Hristiyan Lazarov

Recommended Mitigations 1) Boot Windows into Safe Mode 2) Navigate to the directory C:\Windows\System32\drivers\CrowdStrike 3) Locate the file matching C-00000291*.sys and delete it 4) Boot the host normally Note: You can also boot in Windows Recovery Environment (WinRE) #crowdstrikefriday

5

Important points summarized: 1. Purpose and Applicability: • The rules, under the Telecommunications Act, 2023, aim to strengthen cybersecurity in telecommunication networks and services. • Effective from the date of publication in the Official Gazette. 2. Key Definitions: • Telecom Cybersecurity: Includes tools, policies, and technologies to protect telecom networks and services. • Telecommunication Entity: Entities authorized under the Act to provide telecom services or operate networks. 3. Data Collection and Sharing: • Central Government can mandate data collection (excluding message content) to enhance cybersecurity. • Collected data can be analyzed and shared with law enforcement or telecom entities, maintaining strict confidentiality. 4. Responsibilities of Telecommunication Entities: • Must prevent cybersecurity threats and report security incidents promptly. • Implement cybersecurity policies, conduct audits, and establish Security Operation Centres (SOCs). • Report security incidents to the government within 6 hours and provide details within 24 hours. 5. Appointment of Chief Telecommunication Security Officer: • Every telecom entity must appoint a Chief Telecommunication Security Officer responsible for compliance and coordination with the government. 6. Incident Reporting: • Security incidents affecting telecom services or networks must be reported to the government. • Detailed records of such incidents should be maintained and shared for further investigation if required. 7. Obligations on Equipment Manufacturers and Importers: • Registration of International Mobile Equipment Identity (IMEI) numbers for devices manufactured or imported into India is mandatory. • Tampering with telecom equipment or identifiers is strictly prohibited. 8. Penalties and Enforcement: • Violations of these rules will be addressed under provisions of the Telecommunications Act, 2023. 9. Digital Implementation: • A government portal will be used for compliance and reporting. Secure communication channels may also be employed. 10. Immediate Measures: • In urgent cases, the government can suspend or permanently disconnect telecom identifiers or services linked to cybersecurity threats without prior notice.

34

3 Kommentare

LLM Tip of the Day Do you have security baselines for an application or a database that are Linux specific but you need the Windows version? Ask your favorite LLM to convert the OS guidance for you, and have an OS expert refine the changes. Saves a a good amount of time.

5

😃check out what security consultants and the business, can do to revise approaches, promote better engagement, build better rapport, bring greater value to the process, along with avoiding some of the common mistakes that we’ve all been known to make! 👀😎

2

SUMMARY: Ivanti warns of an ongoing exploitation of a zero-day vulnerability in its Avalanche enterprise mobile device management software. MAIN POINTS: - The zero-day flaw is actively being exploited by unidentified attackers. - Ivanti has released a security fix and strongly urges immediate updates. - The vulnerability impacts Avalanche software versions up to 6.3.4. TAKEAWAYS: - Prioritize updating Avalanche software to mitigate potential risks. - Monitor security advisories from Ivanti for further updates. - Investigate system logs for signs of exploitation. #Ivanti #zeroday #0day #cybersecuritynews

1

An interesting story (with good insights from Sarah Fluchs) about car models (VW Up and T6.1 as well as three Porsche models) discontinued by their manufacturing because they could not meet the UNECE R 155 transitional regulation. Since the core of this is to "demonstrate that cyber security was adequately considered", the moral of the story is simple: whether it's apps, cars, IoT, AI models, etc., secure by design is a must. #securebydesign #security

8

Interesting report by Dutch Nationaal Cyber Security Centrum (NCSC-NL) about ongoing state-sponsored cyber espionage campaign by exploiting a vulnerability affecting #FortiGate devices. The state actor gained access to at least 20.000 FortiGate devices globally within a few months in both 2022 and 2023. Targets were several Western governments and diplomatic institutions as well as numerous companies operating in the defense industry: https://lnkd.in/ee4x4bNz #cybersecurity

3

Over 22k unpatched Palo Alto Network devices (PANs) exposed to the internet. The time to patch these has passed as exploitation attempts have been detected, with more expected. Patch your PANs and sign up for Shadowserver reports to get alerts as to whether or not there are vulnerable PANs in your networks.

