• Search for:
    5Jun, 2024
    Hyperspectral and Multispectral Remote Sensing in Industrial Automation

    Hyperspectral and multispectral are advanced imaging technologies that capture detailed data across a broad spectrum of light far beyond the capabilities of traditional cameras. The comprehensive data collected offers a detailed analysis of materials and processes, unveiling characteristics invisible to the naked eye. In the realm of automation, these capabilities are employed to enhance quality control, improve efficiency in material handling, and inform predictive maintenance. Collectively, these technologies empower industries with deeper insights and analytics, leading to smarter, more informed decision-making and streamlined operations in various sectors.

    Understanding Hyperspectral and Multispectral Imaging

    The origins of hyperspectral and multispectral imaging can be traced back to remote sensing and space applications. Initially developed for satellite imaging and earth observation, these methods have transitioned into the industrial domain, offering unprecedented insights into precision manufacturing, quality control, and process monitoring.

    Hyperspectral imaging involves capturing light across hundreds or thousands of narrow, contiguous spectral bands. Each pixel in a hyperspectral image contains a full spectrum of information, enabling detailed analysis of materials and processes.  Hyperspectral imaging provides more detailed information than multispectral imaging, requiring more sophisticated data processing and analysis.

    Multispectral imaging uses broader spectral bands and captures less spectral detail per pixel,  providing quicker data acquisition and simpler analysis, making it suitable for real-time applications. 

    The choice between these technologies depends largely on the specific requirements of the application at hand.

    The integration of these technologies with robotic automation and AI algorithms enhances their utility. Robots equipped with hyperspectral cameras can perform intricate sorting tasks, while AI-driven analysis can quickly interpret complex hyperspectral data for real-time decision-making.

    Applications in Factory and Industrial Automation

    Hyperspectral and multispectral imaging technologies have become integral tools, contributing significantly to various aspects of industrial operations. Key areas in which they are applied include:

    Quality Assurance
    Hyperspectral imaging is used to inspect products and materials with a level of detail not possible with traditional imaging techniques. Capturing images across a wide spectrum of light allows for the identification of minute variations in material composition, color, texture, or even the presence of contaminants.

    Specim, Spectral Imaging Ltd. is the world’s leading hyperspectral imaging solutions provider. In the food industry, their hyperspectral cameras identify nut types by their spectral signatures, leading to more accurate sorting than conventional RGB cameras. Faulty nuts and foreign objects are identified and removed from the production line, ensuring product purity.  

    Material Handling
    Hyperspectral imaging facilitates the sorting and classification of materials based on their spectral signatures, which is particularly valuable in recycling operations, where different types of materials need to be accurately sorted for efficient processing. Hyperspectral cameras can differentiate between various types of plastics, papers, and metals, ensuring materials are recycled correctly, improving recycling processes’ efficiency, and reducing waste’s environmental impact.

    Waste Robotics integrates advanced technologies to enhance recycling operations. Leveraging Specmin’s SpecimONE hyperspectral camera processing and training platform provides insights into materials’ chemical compositions and improves object detection and classification accuracy.

    Safety Monitoring
    Hyperspectral imaging provides a unique advantage in safety monitoring by detecting potential hazards that are not visible to the naked eye. In industrial environments, this can mean the early detection of gas leaks, overheating equipment, or hazardous material spills. Hyperspectral cameras can identify specific spectral signatures of gasses or other substances, allowing for the immediate identification and localization of leaks or spills. This early detection is crucial for preventing accidents, ensuring worker safety, and minimizing environmental damage.

    Environmental Compliance
    In terms of environmental compliance, hyperspectral imaging plays a critical role in monitoring and ensuring adherence to environmental regulations. This technology can be used to monitor emissions, detect pollutants, and assess environmental health. Hyperspectral cameras mounted on drones or satellites can survey large industrial areas or natural environments, identifying areas of pollution or environmental degradation. By providing detailed spectral information, these systems enable companies to monitor their impact on the environment more effectively and take corrective actions to comply with regulatory standards.

    Predictive Maintenance
    In predictive maintenance, hyperspectral imaging offers a proactive approach to equipment maintenance. By capturing detailed spectral information, these systems can identify subtle changes in machinery, such as signs of wear, corrosion, or overheating, before they lead to failure. This early detection allows maintenance teams to address issues before they result in costly downtime. In addition, ongoing monitoring of equipment using hyperspectral imaging can provide valuable data for predicting future maintenance needs, optimizing maintenance schedules, extending the lifespan of machinery, saving time and resources, and enhancing overall operational efficiency.

    Advancements, Trends, and Challenges

    AI and Machine Learning Integration:
    The incorporation of AI and machine learning algorithms is a game-changer, enhancing the capabilities of hyperspectral and multispectral imaging systems. AI algorithms can efficiently process vast amounts of spectral data, enabling real-time analysis and decision-making. This integration is paving the way for autonomous industrial systems that can adapt and respond to changing conditions with minimal human intervention.

    Emerging Trends
    The future of hyperspectral and multispectral imaging in industrial automation is intertwined with the advancements in IoT and edge computing. These technologies enable the deployment of smarter, interconnected systems that can communicate and make decisions at the edge, reducing the need for central processing and allowing for more responsive and efficient operations.

    Overcoming Barriers
    While these advancements promise significant benefits, they also bring challenges in terms of data management, system complexity, and integration with existing industrial infrastructures. Implementation costs can be significant. The successful adoption of these technologies will depend on developing solutions that are not only technologically advanced but also user-friendly and easily integrated into existing workflows.

