Laxman Bhandari

DID YOU GET BSOD TOO? #CROWDSTRIKE It's not just you! Laptop blue screen errors.. Due to a recent end point protection update by Crowdstrike, a number of laptops are suffering a bluescreen of death error and are unable to successfully reboot. This issue has impacted a significant number of organisations within Australia. Crowdstrike is currently investigating the issue as a top priority. Workaround Steps: 1. Boot Windows into Safe Mode or the Windows Recovery Environment 2. Navigate to the C:\Windows\System32\drivers\CrowdStrike directory 3. Locate the file matching “C-00000291*.sys”, and delete it. 4. Boot the host normally.

9

How many out there know that there is an Australian government approved cyber security framework and certification? No, it's not Essential 8. Although Essential 8 is the "go to" framework from the ACSC, that's not what I'm referring to. SMB1001 has been brought to market by Cyber Security Certification Australia (CSCAU) and is available now for any organisation to certify themselves against. 5 tiers, to cater from small business to larger organisations well into the mid-market space. MyCISO and CyberCert have partnered up to bring the SMB1001 framework into our Assess platform to provide a really great way for those organisations who don't want to go down the ISO 27001 or full NIST CSF path to baseline their maturity, and be able to prove to their customers that they have taken reasonable steps to secure thier cyber posture. This same framework can be used as an excellent baseline to assess your supply chain as well. Fewer control requirements, but focused on the things you really need to know when assessing risk in your 3rd parties. Reach out to us here at MyCISO, or get in touch with Cyber Security Certification Australia (CSCAU) if you want to learn more. Stay safe out there! #cybersecurity #smb1001 Dane Meah Nick Anderson Ryan Ko Peter Maynard

68

6 Comments

PROBLEM: crooks 🦹‍♂️ use hooks 🪝to get your passwords 🤦🏻 SOLUTION: use passkeys 🔑not passwords BACKGROUND myGov is one of the most impersonated 😡Australian Govt websites 🔹 Phishing-fake websites typically steal 🦹‍♂️ your password and username by mimicking the login page of a legitimate website. 🔹When you enter your email and password on the fake website, they are captured by the attacker 🪝 🟣 Good news / news flash 📣 1️⃣ myGov is NOW among the first govt digital services in the world 🌎 to start using passkeys - which are resistant to phishing ✅ 2️⃣ turning off - your myGov password as a sign-in option - and using your passkey 🔑 instead - makes it harder for scammers to access your accounts using stolen usernames and passwords ✅ 3️⃣ On average, more than 860,000 people sign in to myGov each day 🤯 4️⃣ In Australia ♥️ last year scams cost $2.74 billion, with $250 million coming from someone stealing/phishing 🪝 your log in details. For more information on how to set up your myGov passkey ➡️ https://lnkd.in/ggWP5XaH See comments for set up instructions … Bravi to Minister Bill Shorten and Services Australia for being an early govt adopter of passkeys 🏆 📸 Serena Hardwick 📍Wagga Wagga TackleWorld

540

43 Comments

The Australian Federal Police (AFP) is going into the cloud 🚀 🚫 Current Challenges: Handling large, malware-infested datasets often requires physically retrieving servers due to limited network capabilities. ✅ Infrastructure Upgrade: The AFP is implementing software-defined wide area networking (SD-WAN) to improve secure connectivity and manage network traffic more effectively. ⛅ Cloud Migration: Moving services to the cloud offers flexibility, resilience, and redundancy, enabling data to be accessed and analysed where experts are located rather than moving personnel to data sites. 🔐 SASE Implementation: Secure access service edge (SASE) technology will provide global security for devices, enhancing the resilience and flexibility of AFP operations. These upgrades aim to improve the AFP’s operational efficiency, security, and adaptability in combating cybercrime globally.

17

We have released new guidance on how to detect and mitigate Active Directory compromises alongside our international partners: https://lnkd.in/en57nmrh Australian Signals Directorate National Security Agency Cybersecurity and Infrastructure Security Agency National Cyber Security Centre National Cyber Security Centre If you use Microsoft’s Active Directory, find out 17 strategies to better protect your organization from malicious cyber actors. This guidance provides strategies to help organizations mitigate prevalent techniques used by malicious cyber actors to target Active Directory and gain access to networks. Responding to and recovering from a compromise is often time consuming, costly and disruptive. Make sure you minimize the risk for your organization today.

