Blog

clearinfosec.com ↗

Author: Clear Infosec

  • TOP 10 CYBER SECURITY BEST PRACTICES TO FOLLOW IN 2022

    TOP 10 CYBER SECURITY BEST PRACTICES TO FOLLOW IN 2022

    Educate your workforce about the importance of security and about the highly evolving threat landscape. Make these below mentioned practices a part of your work culture to prevent your organization from ransomware attacks:

    1.Multi-Factor Authentication

    Multi-Factor Authentication is one of the most effective controls in preventing unauthorized access by bad actors. Authentication uses two or more different factors to achieve authentication. Factors can be (i) something you know (e.g., a password/PIN); (ii) something you have (e.g., a cryptographic identification device, a token); or (iii) something you are (e.g., a biometric).

    2.Password Security

    Strong password policy includes longer passwords (12-15 characters minimum), mix characters, password age shouldn’t be more than 60 days, using password manager.

    3.Security Culture

    Regularly conducting security awareness training fosters a security culture across the organization.

    4.Data Security

    Regular backups of the data and having a strong DLP policy and controls to prevent egression of data.

    5.End Point Security

    Endpoint security, or endpoint protection, is the cybersecurity approach to defending endpoints such as desktops, laptops, and mobile devices from malicious activity. Enabling strong spam filters, antivirus or anti- malware security on endpoints is proven to provide a layer of defense to secure the organization.

    6.Zero Trust and SASE adaption

    The global pandemic further accelerated a trend toward remote work. Traditional, perimeter-based approaches to security will no longer work in a cloud-first environment. Hence, applying zero trust principles to every interaction with that data will enhance the overall security posture. This paradigm shift towards digital transformation calls for a modern architecture to combine cloud access security broker (CASB), Next Generation Secure Web Gateway (NG-SWG), and Zero Trust Network Access (ZTNA) capabilities as foundational for SASE (Secure Access Service Edge).

    7.Security Assessments & Upgrades

    Regular security assessments, like vulnerability assessments, pen tests, and social engineering assessments, will help in identifying the existing vulnerabilities, weak controls and provide compliance and information assurance.

    8.Threat Monitoring

    Real-time monitoring for threats helps in early detection and responding to threats while enhancing the security posture.

    9.Email Protection

    Email protection helps in filtering spam and provides a fortified approach to combat ransomware attacks and many other attacks where users fall prey to phishing attacks.

    10.DOS & DDOS protection

    Utilizing tools to protect against denial of service or distributed denial of service by whitelisting, blacklisting, and having strong firewalls alongside DNS Security will help in combating DOS/DDOS attacks.

  • Android malware BRATA strikes again with new dangerous capabilities

    Android malware BRATA strikes again with new dangerous capabilities

    Android malware BRATA gained new dangerous features in the latest version like GPS tracking, the ability to use various communication channels and factory reset to hide fraudulent wire transfer.

    BRATA – Brazilian Remote Access Tool (RAT) Android was a spyware, which was later known to be a banking trojan. This spyware was found out by Kaspersky as banking and financial institution-targeting Android RAT (The remote access trojan) in 2019. Before this RAT reach US and Spain, it used to target only Brazil.

    Cleafy published a research in December 2021 and highlighted BRATA as malware emerging across Europe. It was discovered that hackers posing as bank customer service representatives were targeting e-banking users and collecting their credentials.

     

    Variants and Capabilities:

    The BRATA trojan has been detected in three different variants so far:

    Source: Cleafy

    1. BRATA.A: This variation has been most popular for the last few months and hackers included 2 more capabilities to it in December. GPS tracking of the user’s device is the first capability that is under development and the second feature is wiping out the infected device.
    2. BRATA.B is quite comparable to the first variant. The partial concealment of the code and using customized banking overlay pages to steal the PIN is what sets this variant unique from the previous one.
    3. BRATA.C :  This variant consists of a trap that attacks by downloading and executing the malicious app.

    The creators of BRATA are constantly changing the malicious code to avoid antivirus software detection. “Although the majority of Android banking trojans try to obfuscate/encrypt the malware core in an external file (eg. .dex or .jar), BRATA uses a minimal app to download in a second step the core BRATA app (.apk),” the Cleafy team added.

    “When the victim clicks on the install button, the downloader app sends a GET request to the command-and-control (C2) server to download the malicious .APK,” they explained. “At this point, the victim has two malicious apps installed on their device.”

    After BRATA installs a malicious app and executes the code, the accessibility permissions had been granted and can take control over the compromised device. Here’s a list of commands discovered by McAfee in all of the payloads :

    • lock screen Theft (PIN/Password/Pattern)
    • Screen Capture: Screenshots are sent to a remote server after the device’s screen is recorded.
    • Execute Action: Abuse accessibility services to interact with the user’s interface.
    • Unlock Device: Use stolen PIN/Password/Pattern to unlock the device
    • Start/Schedule activity lunch: Opens a specific activity provided by the remote server
    • Start/Stop Keylogger: Captures user’s input on editable fields and leaks that to a remote server
    • UI text injection: Injects a string provided by the remote server in an editable field
    • Hide/Unhide Incoming Calls: Sets the ring volume to 0 and creates a full black screen to hide an incoming call
    • Clipboard manipulation: Injects a string provided by the remote server in the clipboard
    • In addition to the commands above, BRATA also performs automated actions by abusing accessibility services to hide itself from the user or automatically grant privileges to itself:
    • Hides the media projection warning message that explicitly warns the user that the app will start capturing everything displayed on the screen.
    • Grants itself any permissions by clicking on the “Allow” button when the permission dialog appears on the screen.
    • Disables Google Play Store and therefore Google Play Protect.
    • Uninstalls itself in case the Settings interface of itself with the buttons “Uninstall” and “Force Stop” appears on the screen.

