Michel A.

New Post: #CISA and @FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory #Traversal Vulnerabilities - https://lnkd.in/dAir6seU CISA and FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory Traversal Vulnerabilities 05/02/2024 02:00 PM EDT Today, CISA and the Federal Bureau of Investigation (FBI) released a joint Secure by Design Alert, Eliminating Directory Traversal Vulnerabilities in Software. This Alert was crafted in response to recent well-publicized threat actor campaigns that exploited directory traversal vulnerabilities in software (e.g., CVE-2024-1708, CVE-2024-20345) to compromise users of the software—impacting critical infrastructure sectors, including the Healthcare and Public Health Sector. Additionally, this Alert highlights the prevalence, and continued threat actor exploitation of, directory traversal defects. Currently, CISA has listed 55 directory traversal vulnerabilities in our Known Exploited Vulnerabilities (KEV) catalog. Approaches to avoid directory traversal vulnerabilities are known, yet threat actors continue to exploit these vulnerabilities which have impacted the operation of critical services, including hospital and school operations. CISA and the FBI urge software manufacturer executives to require their organizations to conduct formal testing to determine their products’ susceptibility to directory traversal vulnerabilities. For more information on recommended principles and best practices to achieve this goal, visit CISA’s Secure by Design page. To catch up on the publications in this series, visit Secure by Design Alerts. Robert Williams#News247WorldPress

1

AI Coding Assistants are great for boosting productivity but it's not risk free! Read more about the associated risk and how to mitigate them.

9

🇷🇺 In a new report, ANSSI - Agence nationale de la sécurité des systèmes d'information (CERT-FR) details cyberattacks targeting French diplomatic entities attributed to the #Nobelium (#APT29) intrusion set, which has been active since at least October 2020, primarily for espionage. Western diplomatic entities, such as embassies and Ministries of foreign affairs, are the most known victims of #Nobelium. However, several IT companies have also reported being targeted by #Nobelium’s operators in late 2023 and 2024. Different sources have publicly linked the #Nobelium intrusion set to the Russian #SVR. ➡ https://lnkd.in/e5WDjGAq IOCs: https://lnkd.in/eXH6GzGY

60

New feature in TaskForce 2024.6! 🎉 With the new TaskForce update, you can combine various ports into a group in Express mode. Each group has different settings of target folder, file format, type of hash to calculate, and case report fields. #dfir #digitalforensics #forensicimaging

13

A Malicious Package != A Vulnerability! Served as a public service. A common misconception I often encounter is the treatment of a malicious package as if it were a vulnerability. This assumption is flawed for several reasons: 1️⃣ A malicious package does not necessarily indicate the presence of a vulnerability. 2️⃣ Unlike a vulnerability, which may arise from carelessness, lack of knowledge, or a logical flaw in the implementation, a malicious package requires malicious intent! 3️⃣ A malicious package usually contains a malicious payload, in a sense making it more akin to malware than a vulnerability. Therefore, if a malicious package is identified in your environment, you should assume compromise and initiate incident response protocols. Simply removing the malicious package after a compromise does not "fix" the problem! 4️⃣ It’s crucial to recognize that a malicious package is often just a symptom. The real threat is the malicious actor behind it. As an industry, our goal should be to stop these actors. Also note that there are different types of malicious packages: 💥 Packages originally created with malicious intent. Attackers may use techniques like typosquatting or spoofing reputation to deceive users into deploying these packages. 💥 Benign packages that become compromised at some point in their lifecycle, possibly by a "malicious" maintainer injecting harmful behavior into the source code or by an adversary compromising the software delivery lifecycle. A recent example is the latest xz attack. Lastly, be aware that there is currently a significant gap in the documentation and tracking of malicious packages. While CWE includes a category for Embedded Malicious Code (CWE-506), it is seldom used (only about 50 such cases are recorded in the NVD). Only a small fraction of malicious packages are assigned CVE IDs which means standard vulnerability scanners will fail to identify them. While IMO tracking these packages is essential, since we established that a malicious package differs fundamentally from a vulnerability, a CVE assignment isn't necessarily the answer (I'll expand on that in a different post). While last year alone over 250K malicious packages were identified, currently the most comprehensive data source for malicious packages is the OSV ‘-MAL’ index, which contains approximately 18,300 entries. #SoftwareSupplyChain #VulnerabilityManagement #RiskManagement #CyberSecurity

121

33 commentaires

Great summary here from Marcel on the distinctions between ISO 27001 and NIS2 compliance. As we dive deeper into these frameworks, it’s clear that while ISO 27001 sets a foundation, NIS2 brings added rigor, especially around areas like MFA and incident response. In a landscape where cyber threats constantly evolve, starting with ISO 27001 is a great first step but we can’t stop there. Committing to continuous improvement and assessing our maturity in these critical areas is essential. For anyone working toward NIS2 compliance, this journey requires strategic prioritization together with a long-term view.

