Fabrice De Paepe

😃check out what security consultants and the business, can do to revise approaches, promote better engagement, build better rapport, bring greater value to the process, along with avoiding some of the common mistakes that we’ve all been known to make! 👀😎

2

The telecommunications sector is being hacked by aggressive nation states (this time China's Salt Typhoon group). The National Security Agency, Cybersecurity and Infrastructure Security Agency, and Federal Bureau of Investigation (FBI) have jointly published an alert outlining good basic security principles for the communications sector. I emphasize basic, because telcos and all other critical infrastructure heavyweights should already be doing the basics! If the NSA, CISA, and FBI need to reiterate this information to telcos, it highlights a problem that many aren't consistently adhering to fundamental #cybersecurity practices which should have been in place for more than a decade!

24

1 Comment

🚨 Important news about the critical #CrushFTP security flaw... CVSS 9.8! The team at Airbus #CERT has published Python scripts on #GitHub that can be used to scan for the #CrushFTP file read vulnerability, as well as search for #IoCs in a CrushFTP server installation directory🔥 Thank you!!! Check this out: https://lnkd.in/e6sN7szg If you are still vulnerable (versions below 11.1), your top three priorities today should be: 1️⃣ Patch!! 2️⃣ Patch!! 3️⃣ Patch!! ;-) #SimpleActionPlan This flaw has been exploited as a zero-day to target multiple U.S. entities...

72

Finally, today 21th of November, the EU Cyber Resilience Act (CRA) has been officially published in the EU Official Journal, Keypoints are as follow: - This Regulation aims to set the boundary conditions for the development of secure products with digital elements by ensuring that hardware and software products are placed on the market with fewer vulnerabilities and that manufacturers take security seriously throughout a product’s lifecycle. - It also aims to create conditions allowing users to take cybersecurity into account when selecting and using products with digital elements, for example by improving transparency with regard to the support period for products with digital elements made available on the market. New relevant info from previous draft texts: CRA has adopted the formal number of EU regulation (2024/2847) Specific deadlines are set for different obligations: - From 11 June 2026, the requirements for conformity assessment bodies, [Chapter IV (Articles 35 to 51)] applies - From September 11,2026, Product manufacturing organizations must report actively exploited vulnerabilities and severe incidents in their products (Art. 14) to national authorities and ENISA. - and finally, from 11 December 2027, obligations for all products under the scope of CRA Regulation apply, meaning that no “product with digital elements” may be sold in the EU without a CE mark. Full text with all detailed info, here:

17

I am pleased to share the translation of my article to discover the EAP-TEAP network authentication protocol. Hopefully this will provide you with some answers. https://lnkd.in/e-BJh_7W #cybersecurity #eap #teap #authentication #network #networking #nac

30

FESA (the Forum of European Supervisory Authorities) has published an advisory paper for its members suggesting requirements surrounding the adoption of automation (such as ACME) for Qualified TLS (aka Qualified Web Authentication Certificates or QWACs). The paper seeks to "genericize" the desired features for such automation beyond the specific functions of ACME, and discusses the security features that should be adopted by Trust Service Providers (TSPs) surrounding "external account binding" and key protection to fulfil the requirements of the Qualified standards. As the browsers begin to push towards shorter validity periods for TLS certificates, the use of such automation becomes inevitable if not essential. So far, beyond the technical plumbing descriptions of ACME in RFC 8555 and ARI in draft-ietf-acme-ari-05, few requirements exist describing how TLS automation should be deployed by public trust CAs. The FESA whitepaper represents a useful look at how such controls might be deployed and will undoubtedly be considered as ETSI ESI and the CA/Browser Forum integrate TLS automation into their own standards and baseline requirements.

24

1 Comment

AI Coding Assistants are great for boosting productivity but it's not risk free! Read more about the associated risk and how to mitigate them.