    Here are some of the apps which are compromised :

    Source: McAfee

     

    Prevention against Android Malware:

    Here are some suggestions to help you avoid being deceived by Android malware.

    • Be aware of the Android application available in the official store before you download. Most victims are induced to install the app with the promises of a secure device but with a fake update. Users shouldn’t need to install a third-party app to keep their devices updated.
    • To detect malware applications the users should install a trustworthy and up-to-date antivirus on their devices.
    • Do not click on any suspicious links from an unknown sender, because it may download malicious applications through it.
    • Check the developer information, requested permissions, the number of installations, and the content of the reviews before installing an app. There is a chance that an application’s positive rating be a result of a majority of fake reviews.

    As a result, Android users must exercise extreme caution when allowing this access to any app. As accessibility services are so powerful, a malicious application may exploit them to completely take over device data, online banking, and funds.

    Get the protection you need and the privacy you want, with Clear Infosec. Check out our services and reach out to know more about how to secure your data.

     

    Reference :

    Fernando Ruiz Apr 12, Ruiz, F., Fernando Ruiz Mobile Malware Researcher Fernando Ruiz is a Security Researcher in McAfee, Researcher, M. M., & Fernando Ruiz is a Security Researcher in McAfee Labs. He specializes in mobile threats and Android malware. Ruiz performs deep analysis and reverse engineering of malicious code. (2021, April 12). Brata keeps sneaking into Google Play, now targeting USA and Spain. McAfee Blog. Retrieved January 25, 2022, from https://www.mcafee.com/blogs/other-blogs/mcafee-labs/brata-keeps-sneaking-into-google-play-now-targeting-usa-and-spain/

  • Anatomy of ransomware attacks

    Anatomy of ransomware attacks

    As we discussed in our previous blog “What is Ransomware”, let us look into the anatomy of ransomware attacks today.

    Ransomware attacks have been very high in all fields, and many have lost so much of money. In this section, different stages of ransomware attacks are explained. There are five stages of attacks in general, they are

    • Initiation,
    • Infection,
    • Attack,
    • Encryption,

    Initiation

    This is the first stage where the ransomware infiltrates the system. This is how cybercriminals will use their endeavors to take advantage of an environment. There are many ways the hacker may utilize this method, like setting up malicious websites, phishing mail, exploits on web servers, etc. In general, the most used method by hackers is a phishing email. The victim may download the contents or go to the email’s link, and the malware will easily enter the system. The number of users the organization has, as many exploits the hacker can use. Even if one user downloads the malware, it can affect the organization’s entire security.

    Infection

    The malware will be successfully downloaded into the system in the second stage. We can consider this the official stage where the ransomware attack has successfully gotten hold of our systems. The malware downloaded may also open back door communication with the hacker. Which, in turn, helps the hacker to install more malware. This may continue for weeks or months, without anyone knowing till the hacker decides to attack.

    Attack

    In this stage, the hacker will initiate the attack remotely. The already downloaded ransomware had infected many systems will start scanning across the systems to find the confidential data. It can also look for files stored in the cloud or any other backups as the hacker will not allow the victim to restore the data easily. The attacker usually will select the time when the company is less guarded and initiate the attack. Once the attack is started, then everything is racing against time. If specific plans are already devised and implemented, the attack may be mitigated in time. If not, the loss of money and the organization’s reputation will be huge.

    Encryption

    After the data scanning is done, the encryption of the data will begin. Different ransomware strains use different encryption algorithms to encrypt data successfully. The data may be the boot files, some classified pieces of information, or the whole machine itself. When the local data files are taken care of, the cloud data will also be encrypted. The simpler way is to download the data to the local network, encrypt the data, and then upload the encrypted data to the cloud by replacing the existing data file. This is done mainly to prevent the backup from recovering the encrypted data. Decrypting the data is a difficult task unless the organization has high lever specialists in that field.

    Ransom

    At this stage, you are a victim of a ransomware attack. The attacker would have sent a ransom note which explains the condition to decrypt the data file. In recent times the ransom demanded is in some cryptocurrency. Some hackers will delete a portion of data or corrupt the data if the time taken for ransom is not delivered exactly on time. If the organization cannot decrypt the data without crashing the file or there are no other backups available, the only option left is to pay the ransom. It is the loss of money and the loss of reputation, as this kind of attack exposes the organization is vulnerable to attacks easily.

    After the attack, the malware will be identified and eliminated by the system. But it is highly recommended to check the infected systems to identify any malware that is still hidden. There are also possibilities that hackers may not decrypt the data after the ransom is paid. Having a better cybersecurity team in an organization and equipped them with knowledge and technology can prevent ransomware attacks.

    Stay Aware and Stay Safe with Clear Infosec

    All of your employees play a role in recognizing and addressing security threats. Level up their skills with our Security Awareness Training.

  • Log4j related RCE flaw found in H2 Database – Earns critical rating

    Log4j related RCE flaw found in H2 Database – Earns critical rating

    Researchers have found that cyberattacks surged by 50% year over year in 2021, peaking in December due to a log4j exploit frenzy. Millions of Log4j targeted attacks have been recorded per hour since the bug was detected last month. The result was a global peak of 925 cyberattacks per week.

