

    They are easy to expose if not designed and tuned for robust, ongoing security. Inadequate security testing and a lack of business logic have resulted in an overall rise in API security risks.

    Important factors that drive API security concerns are

    Authentication Flaw

    Many APIs not properly checking if the request comes from a legitimate user. Hackers find coding errors in authentication and escalate privileges. They further use enumerated technologies to compromise users’ accounts.

    For instance, some eCommerce platforms integrate with external logistics systems to pass on shipping details. In this situation, if there is an insufficient authentication chain, API can leak PII via replay attacks.

    Automated Attacks #

    Automated attacks on insecure APIs are increasing with the widespread adoption of APIs. Rather than exploiting vulnerabilities in APIs code, hackers exploit business logic flaws within APIs.

    They may feed malicious scripts into bots to access your product details at scale.

    With bad bots overwhelming your site, your genuine user cannot shop on your site. For example, they can snatch the complete inventory of high-demand products within seconds.

    Volumetric attacks against eCommerce API without rate limiting (#4 in OWASP API Security Top 10) can cause shopping apps non-responsive, resulting in user dissatisfaction.

    Shadow and Zombie APIs

    Still, many businesses struggle to separate real transactions from fake. They are also blindsided by unprotected shadow APIs.

    Equally, Zombie APIs are the most common method of attack. Zombie APIs may longer be unmonitored. They can contain malicious codes or may expose sensitive data or functionality.

    Third-party APIs

    E-commerce businesses integrate with 3rd parties like shipping and payment systems. Third-party APIs are challenging to manage. These are the ones that attackers typically target.

    For example, shopping cart API is a prime target as it offers entry points into the business. A leading UK retailer experienced attacks more than 1000 times a day on this API. The attack increased 10-fold times when special offers were running.

    Traditional Security Tools

    Most businesses lack adequate defense capabilities to protect against the ever-evolving API risks. API threats are highly sophisticated and persistent, and traditional methods are ineffective against them.

    Legacy WAF or API gateways need more real-time ability to understand bad from good API activity.

    Hackers can manipulate the discount and promotion APIs during peak times. These tools find it hard to protect against such attacks.

    You will need comprehensive API protection solutions like AppTrana to protect your website and customers’ sensitive information.

    API Security Best Practices for Ecommerce#

    The API threats to eCommerce security are potentially devastating to retailers and customers. For this reason, you must take appropriate measures to address them.

    API Discovery

    The first step is to understand what you have in your API landscape. An inventory of all APIs, including undocumented APIs, is essential if you want to secure what you don’t know about.

    API discovery involves finding and inventorying APIs. 67% of the retail respondents say they lack visibility on API inventory. A good API security solution offers strong API discovery features. It automatically inventories all APIs, including Zombie and shadow APIs.

    Make sure zombie APIs are turned off. After the last customer stops integrating with a deprecated API, ensure the API is turned off. If you’re going to publish API documentation externally, make sure it’s valid and tested, and it’s not exposing vulnerabilities.

    API Security Testing and Penetration Testing#

    Integrate API security at the early stage of the development process. Security enhancement and vulnerability management are key aspects of your API development. Use API security scanners (e.g., Infinite API Scanner) for smooth API vulnerability scans. Make sure to patch the identified vulnerabilities immediately.

    In addition to automated API scanning tools, manual pen testing is vital. It helps you to detect misconfiguration that could otherwise go unseen.

    Proper Authentication and Authorization#

    Validating purchasers who they are and only allowing access to specific resources they have permission for is essential in API security.

    OAuth 2.0, API keys, and Token based authentication are a few API authentication methods to verify users’ identity.

    API Rate Limiting

    According to data, there were 28 API endpoints in 2020 and 89 in 2021, a three-fold increase in API endpoints. A similar increase in API calls is logical. There was a 141% increase in API calls in H1 2021. There has been a corresponding increase in attack surfaces.

    Attackers can make eCommerce sites unavailable for legitimate purchasers with DDoS attacks. With API rate limiting, you can limit the number of requests from overwhelming system resources. It can throttle the request that exceeds the limits. It enables you to make your site available for purchasers without impacting performance.

    API Behaviour and Analytics

    Leverage API protection solution to look for abnormal behaviour in API traffic. Differentiating malicious traffic from normal API traffic can help to detect attacks in progress.

    It also highlights system misbehaviors and other malicious disruptions to your service. It analyzes traffic metadata to pinpoint the attack source. You can use this information to stop the incident and fix the issue in API.

    Tips to protect your eCommerce Site

    • Make sure all third-party integrations and plugins are regularly inspected
    • Help your customers to create strong, unique passwords
    • Ensure that only necessary customer data is stored
    • Always keep your site up-to-date
    • Secure your website with HTTPS
    • Keep a backup of your data

    Ecommerce Security: Plan Ahead to Stay Safe

    An increase in API usage has increased the attack surface, which leaves eCommerce businesses vulnerable. It calls for the immediate requirement to mitigate the API security risks mentioned above.

    Failing to secure an eCommerce platform can directly impact sales. It ruins your reputation. Take immediate measures to win your API security platform.