4

"These claims and their freshness are among the observable elements allowing to estimate the impact of Cronos and the Alphv exit-scam on the cybercriminal ecosystem of  ransomware. Added to this are the cross-claims. These claims – or  crossclaims  in English –  essentially reflect  a  cyberattack  conducted by the same actor using two banners to conduct its activities: ransomware franchises are increasingly used as simple brands, smokescreens  behind which the affiliates hide. Recently, Anastasia Sentsova, an analyst at Analyst1 looked into the subject as part of an  investigation into RansomHouse." A great analysis by Valery Rieß-Marchive on the aftermath of #OperationCronos and the role of crossclaims in ransomware. Read here 👇 https://lnkd.in/eWF67gmt

17

I'm sharing our published paper that discusses the European approach (eIDAS) to regulate the WebPKI compared to the current practices applied by WebPKI industry. The paper shows that both approaches have their own limitations and advocates for the explicit definition of the validator role, which should be removed from Web browsers and instead be selected by web users based on the trust they have in the validator.

18

Did you deploy advanced email filtering capabilities ? Not the useless cloud defaults. "Nespress-Oh No! Phishing Attack Exploits Nespresso Open Redirect Vulnerability" This blog post delves into how a Nespresso domain is being misused to redirect victims, urging urgent actions leading to the theft of Microsoft credentials. connected=hacked #cybersecurity #phishing

22

6 commentaires

I am excited to announce that our paper "𝐔𝐧𝐜𝐨𝐯𝐞𝐫𝐢𝐧𝐠 𝐀𝐭𝐭𝐚𝐜𝐤𝐬 𝐚𝐧𝐝 𝐃𝐞𝐟𝐞𝐧𝐬𝐞𝐬 𝐢𝐧 𝐒𝐞𝐜𝐮𝐫𝐞 𝐀𝐠𝐠𝐫𝐞𝐠𝐚𝐭𝐢𝐨𝐧 𝐟𝐨𝐫 𝐅𝐞𝐝𝐞𝐫𝐚𝐭𝐞𝐝 𝐃𝐞𝐞𝐩 𝐋𝐞𝐚𝐫𝐧𝐢𝐧𝐠" has been accepted for publication in the 𝘐𝘌𝘌𝘌 𝘐𝘯𝘵𝘦𝘳𝘯𝘢𝘵𝘪𝘰𝘯𝘢𝘭 𝘊𝘰𝘯𝘧𝘦𝘳𝘦𝘯𝘤𝘦 𝘰𝘯 𝘋𝘢𝘵𝘢 𝘔𝘪𝘯𝘪𝘯𝘨 (𝘐𝘌𝘌𝘌 𝘐𝘊𝘋𝘔)! (𝘵𝘰 𝘢𝘱𝘱𝘦𝘢𝘳 𝘪𝘯 𝘋𝘦𝘤𝘦𝘮𝘣𝘦𝘳 2024): https://lnkd.in/e6Dj9nYt ---- Abstract: Federated learning enables the collaborative learning of a global model on diverse data, preserving data locality and eliminating the need to transfer user data to a central server. However, data privacy remains vulnerable, as attacks can target user training data by exploiting the updates sent by users during each learning iteration. Secure aggregation protocols are designed to mask/encrypt user updates and enable a central server to aggregate the masked information. MicroSecAgg (PoPETS 2024) proposes a single server secure aggregation protocol that aims to mitigate the high communication complexity of the existing approaches by enabling a one-time setup of the secret to be re-used in multiple training iterations. In this paper, we identify a security flaw in the MicroSecAgg that undermines its privacy guarantees. We detail the security flaw and our attack, demonstrating how an adversary can exploit predictable masking values to compromise user privacy. Our findings highlight the critical need for enhanced security measures in secure aggregation protocols, particularly the implementation of dynamic and unpredictable masking strategies. We propose potential countermeasures to mitigate these vulnerabilities and ensure robust privacy protection in the secure aggregation frameworks. ---- Congratulations to Yiwei Zhang for this great work! Special thanks to Dr. Rouzbeh Behnia for uncovering the attack, and many thanks to Dr. Reza Ebrahimi and Dr. Elisa Bertino for their support. #AI #federatedlearning #cybersecurity #research

68

9 commentaires

The telecommunications sector is being hacked by aggressive nation states (this time China's Salt Typhoon group). The National Security Agency, Cybersecurity and Infrastructure Security Agency, and Federal Bureau of Investigation (FBI) have jointly published an alert outlining good basic security principles for the communications sector. I emphasize basic, because telcos and all other critical infrastructure heavyweights should already be doing the basics! If the NSA, CISA, and FBI need to reiterate this information to telcos, it highlights a problem that many aren't consistently adhering to fundamental #cybersecurity practices which should have been in place for more than a decade!

