Alexei Zhurba

🤔 Will Andorran #domains be used for #advertisement or for #cybersquatting? 📢 The domain registry just announced the upcoming lift of all restrictions related to the registration of .ad domains, and the adoption of the classic registry-registrar model. ⚠ They are yet to announce if any out-of-court #dispute procedure will be available. None has been announced so far. 🌐 Many ccTLDs are used in their generic meaning, the most famous being .tv. The .ad will certainly not escape that trend. 💡 We recommend that companies secure their .ad domains before they are registered by malicious third parties.

7

1 comentario

🔐 We've kicked off "The future of cybersecurity, today: Free and #opensource tools for #CRA compliance for SMEs" at #OCX24, presented by Mikael Barbero (Eclipse Foundation) and Philippe Ombredanne (AboutCode)!

61

6 comentarios

FIDO Alliance Working on Making Passkeys Portable Across Platforms: The FIDO Alliance is developing new specifications to enable secure transfer of passkeys between different password managers and platforms. Announced this week, the initiative is the result of collaboration among members of the FIDO Alliance's Credential Provider Special Interest Group, including Apple, Google, Microsoft, 1Password, Bitwarden, Dashlane, and others. From a report: Passkeys are an industry standard developed by the FIDO Alliance and the World Wide Web Consortium, and were integrated into Apple's ecosystem with iOS 16, iPadOS 16.1, and macOS Ventura. They offer a more secure and convenient alternative to traditional passwords, allowing users to sign in to apps and websites in the same way they unlock their devices: With a fingerprint, a face scan, or a passcode. Passkeys are also resistant to online attacks like phishing, making them more secure than things like SMS one-time codes. The draft specifications, called Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF), will standardize the secure transfer of credentials across different providers. This addresses a current limitation where passkeys are often tied to specific ecosystems or password managers. Further reading: Passwords Have Problems, But Passkeys have more. Read more of this story at Slashdot.

3

🚨 Security Vulnerability Alert: Lawo AG vsmLTC Time Sync (vTimeSync) 🚨 Earlier this year, researchers Sandro Einfeldt & Dennis Jung identified for the SEC Consult Vulnerability Lab a significant vulnerability in the Lawo AG vsmLTC Time Sync (vTimeSync) component. The issue, a path traversal flaw, allowed unauthenticated attackers to download arbitrary files from the operating system, potentially exposing sensitive information and putting systems at risk.   While the discovery was made in early 2024, Lawo AG has now released a #patch after careful development and testing. Though it took time to resolve, we appreciate that good things sometimes require thorough attention to detail, especially when securing systems from such security risks.   ❗We strongly encourage all users to update to the latest version to protect their systems against this #vulnerability. As always, ensuring timely patch management and vigilant security practices are key to safeguarding infrastructure.   📄 Full advisory and technical details here: https://lnkd.in/daj-SEX3 🔐 Take action now and make sure you're up to date! #CyberSecurity #infosec #patchmanagement #pathtraversal

5

Sibylity: Empowering FCR with Centralized Strategy, Distributed Action 🎯🔄 Federated Cyber-Risk Management (FCR) isn't just about distributing responsibility—it's about aligning the entire organization towards common security goals. Here's how Sibylity makes it happen: 🏛️ Centralized Security Model: * Security team curates a comprehensive strategy * Sets organizational priorities and standards * Provides a unified framework for all teams 👥 Distributed Risk Management: * Cross-functional teams manage risks across the organization * Aligned with centralized strategy * Focused on relevant, prioritized security objectives 🧠 Meet Thia: Sibylity's AI-Powered Cybersecurity Intelligence * Interprets centralized security settings * Provides tailored recommendations to each team * Ensures consistency with organizational priorities 🛡️ Guardrails for Effective Risk Management: * Centralized configuration sets boundaries * Teams operate with guided autonomy * Maintain alignment while allowing for contextual decisions Benefits of this approach: ✅ Consistent security posture across the organization ✅ Empowered teams with clear direction ✅ Efficient resource allocation based on priorities ✅ Adaptable to unique needs of different departments Sibylity doesn't just enable FCR—it optimizes it, ensuring that every team contributes effectively to your organization's overall security goals. Ready to align your entire organization towards common security objectives? Let's explore how Sibylity can transform your approach to cyber risk management. #FCR #CybersecurityStrategy #DistributedRiskManagement #Sibylity