    Resource : https://thehackernews.com/2022/12/why-is-robust-api-security-crucial-in.html

    9Dec, 2022
    Can You Double CPU Performance by Cooling It With a Chip Instead of a Fan?

    A four-year-old company is coming to market soon with an unexpected technology to cool CPUs and SoCs. Frore Systems has developed a cooling chip it calls AirJet that sits on top of a heat-generating chip and cools it without the need for mechanical fans. It’s 2.8mm thick and uses pulsating inlets to suck air into it and exhaust it out the sides. The company claims its “solid-state” cooling solution allows for double the CPU performance compared with using traditional methods. It’s secured $100 million in funding and is now partnering with Intel to bring its technology to the company’s Evo line of laptops.

    The AirJet is designed to deal with the ever-shrinking nature of our electronic devices. As phones, tablets, and laptops get smaller, cooling them becomes more difficult. When insufficient cooling is applied, a CPU will throttle, lowering its clock speeds to reduce temps. This naturally results in decreased performance. Frore Systems claims its AirJet tackles this problem better than a fan, without taking much room inside the device. The heart of the issue is how long a CPU can maintain its maximum clock speed with peak power consumption.

    CPUs typically have a “tau value” that indicates how long they can boost at maximum power consumption. This is known as the PL2 state, compared with PL1, which is stock power consumption. Once a CPU hits PL2, it can’t maintain that state forever unless there’s adequate cooling. For example, Intel’s Core i9-10900K CPUs can maintain tau for 56 seconds before throttling down. Frore Systems says with AirJet, the tau state can be maintained to infinity in some scenarios. This is how the company arrives at its claim of boosting CPU performance 2X. According to CEO Dr. Seshu Madhavapeddy in an interview with PCWorld, a 1.8GHz ARM processor with four AirJet Minis will be able to run at 3.5GHz “forever.” An AirJet Pro that’s made for x86 could run at PL1 at 2.1GHz instead of 1.4GHz with a fan. Additionally, the AirJet in a 15-inch laptop would produce just 29 dBA of sound, instead of 42 dBA with a fan.

    The AirJet is still considered a heatsink, and it’s a solid-state device like any type of copper heatsink. However, they include membranes inside that vibrate at ultrasonic frequencies. This vibration sucks air into inlets at the top of the AirJet. Once inside the device, air is then transformed into “pulsating jets” as the air removes the heat from the heat spreader. It is eventually exhausted out of the sides via integrated spouts. From there, it’s up to the device maker to find a way to get the heat out of the system entirely.

    For now, the company also is targeting slim, portable devices with its Mini product, including tablets,  laptops, and VR headsets. The AirJet Mini looks like a credit card, and measures 41.5mm long by 27.5mm wide and 2.8mm thick. It can remove 5.25W of heat while consuming just 1W with a very quiet 21 dBA of noise. The AirJet Pro for x86 is a bit larger, naturally. It measures 71.5 mm by 31.5mm at the same 2.8mm thickness. It can exhaust 10.75W of heat while using just 1.75W.

    Frore Systems has also begun working with Intel on an “engineering collaboration.”  This means no money has exchanged hands, but Intel is using its vast resources to assist Frore in getting its product to market, which could happen in 2023. In return, the company has been giving Intel input on changes it could make to the CPU socket area on the motherboard to adopt the technology. It’s been giving Frore engineering targets to work with and invited the company’s members to its Bangalore facility for debugging work. Intel has also been giving Frore Systems guidance on how to work with other companies to integrate its products.

    This concept sounds amazing, at least in theory. The founders of the company have seemingly come up with a clever solution to a big real-world problem. But like every other bit of new-generation technology that comes along with high hopes, we’ll be curious to see if it ever materializes in the real world. Maybe one day we’ll have an AirJet Ultra Extreme attached to our single-slot RTX 5090.

    Resource : https://www.extremetech.com/computing/341252-can-you-double-cpu-performance-by-cooling-it-with-a-chip-instead-of-a-fan

    9Dec, 2022
    What is power over Ethernet?

    Power over Ethernet (PoE) technology allows a twisted-pair Ethernet cable to provide power to electric devices, in addition to data. This is most commonly found in Internet of Things (IoT) devices, like IP security cameras, and greatly simplifies the wiring of any such setup, as it means only one cable is necessary for almost everything. When such devices can be placed in hard-to-reach locations, where running any cabling is cumbersome, it is really handy, not to mention cheaper.

    That’s not everything that makes PoE so useful, though. Here’s everything you need to know about Power over Ethernet.

    What is Power over Ethernet?

    Power over Ethernet is the name given to the overarching technology that facilitates providing power over an Ethernet network connection, as well as data transmission. In reality, PoE is the combination of a device that supports PoE, a standard Ethernet cable, and a network switch with PoE support. It is also possible to use a non-PoE switch, and have a PoE injector between the switch and PoE device, but that injector will require its own main power connection to provide power on the network.

    PoE was initially conceived for use with Voice over Internet Protocol (VoIP phones), allowing them to be powered and connected to a network with a single cable, while also providing the simple ability to remotely shut off such devices when not in use. It has since been extended to provide easier wiring for IP cameras, outdoor radios, IP TVs, network routers, access control points like intercoms and entry card scanners, remote point-of-sale kiosks, and industrial control systems, to name a few.

