Blog

clearinfosec.com ↗

Author: Clear Infosec

  • WINDOWS LSA Spoofing Vulnerability

    WINDOWS LSA Spoofing Vulnerability

    Microsoft released a patch for Windows Local Security Authority (LSA) spoofing recently. This was one among the 74 security flaws reported to be fixed with the new patch, including 7 critical, 66 deemed important and 1 low severity.

    Windows LSA spoofing vulnerability (CVE-2022-26925) is being wildly exploited. As per Microsoft an unauthorised bad actor will be able to “coerce the domain controller to authenticate to the attacker using NTLM.” A bad-actor, via man-in-the-middle attack can easily exploit this vulnerability. They inject themselves into the logical network path between the target and the resource requested. The bug individually has a 8.3 CVSS severity score but when combined with NTLM relay attacks, the combined severity score is would be 9.8, according to Microsoft.

    Cybersecurity and Infrastructure Security Agency (CISA) have added this vulnerability in their “Must-Patch” list because federal agencies are advised to patch the vulnerabilities within a specified timeframe. Microsoft is giving further mitigation instructions for this vulnerability, as well as a default configuration for Windows servers with specified roles enabled, which permits exploitation of the vulnerability.

    “The story behind CVE-2022-26925 is no advanced reverse engineering, but a lucky accident. During my pentests in January and March, I saw that PetitPotam worked against the [domain controllers],” said Raphael John from Bertelsmann Printing Group, who has been credited by Microsoft for reporting CVE-2022-26925 on Twitter.

    Microsoft has addressed this vulnerability with the May patches release and warned at the time that the vulnerability has been publicly disclosed and exploited in attacks. The May 10 upgrade should not cause issues on client devices or non-domain controller servers, according to CISA, and users should continue to install it on these devices.

    Base Score Metrics explained

    1. Attack Vector

    It describes the context by which the vulnerability exploitation is possible. In this case, it is the Network. The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. 

    1. Attack Complexity

    It describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability. In this case, it is High. requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected.

    1. Privileges required

    It describes the level of privileges the attacker must have in order to exploit the vulnerability. In this case, it is None. The attacker is unauthorized and requires no access to settings or files to perform an attack. 

    1. User Interaction

    It describes the requirement for a user other than the attacker to perform a successful attack. It is None in this case. The vulnerable system can be exploited without any user interaction.

    1. Scope

    It shows the if components other than the vulnerable component are affected with the attack when the vulnerability is exploited. Base score increases if so. It is Unchanged in this case as this vulnerability, when exploited, can affect only the resources managed by same security authority.

    1. Confidentiality

    It measures the impact to the confidentiality of information resources managed by a software component due to a successful exploitation. In this case, it is High as there is a total loss of confidentiality.

    1. Integrity

    It measures the impact to the integrity of a successful exploitation. It is High in this case as there is a total loss of integrity.

    1. Availability

    It measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.

    This vulnerability is actively under exploitation, and we recommend updating the new Windows May patch. With Clear Infosec Threat Intelligence Bulletin, stay update of the new threats and stay fortified.

  • Do you know about Denonia?

    Do you know about Denonia?

    Malware that targets AWS Lambda Environments

    A first-of-its-kind malware that is specifically designed to execute in an AWS Lambda environment has been discovered by Cado labs. Even serverless environments are no longer safe. While the malware’s distribution is limited, the discovery of such malware is evidence of bad actors’ advanced technical skills and their interest in cryptocurrency.

    What is AWS Lambda

    AWS Lambda is serverless, event-driven compute service that runs code for any application or service without managing a server. It runs the code in response to events and can be triggered from over 200 AWS services and SaaS applications.

    A serverless environment doesn’t mean there isn’t any server lying behind, but the user doesn’t have to manually manage the virtual machine or infrastructure behind it. AWS Lambda automatically manages the underlying computing resources, unlike AWS EC2 (Elastic Compute Cloud).

    Why a malware inside a serverless environment can be a big deal?

    It is the cloud provider who manages and secures the underlying server, operating system, etc. reducing the attack surface. Under AWS shared responsibility model, AWS manages and secures the Lambda environment while the users secure the functions. Another feature to be mentioned is its ephemerality. AWS Lambda is short-lived, which means its runtime duration is very short. Security features of AWS lambda allow it to act only when the right resources or services with the right permissions try to invoke it.

