• Search for:
    12Nov, 2022
    GitHub Introduces Private Vulnerability Reporting for Public Repositories

    Microsoft-owned code hosting platform GitHub has announced the introduction of a direct channel for security researchers to report vulnerabilities in public repositories that allow it.

    The new private vulnerability reporting capability enables repository maintainers to allow security researchers to report to them any vulnerabilities identified in their code.

    Some repositories may contain specific instructions on how the maintainers can be contacted for vulnerability reporting, but for those that do not, researchers often report issues publicly.

    Regardless of whether the researcher reports the vulnerability via social media or by creating a public issue, this method could result in vulnerability details inadequately being made public.

    To avoid such situations, GitHub has introduced private reporting, where researchers can directly contact repository maintainers willing to enroll.

    If the functionality is enabled, the reporting security researchers are provided with a simple form they can fill out with details on the identified issue.

    “Anyone with admin permissions to a public repository can enable and disable private vulnerability reporting for the repository,” GitHub says.

    Once a vulnerability has been reported, the repository maintainer receives a notification and can either accept or dismiss the report, or ask more questions about the issue.

    Benefits of the new capability, GitHub says, include the opportunity to discuss vulnerability details privately, receiving the reports directly on the same platform where the issue is discussed and addressed, the advisory report being initiated by the reporter, and a lower risk of being contacted publicly.

    Private vulnerability reporting can be enabled under the ‘Settings’ section on the repository’s main page, in the ‘Security’ section of the sidebar, under ‘Code security and analysis’.

    Once the functionality has been enabled, security researchers can submit reports by clicking on a new ‘Report a vulnerability’ button in the ‘Advisories’ page of the repository.

    The code hosting platform announced the private vulnerability reporting at the GitHub Universe 2022 global developer event, where it also announced the general availability of CodeQL support for Ruby, a new security risk and coverage view for GitHub Enterprise users, and funding for open source developers.

    Through the new GitHub Accelerator initiative, the platform will provide a $20,000 incentive to 20 developers who maintain open source repositories, while the new $10 million M12 GitHub Fund is meant to support open source companies of the future.

    Resource : https://www.securityweek.com/github-introduces-private-vulnerability-reporting-public-repositories

    12Nov, 2022
    Securing Your Move to the Hybrid Cloud

    Infosec expert Rani Osnat lays out security challenges and offers hope for organizations migrating their IT stack to the private and public cloud environments.

    Infosec Insider contributor Rani Osnat is SVP Strategy at Aqua Security

    The combination of private and public cloud infrastructure, which most organizations are already using, poses unique security challenges. There are many reasons why organizations adopt the public cloud — from enabling rapid growth without the burden of capacity planning to leveraging flexibility and agility in delivering customer-centric services. However, this use can leave companies open to threats.

    Since regulatory requirements or other preferences dictate that certain applications remain on private (on-prem) infrastructure, many organizations choose to maintain a mix of private and public infrastructure. Additionally, organizations typically use multiple cloud providers simultaneously or preserve the option to move between providers. However, this hybrid approach presents unique and diverse security challenges. Different cloud providers and private cloud platforms may offer similar capabilities but different ways of implementing security controls, along with disparate management tools.

    The question then becomes: How can an organization maintain consistent governance, policy enforcement and controls across different clouds? And how can it ensure that it maintains its security posture when moving between them? Fortunately, there are steps professionals can take to ensure that applications are continuously secure, starting from the early stages of development and extending throughout the lifecycle.

    Old Security Tools No Longer Effective in the Cloud

    Security tools not born in the cloud are ill-equipped to protect applications running in the cloud for many reasons. First, they are incapable of coping with the considerably accelerated development cycles of cloud native applications, compared with traditional waterfall methods. Instead of releasing versions every few months, organizations that employ cloud native CI/CD are continuously integrating and deploying applications and updates, sometimes multiple times per day. This mandates an automated approach to ensuring security — one that’s embedded into the early stages of development so that it doesn’t become the bottleneck slowing development and operations.

    Additionally, in the dynamic and diversified cloud environment, security solutions can no longer expect or rely on permanent infrastructure and location. If, in the past, we knew that a certain server ran a certain application (e.g., a Microsoft Exchange server or database), we cannot assume that the same scenario applies today. Modern cloud application solutions are tied to the application itself, not to its IP address or a specific server location. Automated orchestration of workloads means that a database might be running on one container now and on a different one, with a different IP address, 10 minutes later. Or, perhaps, tomorrow, the whole cluster will move to a different cloud provider entirely. This is why organizations need to use more modern, cloud-specific solutions rather than older ones not meant for the cloud.