    Its most common use in most people’s homes, however, is with Wi-Fi access points. This is particularly common on mesh networks, where multiple routers and nodes are required.

    How does Power over Ethernet work?

    All different types of Ethernet cables are made of twisted pairs of copper wires. It’s those pairs that transmit the data and it’s those same pairs that facilitate power transmission down the cable, too. Some of that power is received by the power source device, be that a PoE switch or a PoE injector, and the rest is delivered to any attached PoE devices through the Ethernet cabling.

    There are three standardized techniques for delivering power over Ethernet. They’re known as Alternative A (or Mode A), Alternative B (or Mode B), and 4PPoE. For Alternative A PoE configurations, the power and data are transmitted on the same wires (for 10Mbps and 100 Mbps speeds), while Alternative B transmits the power on separate wires to the data. The 4PPoE standard uses all four pairs of a twisted-pair wiring to transmit power and data. That allows for greater power delivery and network speeds.

    Which Ethernet cables support PoE?

    You don’t need any kind of special cabling to use PoE, but you do need to choose a high enough quality of Ethernet cable that the power and data can be delivered without interference. Although the performance and quality of Ethernet cables can vary dramatically depending on which Ethernet cable you choose, the most recent categories of cables have a minimum quality threshold that ensures you’ll get a reliable PoE connection. With that in mind, Category 5, or Cat 5, Ethernet cables should be considered the minimum cable category used for Power over Ethernet, with more recent generations of cables used for Gigabit Ethernet with PoE or greater bandwidth connections.

    The one caveat with this recommendation is that the cable needs to be made with 100% copper wiring. Some cheaper Ethernet cables are known as CCA, or Copper-Clad Aluminum, and they effectively wrap an aluminum wire in a thin layer of copper. As aluminum is not as good an electrical conductor as copper, it’s recommended not to use CCA Ethernet cables for PoE networking, regardless of the desired bandwidth.

    How much power can PoE provide?

    Although PoE typically provides relatively low-level power for modest connected devices, it can deliver quite a lot of power if necessary, facilitating some more demanding PoE devices. The base Power over Ethernet specification provides up to 15.4 watts of DC power on each port, although that typically reduces to 12.95W at the device, as some power is lost along the length of the cable — and more so in longer cables.

    More recent specifications can provide 25.5W, 51W, or even 71W per port, with each demanding more from the power sourcing equipment, be that a PoE-equipped switch or a PoE injection device.

    How long can PoE cables be?

    Although PoE doesn’t demand any special cabling to work correctly, there are some limitations on cable length. Different Ethernet cables support different data rates at different lengths, but PoE is also limited to 100 meters. However, while you are limited to 100m per Ethernet cable on a PoE network, you can extend that power-delivery mechanism using PoE extenders. You install them on the line between the power source device and the networked device, giving you the option of adding a further 100m of Ethernet cable to the network.

    PoE extenders are not injectors, so do not require a power connection of their own, but they do make sure the power is maintained throughout the network. However, they don’t fully replicate the power from the original source, with the extender itself requiring some power to operate. This results in the power delivered to the eventual endpoint device being lower than if it were simply attached directly to the power source device over a shorter cable run.

    With this in mind, you can technically use multiple PoE extenders over the length of the network to further extend its reach, but each extender saps more power, leaving less for the eventual PoE device. This is exacerbated if you use an extension splitter, which funnels the Power over Ethernet connection to multiple endpoint devices.

    Resource : https://www.digitaltrends.com/computing/what-is-power-over-ethernet/

    8Dec, 2022
    What Is the Service Host Process (svchost.exe) and Why Are So Many Running?

    The Service Host process (svchost.exe) is a shell for loading services from DLL files. Services are organized into groups, and each group is run inside a different instance of the Service Host Process. There are usually many instances of svchost.exe running because Windows requires numerous services to operate correctly.

    If you’ve ever browsed through Task Manager, you may have wondered why there are so many Service Host processes running. You can’t kill them, and you sure didn’t start them. So, what are they?

    This article is part of our ongoing series explaining various processes found in Task Manager, like dwm.exe, ctfmon.exe, mDNSResponder.exe, conhost.exe, rundll32.exe, Adobe_Updater.exe, and many others. Don’t know what those services are? Better start reading!

    What Is the Service Host Process?

    Here’s the answer, according to Microsoft:

    Svchost.exe is a generic host process name for services that run from dynamic-link libraries.

    But that doesn’t really help us much. Some time ago, Microsoft started changing much of the Windows functionality from relying on internal Windows services (which ran from EXE files) to using DLL files instead. From a programming perspective, this makes code more reusable and arguably easier to keep up to date. The problem is that you can’t launch a DLL file directly from Windows the same way you can an executable file. Instead, a shell that is loaded from a executable file is used to host these DLL services. And so the Service Host process (svchost.exe) was born.

    Why Are There So Many Service Host Processes Running?