103

1 Comment

A step forward, nonetheless. But if we as a country are still focused on reporting and reviewing as opposed to protecting and responding, it feels like we are very far behind the 8 Ball. #cybersecurity #parliament #australia #business

2

I look forward to discussing how to design and run a TTX in Canberra for SANS Community Night! Control 1 of the SANS ICS Five Critical Controls is to have a dedicated ICS Incident Response Plan. I'll discuss how to exercise that plan to ensure it's fit for purpose and share experiences from many TTXs I have facilitated. If you're coming from an IT background, the presentation also applies to you. I look forward to seeing you there! #sans #sansics #icscybersecurity #otcybersecurity

32

4 Comments

Curious as to why the AssetCacheLoacator service on my MacOS is trying to connect to Australia to perform an Apple Update per Little Snitch. I have a whole thread going on X right now. Still waiting for followers to pick up on BlueSky. I tried different Laptops and networks and have come to the conclusion that so far either my firewall has been compromised or is simply malfunctioning or something is wrong with Comcast. DNS is doing some really strange things. Someone is trying to point my laptops to a DNS record instead of an IP, and as you know if you are into this sort of thing, DNS rebinding can change IPs, and DNS caches can be compromised. When I set the allow rule for the DNS record, I still block any invalid DNS servers based on IPs. DNS is not working on that network and I haven’t changed anything on the network side. The only thing in my firewall logs getting blocked is traffic to 1.1.1.1 which the family DNS record should not resolve to. I’m not getting any DNS responses at all. When I move my laptop to another network, the DNS records were somehow altered. When I fixed that DNS worked. But Little Snitch reports that the MacOS asset service mentioned above is apparently still trying to reach Australia and softwareupdated is trying to reach an address in Rio de Janeiro. Hmm. Do you block invalid DNS servers on your network? If you don’t, things might be resolving to unexpected or unauthorized IP addresses.

2

❗ ALERT ❗ Exploitation of vulnerabilities in Cisco ASA VPNs, software & devices has been detected in Australia. Cisco has released the following CVEs relating to the Cisco ASA device compromises: • CVE-2024-20353 – applies to management and VPN web servers for Cisco ASA Software and Cisco Firepower Threat Defence (FTD) Software. This could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly resulting in denial of service. • CVE-2024-20359 – applies to a legacy capability allowing preloading of VPN clients and plug-ins, which has been available in Cisco ASA Software and FTD Software. This could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system (OS) with root-level privileges. • CVE-2024-20358 – applies to Cisco ASA restore functionality available in Cisco ASA Software and FTD Software. This could allow an authenticated, local attacker to execute arbitrary commands on the underlying OS with root-level privileges. If your organisation has Cisco ASA devices, you should follow patching advice and discontinue use of unsupported device models and software. Read the full alert details and advice 👉 https://lnkd.in/gWRKv83s

455

6 Comments

Sharing an important alert from the Australian Signals Directorate regarding vulnerabilities in Cisco ASA VPNs, software, and devices. It's crucial to stay vigilant and ensure our digital infrastructure is secure. In light of these recent vulnerabilities, it's a stark reminder of the importance of regular patching and discontinuing the use of unsupported device models and software. Stay safe, everyone! #CyberSecurity #Cisco #ASA #Vulnerability #PatchManagement #DigitalInfrastructure #SpellShield

3

An important update from the Australian Signals Directorate on vulnerabilities in Cisco ASA CPNs, software and devices.   Read the updated alert below, or visit here for the full story:

40

2 Comments

Another Australian business affected through a 3rd party cyber incident, though in this article great pains are taken to explain that it is not their own systems but rather a 3rd party, yet who owns the data that has been exfiltrated and is now showing up on third party sites? Likening this to a personal situation, if I have household items and valuables stored at a storage facility, I will be damned certain that the storage facility is fully secure and I will expect them through the T&Cs of our agreement to have security in place. Always know what data you are sharing with your third party providers, in this case it would appear to be an unacceptable type of data (sensitive information) without sufficient security of that data, if it did need to be shared with this 3rd party provider. Data that must be shared with a third party, must be: - As little as possible to provide the service - For as short a time as possible to provide the service - At least as securely as your data security policies Thanks Brandon Dunlop for sharing https://lnkd.in/ggurmxhs