    But we need to note that nothing could stop DENONIA. Denonia can be a great example that attackers are gaining advanced cloud-specific knowledge to exploit even the complex cloud infrastructure. It is still a mystery exactly how the bad actors were able to deploy Denonia in the AWS Lambda environment. This single malware shows that there might be more attacks to come.

    Denonia Malware

    Denonia malware is 64-bit executable targeting x86-64-bit architecture that is written in Go language. It is named after the domain it communicates with (gw.denonia.xyz).

    Denonia malware executes a customized version of XMRig in the lambda environment. XMRig is a software that is intended to mine Monero cryptocurrency. The malware uses several 3rd party libraries including the one that enables execution inside the AWS lambda environment. The security researchers were able to execute the malware on AWS Linux boxes used by the Lambda environment.

    How Denonia works

    Denonia communicates with Command and Control (C&C) servers using a GO library that supports DNS over HTTPS (DoH). The DNS queries are encrypted, and the requests go out as regular HTTPS traffic to DoH resolvers like Cloudflare, Google, etc.

    This technique provides some benefits which we must note. AWS cannot see the DNS lookups for the malicious Denonia domain, which helps to avoid detection from cloud workload protection tools. Since DNS requests appear as HTTPS traffic, it bypasses VPC level DNS controls.

    When DNS resolvers send an IP address back to malware, it simply writes it to XMRig, and the malware then starts XMRig from memory and communicates with the hacker mining pool to get the mining job started.

    The future implications

    Even though the malware seems to be causing harm to anybody now, the techniques used behind might open doors to more harmful attacks in the coming days. This single malware proved that even the serverless environments are not fundamentally secure as we thought they were.

    The need to build new security tools to deal with malware detection and prevention within the serverless environment is on the rise.

    Protect yourself from Denonia

    How Denonia gets deployed in the Lambda environment is still unknown. But it is important to take all possible security measures to bring more security to avoid it.

    1. Keep your AWS credentials secured and do not share them with anyone
    2. User accounts should be carefully set up with the least privileges
    3. Enable MFA for every account
    4. SSL/TLS protocol should be used to communicate with AWS resources
    5. Enable API and user log in with AWS CloudTrail
    6. Monitor activity logs regularly

    Found the article interesting? Follow us on LinkedIn, Facebook & Twitter for more updates on the new vulnerabilities and what is happening in the InfoSec community.

  • Microsoft Autopatch

    Microsoft Autopatch

    Everyone might have already known that Microsoft announced a feature Windows Autopatch, which will be released in July 2022. This blog is about this new feature that Microsoft is planning to release.
    Windows Autopatch is a service mainly designed to update the windows and office automatically. This feature will be available for free for those users who have a subscription to
    • Windows E3 or above
    • Microsoft Intune
    • Windows 10/11
    • Azure AD premium.
    And it does not apply to Windows Server OS and Windows 365 for Business.
    “This service will automatically keep Windows and Office software on enrolled endpoints up-to-date at no additional cost. The second Tuesday of every month will be ‘just another Tuesday’,” promised Lior Bela, a Sr. Product Marketing Manager at Microsoft.
    It was mentioned that the patch was mainly released to focus on updating the patch timely to reduce the security threats that may arise because of lag in an update. This update also focused on tackling the complexity involved in software updating in an entire IT organization.
    As we know, cybercrime is getting more and more advanced. Their knack for catching the loophole is also high reading all the attacks. So, we can guess they are hoping this update may reduce the attackers to catch this simple entry into the network or system, which may arise due to lag in time to update.


    Source: Windows

    According to the description given by Microsoft, the windows autopatch feature automatically creates four testing rings. Each of the testing rings represents all the diversity in an enterprise.
    The updates are initially tested on a small set of devices. If the update and installation create no further problems, the installation will be extended to larger sets of devices.
    The “test ring” will contain a minimum number of devices in the organization.
    “First ring” is around 1% of all the devices and software needed to keep up to date as soon as possible.
    “Fast ring” contains around 9% of the devices, and “broad ring” is around 90% of the rest of the devices.
    The population dividend if these rings are managed automatically. But the organization’s IT admins are given privileges to move specific devices from one ring to another ring


    Source: Windows

    And administrators can also stop, pause or roll back the update if they find any problems during the update or need an older version for their unique requirement.
    For more details about the requirements, eligibility, and other information about this feature, you can search in Windows Autopatch FAQ. Lior Bela publishes them.

  • What is Spring4Shell?

    What is Spring4Shell?

    Spring framework is found to have a Remote Code Execution (RCE) flaw. This vulnerability, if exploited successfully, will let the attacker take control of the targeted system. Fortunately, the team behind the framework was successfully able to release a patch to address the flaw.