    If you’ve ever taken a look at the Services section in Control Panel, you’ve probably noticed that Windows requires a lot of services. If every single service ran under a one Service Host process, a failure in one service could potentially bring down all of Windows. Instead, they are separated out.

    Services are organized into logical groups that are all somewhat related, and then a single Service Host instance is created to host each group. For example, one Service Host process runs the three services related to the firewall. Another Service Host process might run all the services related to the user interface, and so on. In the image below, for example, you can see that one Service Host process runs several related network services, while another runs services related to remote procedure calls.

    Service Host Process running Remote Procedure Call Services.

    Is There Anything For Me To Do With All This Information?

    Honestly, not a lot. In the days of Windows XP (and previous versions), when PCs had much more limited resources and operating systems weren’t quite as fine-tuned, stopping Windows from running unnecessary services was often recommended. These days, we don’t recommend disabling services anymore. Modern PCs tend to be loaded with memory and high-powered processors. Add that to the fact that the way Windows services are handled in modern versions (and what services run) has been streamlined, and eliminating services you think you don’t need really doesn’t have much of an impact any more.

    That said, if you notice that a particular instance of Service Host—or a related service—is causing trouble, like continual excessive CPU or RAM usage, you could check into the specific services that are involved. That might at least give you an idea of where to start troubleshooting. There are a few ways to go about seeing exactly what services are being hosted by a particular instance of Service Host. You can check up on things within Task Manager or using a great third-party app named Process Explorer.

    Check Related Services in Task Manager

    If you’re using Windows 8 or 10, processes are shown on the “Processes” tab of Task Manager by their full names. If a process serves as a host for multiple services, you can see those services by simply expanding the process. This makes it very easy to identify which services belong to each instance of the Service Host process.

    You can right-click any individual service to stop the service, view it in the “Services” Control Panel app, or even search online for information about the service.

    If you’re using Windows 7, things are a bit different. The Windows 7 Task Manager did not group processes the same way, nor did it show regular process names—it only showed all the instances of “svchost.exe” running. You had to explore a bit to determine the services related to any particular instance of “svchost.exe.”

    On the “Processes” tab of Task Manager in Windows 7, right-click on a particular “svchost.exe” process, and then choose the “Go to Service” option.

    This will flip you over to the “Services” tab, where the services running under that “svchost.exe” process are all selected.

    The Windows 7 Task Manager with all of the services running under

    You can then see the full name of each service in the “Description” column, so you can choose to disable the service if you don’t want it running or troubleshoot why it’s giving you problems.

    Check Related Services Using Process Explorer

    Microsoft also provides an excellent advanced tool for working with processes as part of its Sysinternals lineup. Just download Process Explorer and run it—it’s a portable app, so no need to install it. Process Explorer provides all kinds of advanced features—and we highly recommend reading our guide to understanding Process Explorer to learn more.

    For our purposes here, though, Process Explorer groups related services under each instance of “svchost.exe.” They’re listed by their file names, but their full names are also shown in the “Description” column. You can also hover your mouse pointer over any of the “svchost.exe” processes to see a popup with all the services related to that process—even those that aren’t currently running.

    Could this Process Be a Virus?

    The process itself is an official Windows component. While it’s possible that a virus has replaced the real Service Host with an executable of its own, it’s very unlikely. If you’d like to be sure, you can check out the underlying file location of the process. In Task Manager, right-click any Service Host process and choose the “Open File Location” option.

    If the file is stored in your Windows\System32 folder, then you can be fairly certain you are not dealing with a virus.

    Resource : https://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/

    7Dec, 2022
    Adobe Will Accept Stock Art Generated by AI

    Until recently, you needed some degree of artistic skill to create a piece of digital art, but artificial intelligence is changing that. Now, all you have to do is click a few buttons to generate new art, and that has put stock image providers in a tight spot. Fearing abuse and copyright issues, some image repositories have banned AI-generated art, but Adobe is willing to take a risk. It will allow AI art in the  Adobe Stock collection, but there will be some strict limitations.

    When uploading AI-generated art from services like DALL-E, Adobe will require contributors to mark their creations as “Generative AI illustrations.” That goes for photorealistic images as well as abstract illustrations. It also requires that contributors refrain from clogging the service with repetitive or low-quality AI art. Many of these services will spit out multiple versions of each prompt, and few of them are actually good enough to be offered on services like the Adobe Stock collection.

    Some image hosts like Getty have outright banned AI-generated art because the copyright implications are still unclear. Anyone who wants to upload AI-generated content to Adobe Stock for licensing needs to abide by the same basic copyright rules as traditional art. That means no identifiable property like famous characters or logos. Adobe also warns people to stay away from AI generators with known issues that could run afoul of copyright by borrowing too heavily from source material.

    Adobe also stresses that just because a computer created a piece of art, that doesn’t mean you’re free and clear to use it. The company will still require model releases if AI-generated art portrays (or is intended to portray) an identifiable person. However, you can at least use the same release for multiple images within the same AI-generated series, provided you don’t disregard the requirement for high-quality submissions.