    The integration of hyperspectral and multispectral imaging technologies into industrial automation represents a significant leap forward in manufacturing and process control. These technologies, with their ability to provide detailed insights into materials and processes, are set to play a pivotal role in the future of industrial automation. As they continue to evolve, their applications are expected to expand, offering new opportunities for enhancing efficiency, precision, and quality across various industrial sectors.

    Ref: Link
     

    1Jun, 2024
    Audi virtualizes factory with software PLCs

    Audi has implemented virtual PLCs at one of its plants, with the aim of reducing the variety and number of hardware devices needed and converting applications to run in software thus making production faster, more robust, and more flexible.

    A key aim of the German car-maker Audi is to have stable and consistently available production facilities where it can build as many cars as possible. But to speed up the integration of innovations from the rapidly developing world of IT, and to optimize production continuously, this production needs to become more IT-oriented.

    A major challenge for Audi is the wide variety of devices that it uses. To adapt production to increasing customer demand, more hardware devices must be installed. However, in recent years, delivery periods have become stretched. Often, updates have to be installed manually on the hardware devices and maintenance can be costly, but both are necessary to ensure cybersecurity. Power consumption is also high. As more hardware devices are installed, more power is consumed, affecting energy efficiency.

    To meet these challenges, Audi realized that it needed to merge IT and OT in its production environments by virtualizing the shop floor. It has therefore created a new software-based infrastructure modeled on how data centers are implemented.

    The lowest level of the infrastructure is always the same and lays the foundation for various applications. With its Edge Cloud 4 Production platform, Audi has transferred this principle to production and has revolutionized automation on its shop floor, including the use of virtual PLCs.

    The platform has been created by a team of IT and OT specialists who’ve designed a private cloud infrastructure that covers all of the production requirements in a factory. Applications run in this cloud as software – including Siemens’ Simatic S7-1500V virtual PLC.

    After some initial debate about how IT-based production should be designed, it quickly became clear that a large-scale concept was required. It took about three years to evaluate its feasibility and perform the necessary tests. This period was needed to define requirements, test conditions, and talk to the manufacturers of the necessary components. This way, the partners in the virtual PLC project were already benefitting from each other early on: Audi from Siemens’ expertise in the field of automation engineering, and Siemens from Audi’s feedback. The technologies also needed to be modified: for example, to establish the real-time capability of the lower-level infrastructure.

    Software-driven factory automation is only feasible if suitable software-based controllers are available. Audi needed a virtual PLC that would be compatible with its Edge Cloud 4 Production platform and could be integrated into its existing automation environments.

    “The virtual PLC represents a revolution in automation engineering and industry, making it possible to rethink a factory and its infrastructure,” says Sven Müller, project manager for Edge Cloud 4 Production at Audi.

    The Simatic S7-1500V virtual PLC was first tested successfully in Audi’s production laboratory. Part of the line being used to produce Audi’s e-tron GT high-performance electric car at the company’s Böllinger Höfe plant in Neckarsulm was then chosen as suitable for the initial commissioning of the virtual PLC in a production environment. The line’s small-series manufacturing was ideal for testing the new technologies.

    Working with Siemens, Audi performed tests at the plant to learn about the on-site setup and to discover if there were any challenges that might hamper the implementation. This cautious approach helped to increase employee acceptance. The growing number of successful tests boosted Audi’s confidence in the virtual PLC.

    “Naturally, employees were initially skeptical and expressed reservations,” acknowledges Robin Fallmann, who is involved in production planning for automation engineering at Audi. “This was our motivation for making the rollout planning for the overall project as detailed and predictable as possible.”

    Before commissioning the technology in a working production environment, there was a preparatory phase, lasting several months, during which servers were built, the network was planned, components were installed, and connections to the industrial edge were set up.

    According to Pascal Schirmer, the member of the Edge Cloud 4 Production team who was mainly responsible for the initial implementation, the preparatory phase was successful because all of the participants had agreed on clear goals, and each of them had invested the time needed to achieve the agreed milestones on schedule. The experience will contribute to the implementation of subsequent rollouts, he adds.

    Implementation

    The virtual PLC was introduced in the spring of 2023. At the time, Audi was already starting to convert its first assembly plant to Edge Cloud 4 Production. The cloud went live in July 2023.

    Preparations for implementing the virtual PLC started soon after that and required close collaboration between Audi, Siemens, and other technology partners. Since January 2024, two virtual PLCs have been deployed successfully on the e-tron GT axle assembly line in Audi’s Böllinger Höfe factory.

    Although the conversion to IT-based shopfloor automation is a huge step, the site’s employees have hardly noticed the change. They continue to access all the functions that they know from hardware PLCs, as well as familiar user interfaces and tools. Thanks to compatibility with the Siemens TIA Portal platform, no other programs have needed to be written for the virtual PLC.

    The uniform infrastructure ensures that all of the virtual applications operate on the same basis, allowing complete digital management. Activities can be conducted centrally or remotely. Management via the cloud production platform also enhances cybersecurity, because many of the previous attack vectors have been removed from the production environment.

    Because the virtual PLC is downloaded as software and deployed via an industrial edge platform, the problems of extended delivery periods and the need to install hardware components have both been eliminated. Additional instances of the PLC can be downloaded if needed, and unnecessary instances can be uninstalled. This saves money and energy. Updates, and apps from industrial edge management, can also be rolled out quickly and easily plant-wide and on a remote basis.