    Cloud Providers’ Own Security Tools: A Limited Answer

    The major cloud providers all use what’s called “the shared responsibility model,” which, at a very simplistic level, distinguishes between security “of the cloud” (the provider’s responsibility) and security “in the cloud” (the customer’s responsibility). “Shared responsibility” does not translate into shared accountability. When it comes to the physical security of public cloud data centers, organizations need not worry; the cloud providers operate such security at the highest standards, similar to those employed by major banks and government agencies. But for everything else, the responsibility lies squarely with the customer organizations — in fact, Gartner predicts that through 2025, 99% of cloud security failures will occur on the customer’s side.

    The tools offered by the cloud security providers (CSP) usually provide partial coverage for customer needs and increase the dependency of the customers on the cloud provider, but are not equally effective in protecting the multi-cloud environment, especially private clouds.

    The New Stack is Great for Security

    The good news is that the technologies that are used to run the new stack, such as containers and Kubernetes, enable better security than was ever possible before, and with more granular visibility and automation. They also make it easier to transfer security across private and public cloud environments, provided that the security controls are applied correctly.

    Since containers are made to be portable and Kubernetes was made to be intraoperative with any cloud environment, if you attach security tooling that was specifically designed to protect your containers, you can run them anywhere uniformly, regardless of where your applications are.

    Due to the complexity of cloud environments and the many moving parts involved, planning the tech stack requires a holistic approach to defend applications across their entire lifecycle — from development to production. Such an approach should be able to handle multiple security gaps across both infrastructure components and application code, whether managing vulnerabilities, misconfigurations, malware or behavioral anomalies.

    The Born-in-the-Cloud Approach

    Companies now are not only born in the cloud but specifically set out to secure the new cloud native stack, from containers to VMs and serverless. Cloud Native Application Protection Platform (CNAPP) — a new category named by Gartner — protects enterprise applications against attacks, which are increasing as the adoption of cloud grows.

    While the future of cloud security is bright, the present is uncertain. This is due to the increase in the volume and sophistication of attacks that specifically target cloud infrastructure and supply chains. A vulnerable or badly configured Kubernetes node will be targeted within as little as 20 minutes. These sophisticated attacks might result in a variety of malicious outcomes, from cryptocurrency mining to credentials theft, and from rootkit installation to network traversal.

    The lag between the race to move more workloads to the cloud and the ability to secure those workloads stems from knowledge and skills deficits, but there are platforms to bridge those gaps. More importantly, companies can achieve an unprecedented level of security as a result of the high level of policy-driven automation, the reduction in attack surface, and the ability to detect the smallest drift or behavioral anomalies of application components. Security methods that are an integral part of developing, deploying and running cloud applications are the way forward.

    Resource : https://threatpost.com/secure-move-cloud/180335/

    10Nov, 2022
    Several Cyber Attacks Observed Leveraging IPFS Decentralized Network

    A number of phishing campaigns are leveraging the decentralized Interplanetary Filesystem (IPFS) network to host malware, phishing kit infrastructure, and facilitate other attacks.

    “Multiple malware families are currently being hosted within IPFS and retrieved during the initial stages of malware attacks,” Cisco Talos researcher Edmund Brumaghin said in an analysis shared with The Hacker News.

    The research mirrors similar findings from Trustwave SpiderLabs in July 2022, which found more than 3,000 emails containing IPFS phishing URLs as an attack vector, calling IPFS the new “hotbed” for hosting phishing sites.

    IPFS as a technology is both resilient to censorship and takedowns, making it a double-edged sword. Underlying it is a peer-to-peer (P2P) network which replicates content across all participating nodes so that even if content is removed from one machine, requests for the resources can still be served via other systems.

    This also makes it ripe for abuse by bad actors looking to host malware that can resist law enforcement attempts at disrupting their attack infrastructure, like seen in the case of Emotet last year.

    “IPFS is currently being abused by a variety of threat actors who are using it to host malicious contents as part of phishing and malware distribution campaigns,” Brumaghin previously told The Hacker News in August 2022.

