Nadia Aimé

Introducing Our Ransomware Chatbot POC! I'm excited to share the proof of concept for our innovative Ransomware Chatbot, designed to tackle the growing threat of ransomware attacks. This chatbot leverages advanced AI to provide real-time assistance, threat detection, and mitigation strategies. Your feedback is invaluable to us! Check out the demo and let us know your thoughts. 🔗 Why This Matters: Ransomware attacks are on the rise, posing significant risks to businesses of all sizes. Our chatbot aims to empower organizations with the tools they need to protect their data and maintain business continuity. By integrating this chatbot into your cybersecurity strategy, you can enhance your defenses and respond more effectively to threats. Let's make the digital world safer together! 💬✨ https://lnkd.in/eDRXX35W #CyberSecurity #RansomwareProtection #AI #TechInnovation #FeedbackWelcome

8

I am pleased to share my translated article to demystify HTTP Security Headers. Hopefully this will allow you to read it now and enlighten things! https://lnkd.in/efGEDMdF #cybersecurity #web #http #https #headers

35

2 Comments

😃check out what security consultants and the business, can do to revise approaches, promote better engagement, build better rapport, bring greater value to the process, along with avoiding some of the common mistakes that we’ve all been known to make! 👀😎

2

I just completed the TryHackMe room on Phishing Prevention. This room focus specifically on Email Security, I learnt and used tools such as: - SPF (Sender Policy Framework) - DKIM (DomainKeys Identified Mail) - DMARC (Domain-Based Message Authentication, Reporting, and Conformance) - S/MIME (Secure/Multipurpose Internet Mail Extensions) Final part of the task involved using wireshark to investigate a PCAP file to identify SMTP packet information, and understand how these tools perform on the network.

5

🇮🇹 We’re bringing the expert-level stack exploit development class to Rome, Italy for the first time in history! 🇮🇹 You don’t want to miss out on this unique opportunity to take the first of our 2 world-renowned classes on exploit development for Windows. ⭐️ Our classes are an amazing investment in your future. The content will definitely broaden your offensive cybersecurity skills and put yourself in the drivers seat of your career ⭐️ Just to set the expectations straight: We’re not selling boxes, pdf files, videos. We’re only doing real classes, in person, lead by Peter Van Eeckhoutte himself. He has been working in the field of exploit development since 2005 and teaching classes since 2011. At the same time, you can still learn at your own pace. In fact, you’ll leave the class with: ✅ An unprecedented understanding of the inner workings and mechanics. We won’t tell you to “just do this or that”, but you’ll understand exactly “why”. ✅ The courseware is quite detailed and verbose ✅ Investment protection; Just to indicate how much we care about your education, we include FREE access to a post-training support system. You can ask questions at any time and we’ll be more than happy to guide you into the right direction. Yes, even years after you took one of our classes. Sign up now for our class in Rome, or check out our schedules page for other timings/locations: https://lnkd.in/e-GhbBW

56

1 Comment

I have updated my specifications for an HSM-based European Digital Identity (EUDI) wallet I discussed in my previous post: https://lnkd.in/emmZPmX2. In the update I have addressed the comments I got including those from Sander Dijkhuis. I have also indicated more precisely the WSCA role distinguishing it from other (less trusted) Wallet Provider roles such as the front-end sitting between the wallet and the WSCA providing basic internet security. The specifications roughly consist of three parts. First eight security objectives are derived from regulations and standards referred to in the eIDAS 2.0 regulation including eIDAS implementation regulation 2015/1502. These objectives include *verifiable* sole control (a.k.a. Transaction Transparency). The second part is a specification of a basic implementation of an HSM-based EUDI wallet using standard (PKCS#11) meeting the security objectives. The third part is a specification of an *advanced* implementation of an HSM-based EUDI wallet comprising of three modest PKCS#11 instruction extensions. In the update I have added a small addition (Algorithm 9) to the third PKCS#11 instruction extension (on the use of the EN 419221-5 Authorization Data) which yields a remarkable and significant improvement: the HSM (or Cryptographic Module in EN 419221-5 speak) and not the WSCA is ultimately in charge of validating the correctness of the user PIN. That is, the HSM also blocks the PIN when a certain threshold is exceeded. The latter uses the standard EN 419221-5 Authorization Failure Counter approach. I think this is a significant improvement as it provides protection against online brute-forcing of the user PIN even in the extreme situation the attacker has compromised the Wallet Provider, the WSCA and the user wallet (but not the HSM). I think that this further simplifies allowing the WSCA to be implemented as a hardened service instead of as an HSM firmware module which has tremendous implementational and cost benefits. Note that by the design and its use of zero knowledge proofs the user PIN is truly personal and not known by the Wallet Provider, the WSCD or the WSCA just like with a regular smartcard.