    What makes Spring4Shell vulnerability (CVE-2022-22965) very dangerous is the leverage it gives to an unauthorized user. It is named Spring4shell due to its resemblance to the old threat log4shell. Many researchers believe this could have been worse than log4shell. This vulnerability impacts the spring framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and other older versions. The patch is available in versions 5.3.18 or later and 5.2.20.

    What is Spring framework?

    Spring is a popular application development framework for Java, used by millions of developers across the world. What adds the most value to it is that it is an open-source platform.

    Spring can be used to build websites and applications and there exist millions of sites on the internet that runs on the spring framework which potentially increases the attack surface.

    CVE 2022-22965

    You should not get confused this vulnerability with another vulnerability (CVE-2022-22963) that was disclosed at almost the same time in a component called the spring cloud function allowing code injection through Spring Expression language. This vulnerability, found in the Spring Cloud Function versions 3.1.6, 3.2.2, and below, does not impact the Spring core, but Spring4Shell does. But both the vulnerabilities can be used for remote code execution.

    Spring4shell vulnerability, affecting the Spring core, allows attackers to send a custom-built HTTP request to bypass the security measures in the HTTP request parser and leads to remote code execution. The bug exists in the getCachedIntrospectionResults method to gain unauthorized access. When special object classes are used, it creates a risk of data leakage and remote code execution.

    This vulnerability is easy for the bad actors to exploit if they can find vulnerable versions in the production environment.

    Check whether you are vulnerable or not:

    You are vulnerable if:

    1. You are using Spring framework versions 5.3.17 and below, 5.2.19, and below.
    2. Your app runs on Java 9+
    3. You have Apache Tomcat for serving the application
    4. You built applications as WAR files
    5. You use form binding with name=value pairs and not using Spring’s more popular message conversion of JSON/XML
    6. You don’t use an allowlist or you don’t have a denylist that blocks fields like “class”, “module”, “classLoader”

    It is a toiling process for the development team to manually check the entire source code. Using a Software Composition Analysis (SCA) tool. An SCA tool enables you to analyze and manage the open-source elements of your applications.

    It scans your source code repositories and figures out all the open-source components that are used to build your application. So, when a new vulnerability comes up, you can immediately verify whether you are using the vulnerable component.

    How to mitigate the issue:

    There are many PoCs available for the Spring4Shell vulnerability. As this is a new vulnerability and more exploits can be expected in the coming days and the one thing that you need to do to keep your application secured is to stay updated and patch.

    How Clear Infosec can help:

    Talk to our industry-leading security experts in order to keep your applications protected. Review your source codes and much more offerings and integrate security into every layer of your application development cycle.

  • Dirty Pipe – Privilege Escalation Vulnerability in Linux

    Dirty Pipe – Privilege Escalation Vulnerability in Linux

    Linux is found to have yet another severe privilege escalation vulnerability (CVE 2022-0847) in kernel version 5.8 and above. This vulnerability is allowed bad actors to execute malicious code that can act as a host to destructive actions like installing backdoors into the system, injecting code into scripts, and even creating unauthorized user profiles.

    This vulnerability was discovered by Max Kellermann in early March 2022 and is similar to the old Dirty Cow vulnerability (CVE 2016-5195). You must also note that the Dirty pipe vulnerability has been fixed in Linux Kernel versions 5.16.11, 5.15.25, and 5.10.102. If you are using Linux devices, ensure that it is updated to these versions or above.

    Let us look at the way the Linux kernel manages memory before we dive into the vulnerability.

    Working of Linux Kernel

    The kernel is a core program of an operating system. It is in fact the first program loaded when the system starts. The basic unit of memory is the PAGE. It is still unknown how large a page can get, but typically, it is considered as 4Kib. Page cache manages the page and pages are mainly used when a read or write operation is performed on the files on the disk. This reading and writing are performed with the use of PIPES. Piping is an old mechanism that sends the output of one command/process/program into another.  

    Before getting into this vulnerability, you should also know about “splice()”. This function speeds up the process of pushing the contents of a file into a pipe. In other words, it points the pipe at a page that is already loaded into the memory where a section of a read-only file is already opened.

    Dirty Pipe in Linux                                            

    Dirty Pipe vulnerability makes use of the pipeline mechanism to allow local users to gain root access to any system. What makes this vulnerability dangerous is that this vulnerability can be easily exploited with publicly available exploits.

