Gilles L.

Did you deploy advanced email filtering capabilities ? Not the useless cloud defaults. "Nespress-Oh No! Phishing Attack Exploits Nespresso Open Redirect Vulnerability" This blog post delves into how a Nespresso domain is being misused to redirect victims, urging urgent actions leading to the theft of Microsoft credentials. connected=hacked #cybersecurity #phishing

22

6 commentaires

A Malicious Package != A Vulnerability! Served as a public service. A common misconception I often encounter is the treatment of a malicious package as if it were a vulnerability. This assumption is flawed for several reasons: 1️⃣ A malicious package does not necessarily indicate the presence of a vulnerability. 2️⃣ Unlike a vulnerability, which may arise from carelessness, lack of knowledge, or a logical flaw in the implementation, a malicious package requires malicious intent! 3️⃣ A malicious package usually contains a malicious payload, in a sense making it more akin to malware than a vulnerability. Therefore, if a malicious package is identified in your environment, you should assume compromise and initiate incident response protocols. Simply removing the malicious package after a compromise does not "fix" the problem! 4️⃣ It’s crucial to recognize that a malicious package is often just a symptom. The real threat is the malicious actor behind it. As an industry, our goal should be to stop these actors. Also note that there are different types of malicious packages: 💥 Packages originally created with malicious intent. Attackers may use techniques like typosquatting or spoofing reputation to deceive users into deploying these packages. 💥 Benign packages that become compromised at some point in their lifecycle, possibly by a "malicious" maintainer injecting harmful behavior into the source code or by an adversary compromising the software delivery lifecycle. A recent example is the latest xz attack. Lastly, be aware that there is currently a significant gap in the documentation and tracking of malicious packages. While CWE includes a category for Embedded Malicious Code (CWE-506), it is seldom used (only about 50 such cases are recorded in the NVD). Only a small fraction of malicious packages are assigned CVE IDs which means standard vulnerability scanners will fail to identify them. While IMO tracking these packages is essential, since we established that a malicious package differs fundamentally from a vulnerability, a CVE assignment isn't necessarily the answer (I'll expand on that in a different post). While last year alone over 250K malicious packages were identified, currently the most comprehensive data source for malicious packages is the OSV ‘-MAL’ index, which contains approximately 18,300 entries. #SoftwareSupplyChain #VulnerabilityManagement #RiskManagement #CyberSecurity

121

33 commentaires

𝐍𝐈𝐒𝟐, 𝐞𝐈𝐃𝐀𝐒 𝐚𝐧𝐝 𝐎𝐭𝐡𝐞𝐫 𝐂𝐨𝐧𝐬𝐢𝐝𝐞𝐫𝐚𝐭𝐢𝐨𝐧𝐬 𝐟𝐨𝐫 𝐚 𝐂𝐨𝐦𝐩𝐫𝐞𝐡𝐞𝐧𝐬𝐢𝐯𝐞 𝐒𝐂𝐚𝐚𝐒 Strengthening Cybersecurity with NIS2 Beyond flagship regulations like MiCA or the GDPR, other texts shape the legal environment for SCaaS providers. Directive (EU) 2022/2555 on network and information systems security (NIS2) enhances cybersecurity for essential service operators, including some financial players. If SCaaS falls under NIS2’s scope, it must boost its capabilities in detecting vulnerabilities, responding to incidents, and coordinating with national authorities. This leads to better anticipation of cyberattacks, improved staff training, and the adoption of recognized technical standards. eIDAS: A Legal Guarantee for Transactions Regulation (EU) No 910/2014 on electronic identification and trust services (eIDAS) provides a framework for electronic signatures, strong authentication, and electronic seals. A SCaaS can leverage eIDAS to strengthen the integrity of stablecoin-related smart contracts. For example, using a qualified electronic signature to validate the creation of a token backed by euro reserves gives the SCaaS and its issuing client additional legal assurance. This electronic proof, potentially admissible in court, reduces litigation risks and facilitates regulator oversight. Completing the Regulatory Toolkit These texts, less publicized than MiCA or DORA, round out the regulatory landscape. The objective is to ensure maximum security and reliability across the stablecoin’s entire value chain. A diligent SCaaS will incorporate NIS2 requirements for cybersecurity by implementing advanced monitoring tools or subscribing to third-party audit solutions. It will use eIDAS to seal transactions with legal certainty, providing valuable legal security in an international context. A Coherent European Ecosystem The interplay of these rules creates a coherent European ecosystem. A SCaaS that complies with all these texts can claim regulatory excellence, a mark of credibility for institutional partners. An innovative start-up wishing to issue a stablecoin to streamline its supply chain will find that choosing a SCaaS adhering to NIS2, eIDAS, and other norms ensures a turnkey, robust, and secure solution. Innovation and Compliance, Hand in Hand Ultimately, integrating these additional regulatory considerations solidifies the position of SCaaS as essential players in the EU’s digital financial infrastructure. They help shape a market where innovation goes hand in hand with compliance and the protection of everyone’s interests. #NIS2 #eIDAS #SCaaS #Stablecoin #Cybersecurity #LegalCertainty #FinTech #Innovation #Regulation #EU