    The rise of AI-generated art is causing many to rethink what even counts as art. Is there an “artist” involved at any point? Is it the person who typed the prompt? The programmer? The computer itself? These questions will only come up more as the systems generating art get better, and they’re already very impressive — it’s getting hard to tell it apart from “real” art created by people. Someone even managed to win first prize at the Colorado State Fair’s fine art competition. It’s a brave new world for artists when a keyboard is as good as a canvas.

    Resource : https://www.extremetech.com/extreme/341360-adobe-will-accept-stock-art-generated-by-ai

    7Dec, 2022
    NASA’s Mars helicopter has just set a new flight record

    NASA’s plucky Ingenuity helicopter set a new flight altitude record on Mars on Saturday.

    In a mission lasting 52 seconds, the 4-pound, 19-inch-tall machine reached a height of 46 feet over the martian surface while traveling a distance of 49 feet.

    While most of Ingenuity’s 35 flights on the red planet have reached a peak altitude of 33 feet, the weekend excursion by the drone-like device topped the existing record of 39 feet achieved on three separate flights last year.

    Ingenuity reached Mars with NASA’s Perseverance rover in a spectacular arrival captured in high-definition video in February 2021.

    Two months later, following a period of ground-based tests, Ingenuity became the first aircraft to achieve powered, controlled flight on another planet with a 39-second hover 10 feet off the ground. Its longest flight to date covered a distance of 2,325 feet in a mission in April 2022.

    Although the helicopter was sent to Mars to merely test the viability of using such a machine for future planetary missions, Ingenuity performed so well that NASA started using it to assist the ground-based Perseverance rover as it searches for evidence of ancient life on the planet.

    The aircraft helps by using its downward-facing camera to search for areas of interest for Perseverance to explore. The aerial vantage point also allows the team to use the imagery to find the safest and most efficient routes for Perseverance to take as it makes its way across the rocky surface to different exploration sites.

    Ingenuity’s record-breaking flight came 11 days after the flying machine set another record, for the shortest flight in Mars aviation history when it hovered 16 feet off the ground for a mere 18 seconds. The mission was an important one, however, as it gave the team a chance to test two new capabilities, specifically, hazard avoidance for landings and digital elevation maps to aid navigation.

    Resource : https://www.digitaltrends.com/space/nasa-mars-helicopter-new-flight-record/

    6Dec, 2022
    Severe AMI MegaRAC flaws impact servers from AMD, ARM, HPE, Dell, others

    Three vulnerabilities in the American Megatrends MegaRAC Baseboard Management Controller (BMC) software impact server equipment used in many cloud service and data center providers.

    The flaws were discovered by Eclypsium in August 2022 and could enable attackers, under certain conditions, to execute code, bypass authentication, and perform user enumeration.

    The researchers discovered the flaws after examining leaked proprietary code of American Megatrends, specifically, the MegaRAC BMC firmware.

    MegaRAC BMC is a solution for complete “out-of-band” and “lights-out” remote system management, allowing admins to troubleshoot servers remotely as if standing in front of the device.

    MegaRAC BMC firmware is used by at least 15 server manufacturers, including AMD, Ampere Computing, ASRock, Asus, ARM, Dell EMC, Gigabyte, Hewlett-Packard Enterprise, Huawei, Inspur, Lenovo, Nvidia, Qualcomm, Quanta, and Tyan.

    Vulnerability details

    The three vulnerabilities discovered by Eclypsium and reported to American Megatrends and impacted vendors are the following:

    • CVE-2022-40259: Arbitrary code execution flaw via Redfish API due to improper exposure of commands to the user. (CVSS v3.1 score: 9.9 “critical”)
    • CVE-2022-40242: Default credentials for sysadmin user, allowing attackers to establish administrative shell. (CVSS v3.1 score: 8.3 “high”)
    • CVE-2022-2827: Request manipulation flaw allowing an attacker to enumerate usernames and determine if an account exists. (CVSS v3.1 score: 7.5 “high”)

    The most severe of the three flaws, CVE-2022-40259, requires prior access to at least a low-privileged account to perform the API callback.

    “The only complication is the attack sits in the path parameter, but it is not URLdecoded by the framework, so the exploit needs to be crafted specially to both be valid per URL and valid per bash shell command,” says Eclypisum.

    For the exploitation of CVE-2022-40242, the only prerequisite for the attacker is to have remote access to the device.

    Impact

    The first two flaws are very severe due to giving attackers access to an administrative shell without requiring further escalation.

    The vulnerabilities could cause data manipulation, data breaches, service outage, business interruption, and more if successfully leveraged.

    The third flaw doesn’t have a significant direct security impact, as knowing what accounts exist on the target isn’t enough to cause any damage.

    However, it would open the way to brute-forcing passwords or performing credential-stuffing attacks.

    “As data centers tend to standardize on specific hardware platforms, any BMC-level vulnerability would most likely apply to large numbers of devices and could potentially affect an entire data center and the services that it delivers,” comments Eclypsium in the report.

    “Standardization of hosting & cloud providers on server components means these vulnerabilities can easily impact hundreds of thousands, possibly millions of systems.”

    System admins are recommended to disable remote administration options and add remote authentication steps where possible.

    Additionally, admins should minimize the external exposure of server management interfaces like Redfish and ensure that the latest available firmware updates are installed on all systems.