    There are several ways to exploit this vulnerability for privilege escalation. This vulnerability makes the bad actors gain root access and write to read-only files possible. If the bad actor gets to the /etc/passwd file containing the list of users and their privileges, they can append to the file a new user with root privileges.

    How the exploit works

    Let us start by creating a pipe. You will then be copying arbitrary data into that pipe just to ensure that the pipe buff flag (can merge flag) is set in all instances. Then you will be draining the pipe leaving that flag set in all the pipe buffers. This is where the bug occurs.

    That flag is supposed to get reset. You will then splice data from a target read-only file into the pipe just before where the target is. Normally when you splice data into a pipe, you cannot write more data to that page. But this pipe buffer has the “can merge flag”.

    This results in a mergeable pipe buffer that also has a reference to data in it. Now starts the real exploit. You can now simply write arbitrary data to that pipe buffer and then overwrite what was being referenced.  

    The real problem

    The write permissions are working fine but the real problem is, the write permissions aren’t checked in pipes. It is because when you are at the pipe level, the kernel believes the permissions are already verified and accepted.

    This can make an unauthorized user gain root permissions and even inject arbitrary ssh keys to gain remote access to a system. This raises a big issue, making this vulnerability notable in the InfoSec community.

    Remediations

    Updating the kernel is the remedy here. Patch for this vulnerability was released very soon knowing the impact this will cause. The Linux kernel versions 5.16.11, 5.15.25, 5.10.102 are released with the patch included.

    If you are using Linux systems, ensure that you are using at least these versions or above.

    Stay secure with Clear Infosec

    To keep you informed of all the new vulnerabilities and fixes, sign up for our Threat Intelligence newsletter (TIB). Stay informed and stay secure.

  • Adopting Zero Trust Model

    Adopting Zero Trust Model

    From Zero to Hero

    Employees are not limited to the office building like in the old days. The remote working had effects on literally everything. Organizations today need a comprehensive security strategy to manage the complexities of securing the data.
    From perimeter-based security to Zero trust architecture, we have come a long way. Let us look into how everything used to be and how everything is today.

     

    Before Zero Trust

    There was a time when the organizations only had to secure just the perimeter and everything inside that was counted as a trusted device or person. With time, technologies evolved and we have measures to secure each device/person within the perimeter.

    In Perimeter based security:      1. External access is untrusted
                                                               2. Internal access is trusted

    With remote working, organizations no longer have the perimeter, and made the attack surface increase. Excessive trust is always the main challenge to overcome and that is what the Zero-Trust model addresses.

    What is Zero Trust Model?

    Zero Trust is an advanced tactic intended to secure data and information by continuously verifying every digital interaction and avoiding implicitly trusting any access requests. The Zero-Trust model is built on a foundation that says, “NEVER TRUST, ALWAYS VERIFY”. No device or person is trusted by default, regardless of the location – whether within or outside the security perimeter.

    The basic principles of the Zero Trust model are:

    1. Verify Explicitly: Always Authenticate and Authorize.
    2. Use least privileged access: Limit user access with limited permissions for a limited time.
    3. Assume breach: Verify all sessions and attempts made for accessing data

    This model assumes every incoming request into the network as a breach and looks at that request as it is from an unauthenticated source. So the response to the request is provided only if that request is proved to be from a trustworthy source. Under the zero trust model, all traffic should be:

    • Authenticated – Every user/device is authenticated and is proved to be legitimate to gain trust
    • Encrypted – To protect Confidentiality, the data is encrypted while transmitting between source and destination.

    Need for Zero Trust Model

    Organizations are allowing employees to access business assets from remote devices and locations. So, organizations can no longer trust everything within the security parameter is secure. Regardless of where the request originates from, companies should secure connections to the business resources.

    With users and devices moving outside the enterprise perimeter, the business processes driven by digital transformation are increasing the risk exposure. The need to think of some strategy other than “Trust but verify” was inevitable.

    To protect data, and securely provide access to devices and users from wherever they are, organizations needed a new strategy. The zero trust model can be called a powerful strategy to stand protected in the competitive market.