60

6 Comments

Safeguard Your Digital Identity with Fortified Cyber Solutions Url- https://lnkd.in/eYCT5M5s Are you concerned about the security of your email? With increasing digital threats, it’s more important than ever to ensure your personal and professional emails are protected. Fortified Cyber Solutions is proud to offer a special deal on our Email Vulnerability Reports for just $45.00. This promotion is available for a limited time only, from today until July 20th. What You Get: Our Email Vulnerability Report provides detailed insights into any breaches involving your email, helping you understand your digital exposure and take action. Report Highlights: Summary of Breaches: Detailed accounts of where and how your email was compromised. Associated Accounts: Lists all accounts linked to your email that have been affected. Sample Report Insight: Company: Advance Auto Parts Domain: advanceautoparts.com Date of Breach: 2024-06-05 Breached Information: Email addresses, Names, Phone numbers, Physical addresses Fabricated: False Verified: True Retired: False Spam: False Why Fortified Cyber Solutions? Expert Analysis: Our reports are prepared by cybersecurity experts using the latest tools and data. Verified Data: We ensure all information is accurate and up-to-date, allowing you to trust the results. Affordable Protection: At only $45, securing your digital identity has never been more accessible. Don’t miss this opportunity to fortify your digital presence. Visit our promotion page today to secure your Email Vulnerability Report at a special price: Fortified Cyber Solutions Promotions Url- https://lnkd.in/eYCT5M5s #CyberSecurity #DataProtection #EmailSafety #DigitalIdentity #InfoSec #CyberAttack #DataBreach #InternetSafety #Technology #SecurityAwareness #BusinessSecurity #ProtectYourData #CyberThreats #SecureEmail #OnlineSecurity #FortifiedCyberSolutions

2

1 Comment

🔧 Release: LAPS-Extractor - Tool for Retrieving LAPS Passwords 🔧 Together with my colleague Idan Lerman I am pleased to introduce LAPS Extractor, a new PowerShell script designed for securely retrieving LAPS (Local Administrator Password Solution) passwords in Active Directory environments. This script automates the process of querying organizational units (OUs) for computers with LAPS passwords and checking user permissions for reading these passwords.   https://lnkd.in/d5vgBJDa #ActiveDirectory #LAPS #PowerShell #CyberSecurity

33

2 Comments

I'm so looking forward to this amazing read from Confidence Staveley who I #cyber fan girl over. I admire her work and what she has done in the #cybersecurity sector. Check it out when you get a chance. #APIsecurity #whitehat #cybersecurity #hackers #whitehathackers #offensivedefense #strategies #secureAPIimplementation #technology #informationsecurity #cybersecurityauthor #author #book