    This includes Dark Utilities, a command-and-control (C2) framework that’s advertised as a way for adversaries to avail remote system access, DDoS capabilities, and cryptocurrency mining, with the payload binaries provided by the platform hosted in IPFS.

    Furthermore, IPFS has been put to use to serve rogue landing pages as part of phishing campaigns orchestrated to steal credentials and distribute a wide range of malware comprising Agent Tesla, reverse shells, data wiper, and an information stealer called Hannabi Grabber.

    In one malspam delivery chain detailed by Talos, an email purporting to be from a Turkish financial institution urged the recipient to open a ZIP file attachment that, when launched, worked as a downloader to retrieve an obfuscated version of Agent Tesla hosted within the IPFS network.

    The destructive malware, for its part, takes the form of a batch file that deletes backups and recursively purges all directory contents. Hannabi Grabber is a Python-based malware that gathers sensitive information from the infected host, such as browser data and screenshots, and transmits it via a Discord Webhook.

    The latest development points to the growing use by attackers of legitimate offerings such as Discord, Slack, Telegram, Dropbox, Google Drive, AWS, and several others to host malicious content or to direct users to it, making phishing one of the lucrative primary initial access vectors.

    “We expect this activity to continue to increase as more threat actors recognize that IPFS can be used to facilitate bulletproof hosting, is resilient against content moderation and law enforcement activities, and introduces problems for organizations attempting to detect and defend against attacks that may leverage the IPFS network,” Brumaghin said.

    Resource : https://thehackernews.com/2022/11/several-cyber-attacks-observed.html

    9Nov, 2022
    NASA shifts launch date for its mega moon rocket yet again

    NASA’s Artemis I mission just can’t catch a break.

    Following several delays earlier this year due to technical issues on the launchpad, and more disruption caused by Hurricane Ian that prompted NASA to roll its next-generation Space Launch System (SLS) rocket to shelter, the approaching Tropical Storm Nicole is now causing concern among mission planners.

    Nicole is expected to develop into a hurricane before making landfall in Florida on Thursday morning. After assessing the latest weather data for the Kennedy Space Center in Florida, NASA said on Tuesday that it is no longer targeting Monday, November 14 for the SLS rocket launch that will send an uncrewed Orion spacecraft on a journey to the moon and back. Instead, it is aiming to send the SLS skyward on Wednesday, November 16.

    “NASA is continuing to monitor Tropical Storm Nicole and has decided to retarget a launch for the Artemis I mission for Wednesday, November 16, pending safe conditions for employees to return to work, as well as inspections after the storm has passed,” NASA said in a release on Tuesday.

    “Adjusting the target launch date will allow the workforce to tend to the needs of their families and homes, and provide sufficient logistical time to get back into launch status following the storm.”

    At the current time, Kennedy is in what is known as a HURCON (Hurricane Condition) III status, which involves securing facilities, property, and equipment at the center. It also has in place a ride-out team that will remain in a safe location at Kennedy throughout the storm to keep a close eye on the flight hardware for the Artemis I mission.

    For now, NASA plans to keep the 98-meter-tall SLS rocket on the launchpad, but if the weather conditions worsen significantly, it could take the same action it took with Hurricane Ian and roll the rocket back to the Vehicle Assembly Building (VAB) about four miles from the launchpad.

    After spending the entirety of October in the VAB — initially for protection from Hurricane Ian, but also to fix a number of technical issues — NASA rolled the SLS back to the launchpad last Friday.

    The space agency says its rocket is designed to withstand 85-mph (74.4-knot) winds at the 60-foot level. Current windspeed forecasts fall within that range.

    Hatches on the Orion spacecraft, which sits atop the rocket, have been secured to prevent water intrusion from any rain. For added protection, engineers have also placed a hard cover on the launch abort system window, and secured the crew access arm on the mobile launcher, among other measures, NASA said.

    Artemis I, when it finally gets underway, will be a test run for the crewed Artemis II mission taking the same route around the moon. If both go well, Artemis III will endeavor to put the first woman and first person of color on the lunar surface, a mission that could take place as early as 2025.

    Resource : https://www.digitaltrends.com/space/nasa-shifts-launch-date-again-for-its-mega-moon-rocket/

    9Nov, 2022
    pCloud’s password manager uses military-grade encryption on every device

    It seems like at every turn, there’s some sort of malicious actor trying to steal your login credentials. To combat this, a brand-new password manager called pCloud Pass uses some seriously heavy-duty tech to keep all of your credentials and vital info safe.