    Building zero trust in your organization

    Zero trust controls should be implemented into all fundamental elements which are:

    • Identities: It can be people, devices, or services. When an identity tries to access a resource, that attempt should be verified with strong authentication and ensure that the least privileged access is provided.
    • Devices: Once an identity is granted access, it can access the data from anywhere via different devices. This increases the attack surface area and needs to be properly secured. The device should be compliant for secure access and its health should be continuously monitored.
    • Applications: Applications and APIs stand as the point of contact through which an identity access the data. The applications should have appropriate in-app permissions, control for user actions, and should be monitored for abnormal behavior.
    • Data: Data is the primary thing that needs the most secure options. Data should be classified, labeled, and encrypted. Whether it is in motion or at rest, it should be protected.
    • Infrastructure: The infrastructure of organizations every from one another. It can be On-Premises, Cloud, hybrid, etc. the infrastructure as a whole should be secured, monitored for any suspicious behavior, and apply patches/updates whenever it is available.
    • Networks: The data transfer is carried out over the networks. Proper controls should be placed in order to enhance better visibility of the data flowing in the network. The network connection should be monitored and end-to-end protected.

    Organizations should ensure that their data is kept safely to be recognized in the competitive business market. We highly recommend increasing the visibility of your networks and speeding up your detection procedures. Talk to our information security expert to start your journey towards a fortified infrastructure.

  • Browser in The Browser – A new near invisible attack

    Browser in The Browser – A new near invisible attack

    While reading on the different types of phishing attacks, recently I came across an interesting article by mr.d0x. His article explores the type of attack called Browser in the Browser (BITB). It is a novel phishing attack that exploits the user by simulating a browser window within a browser to spoof a legitimate domain. In simple terms, the pop-up window is used for spoofing.

    For all those who want to access the net and be safe, the first thing they will note is to look for whether the website URL shows HTTPS. This will indicate that the site is secured with TLS/SSL encryption.

    Of course, as technology develops, cybercrimes also develop with time. The URL method of checking is not reliable for quite some time because of many homographs attacks, DNS hijacking, and more. Now we can add one more attack to this list.

    BITB

    This BITB attack exploits the advantage of the third-party single sign on options (SSO) embedded on websites that issue pop-up windows for authentication. For example, Sign into Facebook, Apple, Google, or Microsoft. And it should be taken into consideration that these kinds of SSO pop-up methods are used widely for authentication.

    Fabricating POP up is easy

    According to the researcher, mr.d0x, creating a malicious pop-up window is very simple using basic HTML and CCS code. This BITB attack is very hard to find as it looks exactly similar to the original version. The following image shows the side by side by comparing original and fake windows provided in the mr.d0x blog.

    As we can see, the imitation of the windows is uncanny. Many security industrialists will also fail to see the difference between the two.

    POP-UP windows from click

    Fortunately, for this kind of attack to initiate, the attacker needs to make the user first visit the malicious site and click on the links to provide the pop-up windows.

    The attackers may use JavaScript to make the fabricated window appear when pressing the button click or link. The attackers may use animations or other designs to make it more appealing to the users.

    Hover over the links

    Hovering over the links is another simple method to confirm the link’s legitimate address. But if JavaScript is included in the attack, this method will ultimately fool the users. So BITB attacks render another simple means of avoiding phishing attacks useless.

    Avoid Fake POP window

    By using BITB, stealing the passwords will be very easy. Now let’s see some ways to avoid falling into this malicious attack lose our valuable credentials.

    • The best way to avoid this is to use password managers, as unnatural links may not fool the best password managers.
    • We can resize the desktop browser. If the JavaScript is not good enough, it will be easy to identify the fake.
    • You can also drag the pop window past the browser edge and hope that the pop-up window responds correctly. Otherwise, you can conclude that you are subjected to a phishing attack.

    The BITB attack mainly targets SSO, so using Multi-Factor Authentication (MFA) is highly recommended.

  • How Attack Vectors Can Harm Your Company

    How Attack Vectors Can Harm Your Company

    Effects Of Cyber Attacks :

    In recent years, we’ve likely to hear more about cybersecurity problems affecting all sorts and scales of businesses. This year, remote employment played a big role in the breach and the average cost was USD 1.07 million in which compromised credentials were the most prevalent first attack vector – accounting for 20% of breaches with an average cost of USD 4.37 million.

    Global cybercrime expenses which are expected to reach USD 10.5 trillion annually by 2025 up from USD 3 trillion in 2015 include – Theft of intellectual property, theft of personal and financial data, fraud, post-attack disruption to the regular run of business, forensic investigation, restoration and deletion of hacked data and systems, and reputational damages are all costs associated with cybercrime.

    A cyberattack can shut down a city’s, state’s, or even our entire country’s economy. In this blog, we’ll look at what is attack vectors and how cybercriminals utilize these attack vectors to exploit IT security flaws and execute their methods. We’ll also go over some basic security precautions for your firm to protect from these types of attacks.