    Resource : https://www.bleepingcomputer.com/news/security/severe-ami-megarac-flaws-impact-servers-from-amd-arm-hpe-dell-others/

    6Dec, 2022
    How Windows 11’s Enhanced Phishing Protection guards your password

    One of the easier ways to steal a user’s credentials is through a convincing fake login page or application. An unwitting user can quickly give an attacker the crucial “in” to an organization’s systems with the everyday act of entering their password in the wrong place.

    Often a phishing attempt shows up in the form of an email that looks dangerously close to the real thing and directs a user to a fake login page. The truly convincing phishing attempts mimic the logos, verbiage, and layout down to the pixel.

    Often, the only giveaway is the URL, but there are ways to obfuscate and hide this as well.

    Protecting Users with Enhanced Phishing Protection in Windows 11

    To help combat the constant risk of password theft, Microsoft added phishing protection in Windows 11 Version 22H2.

    When enabled, Enhanced Phishing Protection is offered through Microsoft Defender SmartScreen. But what does this actually offer for users?

    Enhanced Phishing Protection inspects the URLs and any running processes to evaluate whether the site or application appears to possibly host malicious content or is insecure.

    If so, SmartScreen leverages telemetry data from a multitude of Microsoft security products to notify the user and block the offending site or application.

    As this integration is deeply integrated into Windows through operating system-level integration with Microsoft Defender, a deeper inspection of processes and URLs is available than many competing products offer. In addition, Enhanced Phishing Protection is offered as a baked-into Windows 11 capability without needing an additional install or license.

    If Enhanced Phishing Protection detects a user entered their Windows password into a website or an application, an alert and prompt are shown warning the user to change their password.

    If the password is simply entered into an application like notepad, the protection recommends that the user delete their password from that file.

    Windows 11 warning when you enter your password in Notepad

    This proactive approach helps keep users safe and doesn’t allow a potential attacker to take advantage of their newfound credentials.

    Real-World Consequences of Phishing Attacks

    Phishing campaigns are becoming all too easy for threat actors to create.

    A Phishing-as-a-Service (PhaaS) platform named Caffeine offers open registration and focuses on Microsoft 365 logins but with a subscription model and anti-detection and anti-analysis protections.

    The speed at which a new threat actor can attempt a realistic phishing attempt on a victim is becoming difficult to contend with.

    A real-world example of this is American Airlines. They found that an employee’s Microsoft 365 account was hacked. From this vantage point, multiple employee accounts were accessed and leveraged to send even more phishing emails from within the organization.

    In filings, the data breach appeared to affect over 1,700 employees and customers. American Airlines now has to offer compensation and protection against future threats. Not to mention the time investment it will take to secure and handle the damage done by the phishing attack.

    What to Consider While Configuring Enhanced Phishing Protection

    As with most solutions, there are several caveats. This integration only works with non-Windows Hello logins. If you do not use a password to sign into your computer, then the Enhanced Protection is unavailable.

    In addition, the browser-level integration only works with Chromium-based browsers at this time, which leaves Firefox out of the equation and Opera. As Microsoft Edge is Chromium-based, this makes sense for Microsoft but may not fit every organization’s requirements.

    For system administrators, the Enhanced Phishing Protection is configurable via Group Policy which makes organization-wide rollouts easier.

    These include settings such as whether to enable the feature, whether or not to notify a user of a malicious website, whether a password has been reused, or if an unsafe application has been detected.

    For those using Microsoft Endpoint Manager, add Enhanced Phishing Protection to your users with a profile and the relevant settings. Adding to that, those organizations using Microsoft 365 Defender view alerts in the Defender for Endpoint portal.

    The Other Side of the Coin: Specops Password Policy

    Microsoft’s Enhanced Phishing Protection is only part of the equation; keeping track of passwords and blocking weak ones is the other side of actively protecting users and your organization.

    With Specops Password Policy, you gain a constantly updated breached/stolen password list and powerful and customizable password policies.

    Phishing attacks resulting in lost passwords make quick work of infiltrating an organization. But, an organization with Enhanced Phishing Protection paired with Specops Password Policy and Breached Password List functionality ensures that your users stay safe.

    By scanning your accounts against a constantly updated list of over 3 billion+ breached passwords, when a stolen password is added to the list, you can take fast action and remove the potential vulnerability from your environment.

    With the Specops Authentication Client, upon password changes, instantly inform your users as to why their password won’t work, even more so if the password has been stolen through a sophisticated phishing scam.

    Specops Passwords offers much more than breached password protections; a slew of features exist to secure accounts and protect users from costly mistakes. Make sure that your users are using secure passwords by auditing existing accounts and providing invaluable feedback to make sure that your users know exactly what is expected.

    A few of the valuable features Specops Password Policy has:

    • Use custom dictionary lists to add words common to your organization.
    • Block user names, display names, specific words, consecutive characters, incremental passwords, and the reuse of a part of the current password.
    • Take advantage of granular GPO-driven targeting for any organizational unit (OU), computer, user, or group population.
    • Use Regular Expressions to customize requirements further.
    • Use helpful end-user client messaging at failed password changes.