    There are a lot of password storage services out there. Unfortunately, it can be difficult to know who to trust. Most of those services store your passwords in plaintext, which is a basic form that doesn’t necessarily encrypt data at its core. The way pCloud’s password manager does it is to use a military-grade encryption algorithm so that crucial data is safe and sound.

    While the password manager from pCloud is only a month old, the user base already exceeds 20,000 users. With it, users have the ability to store website credentials, notes, and credit card information to have on hand. The only way that data can be decrypted is with a master password, which is a safe touch.

    The pCloud password manager app or extension is available for all major devices and browsers. You can grab passwords from your Android phone that you stored in Chrome on your desktop or vice versa. In either situation, your credentials are all securely stored and accessible as soon as you need them. You can have pCloud autofill your passwords with just a click, which makes navigating sites securely much easier.

    One helpful feature is pCloud’s import feature, which offers a seamless transfer of your saved passwords on other websites or services. You can have passwords sent directly from certain services or you can import your own CSV file, which is used by almost all cloud password storage services out there.

    In all, pCloud is probably one of your best options when it comes to safely store your passwords. Having your credentials locked behind a military-level method of encryption is enough to make anyone confident that their information is secure and locked tight.

    The service is currently offering a free 30-day trial of the premium tier.

    Resource : https://9to5google.com/

    8Nov, 2022
    Web Scraping – Is It Legal and Can It Be Prevented?

    Web scraping is a sensitive issue. Should a third party be allowed to visit a website and use automated tools to gather and store information at scale from that website? What if that information includes personal data? What does the law say? Can it be prevented? This is what we’ll discuss.

    What is web scraping?

    Web scraping is the use of automation to collect data from websites. In effect, it is little different to a person visiting a website to see what can be discovered – except the use of bots makes it thousands of times quicker and more efficient across many more sites.

    It is rarely, if ever, ad hoc. The organization conducting the scraping knows what information is being sought, and which sites should be visited. Examples include ecommerce sites seeking to learn competitive pricing and/or holiday season campaigns. Real Estate agencies might scrape other agencies to learn what properties are being sold, where and for what price.

    “Web scraping is the extraction of website information,” explains Nick Rago, field CTO at Salt Security. “While web scraping has valid business purposes, such as research, analysis, and news distribution, it can also be used for malicious purposes, such as sensitive data mining.”

    The scraped data is often in html format. This is sent to another application that converts it into a format suitable for analysis, such as a spreadsheet. A frequent purpose is to obtain information about competitors to allow the development of more competitive projects or offerings. There is, then, a clear business incentive to do so. But is it legal?

    Legal or illegal

    There is no clear statement on whether web scraping is legal or illegal – it is a sensitive issue that currently lacks comprehensive legal regulation or a clear industry consensus. Denas Grybauskas, head of legal at Oxylabs (a Lithuanian company providing proxies and specializing in web scraping) comments, “Web scraping is relatively new and thus shares the same problem with other new technologies – regulation is developing a lot slower than the technology itself.”

    hiQ vs LinkedIn

    Many people consider the question was settled in the US with a Ninth Circuit ruling in mid-April 2022. It was a case between hiQ Labs and LinkedIn. hiQ scrapes data from LinkedIn, creates employment profiles from the data, and sells it to employers. 

    LinkedIn sent a cease and desist notice to hiQ claiming the scraping was in breach of the Computer Fraud and Abuse Act (CFAA). hiQ disagreed and took the issue to court. A five-year legal journey eventually ended with the Ninth Circuit ruling that scraping publicly available web data is not precluded under the CFAA. At its basis, scraping public data does not involve hacking the site.

    The media led with headlines such as ‘Web scraping is legal’. This is an over-simplification. What the court ruled is that it is not illegal under CFAA – and even this, frankly, could be overturned if the Supreme Court takes a different view. There may also be different regulations in different jurisdictions – both at state level within the US, and most certainly at the international level with regulations such as GDPR.

    European regulators vs Clearview

    Clearview.ai says of its services, “Our platform, powered by facial recognition technology, includes the largest known database of 30+ billion facial images sourced from public-only web sources, including news media, mugshot websites, public social media, and other open sources.” Put simply, Clearview scrapes all possible websites for facial images, to provide “a revolutionary, web-based intelligence platform for law enforcement to use as a tool to help generate high-quality investigative leads.” This is not currently illegal in the US.