93

5 Kommentare

🔐 🤖 🧠 Weekly InfoSec Knowledge Nugget 🧠 🤖 🔐 ℹ 89% of Information #Security Awareness survey respondents noted #SocialEngineering as the top human risk for their organisation. 🔗 Source: SANS Institute 2024 Security Awareness Report - https://lnkd.in/dfRWPHMc ⚡ With Social Engineering in this context referring to the three most common social engineering attacks: email-based #phishing, text-based #smishing, and voice-based #vishing, #educating and #training your employees on how to spot these scams remains an extremely strong part of the organisational #infosec armour 🛡 #Knowledge and #Awareness are the building blocks for your #HumanFirewall!

5

"OSCs must retain artifacts used as evidence for the assessment for the duration of the validity period of the certificate of assessment, and at minimum, for six years from the date of certification assessment as addressed in 32 CFR 170.17(c)(4). The OSC is responsible for compiling relevant artifacts as evidence and having knowledgeable personnel available during the assessment. The organizational artifacts are proprietary to the OSC and will not be retained by the assessment team unless expressly permitted by the OSC. To preserve the integrity of the artifacts reviewed, the OSC creates a hash of assessment evidence (to include a list of the artifact names, the return values of the hashing algorithm, and the hashing algorithm used) and retains the artifact information for six years. The information obtained from the artifacts is an information collection and is provided to the C3PAO for uploading into the CMMC instantiation of eMASS." The above text is from the DoD's June 21, 2024 submission to the Federal Register. It describes the expected information collection level-of-effort for a CMMC Level 2 assessment. Some more information: The DoD expects evidence collection and archival, assessment planning and results, C3PAO records about their assessment staff, and submission of data into CMMC eMASS to take 525 hours on average, per assessed company. This is just the effort related to paperwork. It doesn't cover the time spent interviewing or demonstrating the system. It doesn't cover the time preparing. Bottom line? The DoD seems 𝒅𝒆𝒕𝒆𝒓𝒎𝒊𝒏𝒆𝒅 to get their defense contractors cyber-secure, no matter the cost. They are treating this as seriously as the defenses for our key military and government installations, and looking at a timeline of just a few years to get our manufacturing and military support base resilient to cyber-attack. If you're ready to start working seriously on NIST SP 800-171 and #CMMC compliance, or want to get scheduled for your certification assessment, give my team at Kieri Solutions - Authorized C3PAO a call. We specialize in helping companies become compliant without outsourcing their control of IT to a third party. Read more about the DoD's submission below: https://lnkd.in/eTFi9dVK

51

47 Kommentare

#quishing #awarness #cybersecurity Today, numerous tools can detect and eliminate harmful links that may direct users to phishing sites or distribute malware. However, the majority of these tools have yet to incorporate features for scanning malicious QR codes. Consequently, cybercriminals have increasingly turned to QR codes in their schemes. QR code phishing closely resembles other phishing methods, constituting a social engineering attack aimed at coaxing individuals into divulging personal information, ranging from login credentials to financial data. Although QR code phishing is not a novel tactic, its novelty lies in the utilization of QR codes to lure victims to malicious websites. Similar to traditional phishing attacks, the primary objective remains the same: enticing users to input sensitive information such as social security numbers, bank login details, email credentials, and the like. - In China, individuals were apprehended for distributing counterfeit parking tickets adorned with QR codes, purportedly for easy mobile phone payments, targeting parked vehicles. - Fraudsters in the Netherlands exploited a legitimate function within a mobile banking application to deceive bank clients using QR codes. - In Germany, deceptive emails containing QR codes enticed eBanking users to visit fraudulent websites, falsely claiming to provide updates on account privacy policies. - In Texas, criminals affixed stickers bearing malicious QR codes onto city parking meters, duping residents into inputting credit card information into a bogus phishing website. What do you need to be aware? + Avoid scanning if in doubt! Trust your instincts. + Pause and reflect before scanning. Consider the circumstances: do you trust the source of the QR code? Can you ensure its integrity? Is there a genuine necessity for using a QR code in this context? + Carefully examine the QR code's URLs. Just as with a dubious website, scrutinize the destination URL before proceeding. If it appears questionable, misspelled, or unrelated to the intended organization, avoid opening the link. + Be vigilant for signs of physical tampering. Fraudsters may exploit QR codes, particularly in public spaces like parking lots. Thus, be alert for indications of tampering, such as stickers covering existing codes. + Never install apps via QR codes. Attackers can clone and manipulate websites easily. Instead, always obtain apps from your device's official app store. + Beware of hidden scams: Could a QR Code Conceal a Phishing Attack? If uncertain, refrain from making payments via QR codes. Utilize a securely downloaded proprietary app or search for an official payment portal online. + Implement multi-factor authentication (MFA). In case of an inadvertent breach, MFA serves as an additional security layer, thwarting unauthorized access to your accounts (e.g., email or social media) and notifying you of any suspicious activity.