    Source: CPR

    Now in the popular open-source H2 Java database console, JFrog security detected and rated the flaw critical. This critical issue is similar to the Log4J vulnerability where the vulnerability in the Log4J logging library allows the attacker to execute remote code on vulnerable systems.

    It has got a lightweight in-memory solution that eliminates the need for data to be saved on a disc. However, this issue does not offer the same risk as the one previously discovered in Log4Shell.

    Researchers said the H2 flaw may be highly critical and the most severe attacking method is directly hitting the H2 console. This flaw allows unauthenticated RCE through the systems running H2 console connected to LAN or WAN.

    “ There are likely less than 100 servers on the internet impacted by the H2 flaw according to open-source intelligence (OSINT), so only a very limited number of organizations are directly affected.” Blumira’s Warner said. He also added that “This vulnerability is a good reminder that it is important to ensure that sensitive services are only internally exposed to mitigate potential future risks”

    H2 Bug and Log4J:

    “H2 bug (CVE-2021-42392) is similar to Log4Shell (CVE-2021-44228) but not of a much widespread and less severe than Log4Shell because the susceptible servers should be easier to discover.” JFrog researchers wrote in their post. The main similarity is JNDI remote class loading is the primary cause of the H2 vulnerability. This bug permitted many H2 database framework code paths to deliver unfiltered attacker-controlled URLs to the javax.naming.Context.lookup function which enables remote codebase loading (also known as Java code injection or remote code execution).

    “The org.h2.util.JdbcUtils.getConnection method requires a driver class name and database URL as parameters,” they wrote in the blog post. “The function creates an object from the driver’s class and executes its lookup method if the driver’s class is assignable to the javax.naming.Context class.”

    Unlike Log4Shell, The remote code execution (RCE) bug will directly affect the H2 console server which processes the initial request and the H2 console only listens to localhost connections by default on vanilla H2 database releases which makes the default setting safe.

    “Log4Shell was vulnerable under Log4j’s default configuration and comparatively H2 console also can be easily modified according to remote connections. But in comparison to the Log4j, the severity of H2 is less because of its execution aspects. Despite the fact that many companies run the H2 database, they may not run the H2 console along with it” researchers said.

    Recommendations:

    Numerous developer tools depend on the H2 database and expose the H2 console. This is concerning because of a “current trend of supply chain attacks targeting developers, such as malware packages in prominent repositories,”. These attacks highlight “the significance of securing development tools for all legitimate use cases and after applying their recommended update, many H2-dependent tools should be safer.,” according to the researcher.

    The JFrog team recommends upgrading the H2 database with version 2.0.206, which can fix CVE-2021-42392 by limiting JNDI URLs to use only local java protocol and excludes any remote LDAP/RMI queries. “This fix is so much similar to the fix which is recommended for Log4j 2.17.0” researchers explained.

    With Clear Infosec security experts, find and fix any bugs before someone bad does and stay away from being in the next headline. Keep your IT infra secured.

    Reference:

    Montalbano, A. E., & Montalbano, E. (n.d.). LOG4J-related RCE flaw in H2 database earns critical rating. Threatpost English Global threatpostcom. Retrieved January 11, 2022, from https://threatpost.com/log4j-related-flaw-h2-database/177448/

  • What is RANSOMWARE ?

    What is RANSOMWARE ?

    Ransomware is an ever-evolving type of malware. It is designed to encrypt files on a device and corrupt the device or system that depends on the files. The cybercriminal may encrypt the classified data or block access to the system itself. Later, they will ask the victims to satisfy their demands or threaten them with selling or leaking the confidential data in their control. In recent years, ransomware attacks became very prevalent in all kinds of organizations, small or big, private or government. No organization is safe from cybercriminals.

    To prevent a ransomware attack, it is highly recommended to have a professional cyber security team that monitors the organization 24/7. Even with the increase in security, cybercriminals also increase their tactics of attacks, so the security professional must always increase their knowledge. If the ransomware infection has happened, the victims generally have three solutions pay the ransom, remove the malware, or reboot the system completely. The last option is only when the system is corrupted, and data is not stolen already.

    Impact of ransomware

    The ransomware attack may happen to any individual or an organization itself. Anyone with a system or mobile connected to the internet is at risk of being subjected to ransomware.

    The effects of ransomware differ with their intent of attacks. It can be destructive to an individual or an organization. Even if the victims pay the ransom to recover their corrupted files, it cannot be guaranteed that files will recover. If the ransom is not paid and the organization cannot decrypt the data by themselves, they need a third-party specialist to recover or decrypt the specified files. This may also be costly as reputed recovery specialist organization fees may be higher.

    Ransomware has a huge impact, as it leaves a company or individual without the data they need to operate or deliver. The monetary and reputation loss will be devastating to any organization. With the development of technology, ransomware infections also increased significantly, and their effects are very destructive. The recovery from a destructive ransomware attack is also very tedious for organizations. Some organizations cannot overcome the impact caused even after paying the ransoms.

    Types of Ransomware

    The most common types of ransomware are :

    1. Locker ransomware

    The basic function of this kind of ransomware is to deny access to computer functions. Such as, the victim may be blocked from using the desktop, the mouse or keyboard functions may be disabled, etc. And allow only to work in the window which contains the ransom demand. If the victim didn’t pay the ransom, they could not get the access back. This kind of attack can be mild, as it only makes the victim deny their access to the computer and not concentrate their attacks on critical files or confidential data.