    In addition to the technological hurdles, many organizational challenges also needed to be overcome. Employees and management had to be won over to the concept of IT-based factory automation, the functionality of the virtual PLC had to be demonstrated, and responsibilities had to be assigned. An Edge Cloud 4 Production team was established that allowed IT experts to collaborate closely with OT specialists. Thanks to extensive testing at the plant and close alignment between the IT and OT teams, Audi and Siemens were able to commission the new technology relatively smoothly.

    Just the start

    The successful initial implementation of the virtual PLC is just the starting point. Over the next few years, both the virtual controller and the cloud-based infrastructure will continue to be developed, tested and rolled out further.

    The priority in the coming months is to train employees at the Böllinger Höfe plant in the new technology. The first apps from Industrial Edge Management are also being rolled out and tested, including Siemens’ Sinec Traffic Analyser. The apps can be downloaded and used flexibly, and can be deleted later when they are no longer being used.

    The initial implementation lays the groundwork for learning organizational and operational lessons. For example, there are plans to test a virtual operator panel, and any potential obstacles to the plant’s everyday operation will be detected. Challenges that arose in the initial implementation were overcome thanks to the dedication of the project partners. Based on the successful collaboration to date, they are optimistic about the future of the project.

    Ref: Link

    31May, 2024
    2024 Cybersecurity Trends: What’s Observable Already?

    2024 has already witnessed a staggering number of cyber incidents, with over 29.5 billion records breached across 4,645 publicly disclosed incidents in January alone, according to the IT Governance Security Spotlight. Moreover, CVEs are growing significantly year over year, with 13% growth from 2022 to last year, and an expected 25% increase from 2023 to 2024. With such growth in vulnerabilities, staying on top of the latest trends that attackers may be using is vital.   

    So, what trends are we observing so far in 2024?

    Ransomware-as-a-Service (RaaS)

    Among the most significant trends is the proliferation of Ransomware-as-a-Service (RaaS), which has democratized the tools necessary for cyber-attacks, making it easier for less skilled attackers to launch ransomware campaigns. Ready-to-use ransomware has lowered the barrier to entry for committing cybercrimes, leading to an increased attack volume. The rise of RaaS stresses the need for robust, multi-layered security strategies to measure, map, and prioritize vulnerabilities with a focus on ransomware attacks. One critical aspect of countering RaaS threats involves reducing the window of opportunity for cyber attackers to exploit outdated systems. Security teams must focus on patching vulnerable external-facing assets, including web servers, email systems, and cloud-based services, which are often the first targets in ransomware attacks. To mitigate risks related to software processing internet data—such as browsers, plugins, and document readers—automated patch management can significantly enhance the effectiveness and timeliness of patches without manual intervention.

    Software Supply Chain Attacks

    Supply chain attacks have also surged, exploiting interconnected networks to compromise systems and data at various points in the production and distribution process. The reason for this rising trend, outside of being lucrative and debilitating to its victims, rests in the fact that software supply chains are often poorly managed and fraught with embedded open-source software (OSS) with unpatched vulnerabilities—making it a prime target for attackers. This trend highlights the critical need for streamlined approaches to managing your inventory of software components and inherently linking software management processes with security hygiene oversight between IT and security teams.

    Advanced Persistent Threats (APTs)

    The exploitation of zero-day vulnerabilities by Advanced Persistent Threats (APTs) remains a concern, particularly given rising global tensions attached to degrading China-US relations, the Ukrainian conflict, and the common offenders of Iran and North Korea. These attacks underscore the need for rapid patching and proactive security measures to mitigate risks ​​as non-government entities increasingly become targets of nation-state actors looking to harm critical parts of commerce, such as telecom service access and digital payments. For example, by downing a mobile carrier for a matter of hours, an attacker can cost a regional economy billions of dollars by interrupting payment exchanges, ride-sharing services, and more.

    Cloud Security

    Cloud security has emerged as both a trend and a key challenge. As businesses continue to migrate to cloud-based environments, attackers are exploiting vulnerabilities in cloud services, such as misconfigurations and inadequate access controls. This necessitates enhanced cloud security practices and advanced mitigation actions that can scale across a hybrid enterprise. Regretfully, many larger businesses and enterprise organizations have fallen victim to a fragmented approach to cybersecurity oversight with separate point solutions used to manage assets on-premises vs. in the cloud. This approach, outside of being a bit archaic and costly, increases the complexity of analyzing the cyber risk associated with assets in the cloud vs. assets elsewhere, thus inhibiting response.

    AI-Enabled Attacks

    Lastly, cybercriminals’ use of artificial intelligence (AI) is a growing concern. AI technologies, such as generative AI, could enhance phishing attacks, making them more targeted and difficult to detect. Moreover, the potential for criminals to develop their own AI models trained on malicious code is particularly worrying, suggesting a future where malware is more sophisticated and harder to defend against​​.

    Going Forward

    Considering these trends, the role of today’s security practitioner is changing from an analyst to an alert facilitator, bouncing from security platform to IT service management tool in order to keep up. From the perspective of someone who has grown up alongside the cybersecurity industry, the industry must shift from a growth-by-acronym model that offers customers a plethora of point solutions that solve only parts of what a security stakeholder must concern themselves with. This approach has served better to bloat budgets for CTOs and create a tool sprawl for security practitioners to manage – sometimes not so well.