1

The "ToxicPanda" attacks highlight a growing risk in our interconnected world - the targeting of mobile and cloud platforms by cyber adversaries. Corporations and financial institutions must adapt and develop robust security measures against evolving cyber threats. Here are some key strategies to resist such attacks: 1. Vigilance and Awareness: Regular training for employees to spot suspicious emails or messages can be the first line of defense against mobile trojans. 2. Regular Updates: Ensure all your devices, software, and applications are running on the latest versions. 3. Utilize Security Tools: Leverage robust dedicated security tools for mobile devices including secure browsers, antivirus, and VPN. Remember, security isn't static. As this botnet shows, the risk landscape is constantly shifting, requiring an agile, responsive approach to defense. #CyberSecurity #Botnet #CloudSecurity #MobileSecurity #BankingSecurity

1

Redefining Security: A Dive into Risk-Based Application Threat Modeling The traditional approach to threat modeling is no longer sufficient. It’s time we talk about a methodology that’s not just about mapping threats but about understanding the real-world impact on our businesses. Enter PASTA (Process for Attack Simulation and Threat Analysis) - a risk-centric framework that integrates business impact, inherent application risk, and attack patterns to provide a comprehensive view of potential threats. Why PASTA? Business-Centric: Tailors threat models to the specific context of your business operations. Risk-Focused: Goes beyond generic threat categories to address actual risks and attack scenarios. Evidence-Based: Correlates real threats to your application’s attack surface, providing actionable insights. The PASTA Advantage Proactive Security: Helps preemptively address security within your software development lifecycle. Holistic Approach: Considers trust boundaries, correlated threats, and the exploitation of identified weaknesses. Strategic Process: Aims for effective countermeasures by analyzing attacks that exploit vulnerabilities. As we navigate through the complexities of protecting our digital assets, it’s crucial to adopt a framework that resonates with our need for defensible and strategic cybersecurity measures. Let’s embrace PASTA, not just as a threat modeling methodology, but as a mindset shift towards a more resilient and informed security posture. Have you integrated a risk-based approach to your application threat modeling? Share your experiences and insights below! https://lnkd.in/gwvJ_vaf #CyberSecurity #ThreatModeling #RiskManagement #PASTA #InfoSec #ApplicationSecurity #RiskBased #CyberDefense #AttackSimulation #BusinessImpact #SecurityFramework #ThreatAnalysis #CyberResilience #InfoSecCommunity #RiskAwareness

5

🚨 RegreSSHion vulnerability detected! 🚨 The Qualys Threat Research Unit (TRU) has identified a severe Remote Unauthenticated Code Execution (RCE) flaw in OpenSSH's server. CVE-2024-6387, named "regreSSHion," is a vulnerability discovered in OpenSSH's server (sshd) on glibc-based Linux systems. This flaw allows threat actors to run code remotely with root privileges. This flaw affects OpenSSH versions 8.5p1 to 9.8p1, allowing attackers to potentially compromise affected systems completely. It potentially compromises over 14 million OpenSSH instances, with around 700,000 directly exposed to the internet. Our vulnerability management service, SmartScan, is currently helping clients tackle vulnerabilities of this magnitude. It can swiftly identify issues and provide the necessary remedial actions. If you want to learn more about SmartScan, get in touch here 👉 https://lnkd.in/eU7heD49 #VulnerabilityManagement #CyberSecurity  #RiskManagement

4

European Central Bank publish paper 'Adopting TIBER-EU will help fulfil DORA requirements' #DORA sets out a number of requirements for threat-led penetration testing #TLPT. This paper outlines how the European framework for threat intelligence-based ethical red teaming – the TIBER-EU framework – can help competent authorities and financial entities fulfil those requirements. View paper here https://lnkd.in/eE_TScZ7