    2. Crypto ransomware

    Crypto ransomware is opposite to the function of locker ransomware. It mainly encrypts or corrupts the critical data and does not block the computer functions. The victim can see their files but cannot access those files. In general cases of crypto-ransomware, the attackers often provide a countdown. If the ransom is not paid within a certain time limit, they may threaten to delete or leak the important data.

    Examples of Ransomware

    Some of the Ransomware strains are listed below

    Reveton

    Reveton locks the victim’s device completely and asks the victim to log in credentials. In general, the attackers show a fake official (any government security organization) message on the victim’s display. The whole system will be locked completely, and only by paying the ransom, the login credentials can be obtained. In some cases, the attackers also installed a trojan to steal passwords and other data in the victim’s computer.

    Locky

    It is a ransomware strain developed to lock the victim’s system completely. These kinds of ransomware are usually affected by email messages. When the email is opened, the victim is asked to enable macros to read the attached document. If the victim enables the macros, Locky begins its encryption process and encrypts many files. Usually, the email will be disguised as an invoice message.

    Cryptolocker

    It is one of the oldest forms of cyberattacks used for more than a decade. The attackers used the Cryptolocker botnet approach in ransomware in 2013. Even though the original Cryptolocker botnet was shut down in 2014, the attackers managed to earn more than millions. And many kinds of variants are still used. It is often impossible to decrypt the files or system without paying the ransom when Cryptolocker ransomware was used as the algorithms used to encrypt are very strong

    Cerber

    It is a type of ransomware that mainly targets cloud-based Microsoft office 365 users. Millions of users are fallen for this attack with large phishing operations.

    Crysis

    This ransomware encrypts files on fixed, removable, and network drives. It uses a strong encryption algorithm making it difficult to crack or decrypt the files. It usually spreads from email or installer files.

    Bad Rabbit

    This ransomware spreads from compromised websites that contain a fake adobe player installer file like “install_flash_palyer.exe.” If the victim executes the file, the system will reboot, and after rebooting, the screen will show the ransom details on the victim display.

    Jigsaw

    It is one of the destructive types of ransomware, which encrypts many data files and deletes them progressively until the ransom is paid. Usually, the attack will have a countdown of 72 hours, and files will be deleted for every hour until the ransom is paid or ultimately deleted every single file.

    Cryptowall

    It can be considered an advanced form of the crypto locker. There are multiple strains of this ransomware used worldwide with different names.

    KeRanger

    This ransomware was found on the BitTorrent client, and it is the first ransomware developed to block Mac OS applications.

    Apart from these, there exist many other ransomware strains that can infect the systems of an organization or individual. Let us see the anatomy of ransomware attacks in coming weeks.

     

    Stay Aware and Stay Safe with Clear Infosec

    It is always necessary to provide Security Awareness Training to your workforce to keep them aware of the evolving threat landscape and stay fortified for any kind of targeted social engineering attacks. Get adapt to technologies and security trends with Clear Infosec

  • 6 Crucial Features of a Reliable GRC Tool for Your Company

    6 Crucial Features of a Reliable GRC Tool for Your Company

    With the uncertainty brought by the pandemic, businesses need to check on their governance, risk, and compliance framework.

    According to the 2019 State of Enterprise Risk Management, 62% of the surveyed organizations have experienced a critical risk event for three years.

    Such risks are inevitable, which is why governance, risk management, and compliance must be checked.

    • Governance refers to the process by which companies manage and mitigate business risks.
    • Risk management is the evaluation of business risks and mitigation of this in an orderly manner.
    • Compliance refers to the programs that meet industry mandates, regulations, and policies.

    If you want to mitigate and avoid new and emerging threats and risks, you must invest in reliable GRC systems with the following features:

    Automation

    The traditional way of managing governance, risk, and compliance is via spreadsheets, which is time-consuming. You may stick with this process. However, there is no guarantee that operational adjustments will be made promptly, especially if your organization is growing.

    Opting for an automated GRC software will lessen possible human errors like duplication or inconsistencies, making more transactions.

    The best GRC software can integrate and automate routine auditing and compliance processes.

    Dashboards

    GRC systems available in the market were proven to collect data, but not all provide a dashboard feature. According to an Exasol survey, 90% said that data democratization is a priority in their company. Don’t get left behind and find a GRC system that allows data democratization through dashboards and reports. In the same study, 82% reported that their organization uses dashboards to communicate insights.

    Maximize the capacity of your GRC platform by ensuring that it allows the creations of dashboards to better guide your employees in making decisions since they can easily see the key information at one glance.

    ClearGRC is one software that utilizes dashboards for effective management and segregation of controls. This feature ensures that all files, standards, and frameworks are aligned. You may create separate dashboards for policies, processes, and audits which are simple to use and easy to understand.

    Centralization

    The three elements of GRC produce a wide array of data available for your reference. Without centralization features, your GRC software may cause more confusion than a better organization for your company. Experian’s data management report reveals that 83% of businesses see data as a vital part of forming a business strategy. Hence, the data stored in your GRC software must be carefully regulated to hold value.

    Your GRC framework will not work to its full potential without clean, reliable data. In fact, according to the 2018 Nintex survey, 49% of employees have trouble locating documents. You wouldn’t want to waste your employees’ time, which they can use better for meaningful tasks.

    ClearGRC has a dedicated document system where you can classify, group, and control versions of documents. Another centralization feature of GRC that may aid your operations is its End-to-End Policy Life Cycle Management feature, which allows easy alignment of policies to standards and processes.