Understanding encryption is crucial because it plays a fundamental role in protecting our data in today's digitally driven world. The image outlines the process of establishing a secure HTTPS session between a web browser and a server. This is known as the SSL/TLS handshake, which occurs before any data is securely transmitted over the internet. Here's a step-by-step explanation of the diagram: Client Hello: The browser sends a 'hello' message to the server, which includes the cryptographic algorithms (RSA, AES, ECC) it supports and a random byte string that will be used in subsequent steps. [ I have explained RSA, AES, ECC further below, for now consider it to be a language ] Server Hello: The server responds with its own 'hello' message, choosing AES (from the algorithms the client offered) as the encryption method for this session and sends its own random byte string. Server Certificate: The server sends its digital certificate to the client. This certificate contains the server's public RSA key and is usually signed by a trusted certificate authority (CA). Server Key Exchange: The server may send additional data required for establishing the encryption key, using Elliptic Curve Cryptography (ECC) for generating a shared secret. Client Key Exchange: The client responds with its part of the key exchange, also using ECC, enabling both the client and server to calculate the same secret key independently. Change Cipher Spec: The browser informs the server that subsequent messages will be encrypted with the negotiated key and encryption methods. Encrypted Handshake Message (AES): The browser sends an encrypted message to the server that can only be decrypted with the secret key, ensuring that the key exchange was successful and that encryption is working as expected. Change Cipher Spec (Server to Browser): The server sends a similar message to the browser, switching to the negotiated encryption. Encrypted Handshake Message (Server to Browser): The server sends an encrypted message that confirms the server's switch to encrypted communication. HTTPS session established with AES encryption: At this point, both the browser and the server have verified that they share a secret key, and they agree to use AES for encryption. The secure HTTPS session is now established. HTTPS request (encrypted with AES): The browser sends encrypted requests to the server using AES encryption. HTTPS response (encrypted with AES): The server responds with encrypted data, which only the browser can decrypt with the shared secret key. Read more in detail - https://lnkd.in/eE4GNk3q #encryption #security

37

2 Comments

Level Up! ️ Now an Office Document Analyzer! Successfully navigated the Malicious Document Analysis course on LetsDefend. Equipped to dissect and disarm potential threats lurking within documents. #LetsDefend #Cybersecurity #MaliciousDocuments

4

🚨 Critical Windows Server Vulnerability Alert 🚨 Severity: Critical 🔍 Technical Summary: A severe vulnerability identified as CVE-2024-38077 affects the Windows Remote Desktop Licensing Service. This critical flaw allows unauthenticated attackers to execute arbitrary code remotely, potentially compromising the entire server without any user interaction. 🔑 Key Details: CVSS Score: 9.8 (Critical) Vulnerability Type: Pre-authentication Remote Code Execution (RCE) due to a heap overflow in CDataCoding::DecodeData. Exploitation: Exploits involve sending specially crafted packets to the Remote Desktop Licensing server, with a PoC showing near 100% success rate. 🔒 Impact: Affected systems: All versions of Windows Server from 2000 to 2025. Potential outcomes: Full server compromise, data breaches, service disruptions, and unauthorized access to sensitive information. ⚠️ Recommendations: Apply the released patch immediately. Consider disabling Remote Desktop Licensing Service if it is not required. 📚 Good Reads: https://lnkd.in/dquM54Yy https://lnkd.in/duJcSb5v Stay vigilant and ensure your systems are updated to protect against this critical threat. #CyberSecurity #WindowsServer #Ransomware #Vulnerability #PatchManagement