3

🚨Here is a great discovery of a very interesting repository around a SOC based on 4 Open Source tools: 👉Wazuh: Real-time monitoring and alerting for security events. 👉DFIR-IRIS: Streamlined incident response and forensics capabilities. 👉Shuffle: Automated workflow management to streamline security processes. 👉MISP: Open source threat intelligence platform. ✅T-Guard - Nusantara ✔Verified link to the official repository 🔗https://lnkd.in/eRw6y3Ts ⚙As a reminder, T-Guard is a solution around a SOC that leverages the strength of leading open-source tools to provide solid protection for your digital assets. 🤝The integrated approach ensures comprehensive defense against a wide range of cyber threats, making your systems and data safer and more secure. ✅Complete documentation (installation, configuration) ✔Verified link to the official page 🔗https://lnkd.in/eSwQwYAc 🖼Image Source: https://lnkd.in/emmNMJcg 👨 💻Set up your Labs and have fun!! #soc #opensource #security #cybersecurity #blueteam

6

"These claims and their freshness are among the observable elements allowing to estimate the impact of Cronos and the Alphv exit-scam on the cybercriminal ecosystem of  ransomware. Added to this are the cross-claims. These claims – or  crossclaims  in English –  essentially reflect  a  cyberattack  conducted by the same actor using two banners to conduct its activities: ransomware franchises are increasingly used as simple brands, smokescreens  behind which the affiliates hide. Recently, Anastasia Sentsova, an analyst at Analyst1 looked into the subject as part of an  investigation into RansomHouse." A great analysis by Valery Rieß-Marchive on the aftermath of #OperationCronos and the role of crossclaims in ransomware. Read here 👇 https://lnkd.in/eWF67gmt

17

Supply chain compromise. In this type of #cyberattack, criminals compromise vendors or service providers in order to attack their customers and partners. Here's how the attack unfolds and how Proofpoint detects and prevents these threats.

2

🚔 Last week, international law enforcement agencies conducted #OperationEndgame to takedown key malware infrastructures. The Sekoia #TDR team supported the French law enforcement agencies by providing valuable cyber threat intelligence, particularly on #PikaBot. ⚡ #PikaBot is a malware loader widely distributed since February 2023. Initial Access Brokers (IABs) use it to establish an initial foothold within a victim’s networks and distribute additional payloads such as #CobaltStrike and #Meterpreter. Our new #TDR report provides an in-depth analysis of #PikaBot's functionalities, distribution methods, internal structure, and countermeasures used to avoid detection. Additionally, it shares technical details on PikaBot C2 #infrastructure. ➡ https://lnkd.in/eN3MKPqS Thanks to Pierre & Quentin for the technical analysis!

