Michel A.

Discover how Thales is using the #TIBER framework, the gold standard for #Red_Team testing, to enhance cybersecurity resilience. Don't miss out on this essential read! https://lnkd.in/e-B77f-D #Cybersecurity #TIBER #RedTeam

21

🚀New CSS Cyber Defense Report ! CSS Senior Researcher Clémence Poirier just published “Hacking the Cosmos: Cyber operations against the space sector. A case study from the war in Ukraine” After crawling through hundreds of hacktivist groups’ Telegram channels and Twitter accounts, the report mapped 124 cyber operations which targeted the space sector in the context of the war in Ukraine. This report provides an overview of the types of attacks that affected the space sector, investigates the various groups that carried out operations, analyzes how they behave, and what it means for the global space cyber threat landscape. The report is available here: https://ow.ly/HUQW50TEigU

49

The “cryptoprocrastination” excuses to prepare for the transition to quantum-safe cryptography are over after NIST’s publication of the new standards on #PostQuantumCryptography. How to discover and take control of your organization’s cryptography? Start with our #SanExperts 👉 Jaime Gómez García, Head of Quantum at Santander, has prepared a quick guide to inventory your TLS cryptography with minimal code and tools 🧙‍♂️✨ Article on our #BeTech blog 👉 https://lnkd.in/dBs5mJBr #BeTechwithSantander #SanExperts #Cryptography

27

2 commentaires

It’s official! ISF World Congress 2024 has begun! Following tradition, today’s opening sessions were all presented by the ISF team, covering a range of cybersecurity topics focusing on both the here and now, as well as the future. Starting the day, ISF principal analyst Benoit Heynderickx delivered an informative and interactive session that highlighted recent changes to the ISF Standard of Good Practice for Information Security (SOGP 2024), demonstrating how to build and deploy the right mix of technical and business controls. Meanwhile, ISF analyst Mark Ward ran interactive workshops around Threat Horizon, revealing the trends and themes that will feature in the highly anticipated report. This theme of exploring the future was followed up by Wilson Bell who shared guidance on how to position your organisation’s future security posture. Principal consultant, Niko Kalfigkopoulos and director of services, Jean-Michel Chapon tackled a subject many security professionals struggle with – effectively engaging with the board. Highlighting the potential benefits and pitfalls of increasing the board’s awareness of cyber risks, and how to advance cyber agendas with senior stakeholders. To end the day, our Women in Cyber session, featuring Shreya Tiwari, Francesca Williamson and Olena Shumska began with a panel of distinguished female leaders who discussed actionable ideas around supporting gender diversity in the workplace, gender blindness, and initiatives for addressing gender imbalance in the industry. Stay tuned for day two! Attendance at Congress is complimentary for ISF Members. Not a Member? Get in touch to find out more: https://bit.ly/3NMfVjX #ISFWorldCongress #Orlando2024 #CyberSecurity #InformationSecurity #CISO

88

4 commentaires

🚨Here is a great discovery of a very interesting repository around a SOC based on 4 Open Source tools: 👉Wazuh: Real-time monitoring and alerting for security events. 👉DFIR-IRIS: Streamlined incident response and forensics capabilities. 👉Shuffle: Automated workflow management to streamline security processes. 👉MISP: Open source threat intelligence platform. ✅T-Guard - Nusantara ✔Verified link to the official repository 🔗https://lnkd.in/eRw6y3Ts ⚙As a reminder, T-Guard is a solution around a SOC that leverages the strength of leading open-source tools to provide solid protection for your digital assets. 🤝The integrated approach ensures comprehensive defense against a wide range of cyber threats, making your systems and data safer and more secure. ✅Complete documentation (installation, configuration) ✔Verified link to the official page 🔗https://lnkd.in/eSwQwYAc 🖼Image Source: https://lnkd.in/emmNMJcg 👨 💻Set up your Labs and have fun!! #soc #opensource #security #cybersecurity #blueteam

6

We're proud to announce that S21sec joins the CVE Program as CNA Researchers and will seek to improve cybersecurity through the discovery, assignment and publication of CVEs (Common Vulnerabilities and Exposures).

11

French State services hit by intense cyberattacks In a shocking turn of events, several French 🇫🇷 ministerial services have been targeted by a series of intense cyberattacks ☠️ as reported by the Prime Minister’s office. This comes just hours before the opening ceremony of the Olympic Games in Paris, a crucial moment for the nation 📍 The National Society of French Railways 🚇 (SNCF) announced a massive cyberattack against its high-speed trains, urging travelers to postpone their trips. This attack 😰 aimed to paralyze the high-speed train network, leading to numerous diversions and cancellations. SNCF confirmed that the network was subjected to simultaneous malicious acts, including intentional fires that damaged facilities across three lines. 👉🏻 At Aiuken Cybersecurity, we are committed to protecting our clients against such sophisticated threats. This incident 🚨 highlights the urgent need for robust cybersecurity measures to safeguard critical infrastructure and national security. Let’s work together 🤝 to enhance our cybersecurity defenses and ensure a safer digital environment 👉🏻Protected your company 👉🏻Train your staff #CyberSecurity #DDoS #AiukenCybersecurity #FrenchRailways #CyberAttack