3

The domain name registry of Andorra, which operates the .ad TLD (top-level domain, or domain extension) has recently announced that registration restrictions are to be lifted later this year. Previously, registration of .ad domains was only possible to Andorran brands or organisations, looking to register their own name as a domain name. From the 22nd October 2024, the domains will be offered in General Availability, with any entity able to register an available domain, on a first-come, first-served basis. The .ad extension has the potential to be used in a generic capacity, with ‘.ad’ used to refer to advertisements or advertising. It will be interesting to see how quickly the number of registrations grows, and how the patterns of use, abuse and infringement emerge. It is possible that the extension may become extensively associated with advertising fraud. David Barnett explains why brands should secure key or defensive registrations as early as possible, and monitor the space for developments... https://lnkd.in/ewZq676h #domains #TLDs #brandprotection

7

🚨Medium Risk Vulnerability🚨 in OpenImageIO! CVE-2024-40630 is an information disclosure vulnerability due to a bug in the HEIF input functionality. Users are advised to upgrade to the 2.5.13.1 release. This highlights the importance of keeping software up to date to prevent exploitation of known vulnerabilities. #OpenImageIO #Vulnerability #OWASP #InfoSec https://lnkd.in/eAVyiNkR

1

🚨 𝐔𝐧𝐜𝐨𝐯𝐞𝐫 𝐭𝐡𝐞 𝐇𝐢𝐝𝐝𝐞𝐧 𝐃𝐚𝐧𝐠𝐞𝐫𝐬 𝐢𝐧 𝐎𝐩𝐞𝐧 𝐒𝐨𝐮𝐫𝐜𝐞: 𝐀 𝐌𝐮𝐬𝐭-𝐑𝐞𝐚𝐝 𝐒𝐞𝐫𝐢𝐞𝐬 𝐟𝐨𝐫 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐏𝐫𝐨𝐟𝐞𝐬𝐬𝐢𝐨𝐧𝐚𝐥𝐬🚨https://lnkd.in/dU8CBHyD Open-source software is a cornerstone of modern development, but it comes with hidden risks. From malicious packages to ineffective protection methods, understanding these threats is crucial for any organization. Our CTO, Luis Rodríguez, has authored a comprehensive series that dives deep into the problem, explores the latest trends, and offers practical solutions to protect your systems. Swipe through our carousel to explore each part of the series, and click to read more: 1️⃣ The Problem: Open Source Malicious Packages 2️⃣ Anatomy of Malicious Packages: What Are the Trends? 3️⃣ Protecting Against Open Source Malicious Packages: What Doesn’t Work 4️⃣ The Xygeni Approach: Effective Protection Against Malicious Packages Stay ahead of the curve—don't let malicious packages compromise your security. Dive into the series now! ➡ https://lnkd.in/dU8CBHyD #OpenSource #CyberSecurity #SafeDevTalks #DevOps #InfoSec #OSS #Hacking #CyberThreats #Malware #AppSec #DevSecOps #ThreatDetection #DataSecurity #CyberProtection #MalwareProtection #ASPM

6

Mandos Encrypted File System Unattended Reboot Utility 1.8.18: The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.

1

A recent report by Akami experts highlights a troubling trend: the exploitation of a five-year-old zero-day vulnerability in end-of-life IP cameras by the Corona Mirai-based malware botnet. This blog delves into the details of this issue, its implications, and the broader lessons it offers for cybersecurity. The specific target of this malware campaign is AVTECH IP cameras, which have been out of support since 2019. These cameras are no longer receiving security patches, making them prime targets for cybercriminals. The vulnerability in question is a remote code execution (RCE) zero-day, which allows attackers to inject malicious commands into the camera’s firmware via the network. This particular exploit leverages the ‘brightness’ function in the camera’s firmware, a seemingly harmless feature that has become a gateway for malicious activity. The Corona Mirai-based malware botnet is a variant of the infamous Mirai botnet, which has been responsible for some of the most significant distributed denial of service (DDoS) attacks in recent history. By exploiting the RCE vulnerability in AVTECH IP cameras, the malware can gain control over these devices, adding them to its botnet. Once compromised, these cameras can be used to launch DDoS attacks, overwhelm networks, and disrupt services. https://lnkd.in/g6cJk8XG

1