    Customized Report Generation

    Reporting data and results is tedious and time-consuming. GRC solutions may help in this aspect if it has an automatic reporting feature.

    GRC tools such as ClearGRC assist in gathering audit evidence by creating dashboards and reports allowing you and your team to understand specific areas you need to focus on. It also streamlines the process management as ClearGRC provides reminders and timely reports.

    Having a customized report allows you to see the overall progress of your compliance program and risks to manage. This will lead to better decision-making and promotes efficiency.

    Integration services

    When your company uses software for different functions, it is vital to check if integration is possible. Part of the computer science degree requirements is learning about integration, which refers to linking tools, systems, and software applications.

    Without integration, your business may further decline despite implementing technologies for various functions, as you will have to do manual work to align the data from each tool.

    Support services

    As you find the GRC solution for your company, choose one that offers support in different modes. You wouldn’t want to waste the money you invest because you are having difficulty navigating and using the GRC tool. ClearGRC is one tool that offers email and phone support, live support, and training.

    Finding the best GRC tool

    The above-listed features will just serve as a guide as you try to find the best GRC tool. You should do your research and due diligence to ask experts. Several GRC solutions in the market offer consultations and trials. Maximize these opportunities to know whether it is an excellent fit for your company.

    You may book a consultation with ClearGRC by filling out the form here.

  • Impact and Fixes for Apache Log4J Zero-Day Vulnerability :

    Impact and Fixes for Apache Log4J Zero-Day Vulnerability :

    Apache Log4J vulnerability (CVE-2021-44228) commonly known as “Log4Shell,” is a zero-day vulnerability that was first discovered on December 9, has earned a CVSS score of 10 which is the highest possible severity level. Everything from the cloud to developer tools and security devices is affected by the Log4j vulnerability with warnings that it could provide unauthenticated remote code execution and server access.

    A Log4j flaw where the Apache Software Foundation produced the library, which is a key Java logging framework. Several national cybersecurity agencies, including the Cybersecurity and Infrastructure Security Agency (CISA) and the UK’s National Cyber Security Centre, have issued warnings since CERT New Zealand announced last week that CVE-2021-44228, a remote code execution flaw in Log4j, was already being exploited in the wild (NCSC)

    Log4J Vulnerability Impact :

    When using a vulnerable version of Log4J to log untrusted or user-controlled data, your application may be vulnerable to Remote Code Execution (RCE). If Apache Log4J, version 2.0 to 2.14.1, is installed on a device that is connected to the internet, it is vulnerable. According to the NCSC, the affected version of Log4j is used in Apache Struts2, Solr, Druid, Flink, and Swift frameworks.

    AWS has outlined how the issue affects its services and stated that it is working on patching its Log4j-based services as well as releasing mitigations for CloudFront. Similarly, IBM stated that it is “actively responding” to the Log4j issue in its own infrastructure and products. Websphere 8.5 and 9.0 are affected, according to IBM. Oracle has also released a fix for the problem. “Organizations should be prepared for a constant stream of downstream advisories from third-party software producers who include Log4j among their dependencies,” said Rapid7.

    Second Log4J Vulnerability Impact:

    After days of attempting to patch the first vulnerability, cybersecurity experts discovered a second vulnerability involving Apache Log4j on Tuesday. The CVE description says it could allow the attackers to craft malicious input data to result in a Denial of Service (DOS) attack. When the logging configuration uses a non-default Pattern Layout with either a Context Lookup or a Thread Context Map pattern, this could allow attackers with control over MDC input data to craft malicious input data using a JNDI Lookup pattern, and it results in a denial of service (DOS) attack. Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default.

    Log4J Vulnerability Patches:

    In some non-default configurations, the fix for CVE-2021-44228 in Apache Log4j 2.15.0 was found to be incomplete. CISA’s main advice is to identify internet-facing devices running Log4j and upgrade them to version 2.16.0, or to apply the mitigations provided by vendors “immediately”. We recommend at least one of the following mitigations for vulnerable versions greater than or equal to v2.10:

    • version >=2.10: Set log4j2.formatMsgNoLookups to true
    • versions from 2.0 to 2.10.0 >= Run the following command to remove the LDAP class from Log4J: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class.
    • version 2.16 – fixes the problem by removing support for message lookup patterns and disabling JNDI functionality by default.
    • Set the log4j2.formatMsgNoLookups system property to true.
    • In the Java Virtual Machine, mitigate: Java 8 (or later) Upgrade to release 2.16.0.
    • Users requiring Java 7 should upgrade to release 2.12.2 when it becomes available (Work in progress)
    • If upgrading isn’t an option, make sure to remove all JndiLookup class from the classpath: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

    Please keep in mind that Log4J v1 is no longer supported and will not be patched for this issue. Other RCE vectors are also vulnerable to Log4J v1, hence we urge that you upgrade to Log4J 2.16.0/2.15.0 as soon as possible.

    The Log4j problem has been reported in Australia, New Zealand, Canada, the United Kingdom, Sweden, Germany, Singapore, and other countries. According to the CBC, Canada’s Revenue Agency took some services offline on Friday after learning of the issue. Finally, For mitigating attacks on the Log4j vulnerability, Microsoft has released a set of compromise indicators and guidelines. Installing currency miners, using Cobalt Strike to facilitate credential theft and lateral movement, and exfiltrating data from hacked computers are all examples of post-exploitation that Microsoft has witnessed.