    In Britain, however, the UK privacy regulator fined Clearview $9.4 million for contravening the UK’s version of GDPR. The regulator commented, “The company not only enables identification of those people, but effectively monitors their behavior and offers it as a commercial service. That is unacceptable.”

    But at around the same time, a study from the research university KU Leuven reported, “From an EU data protection perspective, the collection and processing of photographs and related information has no legal basis. The data protection principles are not respected, and data subjects cannot exercise their rights. But with no physical presence in the EU, Clearview AI does not seem to be concerned by the unenforceable decisions of the DPAs.”

    The French data protection agency, CNIL, announced a €20 million (approximately $19.5 million) fine on Clearview on Thursday, October 20, 2022. Last year, CNIL ordered Clearview to stop processing personal data, but has not had a response.

    Apart from international legislation, Clearview must now also take account of specific US state-level legislation. In May 2022, the firm agreed to settle a case brought by the ACLU accusing it of violating a strict biometric privacy law in the state of Illinois. The settlement stops Clearview from making its ‘faceprint’ database available to most businesses or other private entities in the US; but does not limit Clearview from working with federal or state agencies other than those in Illinois.

    The implication from such cases is that web scrapers need to consider what they are scraping, and what different regulations may come into play. Clearly, scraping personal data is likely to be subject to various privacy regulations around the world. “In addition to regulations that differ from region to region,” warns Grybauskas, “there’s a long list of laws that might become relevant in specific circumstances.”

    Optus

    A clearly illegal and increasing version of web scraping occurred with the Optus breach announced on September 22, 2022. Modern websites use APIs to serve dynamically generated content to the client/browser. As a result, malicious web scraping bots have begun to focus on the APIs. In this instance, the Guardian comments, “Reports suggest Optus had an application programming interface (API) available online that did not require authorization or authentication to access customer data.”

    Rago takes up the story. “The API breach experienced recently by Australian telecommunications company, Optus, provides a good example of malicious API data scraping or web scraping, where the intent was to harvest sensitive data from a publicly exposed API. In that incident, the attacker leveraged an ‘open’ or unauthenticated API to exfiltrate thousands of user records. Thus, web scraping has evolved into API scraping, making it even more difficult to detect.”

    Scott Gerlach, co-founder and CSO at StackHawk, confirms the importance of APIs in malicious web scraping. “Many site owners may think my app or website isn’t big enough to draw attention, but the data collected by an organization is very valuable to bad actors,” he told SecurityWeek. “And with more websites and apps moving towards API-driven architectures, you must also ensure the APIs transferring data are secure.”

    The legal/illegal balancing act

    It isn’t possible to say whether web scraping is legal or illegal. It depends on the method of scraping, the data scraped, the purpose of the scraping, and the jurisdiction concerned.

    Aleksandras Sulzenko, the product owner at Oxylabs, seeks to navigate the lack of clear regulations on two fronts – which he describes as infrastructure and usage. The ‘infrastructure’ is basically the proxies he uses to deliver the service. He uses residential proxies, but only where the owner knows and consents to the usage and is rewarded for it.

    ‘Usage’ is the actual scraping. His primary concern is to do no harm to the website being scraped. So, he has three priorities: “We limit the rate of the requests to avoid causing any traffic harm; we go through extensive KYC procedures to be confident that our solution is only being used for legitimate purposes; and we only scrape publicly accessible data.” 

    On the last, this means he doesn’t allow customers to scrape data that sits behind a login, and that means he effectively avoids any possible conflict with CFAA in the US because nothing can be construed as hacking.

    Defending against web scraping

    While ‘legal’ web scraping is widely used in business, it remains a sensitive issue. This is most obvious where personal data is scraped. LinkedIn, for example, is basically a professional CV showpiece – so users of LinkedIn are actively advertising their personal details. Having those details collected and collated en masse, and then sold to strangers is less appealing.

    Clearview’s image scraping in the US is similar. Social media users post photos and selfies because they want to be known and recognized. But having those images scraped and sold on to third parties, including law enforcement, so that they can be recognized in realtime in different locations by image recognition camera systems is not so welcome.

    Web scraping is widespread in many different industry sectors. It’s just an aspect of doing business. Where the scraping process is designed to be ‘low and slow’, the ‘victim’ may even be unaware of its occurrence. Some companies may simply assume that it happens, because they do it themselves, scraping competitor data.