65

Déformation professionnelle. One thing that I always find fascinating is the tendency people have to look at things from the point of view of their profession. Security professionals are no exception. The more security professionals I know, the more I find statistically relevant that the bests see the world differently. “We can’t help it”, as Bruce Schneier said in an old but ever-present blog post. And I do agree that if you don’t see the world that way, you’ll never notice most security problems. Full stop. 📖 https://lnkd.in/djQS6ZAP 📖 You can call it a distortion of the way one views the world (see Julia Bönisch in "Déformation professionnelle: Beruflich bedingte Missbildung") in a derogatory way, like “twisted-minded people”, and it’s true, if there’s no balance within the individual. However, that’s often only one side of the coin. After embracing a deep technological standpoint that unleashes your security thinking, it is likewise advisable to understand how technologies interact with the “bigger picture” and society at large, becoming a more mature security thinker. This kind of thinking is teachable and fully trainable, and I agree with Bruce about the benefits of having this mindset spread at community-level. For instance, if more people had a security mindset, services that compromise privacy wouldn’t have such a sizable market share. Time to draw conclusions? The security mindset is a valuable skill that everyone can benefit from, regardless of career path.

4

AI Coding Assistants are great for boosting productivity but it's not risk free! Read more about the associated risk and how to mitigate them.

9

Group-IB was able to infiltrate the ransomware-as-a-service group Cicada, gaining access to its affiliate panel to understand its inner workings. Ransomware-as-a-service is a cybercrime business model where ransomware operators write software that affiliates or threat actors can use while attacking a victim. Since June and October 2024, the notorious ransomware gang Cicada has stolen and published data from roughly 30 companies on their dedicated leak site with 24 of these victims being from the US and UK. Fortunately, in rare occasions, Group-IB, a cybersecurity company that builds tools to help fight digital crime, has managed to infiltrate the group’s affiliate platform and examine its inner workings. Here’s what threat intelligence analysts discovered: Cicada3301 started an affiliate program for ransomware as a topic on the underground dark web forum RAMP, Group-IB said. The topic said that the group was seeking pen-testers and advertisers. If someone was interested, they’d need to go through a “mini-interview” to be part of the affiliate program. Also, access to the affiliate platform should not be shared with anyone who is not already on the panel if it has not been approved previously. Cybercriminal affiliates would also receive a 20% portion of the total payout from its victims. A ransomware locker lets a cybercriminal lock a victim’s device. However, this is just one part of a ransomware attack, as once the device is locked and encrypted, the threat actor demands payment. According to Group-IB’s findings, “the locker is developed in Rust and utilizes ChaCha20 and RSA encryption.”... #cybersecurity #ransomware #threatintelligence

20

3 commentaires

Threat actors are extremely fast to exploit zero days on publicly exposed resources ! Don't let them take the advantage, make sure you master your SBOM (software bill of material) and that you patch timely ! "Massive PSAUX ransomware attack targets 22,000 CyberPanel instances" ⚠ Over 22,000 CyberPanel instances exposed online to a critical remote code execution (RCE) vulnerability were mass-targeted in a PSAUX ransomware attack that took almost all instances offline.⚠ connected=hacked #cybersecurity #psaux #patchmanagement https://lnkd.in/eyz49zpZ

11

** Thank you all for your insights on our latest research. We're currently revising the blog post and adding further clarification and any missing information based on feedback from the community and our latest review*** 🚨 Dear Security Engineers / AppSec people Uri Aronovici discovered a new attack where threat actors can exploit widely-used external Terraform providers to gain full control of a cloud production environment. Why you should care about it ? 📍 Most SAST / SDLC processes are not catching it 📍 There are many ways to exploit it 📍 There are few ways to detect it while it happens #terraform #cloudsecurity #appsec #riskmanagement

86

22 commentaires

You need overlapping security controls, because one control can be taken down, such as the EDR. "Ransomware gang deploys new malware to kill security software" Who's watching the watcher ? Well, hopefully your overlapping control ! That's called layered security, or security in depth. Oh, it's a very very basic of security. Who's watching the watcher. connected=hacked #cybersecurity https://lnkd.in/gAdUqWcR

20

1 commentaire