    Combine Microsoft’s Enhanced Phishing Protection and Specops Password Policy to protect both your users and your environment. You can test out Specops Password Policy in your Active Directory for free, here.

    Resource : https://www.bleepingcomputer.com/news/microsoft/how-windows-11s-enhanced-phishing-protection-guards-your-password/

    5Dec, 2022
    7 Emerging IoT Tech Trends
    Matthew Margetts, Director of Smarter Technologies takes a look at the burgeoning world of IoT by highlighting seven use-cases where we’re already seeing the tech proliferate.

    The Internet of Things (IoT) is becoming a household name – and one that has found unique applicability in not only our homes, but in our businesses, workplaces, and cities. The number of installed IoT devices is expected to surge to around 30.9 billion units by 2025. The myriad of different forms of technology has the potential to provide incredible business value.

    They are vital tools for digital transformation and datafication – and their power lies in performance improvements, as well as problem-solving capabilities. IoT’s importance as a technology trend this year and into the future is the role it plays in the successes of other technologies. For business owners looking to drive evolution, keeping a finger on the pulse of the latest IoT trends is important for agility into 2023 and beyond.

    What is IoT?

    Broadly speaking, IoT is the ecosystem of internet-connected smart devices and technologies in our homes, cities, and workplaces that continuously collect data.

    IoT facts and figures in 2022 and beyond:

    ●There are more than seven billion connected IoT devices currently in operation.

    ●By 2030, 75% of all devices are expected to be IoT.

    ●Worldwide IoT spending is anticipated to reach $1 trillion and this growth rate is predicted to continue in 2023 and beyond.

    Why is IoT Important?

    A quick view of the benefits of IoT in business:

    ●IoT solutions help to build resilient supply chains

    ●Improved health, wellbeing, safety, and security

    ●Optimised asset usage and maintenance

    ●Reduced overheads

    ●Improved communication and engagement

    ●Meaningful sustainability and environmental advances

    Seven IoT Tech Trends

    1. Remote Monitoring

    According to McKinsey, the Covid-19 pandemic accelerated the adoption of digital technologies by seven years. Off the back of global lockdowns, this naturally includes the requirement for remote monitoring and the move towards automated systems. These IoT-based technologies are being adopted to transform everything from building monitoring and machine performance to building occupancy and machine learning.

    2. Modular Smart Technologies Solutions

    The preference for individual devices performing multiple functions has given way to networks of devices. This network of devices creates a modular system of individual utilities and processes. The result is a granular view of whole operations, which works toward holistic network benefits.

    3. Data Analysis

    Data is arguably one of the top strategic tools for businesses. High-quality data plays a role in designing business strategy (what can be monitored can be more effectively managed) and ensuring the integrity of supply chains. Through alerts around deviations from “normal” data sets, real-time action is also inspired, which can avert disaster and save costs.

    Data also has the ability to inspire high-level compliance, machine learning, customer service, maintenance schedules, safety and security. Additionally, it gives invaluable insights for the purposes of gauging return on investment and preventing wastefulness.

    4. Artificial Intelligence, Machine Learning, and Visual Inspection

    The concepts of artificial intelligence, machine learning, visual inspections, and automation are becoming increasingly commonplace. These functions are all best guided by data insights – removing the unpredictability and margin of error from human processes.

    5. Advanced Networks

    As IoT technologies evolve, so too do the networks around them. Improved speed, security, and reliability of networks and connectivity infrastructure are the precursor to IoT sensors, wearables, smart cities and homes.

    6. Smart Buildings, Smart Cities

    IoT and smart technologies are being used to optimise various functions within the city environment. This is being done as a means of creating a more engaged public and improving everything from public transport systems to responsible and environmentally conscientious resource utilisation.

    IoT technologies and smart technology solutions have also found their way into businesses, buildings, healthcare, retail, agriculture, and manufacturing. IoT technologies stand to have a bearing on many different facets of these different sectors.

    This includes vaccination cold chains, predictive maintenance for enhanced equipment management, transport and logistics. The applications are endless – and are easily tailored to the specifics of a project or long-term strategic objective.

    7. Digital Twins

    Digital twins are virtual replicas of a physical product, process, or system that bridge the physical and digital worlds. Today’s digital twins use sensors to collect real-time data about a physical item, which is used to create a virtual duplicate of the item. The digital duplicate can be optimised, manipulated and analysed to test different scenarios in a risk-free environment.

    What are the Challenges for IoT?

    According to Kaspersky research published in the first quarter of 2022, 43% of businesses have unprotected IoT infrastructure – and cybersecurity concerns remain a barrier to IoT systems implementation (as reported by 57% of surveyed businesses).

    As IoT devices become more prevalent – and as our reliance on them increases – so security concerns take on renewed importance. Gartner reports that 20% of organisations have experienced cyber attacks on IoT devices over the past three years.

    The supply of semiconductor chips for IoT solutions has been put under strain by the high demand in recent times, resulting in a chip shortage. This is expected to limit IoT growth by 10-15% in 2022. The good news is that public and private sector efforts by the European Union are designed to meet the challenges of the shortage and make way for achieved growth potential.