6

Phil’s insights on cyber risk quantification offer an important perspective on how we should approach risk management in a practical and interdisciplinary way. Particularly, his point on the distinction between risk quantification and risk communication really resonates. Too often, we conflate the two, leading to confusion in decision-making processes. By recognizing that effective risk communication is just as important as accurate quantification, we can ensure that stakeholders—whether technical teams or business leaders—are equipped with the right information to act. Quantifying risk is just the first step, but conveying that risk in a way that drives actionable decisions is what truly moves the needle. #CyberRisk #RiskManagement #Leadership

20

The telecommunications sector is being hacked by aggressive nation states (this time China's Salt Typhoon group). The National Security Agency, Cybersecurity and Infrastructure Security Agency, and Federal Bureau of Investigation (FBI) have jointly published an alert outlining good basic security principles for the communications sector. I emphasize basic, because telcos and all other critical infrastructure heavyweights should already be doing the basics! If the NSA, CISA, and FBI need to reiterate this information to telcos, it highlights a problem that many aren't consistently adhering to fundamental #cybersecurity practices which should have been in place for more than a decade!

24

1 Kommentar

✅ (8/38) CPG 1.H Supply Chain Vulnerability Disclosure In this new series on the Cybersecurity and Infrastructure Security Agency Cybersecurity Performance Goals - lets look at Supply Chain Vulnerability Disclosure This is very similar to CPG 1G which we covered previously, focusing on incident reporting. The "how" is the same, get it in the contract! The recommendation action here is pretty simple, contracts and SLAs stipulate that your vendor or service provider must notify you within a risk-determined period of time that you specify in the contract of new or updated vulnerabilities that affect their product(s). This is precisely what is called for in NERC CIP 013 Supply Chain Risk Management, and even if you are not subject to NERC, it's foundational in your supply chain security journey. It's also covered thoroughly in: ✅ NIST SP 800-216 Recommendations for Federal Vulnerability Disclosure Guidelines https://lnkd.in/ef2J7D8x ✅ ISO 29147 Information technology — Security techniques — Vulnerability disclosure https://lnkd.in/exdTCJPq ✅ CycloneDX Use Cases for Software Bill of Materials (SBOM) https://lnkd.in/ey5A5GMW ✅ CSAF Advisory formats which are quickly becoming the preferred format for sharing this information, used by Red Hat, Microsoft and many others. https://lnkd.in/eTv8ANB2 ✅ Secvisogram tool for reading and editing CSAF documents https://lnkd.in/ecDiC-b4 And we are seeing these requirements unfold in newer regulations like the Cyber Resilience Act in the EU and others around the globe. This is no longer a negotiable control for vendors delivering products! To get started: ➡️ One approach you could take is to utilize the procurement language from the Edison Electric Institute Model procurement language, which aligns closely to the NERC CIP supply chain requirements, and then layers in additional controls such as a software bill of materials (SBOM) ➡️ Another approach is leveraging the excellent Securing Digital Energy Infrastructure: Procurement, Contracting, and Supply Chain Risk Management Guidance paper from Idaho National Laboratory which also includes some contracting language. In our Notion CPG template at https://lnkd.in/e_eBNp5c we discuss this and more on managing your supply chain vulnerability disclosure process. The tools matter less than doing it and getting your organization onboard with the process. #cybersecurity #cpg #opensource #itsecurity #otsecurity #icssecurity #criticalinfrastructure #supplychainsecurity #vulnerabilitydisclosure

22

4 Kommentare

Based on #WordFress report at 30th September 2024, #File #Upload #Vulnerabilities are the third most common vulnerability type that found in vulnerability analysis of 1599 #WordPress vulnerabilities over 14 months.

4

MerkSpy is designed to clandestinely monitor user activities, capture sensitive information, and establish persistence on compromised systems. But opening the file triggers the exploitation of CVE-2021-40444, a high-severity flaw in MSHTML that could result in remote code execution without requiring any user interaction. It was addressed by Microsoft as part of Patch Tuesday updates released in September 2021. #MSHTML #patching #security

1