    Going forward, it is imperative for the industry to focus on developing solutions that consolidate cybersecurity and risk management to facilitate proactive posture management using advanced technologies like AI and machine learning—predicting and preventing attacks before they occur. In addition, increasing collaboration with other organizations, such as ITOps, is a key area of focus for customer-focused companies like Qualys, recognizing that improving MTTR and reducing cyber risk is the shared responsibility of IT and security organizations alike. Thus, security tooling and technologies that streamline IT-SecOps coordination, bolstered with AI-enabled threat intelligence, are going to be a requirement – not a best practice.

    18May, 2024
    Commonly used passwords for new accounts include “User” & “Welcome”

    New research into password usage for new accounts during the onboarding process, has revealed a worrying trend where easily guessable passwords are left unchanged for new starters, presenting significant security risks for organisations.

    The findings from Secops Software, an Outpost24 company, analysed 651 million compromised passwords which highlighted a list of 120,000 commonly used password for new team members.

    At the top of the list was the term “User”, appearing 41,683 times. “Temp” was second appearing “28,469” times with “welcome” ranking third.

    Other common terms found were “guest”, “starter”, and “logon” and highlights a serious issue with these phrases being used as security credentials. The need for stronger passwords being used is vital otherwise hackers can crack weak passwords in a matter of minutes.

    Darren James, Senior Product Manager at Specops Software, said this about the findings: “Each time you’ve started a new job, there’s a decent chance you’ve been given a temporary password to get you into your system for the first time. These passwords are usually generated by the IT team, and in theory, should be as strong as any other password. Unfortunately, many organizations do not follow the best practices for password security, such as using long and random passphrases. These first day passwords are also often shared in plaintext.

    Reference Link

    25Apr, 2024
    WordPress LayerSlider Plugin: SQL Injection Vulnerability

    On March 25th, 2024, a critical security vulnerability was discovered in the LayerSlider plugin for WordPress, marked as CVE-2024-2879. The plugins have more than 10 lakh active installations. This flaw, rated with a CVSS score of 7.5 out of 10.0, is identified as an SQL injection vulnerability impacting LayerSlider versions 7.9.11 through 7.10.0. 

    Qualys Web Application Scanning released a QID 150868 to address CVE-2024-2879. The detection is part of the OWASP Top 10 Injection category. SQL injections have been getting a lot of visibility recently which we have discussed in our blog on Navigating SQL Injections.

    About CVE-2024-2879

    QID150868
    Severity5
    CVSS 3.1 VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    CVSS 3.1 Score7.5
    Affected Versions7.9.11 – 7.10.0

    Description

    The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

    SQL Injection Analysis

    The `ls_get_popup_markup()` function is utilized to query slider markup for popups. It accepts the ‘id’ parameter value to identify the slider.

    The function checks if the ‘id’ parameter is numeric using `is_numeric()`. If the ‘id’ parameter is not a number, it is passed without sanitization to the `find()` function in the `LS_Sliders` class.

    The vulnerability arises within the `find()` function of the `LS_Sliders` class because it doesn’t properly validate user-provided input. While all other `$args` values are sanitized with the `esc_sql()` function, the ‘where’ value lacks this protection.

    In this code, the `$where` variable is constructed using string concatenation with user-provided input (`$args[‘where’]`). Then it passed to the query.

    Let’s consider an example of an attack. Suppose an attacker provides the following values:

    The resulting SQL query would be:

    In this modified query, the payload `(SELECT 0 FROM (SELECT SLEEP(5))qualysWAS)` is injected into the `$args[‘where’]` parameter. This payload instructs the database to sleep for 5 seconds if the condition is true.

    Detecting the Vulnerability with Qualys WAS

    Customers can detect this vulnerability with Qualys Web Application Scanning using the following QID:

    QID 150868: WordPress LayerSlider Plugin: Unauthenticated SQL Injection Vulnerability (CVE-2024-2879)

    Solution

    Customers are advised to upgrade to LayerSlider 7.10.1, or a later version to remediate this vulnerability. For more information please refer LayerSlider Release logs.

    Ref: https://blog.qualys.com/vulnerabilities-threat-research/2024/04/22/wordpress-layerslider-plugin-sql-injection-vulnerability

    26Dec, 2023
    Why data, AI, and regulations top the threat list for 2024

    The new year finds us confronted by a landscape characterized by political uncertainty, social fragmentation, escalating geopolitical tensions, and a turbulent macro-economic backdrop, making it crucial for security leaders to strategically prepare for the forthcoming challenges.

    Let’s explore the three main security challenges businesses will face in 2024:

    1. Data

    Modern businesses generate and manage vast volumes of data daily. Since data is central to decision-making and competitive advantage, its sudden disruption or unavailability can lead to severe repercussions for the business.

    Some of the essential questions security teams ought to be asking themselves include: How do we manage and safeguard aspects like confidentiality, integrity, and availability of data? What strategies can we employ to protect our data against cyber threats and misuse? How do we address the security challenges that emerge with expanding data repositories? How do we differentiate between valuable data and redundant information?

    Furthermore, there’s often a misalignment in how data is structured versus the business framework. Consequently, security teams may need to engage in discussions with business units to clarify issues such as how we are applying our data. With whom is this data being shared? Who holds accountability for it? Who is responsible for making decisions regarding data security? Is it the information security team, the chief executive, the board, or is it a combined effort?

    2. Artificial intelligence

    Although AI technologies aren’t new, the recent widespread adoption of AI has introduced a myriad of business and security challenges for organizations. Key questions to consider include: How do we monitor AI usage within the organization? How do we regulate the data shared with AI systems by employees? How do we ensure ongoing compliance with ethical standards and legal requirements?