9

🔔 Backmydata Ransomware Attack on Romanian Soft Company (RSC) 🔔 📅 Date: 16.02.2024 During the night of 11 to 12 February 2024, a significant ransomware attack targeted the Romanian Soft Company (RSC) (www.rsc.ro), which manages the Hippocrates computer system used by 26 Romanian hospitals. This attack, leveraging the Backmydata ransomware from the Phobos malware family, severely disrupted hospital operations. Key Details: Malware: Backmydata ransomware Propagation Method: Remote Desktop Protocol (RDP) connections File Extension: .backmydata Ransom Notes: info.hta and info.txt Indicators of Compromise (IOCs): AntiRecuvaDB.exe: 396a2f2dd09c936e93d250e8467ac7a9c0a923ea7f9a395e63c375b877a399a6 kprocesshacker.sys: 70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4 dControl.exe: 6606d759667fbdfaa46241db7ffb4839d2c47b88a20120446f41e916cad77d0b View full list of IOCs Action Required: All healthcare entities, regardless of being affected, are advised to: Scan IT & C infrastructure using the YARA scanning script. Download the YARA rules script here. Follow the provided instructions to execute the script and check for malware. Important Recommendations: Do not pay the ransom or contact the attackers. Report any findings to DNSC at [email protected]. For more information, contact: Email: [email protected] Phone: 1911 Stay safe and vigilant! #DNSC #CyberAlert #Ransomware #CyberSecurity #Backmydata #Awareness #HealthcareSecurity

4

Read about Secure credential exchange to accelerate passkey adaption, to replace passwords on the FIDO Alliance website. And resources to accelerate passkey adaption, required for improved security and less work to maintain passwords ! https://lnkd.in/e6PTjs7B #passkey #iam

2

🚨 Dutch Police Data Breach: 63,000 Officers' Information Stolen in State-Sponsored Cyberattack 🚨 A recent massive cyberattack targeted the Dutch police, compromising the names, email addresses, and job titles of over 63,000 officers. The hack, suspected to be carried out by a state-backed actor, has sparked serious concerns over the safety of law enforcement personnel, particularly those working undercover. ⚠️ Details of the attack: - The breach involved the theft of work-related contact details, although personal and investigative data were reportedly not compromised. - The Dutch government and security agencies have ramped up efforts to protect affected officers and prevent further data exposure. - Intelligence agencies suspect that foreign actors are increasingly targeting critical infrastructure, including law enforcement agencies, as part of larger geopolitical strategies. 🔒 What’s next? Authorities are investigating the full scope of the attack while enhancing security measures like two-factor authentication to mitigate future risks. This breach highlights the growing threat of state-sponsored cyberattackson national infrastructure, emphasizing the need for robust cybersecurity defenses. #Cybersecurity #DataBreach #StateActor #LawEnforcement #InfoSec #DutchPolice #CriticalInfrastructure #ThreatIntelligence #CyberAttack

9

Cyentia Institute has started the planning process for the 2024 Information Risk Insights Study (IRIS). It will once again be sponsored by CISA. One of my main goals for the IRIS 2024 is to incorporate (anonymized, aggregated) insurance claims data into our analysis of publicly-reported cyber loss events. If you are a cyber insurer or reinsurer and would be interested in exploring participating in the study, please reach out. The latest IRIS has about 20k downloads and gets referenced/used widely by cyber risk teams. So, this is a good opportunity to drive visibility AND help the community. #cyberrisk #cyberinsurance #cybersecurity See previous IRIS studies:

46

How to trick defenses to do a SQL attack with JSON. As we have seen previously, SQLi are still fearsome despite their age. If anyone has missed the basic information on SQLi I recommend taking a look at the first article: SQL injection attack: what is it? Naturally, the security industry has developed tools to combat SQLi, these are applications capable of filtering web requests and determining with good approximation whether they are legitimate requests or attack attempts. Naturally, hackers also did not let themselves be discouraged and found a whole series of tricks to "bypass" the defenses, among these the attack called JSON - SQL bypass. Let's try to understand what it is, but... https://lnkd.in/d2dU5_FK

3

I am pleased to share my translated article to demystify HTTP Security Headers. Hopefully this will allow you to read it now and enlighten things! https://lnkd.in/efGEDMdF #cybersecurity #web #http #https #headers

35

2 Comments

Level Up! ️ Now an Office Document Analyzer! Successfully navigated the Malicious Document Analysis course on LetsDefend. Equipped to dissect and disarm potential threats lurking within documents. #LetsDefend #Cybersecurity #MaliciousDocuments