    Attack Vector

    An attack vector is a technique used by cybercriminals to gain unauthorized network access to launch a cyber-attack and get access to sensitive data, personally identifiable information (PII), and other valuable information by exploiting system flaws.

    Cybercriminals can be former employees, politically motivated organized groups, hacktivists, professional hacking groups, or state-sponsored groups who always seem to find a way to overcome a strong cybersecurity perimeter by using increasingly complex attack vectors. Malware, viruses, email attachments, web pages, pop-ups, instant chats, text messages, and social engineering are all common attack vectors they use. Firewalls and antivirus software can help to block attack vectors to some extent. However, no security system is completely impenetrable to attack.

    Hackers are continually upgrading attack vectors and seek to exploit unpatched vulnerabilities published on CVE and the dark web to get unauthorized access to computers and servers, thus a protection approach might quickly become obsolete. Because cybercriminals are becoming more adept, antivirus software is no longer sufficient as a primary security measure.

    Attack Vector And Attack Surface:

    Attack Vector : An attack vector is a tool that cybercriminals use to gain unauthorized access to a network or computer system.

    Attack Surface : Attack surface is any broken links on a company’s network where an attack vector can be used to launch an attack. Surface grows as the number of endpoints, servers, switches, software applications, or other IT assets increases in the network.

    Common Types Of Attack Vectors And Mitigations :

    Weak and Compromised Credentials:  Users revealing their user IDs and passwords knowingly or accidentally remains the most frequent sort of credential access. This is typically triggered by phishing victims – exposing their login information to an attacker by entering it on a spoofed website. Attackers can also use stolen or lost credentials to gain access to user accounts and organization systems without being detected, and then elevate their access level within a network. Cybercriminals utilize brute-force attacks to target weak or easily guessed user IDs and passwords.

    Employees must use strong passwords and multi-factor authentication to limit the chances of an attacker stealing their credentials and also should be taught how to create a secure password or invest in a password manager.

    Malicious employees:  Some security breaches occur within the firm when unhappy or disgruntled employees with access to sensitive information and networks disclose confidential information to hackers.

    Organizations should keep an eye on network access for odd behavior, such as users accessing files or systems they wouldn’t usually access, as this could indicate insider risk.

    Poor Encryption: Encryption prevents cybercriminals from stealing sensitive information by ensuring that the data within a transmission cannot be read by an unauthorized person and sensitive data is transmitted in plaintext when encryption is missing, inadequate, or weak.

    To avoid this, users should utilize strong encryption methods such as Advanced Encryption Standard (AES) or Rivest-Shamir-Adleman (RSA) and ensure that sensitive data is protected at all times, including when at rest, in processing, and transit.

    Misconfiguration: Company software and hardware security can be misconfigured, leaving them open to hackers. As businesses rely more and more on internet-of-things (IoT) devices to do their duties, a hardware breach might also open the door for cybercriminals.

    To avoid misconfiguration, automate configuration management whenever possible.

    Phishing: Phishing is a social engineering method in which hackers pretend to be a real colleague or known person to target employees via email, phone, or text message to disclose sensitive data, credentials, or personally identifiable information (PII).

    To reduce the risk of phishing, teach your employees about the importance of cybersecurity and how to avoid email spoofing and typosquatting.

    Malware: Malware stands for malicious software that allows cybercriminals to gain access to computers and networks and steal data or do significant damage. Once the authorized users lose access, cybercriminals threaten to leak data or disable access until a ransom is paid. Viruses, trojan horses, worms, spyware, adware, rootkits, and ransomware are some of the malware attackers use.

    Understanding the process of an attack, such as phishing techniques that ask users to disclose sensitive information is crucial to avoiding infection. Technology such as sandboxing, firewalls, antivirus, and anti-malware software that detect and stop possible assaults are required to protect against malware.

    Distributed denial-of-service (DDoS): In DDoS attacks, hackers use botnets to flood a server with internet traffic, preventing users from accessing services and perhaps crashing the organization’s website.

    The deployment of firewalls to filter and prevent unwanted traffic can help minimize a DDoS attack. Regular risk assessments, traffic differentiation to spread traffic and avoid a targeted attack, and rate-limiting to limit the number of requests a server may accept are some more protection methods.

    Trust Relationships: Users and systems have a particular level of trust in each other, which is referred to as a trust relationship. Because trust connections link two domains, a user only needs to log in once to access resources. If credentials that are cached on a trusted client are hacked, then It’s easy for an attacker to breach.