    Data is the cornerstone of AI. How do we provide sufficient data for AI systems while ensuring this data is secure, ethical, and transparent? How do we safeguard AI data and algorithms from manipulation by threat actors? Security teams need to be vigilant about all AI-related risks, including ethical concerns. Despite these challenges, AI offers significant opportunity for companies aiming to evolve and enhance their business models.

    In 2024, corporate boards will likely assume a central role in overseeing AI’s secure deployment across the organization. This scenario presents a prime opportunity for security teams to align closely with business objectives, be at the forefront of the AI revolution, and actively participate in key business decisions alongside management teams.

    3. Regulations

    Security is rapidly evolving, and so are regulations governing it. Over the next 12 months, several regulations will either be introduced, updated, or reviewed. For example, GDPR may lead to stringent reinforcements in 2024; the Digital Operational Resilience Act (DORA) will apply to financial entities across the EU in January 2025; the EU AI Act may be voted in.

    Given these developments, organizations must develop a comprehensive understanding of the regulations in the jurisdictions where they operate. This knowledge is crucial for building the necessary processes and frameworks proactively, as once these regulations are enforced, adjusting to them retroactively will be challenging. Hence, staying ahead of these regulations in 2024 is imperative, as non-compliance could lead to severe legal, financial, and reputational consequences.

    How can cybersecurity leaders address these security challenges?

    Below are four risk management initiatives that cybersecurity leaders can integrate into their 2024 cybersecurity planning:

    1. Communicate issues in business terms

    It’s essential for cybersecurity leaders to present issues in a manner that resonates with business leaders. CEOs typically prefer to avoid technicalities. Their concern is how technology will impact the business and whether it aligns with overall objectives. Will it meet stakeholder expectations? What are the risks in terms of financial, operational, and economic factors, beyond technical aspects?

    2. Establish clear risk tolerance levels

    For security leaders working with management teams, it’s crucial to define the company’s risk tolerance concerning cyber loss, akin to other risk types. For instance, what is the risk tolerance for employing generative AI? Who is responsible for making this decision? What regulations are relevant, and how will this affect the information we disclose?

    3. Implement a robust and practiced response plan

    Executive teams and boardrooms seek assurance. They require confidence that the organization is prepared for unexpected crises, ensuring there is comprehensive situational awareness across the organization, and confirmation that vigilant monitoring of activities is ongoing. They need reassurance that fundamental cyber protection measures are implemented and that a thoroughly documented and regularly rehearsed business continuity and response plan is ready to be activated in the event of a security incident.

    4. Build awareness, foster accountability in the workforce and supply chain

    The nature of work has transformed significantly in recent years, necessitating updates in security policies and procedures to reflect these changes. Organizations must explicitly outline accountability for data collection and usage, engage in collaborative and transparent interactions with stakeholders, and ensure everyone understands their role in safeguarding the business. Likewise, it’s crucial to extend the same security principles and procedures to third parties and supply chain partners that handle data on behalf of the parent organization.

    To summarize, we’re facing three key areas that will continue to grow in complexity and challenge: data, AI, and regulation. There’s an increasing expectation for closer engagement between security teams and business operations, coupled with board directors’ growing concerns about their personal liability. If security leaders concentrate on these threat management initiatives, they can significantly help mitigate risk and contribute to building a resilient organization into the future.

    Resource : https://www.helpnetsecurity.com/2023/12/21/2024-security-challenges/

    26Dec, 2023
    MySQL Servers, Docker Hosts Infected With DDoS Malware

    Attackers are targeting MySQL servers and Docker hosts to plant malware capable of launching distributed denial-of-service (DDoS) attacks, according to a warning from researchers at the AhnLab Security Emergency Response Center.

    According to AhnLab, attacks targeting MySQL on Windows have increased in frequency with vulnerable MySQL servers infected with ‘Ddostf’, a DDoS-capable botnet of Chinese origin that has been around since at least 2016.

    Malicious attackers, AhnLab warns, scan the internet for publicly-accessible MySQL servers using the TCP port 3306, and then attempt to compromise them either using weak credentials or exploiting known vulnerabilities.

    The attackers then upload a malicious DLL as a UDF (User-Defined Function) library, which allows them to execute commands on the infected system and to deploy and execute the Ddostf malware.

    Targeting both Linux and Windows environments, Ddostf achieves persistence and then collects system information and sends it to the command-and-control (C&C) server. It then waits for commands to launch DDoS attacks such as SYN, UDP, and HTTP GET/POST floods.

    “Although most of the commands supported by Ddostf are similar to those from typical DDoS bots, a distinctive feature of Ddostf is its ability to connect to a newly received address from the C&C server and execute commands there for a certain period,” AhnLab explained.

    The malware appears to be designed solely for launching DDoS attacks and the researchers believe the threat actor is operating a DDoS-for-hire service.

    OracleIV DDoS-capable malware

    Separately, Cado Security is warning in a new report that Docker hosts are being targeted with the OracleIV DDoS-capable malware, via the Docker Engine API, an HTTP API served by Docker Engine.

    Attackers are scanning for publicly-exposed instances of the Docker Engine API to deploy a malicious container that hosts Python malware compiled as an ELF executable.

    According to Cado, the accidentally exposed Docker Engine API instances have been a popular target for attackers in recent years, especially for deploying cryptocurrency miners. “Once a valid endpoint is discovered, it’s trivial to pull a malicious image and launch a container from it to carry out any conceivable objective. Hosting the malicious container in Dockerhub, Docker’s container image library, streamlines this process even further,” the company said.