    You can find the list of software that is affected by the vulnerability here (Released by Dutch Natural Cyber Security Center) and the attack surface of log4j and list of impacted manufacturers here.

     

    Reference: Rubin, S. (2021, December 14). LOG4J “Log4shell” zero-day vulnerability: Impact and fixes – fossa. Dependency Heaven. Retrieved December 14, 2021, from https://fossa.com/blog/log4j-log4shell-zero-day-vulnerability-impact-fixes/

  • Why Security Operations Center (SOC) as a Service can be a Value addition for you

    Why Security Operations Center (SOC) as a Service can be a Value addition for you

    What is a SOC?

    A SOC is a centralized unit or commanding center for your association’s network safety requirements. It is a setup that works 24/7 with cybersecurity specialists to screen your security act and identify unexpected/ potential dangers.

    The main purpose of the SOC is to monitor the organization’s security by centralizing all cybersecurity operations continuously. By centralizing and continuous monitoring, SOC can analyze, prevent, reason, detect and dampen cybersecurity problems.

    Since it centralized all the cybersecurity operations, it removes the vulnerability of numerous IT security specialists in various areas. It additionally ensures that all working strategies are being completed accurately continuously in real-time.

    The SOC analysts work closely with the organization’s incident response team to eradicate any threat identified as soon as possible.

    SOC mainly collects numerous logs and categorizes them by security information and event management systems (SIEMs). By proper analysis and interpretation, threats are monitored closely. Proper report generation and detection lead to prevent any cybersecurity incidents.

    Advantages of SOC

    • Reduces the dwell time of the attack.
    • 24/7 monitoring
    • Faster incident response and isolation of the threat
    • Manage a large number of logs and storage
    • Reduce the false positives.
    • Increased productivity due to fewer security issues.

    Why SOC as a service?

    With the growing trend of cyberattacks in recent years, soc is an important asset in any organization. Although having SOC is highly essential, financially, it is very tedious to start SOC from scratch. Not only expensive to create a high-level SOC team is also time-consuming. 

    Maintaining is also very costly as it needs a constant upgrade of equipment and software. And these are only for systems and not for professionals. Employing cybersecurity experts, in the long run, may affect financially than starting a SOC unit. Even if we are willing to tolerate the costs for experts in their respective fields, the industry experts firmly predict that demand for these posts will be very high, and qualified officers are not enough to fill the space available for that position.

    For all these purposes, many companies are contemplating outsourcing security services, SOC as a service. Since the SOC provider has already implemented their own team, the organization can start using the SOC as soon as the service is acquired. It should be noted the initial implementation of costs is very high and risky, and these factors can be avoided by taking SOC service.

    The provider will have a necessary professional to monitor the systems for security issues with updated hardware and software. The provider can also guide the staff members to regulate the required patches to mitigate threats and vulnerabilities. It is highly recommended to prevent the attack before it happens rather than mitigate it after the attack.

    So, instead of creating a highly effective SOC from the start, using SOC as a service from a provider will take responsibility for monitoring the defence required to protect against threats and vulnerabilities all around the time.

  • Phishing Email & attachment Analysis Part-2

    Phishing Email & attachment Analysis Part-2

    In my previous blog Phishing Email & Attachment Analysis, we have seen how to address infected PDF files and extract malicious indicators from within them without endangering yourself or your PC. Today, let us see how to analyze phishing emails and attachments by analyzing email headers and downloading the suspected attachments in a VM.

    Email is one of the easy ways of communication, and most formal messages are communicated via email worldwide. A surprisingly large number of cybercrimes are also carried out by email, either by attaching malicious files or sending phishing mail and more.

    Phishing mail is an online scam or an attack on the user. The attacker impersonates legitimate organizations or persons to acquire personal information from the user or receiver of the mail.

    When we open any email, the information normally that are available to the users are like

    From           : It will show the sender details, name, and mail id.

    To               : It will show the receiver details

    Date            : The date and time on which the mail was sent.

    Subject        : Subject of the mail.

    Here the ‘to‘ field is empty, and this will usually happen if the message was sent to lots of people like spam mail.

    These are general information that is readily available. Apart from these, there is a whole lot of information in email headers. The email headers contain the information relevant to the route taken by the email to reach its destination, time taken in each server, IP address of the sender, mail transfer agents, and more.

    To see this information in Gmail, click the three dots on the right end side and choose ‘show original‘ from the options displayed.

    This will take us to another web page and list all the details stored in the email.

    The information in the email headers looks like above. We can identify whether the mail is sent by a genuine organization or a malicious party trying to attack you by interpreting this information. 

    For Outlook, click the three dots on the right side of your mail. In the option displayed select view, in that select view message details.

    … view – view message details.

    Now, let’s see some simple methods to interpret the information stored in the header file.

    As an email was sent and received between two users, the email will travel multiple servers. Just consider email headers like passport, and in each destination, we reach there will be stamping done on the passport. Similarly, each server will add its information in header entries. So to find out the server it originated from, we need to look at the first Received entry on the email header.

    The domain name and IP address of the sender’s computer can also be checked.

    Now let’s try to interpret the mail header that was shown above

    Return-path

    This term shows where the email address delivery notices will be sent. If the mail is not delivered, we will receive a notification about that. So we will check if the mail address in the return path and sender email id is the same. In most phishing mail, it won’t be the same. I will not enjoy many delivery notices in my mail if I send spam mail to many members.

    Return-Path: mrs.dara@charity.net>

    In our example, the return path and from address is the same. Now, we can move on to other factors.