    Where scraping is unwanted, the Oxylabs legal type of scraping can be defeated by insisting visitors have an account that they must log into. “You can prevent scraping by placing all the data you want to hide behind login requirements that can be strengthened by MFA,” comments Sulzenko. “But it’s a trade-off because this creates more friction for the legitimate customers you want to allow in.”

    This is the trap faced, for example, by content and news sites. Take SecurityWeek itself. SecurityWeek wants its content to be seen and read freely. This means not requiring visitors to have an account that must be logged into. But that, in turn, means the content is more easily scraped and perhaps republished elsewhere under a different name. It happens.

    Illegal scraping – the type performed by hackers – can only be mitigated by better security. “To prevent malicious web scraping, site owners need visibility into every API endpoint and the data exposed,” explains Gerlach. “Testing web interfaces and APIs for vulnerabilities frequently and early on improves overall security posture and provides insight to act quickly if needed.”

    Rago adds, “Organizations must be careful that they only expose the information that they want exposed.” A retailer may want to openly share product, pricing, and inventory information, but probably doesn’t want to share customer and payment data. “To reduce risk,” he continued, “organizations need good visibility and governance around their data exposure and maintain proper security around web interfaces and the underlying APIs that transport this sensitive data.”

    Resource : https://www.securityweek.com/web-scraping-it-legal-and-can-it-be-prevented

    8Nov, 2022
    Web security flaw in Sophos Firewall patched

    A recently resolved vulnerability in Sophos Firewall has been abused by attackers in targeted attacks, the vendor warns.

    The critical vulnerability (CVE-2022-3236) poses a remote code execution (RCE) risk.

    Sophos Firewall v19.0 MR1 (19.0.1) and older are potentially vulnerable to the security bug in the User Portal and Webadmin of Sophos Firewall.

    In a security advisory published on Friday (September 23), Sophos said that it has issued a patch that installs automatically in default installations of its firewall technology.

    This is just as well given the vulnerability has already featured in attacks in the wild.

    “Sophos has observed this vulnerability being used to target a small set of specific organizations, primarily in the South Asia region,” the vendor’s advisory said. “We have informed each of these organizations directly.

    “Sophos will provide further details as we continue to investigate,” it added.

    Short of applying a patch, the vulnerability might be mitigated by disabling WAN access to the User Portal and Webadmin, Sophos advises.

    The Daily Swig asked Sophos to explain in what ways the vulnerability has been exploited and how the problem was discovered.

    In response, Sophos said it was alerted about the zero-day vulnerability by one of its customers. The vendor went on to reiterate that few of its customers were affected by the problem – without saying what issues they may have faced:

    A customer notified Sophos, at which time Sophos took immediate steps to issue a hotfix, which was already applied last week. This only affected an extremely small subset of organizations.

    The vulnerability is noteworthy since it represents a web security flaw in a network security product.

    One infosec observer warned that the flaw is of the type that might lend itself to widespread abuse.

    “This has a HIGH chance of mass exploitation, given the vulnerability is based on Code Injection (CWE-94) and if we look at the #CISA KEVs, at least 28 of those are Code Injection related,” said threat researcher Immanuel Chavoya in a post about the vulnerability on Twitter.

    Resource : https://portswigger.net/daily-swig/web-security-flaw-in-sophos-firewall-patched

    7Nov, 2022
    Cyberwar is Changing – is Your Organization Ready?

    Some say that a global cyberwar has been raging for many years now, with the latest geopolitical instabilities, malware and intellectual theft campaigns originating from Russia, China, Iran and North Korea directed against many Western and NATO nations (as well as vice versa), being a continuation of the existing silent cyberwar. In other words, the argument goes, nothing has changed, and there is nothing to worry about – unless you’re aligned with a targeted state. 

    However, a lot has changed. Today’s cyberwar targets extend well beyond state entities and impacts organizations around the world.

    In fact, cyber-attacks against critical infrastructure, manufacturers and tech firms have become so common that CISA has implemented its ‘Shields Up’ advisory, providing updates on how Russia’s ongoing actions are impacting organizations beyond the immediate warzone, along with guidance for preventing cyber-attacks.

    Industrial and Manufacturing Are Top Targets

    Recently, the trend of cyber-attacks has pivoted to target operational technology (OT) and industrial control systems (ICS) in manufacturing providers for all industries.