    Cado said it observed attackers making HTTP POST requests to retrieve a malicious image from Dockerhub and spawn a container from it. The malicious Docker image, Cado says, has over 3,000 pulls and appears to be updated regularly.

    Baked within the image, OracleIV supports commands for UDP, UDP_PPS, SSL, SYN, HTTP/GET, and SLOW flood attacks, although some of the functions are not working.

    Resource : https://www.securityweek.com/mysql-servers-docker-hosts-infected-with-ddos-malware/

    23Dec, 2023
    Every “Thing” Everywhere All at Once

    In the movie Everything Everywhere All at Once, protagonist Evelyn Wang must travel between dimensions to confront and defeat an evil that threatens her family’s existence in their home universe. For Wang it is a confusing and taxing fight that requires her to use information, experience, and power gained as she navigates the multiverse to know what she must do to overcome the challenges she meets along the way. It’s a convoluted story arc that is not unlike the day-to-day of a CISO working to protect the modern enterprise and the universe of “things” that are being deployed.

    The Modern Enterprise is a Multiverse

    Like Evelyn Wang’s world, today’s technology estates are convoluted and multi-dimensional environments where decisions made anywhere have implications everywhere. Multi-campus, multi-cloud, on-premises, cloud-based, mobile, and software defined are all common terms defining a single enterprise. And then you have to take into account the physical and virtual assets comprising a typical environment, many of which come and go, connect and disconnect independent of IT management. It’s hard to keep up; but keep up you must, because threat actors are constantly on the prowl looking for vulnerabilities that will allow them to perpetrate whatever attack they’ve got in mind.

    A recent conversation I had with the CISO of a large enterprise illustrates the dilemma.

    “I am responsible for every device, whether I know about it or not,” he said. “Because we don’t know all of the devices that are connected to the network, we have blind spots that are unprotected.”

    What You See Isn’t All You Get

    To protect a technology estate, you need to be able to see across the network—in real-time—and have information in context for making good decisions. That is a tall order for any organization, but especially for those that rely on a sprawling IT estate. In a 2022 study commissioned by IBM, technology analyst firm IDC found that the average number of IT assets managed by 29 organizations studied was 2.7 million. That’s a lot of systems and devices, and it’s only the ones that are in the known inventory. Another report found that as many as 20% of an organization’s IT assets may be invisible to IT management and security operations, meaning more than a half-million unsecured things are operating in the average enterprise.

    Of that 20%, not all of it is traditional IT that has simply gotten lost in a fast-growing technology environment. Because connectivity is so essential, a lot of things that constitute the Internet of Things (IoT) end up attaching themselves to the enterprise network. In our experience here at Ordr, we’ve seen exercise equipment, gaming consoles, Kegerators, Tesla automobiles, and a lot more operating alongside mission-critical IT systems, Internet of Medical Things (IoMT) devices, operational technology (OT), and plenty more.

    Real-time Asset Inventory Is the Foundation for Security

    Every asset in an organization’s inventory that is not accounted for and protected is a potential attack vector, or step along a path or lateral movement that an attacker can use to gain access or move undetected. Threat actors know this and are targeting IoT more and more to take advantage. One cybersecurity firm says attacks targeting IoT devices have increased 700% since 2020, and Microsoft security researchers recently discovered a “a sophisticated attack campaign” targeting IoT devices.

    That puts a lot of pressure on the CISO, and it also feeds into a vicious asset management and security cycle since a failure to keep track of all assets, including IoT, means that you can’t properly identify your attack surface. These include assets with vulnerabilities, those running outdated operating systems, or devices missing a security agent or patches. This also means IT and security operations aren’t running at maximal efficiency, the context by which decisions are made (and automated) are less precise. Threats thrive in chaos, and so risks increase when assets are not fully inventoried, monitored, and managed in real-time.

    Three Security Considerations To Navigate The Modern Asset Universe

    When security blind spots are a problem, the best first step toward a remedy is to employ tools that enable IT and security teams to gain visibility into the enterprise’s cracks and crevasses. But there are considerations for this:

    • Granular context matters – Asset visibility must include deep threat and asset context. This requires a combination of methods to continuously discover and classify an asset – via deep packet inspection of network traffic, API, NetFlow. For example, in order to determine if you’re impacted by a Zero Day like MOVEit, you must know what applications are actually running on your device. Similarly, to identify vulnerabilities that affect your assets, you may need to know the specific minor version of operating systems running.
    • Behavioral analysis via AI can be a differentiator – Devices are deterministic, a video surveillance camera or an HVAC system or a medical device all have specific behaviors in the network based on their functions. The ability to baseline these communications patterns not only surfaces anomalies– early indicators of a potential compromise, but also informs the foundational Zero Trust policies to secure those devices.
    • Automated policies are important to scale – When there are hundreds of thousands of connected devices in the network, the only way to secure them are via automated policies. This means dynamically generating proactive Zero Trust policies to enable only “baseline” communications for mission-critical devices, or generating reactive policies to block ports, move devices to a different segment or terminate sessions. When a device fits a specific profile, a pre-defined policy can automatically be applied, for example, activating a vulnerability scan when a new device is discovered on the network. 

    Evelyn Wang learned how to navigate her way between dimensions of the multiverse to tackle the challenges that were not visible in her home dimension. CISO’s must gain the means to see every asset across a multidimensional enterprise with fidelity and granular context. Only then will they be able to identify their attack surface and address the security gaps that put their enterprise at risk.