    Traditionally, the optimal effectiveness and speed of data transmission of IoT technologies has hinged on bandwidth capabilities. Network advances will ensure not only that data is transmitted in real time as required by many applications, but also that this process is done securely.

    Resource : https://www.digit.fyi/7-emerging-iot-tech-trends/

    5Dec, 2022
    Deserialized web security roundup: Algolia API key leak, GitHub CVE reporting, scoring CVSS scores

    Our inaugural web security roundup begins with the news that thousands of applications were found to be leaking API keys for Algolia.

    Algolia technology is used by the likes of Lacoste, Stripe, and Slack, to incorporate search, discovery, and recommendations into web, voice, and mobile applications.

    Researchers from CloudSEK found 1,500 apps leaking Algolia API keys, 32 of which had hardcoded keys that could allow attackers to steal or delete the data of millions of users. Vulnerable data included IP addresses, access details, and analytics data.

    Meanwhile, maintainers of open source repositories can now receive private vulnerability reports, remediate them, and issue CVEs via GitHub, the Microsoft-owned software development platform announced at the GitHub Universe conference.

    The news went down well with at least one infosec pro, with vulnerability researcher and The Daily Swig interviewee Alex Chapman calling it an “amazing feature”.

    Staying with vulnerability management, the US Cybersecurity and Infrastructure Security Agency (CISA) has set out a three-step process for enhancing vulnerability management, including leveraging the vulnerability exploitability exchange (VEX), a form of security advisory index recently featured on The Daily Swig that focuses on the exploitability of flaws within applications.

    CISA has also published a study on the effectiveness of the CVSS base score equation that concluded that the metric closely – albeit not perfectly – represents the CVSS maintainers’ expert opinion.

    The Daily Swig also recently reported on system config issues in flavor-of-the-month social networking platform Mastodon, Tailscale VPN nodes being vulnerable to DNS rebinding, and how the Go SAML library was affected by an authentication bypass, among other news.

    Here are some more web security stories and other cybersecurity news that caught our attention in the last fortnight:

    Web vulnerabilities

    • Apache Commons BCEL / CVE-2022-42920 / CVSS 9.8 / Out-of-bounds writing issue impacting APIs could give attackers greater control of resulting bytecode
    • Apache MINA SSHD / CVE-2022-45047 / CVSS 9.8 / Unsafe Java deserialization / Patched
    • Flarum / CVE-2022-41938 / CVSS 9.0 / cross site-scripting XSS allowed injection of malicious HTML markup using discussion title input, either by creating a new discussion or renaming one / Patched November 21
    • TiDB / CVE-2022-3023 / CVSS 9.8 / Data source name injection could lead to arbitrary file reads / Patched November 17

    Research and attack techniques

    • Sonar published a three-part series documenting vulnerabilities in IT Infrastructure monitoring tool Checkmk and its NagVis integration. These flaws could be chained to seize control of servers
    • Platform certificates used to sign system apps on Android builds have been maliciously leaked and used to sign malicious Android apps – “Folks, this is bad. Very, very bad”, tweeted one Android expert
    • Software engineer Tom Forbes uncovered a serious oversight by IT firm Infosys whereby a file was accidentally published to PyPi – and accessible for more than a year – containing AWS keys to an S3 bucket potentially containing patient data from Johns Hopkins University
    • Cybercriminals are tricking TikTok users into downloading malware with the promise of removing invisibility filters from nude photos, Checkmarx reveals – with TikTok videos posted by the attacker gathering over a million views in just two days
    • Hacker extraordinaire Sam Curry revealed that he was part of a team that uncovered 100 vulnerabilities – 50 rated critical – on agricultural equipment supplier John Deere’s security program, with technical details in the pipeline

    Bug bounty / vulnerability disclosure

    • HackerOne’s leading Australian hacker and number 30 on its worldwide leaderboard Shubham Shah has published a deep dive on what it takes to succeed as a bug bounty hunter
    • Belgium-based bug bounty and pen testing platform Intigriti launched a Bug Bounty Calculator, as reported in our monthly Bug Bounty Radar
    • Idaho launched a vulnerability disclosure policy for election websites, becoming the fourth US state to launch a vulnerability disclosure policy, reports Statescoop

    New open source infosec/hacking tools

    • Mi-X – Determines your system’s potential vulnerability to flaws by evaluating runtime execution, configuration, permissions, mitigations, OS, and other relevant variables
    • GuardDog – Identifies malicious Python packages using Semgrep and package metadata analysis
    • Legitify – Detect and remediate misconfigurations plus security and compliance issues across your GitHub assets
    • inTheWild – Vulnerability feed that documents reports of CVEs being exploited in the wild
    • APTRS (Automated Penetration Testing Reporting System) – Python and Django tool for tracking projects and vulnerabilities and creating reports without using DOCX files

    For devs

    • The US’s National Security Agency (NSA) has released guidance (PDF) urging developers to abandon “programming languages that provide little or no inherent memory protection, such as C/C++, to a memory safe language when possible”

    Resource : https://portswigger.net/daily-swig/deserialized-web-security-roundup-algolia-api-key-leak-github-cve-reporting-scoring-cvss-scores