    Managing trust connections and passwords can assist you in limiting or eliminating the impact of the damage.

    How Clear Infosec Can Help :

    Clear Infosec helps organizations secure their networks and control internal and external attack vectors. We also enable them to encrypt data securely to keep it out of the hands of malicious hackers, even if they try.

    Please contact us to learn more about our services and the cutting-edge security technologies we can provide for your organization.

  • Phishing and DDoS attacks on Ukraine

    Phishing and DDoS attacks on Ukraine

    “In the last 12 months, Threat Analysis Group (TAG) has issued hundreds of government-backed attack warnings to Ukrainian users alerting them that they have been the target of government-backed hacking, largely emanating from Russia.” wrote Shane Huntley, Google’s TAG lead. TAG has seen activity like espionage to phishing attempts from several threat actors, including FancyBear and Ghostwriter which they monitor regularly and are well-known to law enforcement.

    FancyBear:

    FancyBear also known as APT28 or Sofacy is a nation-state adversary group that has been active since at least 2008 and poses a persistent danger to a wide range of organizations around the world. They use a sophisticated and cross-platform implant to attack aerospace, defense, energy, government, media, and dissidents. Now they are carrying out many large-scale credential phishing attempts targeting media company UkrNet users in Ukraine. A huge number of compromised accounts (non-Gmail/Google) were used to send phishing emails. Users of i.ua, meta.ua, rambler.ru, ukr.net, wp.pl, and yandex.ru webmail have also been targeted.

    DDoS Attacks:

    According to Google TAG, a recent slew of distributed denial-of-service (DDoS) attacks have targeted Ukrainian government sites like the Ministry of Foreign Affairs and the Ministry of Internal Affairs, as well as critical information-finding services like Liveuamap. According to the report, Google TAG used Google Safe Browsing to block several credential phishing domains that researchers discovered throughout the campaigns. Among the domains were: i[.]ua-passport[.]top, login[.]creditals-email[.]space, post[.]mil-gov[.]space, and verify[.]rambler-profile[.]site.

    Mustang Panda:

    a Chinese phishing operation has also joined the fray, focusing on European companies with lures related to the Ukrainian invasion in a new phishing effort. Mustang Panda has been active against EU entities before, most recently targeting Rome’s Vatican and Catholic Church-related organizations with a spearphishing campaign in September 2020. While Huntley noted that targeted Europe represents a shift for the threat actor – which typically targets entities in Southeast Asia – Mustang Panda has been active against EU entities before. TAG discovered malicious attachments with file names like ‘Situation at the EU Borders with Ukraine.zip’ contains a basic downloader that downloads numerous extra files before loading the final payload. TAG notified the appropriate authorities of its findings in order to minimize the potential for harm.

    Ukraine’s governmental Computer Emergency Response Team (CERT-UA) took this issue to social media right after the invasion by Russian armed troops to warn Ukrainians about an increase in phishing attempts targeting devices in the country. UA’s cyber security firm ESET has urged the warning outside Ukraine to be aware of phishing attempts linked to the conflict when the State Service of Special Communication and Information Protection (SSSCIP) of Ukraine was giving CERT warnings. 

    SSSCIP has issued a new warning to Ukrainian businesses asking them to segregate non-critical workstations and servers, upgrade systems and software to the most recent versions, and back up data to external storage.

    ProjectShield:

    All qualified organizations are encouraged to sign up for ProjectShield-with-google so that systems can stop assisting these assaults and keep websites up and running. Over 150 websites in Ukraine including numerous journalistic organizations use the service as it stops Google to bring harmful traffic generated by a DDoS assault. The number of people eligible for Project Shield has been increased for free DDoS protection, so that Ukrainian government websites, embassies around the world, and other governments in close proximity to the conflict can stay online, protect themselves, and continue to provide critical services and information.

    Reference:
    Montalbano, A. E., & Montalbano, E. (n.d.). Russian apts furiously Phish Ukraine – google. Threatpost English Global threatpostcom. Retrieved March 10, 2022, from https://threatpost.com/russian-apts-phishing-ukraine-google/178819/

  • Best practices for Data Loss Prevention

    Best practices for Data Loss Prevention

    We know that data is what drives the technology today. Data is a distinctive type of information that is collected and translated for a specific purpose. If the data is not formatted in the right way, it does not provide any value to both humans and computers. Data is considered sensitive when it gives classified information and requires the users to have the right permissions to access it. In other words, any data that should be prevented from unauthorized access can be considered sensitive.