24

1 commentaire

➡️ Based on some of the phishing kits harvested by StalkPhish.io last week, here are 5️⃣ new PhishingKit Yara Rules: Rules for detection of #phishing kits targeting customers of: ✅ Kraken Digital Asset Exchange ✅ Société Générale ✅ ANTAI - Agence nationale de traitement automatisé des infractions ✅ Telstra ✅ Microsoft Office365 👉 Use these rules for a better detection of #phishing threats targeting your brand. -- 📩 Contact and follow us if you need help fighting hashtag #phishing and #brand impersonation... we have tools, data and knowledge to help!

7

⚠ More on the Importance of ISO/IEC TS 12791:2024⚠ Many of you saw Adam Leon Smith DEng FBCS's post yesterday commenting on the release of ISO’s new technical specification (TS) document for the treatment of unwanted bias in certain AI systems. I don’t think everyone realizes what a big deal this really is, so today I thought we might explicate it a bit more. The primary goal of ISO/IEC TS 12791:2024 is to offer a structured approach for managing unwanted #bias in machine learning (ML) systems, with a specific focus on classification and regression tasks. It outlines practical methods to identify, assess, and address bias at each stage of the AI lifecycle, ultimately supporting ethical AI practices that yield fair and accurate outcomes. ➡Applicability This specification applies to organizations of all sizes and types that develop, implement, or operate AI systems, particularly those deploying ML models for classification and regression tasks. It’s useful across various verticals where AI-driven decisions impact individuals and groups, such as finance, healthcare, and public services. ➡Technical Aspects 🔶 ISO/IEC TS 12791 outlines methods to address unwanted bias in several AI lifecycle stages: 1. Inception and Stakeholder Identification - Emphasizes understanding diverse stakeholder perspectives, which helps identify and address potential biases early. 2. Design and Development - Provides guidance on selecting features and handling metadata to prevent and mitigate biases. 3. Verification and Validation - Recommends both static and dynamic testing to ensure the AI system performs consistently across diverse groups, supporting fairness and accuracy. 4. Continuous Monitoring and Re-evaluation - Mandates ongoing oversight to detect bias over time, especially when external conditions change. 5. Bias Treatment Techniques - Suggests data and algorithmic adjustments to reduce bias impact, including training adjustments, feature balancing, and use of diverse datasets. ➡ Supporting AI Governance via #ISO42001 For organizations implementing ISO42001 (AIMS), ISO/IEC TS 12791 serves as a key resource to meet your governance requirements related to fairness and non-discrimination in AI. Specifically: ✅Alignment with Risk Management (Clause 6): The standard’s focus on proactive bias identification and mitigation supports ISO42001's risk-based approach by managing bias as a potential risk factor. ✅Transparency and Accountability (Clause 7.5): Documenting bias mitigation steps fulfills ISO42001’s transparency requirements, ensuring that bias-related decisions are recorded and traceable. ✅Stakeholder Engagement (Clause 4.2): By identifying and considering stakeholders impacted by bias, organizations can enhance alignment with ethical AI governance, fostering trust and inclusivity. Special thanks to Deniz Celikkaya for coaching on today's article. A-LIGN #TheBusinessofCompliance #ComplianceAlignedtoYou 🌐 https://lnkd.in/gFpvrndX

104

6 commentaires

👉 According to PSD3 specialists (I'm just a "techie" 😉), Confirmation of Payee becomes mandatory across the EU, requiring PSPs to notify users of any discrepancy between payee name and account details.(p16) 👈 AFAICT, this will effectively also disable the use of a phone number as sole Payee indicator. It is (about) time to reconsider this primitive scheme. For entirely local P2P payments, Apple have showed that you need no ID at all! For remote P2P payments which have proved to be rather susceptible to fraud, Payees should IMO provide a Payer-bank-verifiable Payee-bank-URL, permitting the Payer to access core Payee data like account id, common name, email address and/or phone number BEFORE hitting the transfer button. This information would then (of course) also be included in the transfer request. Not exactly 🚀 science, we can surely do that!

6

4 commentaires

** Thank you all for your insights on our latest research. We're currently revising the blog post and adding further clarification and any missing information based on feedback from the community and our latest review*** 🚨 Dear Security Engineers / AppSec people Uri Aronovici discovered a new attack where threat actors can exploit widely-used external Terraform providers to gain full control of a cloud production environment. Why you should care about it ? 📍 Most SAST / SDLC processes are not catching it 📍 There are many ways to exploit it 📍 There are few ways to detect it while it happens #terraform #cloudsecurity #appsec #riskmanagement

86

22 commentaires