    Reply-to

    This field shows the email address to where the reply will be sent. If we click reply to the mail, it will automatically send our message to the particular email address that was assigned.

    Reply-To: <mrs.dara@daum.net>

    For our case, the reply to mail is different from the received email address. That means the sender has arranged a different email address to receive the reply. Whether they will check the reply or not, who knows.

    Received:

    As I have mentioned previously, the email will pass through multiple servers, which will show the information about these servers. Multiple entries will be recorded in this, and the newest information will be stored on the top. If we look for the sender’s information, we need to look at the bottom of the available information.

    Received: from unknown (HELO User) ([42.200.180.187])

    Now, if we look at this message, there was no proper mail address shown. The missing mail address will not happen if the sender is a genuine party. The IP address of the sender is also displayed, we can use the IP address to check more details about the sender if we need. In general, there will be domain and IP address will be shown here.

    The most important factor about this information is that this is the only reliable and accurate information stored in the mail header. The information was recorded by the server automatically, which cannot be forged by the assailant.

     

    by wbironout1v2.netvigator.com with SMTP; 11 Sep 2021 14:45:34 +0800

    The next line to ‘received from’ is received by, and this field indicates the first-ever server where the mail has arrived. This should contain the domain name and IP address of that server. But in our mail, the IP address is missing. Usually, there will be a high chance the first server will be completely in control of the malicious sender, or the geographical location of the sender and server will be vastly different. This can be found by using the IP address, and there are many online services to track the IP address.

     

    Message ID

    It is a unique identifier for the digital message (email) assigned by the mail system when it was first created. No two mails will have the same message ID, but we should not confuse the same mail in the receiver inbox and sender sent box. It usually shows some random numbers followed by a Fully Qualified Domain Name (FQDN).

    Message-Id: <f127a5$7fpmr4@wbironout1v2.netvigator.com>

    From this, we can identify the local hostname as wbironoutv2, and the local domain is netvigator.com.

    X- Mailer

    This field indicates the email client.

    X-Mailer: Microsoft Outlook Express 6.00.2600.0000

    Here they have used Microsoft outlook express to send mail. Be careful if some random names are displayed.

    The lines beginning with X are created by the recipient mail server and can be considered trustworthy.

     

     

     

     

     

     

    MIME version

    This filed helps to indicate the version of the MIME protocol used by the sender to send the mail.

    MIME-Version: 1.0

    Content type

    It defines the type of data (plain text, HTML, audio, or video content) used in the body of the message.

    Content-Type: text/plain

    Content – transfer – encoding

    This field displays the method (7-bit encoding, 8-bit encoding, etc.) used for encoding the message.

    Content-Transfer-Encoding: 7bit

     

    There are more pieces of information available in header files. And one should always remember that the malicious user will try to forge as many details as possible to appear genuine. So being attentive is very important in dealing with random emails.

     

     

     

    There are many tools available for free to analyze the email headers. Some of the online tools are listed below

    1. My toolbox
    2. Google Admin Toolbox Message header
    3. What is my IP
    4. org
    5. Gaijin
    6. Microsoft Message Header Analyzer

     

    After opening the email header, copy the entire email header and paste it into any analyzing tool mentioned. Most analyzers provide similar information’s with some additional or less information. You can decide whichever you want to use. Even though many online and offline tools are available, understanding the email headers and how to analyze manually will always come in handy.

    Now consider a scenario, we got an office document file attached in an email. We are suspicious of it and used our knowledge on the email header for any vindictive information. But the email header analysis shows it’s a genuine sender. Still, we are not sure whether the attached document is malicious are not.

    So we are going to download the suspected file in a virtual machine. We are going to use REMnux virtual machine to analyze the doc file. Never open a malicious file on your personal computer. Always remember to use a virtual machine. It is easy to protect ourselves from malicious attacks by using virtual machines that are not connected to our networks.

    I have downloaded a random doc file named statistics.09.20.2021.doc from any.run online sandbox.

    The file was password-protected to avoid opening the file mistakenly. The usual password used in that site is infected, or the password will be displayed during the sample file download, so no need to worry about that.

    We used a strings command for the pdf file, but this is not applicable for doc format. The complexity of doc format is higher for strings command to use. So, we are going to use another tool or script. The most used tools to dissect or analyze the MS office documents are oletools based on phyton. I will use two of the scripts or tools and explain how to analyze the doc file.

    oledump

    The first script I will use is oldedump.py, and it is a phyton script created by Didier Stevens. It can also be used to analyze office files. The required modules for the script are pre-installed in the virtual machine REMnux, so we can run the script along with the file name that needs to be analyzed.

    oledump.py statistics.09.20.2021.doc

    The M the shows next to line or stream 8 and 15 show VBA macros in the doc file. The uppercase M represents the macros specifically created to run something when the doc file was open. If the macros were displayed by lowercase m, it specifies that macros are created automatically when the file was created and is not the work of a cybercriminal.

    Now to let’s try to understand what macros are written there. For that, we are going to decompress the VBA macros and display them.

    oledump.py -s 8 -v statistics.09.20.2021.doc

    -s is the string, and we are looking into the 8th sting, -v is used to decompress VBA macros. These all can be known by using oledump.py -h.

    Now let’s use that command and check the hidden macros.