    Resource : https://www.securityweek.com/every-thing-everywhere-all-at-once/

    23Dec, 2023
    Crypto Exchange Hack Guilty Plea, Rating AI Vulnerabilities, Intellexa Spyware 

    SecurityWeek is publishing a weekly cybersecurity roundup that provides a concise compilation of noteworthy stories that might have slipped under the radar.

    We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless important for a comprehensive understanding of the cybersecurity landscape.

    Each week, we will curate and present a collection of noteworthy developments, ranging from the latest vulnerability discoveries and emerging attack techniques to significant policy changes and industry reports.

    Here are this week’s stories:  

    Ukrainian hackers target major Russian water utility 

    In revenge for the recent Russian attack on Kyivstar, Ukraine’s largest mobile network operator, Ukrainian hackers claim to have launched an attack on Rosvodokanal, the largest private water utility in Russia. The hackers claim to have stolen documents, encrypted 6,000 computers, and deleted 50 Tb of data, disrupting operations. Rosvodokanal is responsible for providing water to millions of consumers, but there do not appear to be any reports of the water supply being impacted by the attack. 

    Former security engineer admits hacking two cryptocurrency exchanges

    The US Justice Department announced that Shakeeb Ahmed has pleaded guilty to hacking two decentralized cryptocurrency exchanges, stealing over $12 million worth of cryptocurrency. The attacks were carried out in 2022 and targeted Nirvana Finance and Crema Finance. The DOJ described Ahmed as a former security engineer at an international technology company, which appears to be Amazon.

    Apple and Adobe patches

    Apple and Adobe have each released patches for a single vulnerability. Apple released macOS Sonoma 14.2.1 to address a WindowServer issue that involved content being unintentionally exposed when users shared their screen. Adobe released an Experience Manager Forms update to address an Apache Struts vulnerability that has been exploited in the wild. 

    Hundreds of TeamCity instances still vulnerable to attacks

    Hundreds of TeamCity instances are vulnerable to attacks exploiting CVE-2023-42793, according to Censys. The Russian cyberespionage group known as APT29 has been exploiting the vulnerability on a large scale since September 2023, according to government agencies.

    GWT vulnerability remains unpatched 8 years after discovery

    A potentially serious vulnerability affecting GWT, a popular open source web application framework, remains unpatched eight years after it was discovered, according to Bishop Fox. The flaw can expose application owners to unauthenticated server-side code execution. There have been several discussions on the security hole since 2015, but it still has not been fixed. Bishop Fox has published a blog post describing how the vulnerability can be exploited and how developers can check if their GWT-based application is affected. 

    AI vulnerability rating taxonomy for LLMs

    Bug bounty platform Bugcrowd has updated its Vulnerability Rating Taxonomy (VRT) to define how AI vulnerabilities in Large Language Models (LLMs) are classified, reported, and prioritized on its platform in an effort to enable hackers and customers to have a shared understanding of how these types of flaws are handled. 

    Payment fraud underground shows signs of recovery 

    Recorded Future has published its 2023 Payment Fraud report, which reveals that the payment fraud underground is showing signs of recovery following Russia’s crackdown on domestic cybercriminals and its invasion of Ukraine. The report also shows that the volume of stolen payment cards on carding shops has started to rebound. A total of 119 million cards were offered for sale, with a median fraud charge of $79. 

    Google shuts down thousands of YouTube channels 

    Google has terminated thousands of YouTube channels as part of investigations into influence campaigns linked to China, Russia, and Iran. Ads accounts, domains, and other resources linked to these campaigns were also blocked. Hundreds of YouTube accounts linked to campaigns in Turkey, Azerbaijan, Ethiopia, and Sudan also got the ax. 

    Intellexa and its Alien/Predator spyware products

    Cisco has published a new report detailing the evolution of Intellexa, ‘an intelligence agency-grade spyware vendor’ that emerged from the ashes of Cytrox, after it was bought. The report also dives into the vendor’s Alien/Predator line of implants, which were found to persist device reboots. 

    CISA finalizes Microsoft 365 secure configuration guidance

    US cybersecurity agency CISA announced that the final version of its Microsoft 365 Secure Configuration Baselines guidance, which includes input from a public comment period, is now available to the public. The guidance, which aims to help organizations improve the security and resilience of their M365 services, is accompanied by an updated SCuBAGear tool, enabling interested parties to assess their M365 services against CISA’s baselines.

    Resource : https://www.securityweek.com/in-other-news-crypto-exchange-hack-guilty-plea-rating-ai-vulnerabilities-intellexa-spyware/

    22Dec, 2023
    Top 7 Trends Shaping SaaS Security in 2024

    Over the past few years, SaaS has developed into the backbone of corporate IT. Service businesses, such as medical practices, law firms, and financial services firms, are almost entirely SaaS based. Non-service businesses, including manufacturers and retailers, have about 70% of their software in the cloud.

    These applications contain a wealth of data, from minimally sensitive general corporate information to highly sensitive intellectual property, customer records, and employee data. Threat actors have noted this shift, and are actively working to breach apps to access the data.

    Here are the top trends influencing the state of SaaS Security for 2024 — and what you can do about it.

    Democratization of SaaS 

    SaaS apps have transformed the way organizations purchase and use software. Business units purchase and onboard the SaaS tools that best fit their needs. While this is empowering for business units that have long been frustrated by delays in procuring and onboarding software, it does require organizations to rethink the way they secure data.