    In order to efficiently manage data, they are organized into relevant categories according to usage. Data are categorized into groups of similar kinds. The process of organizing categorized data according to its sensitivity level is Classification and it helps to define a protection scheme for each type. When it comes to risk management and compliance, Data classification is of high importance. Data classification is a useful tactic that facilitates proper security responses based on the data being transmitted, retrieved, or updated.

    Over the years, cyber-attacks are getting highly evolved, and reports say that it takes organizations an average of around 190 days to identify a data breach. If an organization is not careful enough to protect its sensitive data, they are at the risk of getting exposed to bad actors or those who are not authorized to view those data. There exist many security procedures to keep your data secured. The strategy organizations adopt to keep the data secured from reaching the wrong hands is often referred to as Data Loss Prevention or DLP.

    In other words, it is a set of practices or a strategy that detects potential data breaches and ensures no sensitive data is shared, misused, or accessed by unauthorized users. It is identical with the term Data Leakage prevention and these terms are often used interchangeably. But the most commonly used term is Data Loss Prevention itself.

    DLP Best practices

    1. Data Classification

    You need to be clearly aware of the data types you handle. Data classification is the process of classifying data you have under its relevant category. Some of the commonly known data types are Personally Identifiable Information (PII), Protected Health Information (PHI), Payment Card Information (PCI), and any other information that you are legally obliged to safeguard.

    2. Identify the Sensitive data you handle

    You should have a clear understanding of the kind of Data your organization is handling. Don’t matter you are running only a small business or even an Enterprise, this understanding is the primary level of maturity to adopt a DLP strategy.

    If you are handling any Intellectual Property or Personally Identifiable Information or any such sensitive data that requires high security, it is highly recommended to adopt a DLP strategy. In order to enhance the value and creativity of your DLP program, you should engage with your Executive and Senior Leadership.

    3. Research Multiple Vendors

    With senior leadership, you can define your expectations for the DLP program in your organization. Consult with industry peers and vendors to learn about the DLP programs they’ve implemented, their workflow, and their level of confidence.

    4. Define Incident Response and Remediation

    If you are representing an Enterprise level organization, you should not buy any random DLP tool. You should take time to research and implement a complete DLP strategy. What many organizations fail to do is to plan incident management. They won’t go through the strategy process well and purchase any of the tools and fail to define a DLP incident management plan.

    Make sure you have an Incident Response Team in place.

    5. Start Slow, plan well and go for it

    Instead of implementing every single policy checkbox while implementing a tool, go through them all and go for small wins. Start with the prior ones and implement more security on the go.

    6. Perform a Proof-of-Concept exercise

    The goal of this step is to duplicate the functionality and test feature sets. Upon selecting a tool, ensure that it meets your compliance needs and study carefully the deficiencies in your Incident Management program.

    7. Identify the DLP stakeholders

    Many researchers say that not every organization having a DLP strategy is utilizing the program efficiently. Make sure you won’t be one such. Form an internal DLP team comprised of Senior Leaders, Managers, Legal Representatives., and skilled InfoSec professionals.

    If you feel hard to go through any of the DLP strategy implementing steps, try partnering with a reputed and experienced Managed Service Provider with skilled InfoSec professionals.

    8. Always be in touch with the Stakeholders

    Ensure you keep the stakeholders updated about the program. Never let a communication gap takes place between the DLP team and the Stakeholders. Monthly or Quarterly meetings can keep your strategy in a loop that will add value to your entire program.

     

    What you gain with a DLP solution

    With a DLP solution, you get better visibility of the data in your organization. With the right DLP solution, you get to:

    1. Monitor data in motion

    2. Monitor data at rest

    3. Monitor how the data is being used

    4. Take actions such as Delete, Log, Archive, and Quarantine

    We understand that not all organizations get much investment to get a paid tool for DLP. If you are one of them, we got some solutions for you too.

    1. MyDLP –

    It is one of the first free software projects for data loss prevention. The project was acquired by Comodo Group in 2014 and started marketing the Enterprise version once they removed the free version from the website.

    The centralized management options and Google-like search engine makes the application very easy to use. A free trial of 30 days is available for MyDLP.

    2. OpenDLP

    It is an open-source Data Loss Prevention tool. It is a web-based application with Data management and tracking features. It is an always-free software. You can find the application source code here.

    Make sure your capital investment is put to good use and it is made after a cost-benefit analysis, risk assessment, and Vendor analysis. Understand your business model in the first place to start defining a DLP strategy. A well-planned DLP strategy and Deployment makes a DLP program successful.