    The attributes are created automatically, so there are not malicious. But if we further look down, some subroutines are defined. If we open the document, it will automatically run the macros as defined without us knowing.

    https://www.youtube.com/watch?v=opdVFQEBCNU  can go through this video to understand more about this command and more.

    olevba

    Olevba is a script which is used to parse OLE (Object Linking and Embedding) and open XML files such as MS Office Excel (all MS Office files.), extract the malicious VBA (Virtual Basic for Application, a programming language for office programs) in a clear printable text and analyze if the macros present are malicious.

    This olevba script was inbuilt in the REMnux, so all we need to do is type the sample file’s name next to the command.

    olevba statistics.09.20.2021.doc

    The doc file will be analyzed, and results will be shown whether the doc files are malicious or not.

    These results show that if the statistics.09.20.2021.doc were opened, some .exe files would run automatically and run a command or executable file.

    The results also display the macros that are defined in the sample file. The description of the keywords may help us understand the function of the macros. Like this, even without using a sandbox environment, we can determine if the file is malicious.

    Many tools and scripts are available for the same purpose, and I have explained the two easy tools or scripts in this blog.

    I hope these things will help you understand some methods to secure the network or system from phishing emails and malicious files.

  • 5 Cybersecurity Trends You Should Be Prepared for in 2022 and Beyond

    5 Cybersecurity Trends You Should Be Prepared for in 2022 and Beyond

    One of the trending topics in today’s landscape is cybersecurity. The Trend Micro survey revealed that 83% of its respondents forecast a great likelihood of cyber attacks in the next 12 months. This is evidence of how cybersecurity remains a top concern for organizations and corporations.

    Based on the cyber security statistics, cybercrime has been increasing annually since the start of tallying. This is no surprise because according to the findings of the 2020 IDG survey, roughly 80% of IT leaders feel a lack of security against cyberattacks despite increasing investments in IT security.

    It’s common knowledge that cyber threats exist, but it’s better to be aware of the cybersecurity trends 2022 will bring and will possibly stay for the coming years.

    Rise of Remote Work Risks

    The pandemic led to changes in the work setup which introduced organizations to the remote setup. With this transition to remote setup, convenience is a key player but so is cybersecurity attacks.

    Based on the 2020 Ponemon Institute report, 71% of the surveyed organizations are concerned about data breaches due to remote workers’ physical security practices. You can’t monitor employees as they log into their respective devices. This leaves cybercriminals with a chance to target remote workers and attack attempts via email, text, and third-party applications.

    Mitigate the risks associated with remote work by investing in information security services and proprietary tools. ClearGRC is one of the security subsidiaries which offers monitoring of Enterprise and IT risks by providing a centralized process. With the Compliance feature of. ClearGRC, you can conduct control and manage self-assessments in specific industries and geographic locations. This will aid you and your remote workers in keeping a safe and effective management ecosystem.

    Data Privacy Expectations

    Since organizations are moving towards digitization, sensitive information and files are stored on digital platforms. An average of 5% of companies’ folders are properly protected in different organizations based on the 2019 Global Data Risk Report. This is a small percentage and with this statistic, data privacy will surely be a growing concern.

    Regardless of the type of data you are handling, may it be consumer or company information, it is a must to implement proper security techniques to protect your data. Some cybersecurity-related trends to this are data encryption, password protection, and network security.

    ClearGRC offers a Document Library where you and your employees can securely access, classify, group, and create versions of all the documents. In addition to this, it has a Control Management feature where you can create dashboards to ensure that your files, standards, and frameworks are aligned.

    Increase in Social Engineering Attacks

    One of the major issues for many organizations is the shortage of cybersecurity skills. Organizations are having a hard time recruiting cybersecurity professionals with over 76% percent of security professionals saying it is difficult based on the report of ESG Global & ISSA.

    To help minimize the risks of social engineering attacks, you must find a tailor-made line of defense for your company. This may only be done through a series of assessments. ClearGRC can help with the identification and treatment of risks within the realm of your organization through its Risk Register and Risk Assessment features. Risk Register lets you collect and manage all identified risks from one place. It will be easy for you and your employees to monitor all risks and easily treat them. The Risk Assessment feature is focused on examining the trends of identified threats and vulnerabilities which can be customized for your organization.

    Adoption of Cloud Services

    One of the emerging trends in cybersecurity is adopting cloud-based services. The applications and tools are all virtual and you do not have to do any prior testing. This poses another entrance for cybercriminals which makes you question what to do with a computer science degree if you can’t test and monitor your subscriptions to SaaS, TaaS, and others.

     

    For such matters, 2022 cybersecurity offers a wide array of services available in the market. ClearGRC is one of the existing solutions that could aid through its monitoring which happens on a continuous basis.

     

    Elevation of IoT with 5G networks

    5G architecture is one of the top trends in cybersecurity and will surely develop in the coming years. According to the forecast of Mckinsey, capital expenditures for 5G would increase 60 percent from 2020 through 2025. With the interest of many companies in upgrading to 5G networks, company operations will transition towards the Internet of Things (IoT).

     

    5G architecture is relatively new in the industry which can be tricky to protect from attacks or any unknown bugs. ClearGRC offers meticulous treatment of risk based on thorough analysis using its Risk Assessment and Risk Treatment features. Compared to other solutions, ClearGRC is a step ahead as it provides an overview of risks through risk heat maps.

    To jump in the Cybersecurity Trends or not?

    As you upscale and adopt new technologies or trends, remember that managing vulnerabilities can be quite challenging if you do not have tools that are tailored to the specific threats and risks that your organization is facing. Look for solutions that include diligent assessment of your company.

     

    Book a demo here with ClearGRC for a thorough risk assessment of your company.