    Security teams are being forced to develop new ways to secure company data. Lacking access and visibility into an application, they are placed in the role of advising a business unit that is using SaaS applications. To further complicate matters, every SaaS application has different settings and uses different terminology to describe security features. Security teams can’t create a one-size-fits-all guidance document because of the differences between the apps.

    Security teams must find new ways to collaborate with business units. They need a tool that offers visibility and guidance for each application setting so that they – and the business unit – understand the risks and ramifications involved in the configuration choices that they make.

    ITDR Forms a Critical Safety Net

    If a threat actor gains access to a high-privilege account, they gain unfettered access within the application. Organizations are now understanding that identity is the de facto perimeter for their SaaS applications.

    When threat actors take over an authorized user account, they typically follow common tactics, techniques and procedures (TTP) as they work their way through the app toward the data they want. They leave behind indicators of compromise (IoC), which might be based on actions taken within the app or logs.

    As we move into the new year, we are going to see more organizations adopting an Identity Threat Detection & Response (ITDR) approach. ITDR mitigates that concern. As a key component in Identity Security Posture Management, ITDR capabilities can detect TTPs and IoCs, and then send an alert to the incident response team. Through ITDR, threat actors who have managed to breach the identity perimeter can still be stopped before they steal critical data or insert ransomware into the application.

    Cross-Border Compliance Means More Tenants to Secure

    Global companies are increasingly facing different regulatory requirements from one country to the next. As a result, 2024 will see an increase in the number of geo-specific tenants as part of the effort to keep data segmented in accordance with the different regulations.

    This change will have a limited impact on software costs as most SaaS app pricing is based on subscribers rather than tenants. However, it will have a significant impact on security. Each tenant will need to be configured independently, and just because one instance of the application is secure doesn’t mean that all tenants are secure.

    To secure all these tenants, security teams should look for a security solution that allows them to set app benchmarks, compare tenants, and display security settings side-by-side without charging extra for each additional tenant. By applying best practices throughout the organization, companies can keep all their tenants secure.

    Misconfigured Settings Are Leading to New Exploits

    A default misconfiguration in ServiceNow triggered widespread panic in October. The setting, which was part of the application’s Access Control Lists, allowed unauthorized users to extract data from records. The misconfiguration impacted thousands of companies. A similar misconfiguration in Salesforce Community back in May also impacted a significant number of companies and led to data breaches.

    Misconfigurations like these have the potential to cause major damage to companies. They lead to data leaks that break the trust between companies and their stakeholders, and have the potential to turn into onerous fines, depending on the nature of the data that leaked.

    Securing misconfigurations is an organization’s best chance at preventing these exploits from impacting their operations and hurting their bottom lines.

    Increased Reliance on Third-Party Applications Adds to SaaS Risk

    Third-party applications add real value for end users. They improve processes, extend functionality, and connect data between multiple applications. Users connect these SaaS apps with the click of button, and instantly begin improving their workflows.

    In March 2023, Adaptive Shield released a report showing that organizations using Google Workplace with 10,000-20,000 users averaged 13,913 third-party apps connected to Google Workplace alone. An astonishing 89% of these requested either high- or medium-risk permissions. Many of these high-risk apps are used once and forgotten about, or used by a small number of employees. However, even these dormant or lightly used applications have significant permissions and can be used to compromise or breach a SaaS application.

    The use of third-party applications is only increasing, as more apps are developed and employees use their own judgment – rather than checking with their security team – when integrating third-party applications into their stack. Security teams must develop visibility into all their integrated apps, and gain insights into the permissions requested, the value the app contributes to the organization, and the risk it poses.

    Multiple Devices to Secure as Working from Home Isn’t Going Anywhere 

    In 2023, nearly 40% of all employees worked from home at least part of the time. According to WFHResearch, approximately 12% of employees work exclusively in their homes, while another 28% have hybrid roles.

    These figures should give pause to security personnel concerned about users logging in to their work accounts from personal devices. One of the biggest concerns security teams have is when high-privileged users log into their accounts using an unmanaged or unsecured device. These devices may have critical vulnerabilities, and create a new attack vector. For many teams, there is almost no way to tell which devices are used to access the SaaS app or see whether those devices are secure.

    Organizations Are Turning to SSPM to Secure SaaS

    While all these trends point to legitimate SaaS security concerns, SaaS Security Posture Management (SSPM) tools coupled with ITDR capabilities, like Adaptive Shield, can fully secure the SaaS stack. SSPMs are designed to automatically monitor configurations, looking for configuration drifts that weaken an app’s posture. In SaaS Security Survey, 2024 Plans & Priorities by Cloud Security Association and Adaptive Shield, 71% of respondents said their company had increased their investment into SaaS security tools over the past year, and 80% were either already suing SSPM or planned to invest in one within the next 18 months.

    SSPMs can provide baselining tools for multiple tenants of the same app, and enable users to establish best practices, compare settings from different instances, and improve the overall posture of the SaaS stack.

    SSPMs also detect and monitor third-party applications, alerting users if their integrated apps are requesting too much access and updating the security team when integrated apps are dormant. It tracks users, and monitors the devices being used to access applications to prevent the use of unmanaged or unsecured devices on corporate SaaS apps. Furthermore, their built-in communication tools make it easy for business units to collaborate with security personnel in securing their applications.

    SaaS apps have grown in popularity for good reason. They allow organizations to scale as needed, subscribe to the apps they need at the moment, and limit investment in some IT. With SSPM, these applications can be secured as well.

    Resource : https://thehackernews.com/2023/12/top-7-trends-shaping-saas-security-in.html