4

NIS2 A very important topic, hear from the experts at www.eucybersummit.com #EUCS24 ICTTF - Cyber Security Community, Academy and Events

10

SOC of the future. Blueprint for a Security Operations Center in 2030 - Current #state of the #SOC - Relevant #developments between 2024-2030 - #Vision on the SOC in 2030 Security monitoring and incident response will face major challenges in the coming years, as the complexity of infrastructures, threats and regulations increases. Presently, there is a lack of understanding of how #SOCs might and should evolve to address these challenges. Commissioned by #NCSC, TNO completed this project to look into the possible challenges. Based on the findings from the literature review and #expert #interviews a number of possible scenarios have been provided as a thought #exercise. The report additionally presents a number of recommendations. Centro de Investigación de Ciberseguridad IoT - IIoT

89

https://lnkd.in/e-3vDH3p  The Architecture Reference Framework [ARF] for the European Digital Identity (EUDI) Wallet refers to the concepts of Wallet Trust Evidence (WTE) and Proof of Association (PoA) of public keys. These concepts are closely related to the Wallet Secure Cryptographic Device (WSCD), i.e. the trusted wallet cryptographic hardware. The WTE and PoA allow issuers verifying that a public key they bind to a PID or attestation during issuance reside in a certified WSCD of the user in non-extractable fashion. The PoA also allows a relying party during presentation of multiple attestations to verify that the public keys in these attestations are not only bound to a certified WSCD but are cryptographically bound to the same certified WSCD as the PID public key is. The WTE/PoA concepts resemble regular key-attestation, e.g. supported by Android and iOS, but can be considered a privacy enhancing version of it. To illustrate, the WTE/PoA preclude an attacker ‘hooking’ the wallet APP during the issuance proces, e.g. using the Frida Framework, and let it generate private PID/Attestation keys in software allowing cloning of these keys and thus of the PID/Attestation. Prevention against such cloning is fundamental for wallet security and also requires resistance against ‘high attack potential’, i.e. a notion referring to Common Criteria certification stipulated in the eIDAS regulation. We remark that “APP-attestation”, e.g. Android’s SafetyNet, also tries to prevent such hooking but as this operates on OS level this is not able to provide resistance against high attack potential. Such resistance includes attacks by powerful (hostile) nation state attackers wanting to clone or forge PID/Attestations of privileged users as part of a supply chain attack allowing access to security critical governmental or business websites. One of the first documented attacks of this type was in 2011 when allegedly Chinese government successfully compromised the SecureID OTP tokens of security firm RSA allowing them access to Lockheed Martin. This is a US military contractor that developed and produces the F35 strike fighter. Luckily Lockheed Martin timely detected the attack. See https://lnkd.in/esWuXTth. In the referred paper – work done for Dutch government – you can find an example cryptographic specification of the WTE/PoA concepts which is implementable on all four EUDI Wallet architectures envisioned in the ARF. For efficiency the paper concentrates on irrefutable PoAs but also indicates how refutable PoAs can be formed providing plausible deniability which can be beneficial in certain use cases. [ARF]: https://lnkd.in/ejAC_bmt

48

2 Comments

In my post of last week, I stressed the importance of the European Digital Identity (EUDI) wallet meeting the eIDAS High assurance level, including protection against attackers with ‘high attack potential’, most notably hostile nation states. I illustrated the risk of hostile nation states compromising the EUDI wallet by referring to the 2011 attack on Lockheed Martin by - allegedly - Chinese military that successfully compromised the SecureID OTP tokens of security firm RSA. A future abuse case could find it basis in the plan (*) of the European Commission to store digital travel credentials in the European Digital identity wallet. The Commission press release states “Digital travel credentials will make it easier for authorities verify the authenticity and integrity of travel documents, making it harder for fraudsters to use fake documents or pass through borders undetected.” This places great demands on EUDI wallet security which can only be met with big investments/efforts in wallet security such as the cryptographic techniques I discussed in my post of last week. (*) https://lnkd.in/ee9Az8xP

16

1 Comment