    The two most notable recent examples include ransomware attacks on Bridgestone Americas and a suspected cyber-attack on Japan-based Toyota plants. The latter attack happened on the same day Japan joined Western countries in restricting transactions with the Central Bank of the Russian Federation. However, please note that bad actors are often driven by monetary reward and not just geopolitics.

    Attacks on critical infrastructure increased by 3900% from 2013 to 2020, and 55% of OT security practitioners rate ransomware as the #1 threat to OT systems, double the percentage that rated it as the #1 threat in 2019. Why?

    For one, the emergence of ransomware gangs like Conti, who extorted at least $180m from victims in 2021. This is around double the amount extorted by DarkSide/BlackMatter, who were responsible for the well-known attack on Colonial Pipeline. Ransomware is proving to be very profitable for bad actors. 

    Whereas aggressors once sought plausible deniability in their attacks, many now seem to pursue cyberwarfare against consumer services, critical infrastructure, hospitals and the like with impunity. Today, cyberwarfare is the most convenient, asymmetrical and cost-effective way for countries and bad actors to conduct warfare.

    Cyber Resilience Is Key

    Continued migration to the cloud, the move to mobile and BYOD, the convergence of IT/OT/IoT and the sharp increase in remote working have changed how we must approach cybersecurity. As the number of connected devices in the workplace and manufacturing plants grows, the IT/OT and security tools previously relied on are becoming ineffective. 

    For critical infrastructure and OT organizations, given the unprecedented geopolitical situation, every organization should, at the bare minimum, be able to answer these questions:

    • What is connected to my network?
    • What are these devices doing while connected?
    • Are there active exploits crossing my enterprise?
    • What is the risk posture of our devices and our organization?

    Visibility Gaps

    Many organizations do not have the required insight and visibility into their infrastructure, nor do they have all the policies and processes to respond effectively to an attack. If you can’t see your blind spots, you are more likely to be the target of a significant attack.

    Ideally, you should be aware of all the processes in the organization and spread them out on a virtual map. This includes every connected IT and OT asset – managed and unmanaged – found within and around the enterprise and network equipment and related devices that connect to the network. Once the map is established, behavior pattern threat detection can detect anomalies in real time and allow for swift action.

    It only takes one missed asset to suffer from a cyber-intrusion; therefore, organizations can respond much more quickly and effectively if they have a comprehensive view of all assets. Every time a new high-severity vulnerability/CVE is published, vulnerability analysts can cut to the chase and quickly determine the total risk it poses to the business based on all the impacted assets. Then, based on risk levels to the business, they can define which assets should be remediated first (if possible), quarantined or even taken offline. 

    Mapping out all processes and assets is also vital to recovery during a cyber intrusion. Following an attack, organizations can sometimes go down for a day or two, and in unusual cases, it can take months to get back in business. Companies should also push for assurances by independent auditors that their infrastructure can rapidly recover after a cyber-attack. 

    Overall, ensuring best-in-class cyber asset visibility and security partners or providers is crucial to any organization’s future security, safety and profitability in this age of cyberwarfare – where any organization can be a target.

    Resource : https://www.infosecurity-magazine.com/opinions/cyberwarfare-changing-org-ready/

    7Nov, 2022
    World’s Most Expensive Observatory Floored by Cyber-Attack

    The world-famous Atacama Large Millimeter Array (ALMA) observatory in Chile has become the latest unlikely victim of a cyber-attack, forcing it offline.

    The facility, which also claims to house the world’s most powerful telescope for observing molecular gas and dust, revealed the incident on Twitter earlier this week.

    It said the attack on its computer systems came last Saturday, “forcing the suspension of astronomical observations and the public website.”

    At the time of writing, the official ALMA website was still down.

    “There are limited email services at the observatory. The threat has been contained, and our specialists are working hard to restore affected systems. The attack did not compromise the ALMA antennas or any scientific data,” it explained.

    “Given the nature of the episode, it is not yet possible to estimate a date for a return to regular activities. We are thankful for the support across the ALMA partnership and apologize for any inconveniences resulting from the recovery efforts.”

    Kelvin Murray, senior threat researcher at OpenText Security Solutions, argued that space-related technology is increasingly a focus for threat actors.

    “The cyber-attack on the ALMA radio telescope is a stark reminder that no matter the industry, cyber-defenses need to be regularly assessed and updated to ensure that hacks like these don’t happen,” he added.