11

5 Comments

https://lnkd.in/g835ZQeE The new Cyber Security Legislation does not go far enough in providing relevant technical guidance and guidelines that organisations can adhere to, it seems too high-level and very governance-focused. Cybercrime as a problem will not be solved by governance but by practical, technical, defensive, and offensive steps prescribed by technical people, not lawyers politicians or someone from the military. This is one problem that legislating it to death is not going to solve. Also, for these two amendments or additions, Security Standards of IoT Devices & Cyber Incident review boards, you need highly skilled subject matter experts to provide their input into both. Otherwise, this is more like window dressing. The information required for these two amendments to be effective must be first distilled to low-level technical detail and then summarised at a higher level to be digested/understood by different stakeholders. Check out this article I wrote months ago that buttresses some of the points made here. https://lnkd.in/eydDVJ9e

2

🗣️ #BSIDESADL TALK 🗣️ “Canary in the Active Directory Coal Mine” 🗓️ 17 May ⌚️ 1.15pm to 2.00pm Presented by: David Mulligan, ANZ From recon to Active Directory exploitation, deception tech can slow down a red team if you aren’t aware it’s there and if you do know it’s there, you still need to avoid it or else the Blue team will know what you are up to. This talk will look at some common techniques that can be used to discover if deception tech is in use, problems Blue teams have managing deception tech, and hopefully have you avoiding the canary in the coal mine on your next engagement. 👇🏼About our presenter👇🏼 David Mulligan is the Offensive Security Lead at ANZ with over 10 years of professional experience in offensive and defensive security, specialising in intelligence-led attack simulations. Typically looking at and testing new techniques for fun and profit. Has a keen interest in radio and wireless research and attacks. Also enjoys OSINT and taking part in OSINT based CTFs. See our talk agenda here 🔗 https://ow.ly/jvBg50Rq87M #bsides #talks #activedirectory #offensivesecurity #cybersecurity

15

1 Comment

What if I told you that Australian organisations accounted for over 35 #Ransomware Attacks since January 1 2024? And that's just what is available through some public scraping, not including those that never made the front page the Darkweb Trophy Cabinets that are Ransomware Leak Sites 🏆 In #Australia, cyber incidents often lead to widespread alarm, amplified by sensationalised reporting. Dramatic headlines and intense social media buzz create an atmosphere of Fear, Uncertainty, and Doubt (#FUD). This reaction can overshadow a more measured and effective response to such incidents. Is this the best way to handle these situations in a public forum? Probably not. Sensationalised reporting often focuses on the immediate chaos of cyber incidents, exaggerating threats and spreading misinformation. Instead of fuelling FUD, we should shift our focus to understanding the root cause and lessons learned once the initial alarm has settled. Highlighting the findings and improvements made post-incident can provide valuable insights and foster a more informed public. This approach not only aids in preventing future incidents but also builds trust and resilience within the community. Effective management of cyber incidents, driven by emotional intelligence, involves recognising and addressing the public's concerns while providing clear and factual information to mitigate fear and confusion. A prime example, and something I have posted about previously, the #British Library's recent handling of their cyber incident can serve as a model. Their detailed review outlined what actually happened, providing transparency and valuable lessons learned without the grand sensationalism. Found here (https://lnkd.in/gTtni_Vt) ........ "What we do hope is that if doing this strengthens the ability of others to strengthen themselves against these attacks, which will come, then some good will have come from this dreadful incident. The lessons are there. If you've read the paper, there are many of them. They are for us to learn, but perhaps some may have relevance for others" (https://lnkd.in/gnV5F4eX)

19

Supporting Career Villages at Conferences in 2024! I am organising multiple career villages at conferences in Australia, BSides Canberra, BSides Melbourne, and Australian Information Security Association (AISA) CyberCon (Melbourne) this year. I am looking for industry professionals who want to share their knowledge, experience, and advice with others. Ideas for talks: 👉 Breaking down what you do in your job. 👉 Share your unusual journey into the industry. (help inspire others) 👉 Hiring managers advising on what you look out for when hiring. 👉 CISO sharing advice for aspiring CISOs. I am looking for people to join in on some panel sessions: 👉 Certifications 👉 Neurodiversity in cybersecurity 👉 Student to cybersecurity professional We will also seek volunteers to do resume reviews/ mock interviews. There are formal CFPs for BSides Canberra and BSides Melbourne, which you will need to complete, but if you're interested in helping out and don't know where to start/ want to register your interest, fill out the Google Form in the comments, and I can work with you on your submission. We haven't seen much in the way of gender diversity in submissions so far. It sounds corny, but be the change you want to see.

82

13 Comments