11

https://lnkd.in/e-3vDH3p  The Architecture Reference Framework [ARF] for the European Digital Identity (EUDI) Wallet refers to the concepts of Wallet Trust Evidence (WTE) and Proof of Association (PoA) of public keys. These concepts are closely related to the Wallet Secure Cryptographic Device (WSCD), i.e. the trusted wallet cryptographic hardware. The WTE and PoA allow issuers verifying that a public key they bind to a PID or attestation during issuance reside in a certified WSCD of the user in non-extractable fashion. The PoA also allows a relying party during presentation of multiple attestations to verify that the public keys in these attestations are not only bound to a certified WSCD but are cryptographically bound to the same certified WSCD as the PID public key is. The WTE/PoA concepts resemble regular key-attestation, e.g. supported by Android and iOS, but can be considered a privacy enhancing version of it. To illustrate, the WTE/PoA preclude an attacker ‘hooking’ the wallet APP during the issuance proces, e.g. using the Frida Framework, and let it generate private PID/Attestation keys in software allowing cloning of these keys and thus of the PID/Attestation. Prevention against such cloning is fundamental for wallet security and also requires resistance against ‘high attack potential’, i.e. a notion referring to Common Criteria certification stipulated in the eIDAS regulation. We remark that “APP-attestation”, e.g. Android’s SafetyNet, also tries to prevent such hooking but as this operates on OS level this is not able to provide resistance against high attack potential. Such resistance includes attacks by powerful (hostile) nation state attackers wanting to clone or forge PID/Attestations of privileged users as part of a supply chain attack allowing access to security critical governmental or business websites. One of the first documented attacks of this type was in 2011 when allegedly Chinese government successfully compromised the SecureID OTP tokens of security firm RSA allowing them access to Lockheed Martin. This is a US military contractor that developed and produces the F35 strike fighter. Luckily Lockheed Martin timely detected the attack. See https://lnkd.in/esWuXTth. In the referred paper – work done for Dutch government – you can find an example cryptographic specification of the WTE/PoA concepts which is implementable on all four EUDI Wallet architectures envisioned in the ARF. For efficiency the paper concentrates on irrefutable PoAs but also indicates how refutable PoAs can be formed providing plausible deniability which can be beneficial in certain use cases. [ARF]: https://lnkd.in/ejAC_bmt

48

2 Comments

In my post of last week, I stressed the importance of the European Digital Identity (EUDI) wallet meeting the eIDAS High assurance level, including protection against attackers with ‘high attack potential’, most notably hostile nation states. I illustrated the risk of hostile nation states compromising the EUDI wallet by referring to the 2011 attack on Lockheed Martin by - allegedly - Chinese military that successfully compromised the SecureID OTP tokens of security firm RSA. A future abuse case could find it basis in the plan (*) of the European Commission to store digital travel credentials in the European Digital identity wallet. The Commission press release states “Digital travel credentials will make it easier for authorities verify the authenticity and integrity of travel documents, making it harder for fraudsters to use fake documents or pass through borders undetected.” This places great demands on EUDI wallet security which can only be met with big investments/efforts in wallet security such as the cryptographic techniques I discussed in my post of last week. (*) https://lnkd.in/ee9Az8xP

16

1 Comment

🛡️ Security Lessons from the Remcos RAT Phishing Campaign 🛡️ 📰 Brief Summary: A new phishing campaign uses Remcos RAT, exploiting CVE-2017-0199 in malicious Excel attachments to gain remote control of victim systems. Remcos performs stealthy operations like keylogging, process control, and system reconnaissance through advanced anti-analysis techniques. 1️⃣ Key Takeaway for Your Security Controls This campaign emphasizes the importance of strict attachment handling policies. Always scrutinize email attachments, especially those with macros or unusual formats, as they are common vectors for malware. 2️⃣ Mitigation Steps If You Use Similar Tools or Vulnerable Software Patch CVE-2017-0199: Ensure all devices are updated to eliminate this vulnerability. Restrict Macros: Disable macros in office documents from unknown sources to prevent script-based malware execution. Endpoint Monitoring: Implement robust EDR solutions to detect signs of process hollowing or unexpected registry changes. 3️⃣ General Security Actions for All Organizations Email Filtering: Use advanced phishing detection and sandboxing for email attachments. PowerShell Restrictions: Limit PowerShell execution policies to reduce script-based attacks. Employee Awareness: Train staff to recognize phishing signs and report suspicious emails. 🔍 Security Reminder: Phishing attacks are constantly evolving. Regularly review your endpoint defenses, apply the latest patches, and reinforce email security measures. Stay vigilant to reduce the risk of malware infiltration. #EmailSecurity #RATThreat #EndpointProtection #PhishingDefense https://lnkd.in/ege4JK8g

1