    “As digital equipment and software develops, the industry needs to keep cyber risk top of mind and continually assess the strength of its defenses. The consequence of the breach cannot be undermined.”

    It remains to be seen what kind of attack the observatory suffered, although ransomware would be an obvious candidate given the facility was forced offline.

    Chris Vaughan, VP of technical account management EMEA at Tanium, argued that ALMA was likely working with “very limited” IT budgets and staff.

    “A high level of network visibility should be utilized as part of a zero-trust approach. This is where implicit trust is eliminated and the principle of ‘never trust, always verify’ is used,” he advised.

    “This means that strong authentication methods, network segmentation and lateral movement prevention is key. If these practices are embedded within an organization’s culture along with effective staff training, then institutions like ALMA can carry on their fantastic work without costly interruptions caused by cyber-threats.”

    ALMA is believed to have cost around $1.4bn to build.

    Resource : https://www.infosecurity-magazine.com/news/worlds-most-expensive-observatory/

    5Nov, 2022
    NASA Invites Media to Discuss Space Station Science, Experiments

    NASA will host a media teleconference at 1 p.m. EST Wednesday, Nov. 9, to discuss the hardware, technology demonstrations, and science experiments headed to the International Space Station aboard SpaceX’s 26th commercial resupply mission for the agency.

    Audio of the teleconference will be streamed live online at:

    https://www.nasa.gov/live

    SpaceX is targeting Friday, Nov. 18, to launch its Dragon cargo spacecraft atop a Falcon 9 rocket from Launch Complex 39A at NASA’s Kennedy Space Center in Florida.

    One of the payloads aboard the cargo flight is the Moon Microscope kit for in-flight medical diagnosis that includes a portable handheld microscope and a small self-contained blood sample staining device. This will allow astronauts to collect and stain a blood sample, obtain images with the microscope, and transmit images to the ground, where flight surgeons will use them to diagnose illnesses and prescribe treatments.

    SpaceX’s Dragon also will deliver new science investigations, supplies, and equipment for the international crew, including the next set of International Space Station Roll Out Solar Arrays (iROSAs). It also will carry a study which will grow dwarf tomatoes as part of efforts to create a continuous fresh-food production system in space, and an experiment that tests an on-demand method to create specific quantities of key nutrients.

    Teleconference participants include:

    • Kirt Costello, NASA’s chief scientist for the International Space Station Program Research Office, who will provide an overview of the research and technology launching aboard the Dragon spacecrafts
    • Gioia Massa, NASA’s space crop production scientist and principal investigator for the Veg-05 study
    • Matt Mickle, Boeing’s developmental projects senior manager, who will discuss International Space Station Roll Out Solar Arrays (iROSA)
    • Timothy Macaulay, CIPHER vestibular health study lead, an experiment which will use the newly launching Falcon Goggles tool
    • Mayra Nelman-Gonzalez, immunologist in NASA’s Johnson Space Center’s Immunology and Virology Laboratory and co-investigator for the Moon Microscope technology demonstration
    • John A. Hogan, chief of the bioengineering branch at NASA’s Ames Research Center and principal investigator for the BioNutrients-2 experiment
    • A representative for the Extrusion study sponsored by the ISS National Laboratory

    To participate in the call, media must contact Lora Bleacher at least two hours prior to the start of the call for dial-in details at: lora.v.bleacher@nasa.gov. Media and the public can submit questions on social media using #AskNASA.

    Cargo resupply by U.S. companies significantly increases NASA’s ability to conduct more investigations aboard the orbiting laboratory. Those investigations lead to new technologies, medical treatments, and products that improve life on Earth. Other U.S. government agencies, private industry, and academic and research institutions can also conduct microgravity research through our partnership with the ISS National Laboratory.

    Humans have occupied the space station continuously since November 2000. In that time, 263 people and a variety of international and commercial spacecraft have visited the orbital outpost. It remains the springboard to NASA’s next great leap in exploration, including future missions to the Moon under Artemis and eventually Mars.

    Members of the public can attend the launch virtually and receive mission updates. To participate, members of the public can register to stay up to date on mission information, mission highlights, and interaction opportunities.

    For launch countdown coverage, NASA’s launch blog, and more information about the mission, visit:

    https://www.nasa.gov/spacex

    Resource : https://www.nasa.gov/press-release/nasa-invites-media-to-discuss-space-station-science-experiments