20

🔒 Are you looking for the ultimate solution to safeguard your digital infrastructure against sophisticated cyber threats? Discover our Product of the Week: Virtual Dissimulated Encrypted Server (VDES) equipped with Post Quantum Cryptography Kyber-1024 (NIST Security Level 5). In an era where cyber threats are becoming increasingly sophisticated, protecting your servers is more critical than ever. VDES is designed to obfuscate the real endpoint IP address of your landing server, making your digital assets virtually invisible to external scans and cyber attacks. It acts as a traffic redirector, creating encrypted tunnels over private IP schemes and rerouting traffic securely to your destination IP platform. Key features of VDES include: • Obfuscated Endpoints: Conceals the real IP address of your destination server, blending seamlessly with cyberspace noise. • Quantum-Resistant Security: Utilizes Kyber-1024, providing cutting-edge post-quantum cryptography protection. • Minimal Exposure: Only two open ports visible to outside cyber scans, reducing vulnerability. • No Proprietary Signatures: Appears as a generic web server, enhancing anonymity. By employing VDES , your servers not only become non-routable objects within the cyber ecosystem but also benefit from the highest level of encryption available. Embrace the future of cyber defense and ensure your infrastructure remains secure against even the most advanced threats. #CyberSecurity #QuantumEncryption #VDES  #TechInnovation #NetworkSecurity https://lnkd.in/etPkrmHc

1

🔒 Important Security Update: New Remote Code Execution Vulnerability in OpenSSH Discovered 🔒 Cybersecurity alert 🚨: During an analysis of the regreSSHion vulnerability (CVE-2024-6387) in OpenSSH, a second remote code execution flaw has been identified. This new vulnerability, tracked as CVE-2024-6409, was discovered by Alexander Peslyak, aka Solar Designer, founder of Openwall. Here’s what you need to know: CVE-2024-6409 is a race condition in signal handling involving the ‘privsep’ child process. While the impact is lower due to reduced privileges of the ‘privsep’ child process, exploitation in specific scenarios could make it an attractive choice for attackers. No successful exploitation of CVE-2024-6409 has been proven yet, but patches and advisories are being released by impacted Linux distributions. Microsoft has confirmed that Windows systems are not affected, and macOS is also believed to be largely unaffected, pending an official statement from Apple. 🔧 Action Items: Check for and apply patches provided by your Linux distribution to mitigate this vulnerability. Stay updated with security advisories from your OS vendors. Regularly monitor your systems for unusual activity and potential exploitation attempts. Stay secure, and let’s keep our systems safe! #CyberSecurity #OpenSSH #Vulnerability #InfoSec #RemoteCodeExecution #Linux #Windows #macOS #SecurityUpdate

2

🚨 #SecurityAlert: Critical OpenSSH Vulnerability 🚨 Heads up, tech leads and security professionals! The Premier Ministre S.G.D.S.N and the French National Agency for the Security of Information Systems (ANSSI – Agence nationale de la sécurité des systèmes d'information) have issued an urgent security warning: Bulletin CERTFR-2024-ALE-009. 🔴 A critical security flaw has been reported in OpenSSH (CVE-2024-6387), affecting versions from 8.5p1 to 9.7p1. Attackers can exploit this to execute arbitrary code remotely with root privileges on susceptible systems — particularly alarming for Linux 32-bit systems with glibc and ASLR enabled. The timeframe for exploitation? An attacker needs about 6-8 continuous hours of connections. With ASLR disabled, the time could be even shorter. 🛑 The vulnerability was flagged and dissected by the eagle-eyed researchers at Qualys. Check out their blog post for an insightful deep-dive into the issue. ⏰ If your logs show repeated "Timeout before authentication" entries, take note — it’s a sign of attempted exploit. What can you do? Until patches are out, Qualys recommends setting the LoginGraceTime parameter to 0 to block the vulnerability — though be aware this exposes the system to potential Denial of Service (DoS) attacks. 🔗 Relevant links for the security advisories are provided: - OpenSSH Security Advisory: https://lnkd.in/g7yguR_N - CERT-FR Security Advisory: https://lnkd.in/eFFjFsPn - Qualys Blog Post: https://lnkd.in/g53zkeXv 💡 Stay ahead by following security updates from your distro — Look out for patches referenced in Debian Security Tracker and Red Hat CVE: - Debian Security Tracker: https://lnkd.in/e9cRa8vY - Red Hat CVE: https://lnkd.in/ee3X95n4 ⚔️ Protect your assets. Act swiftly. #CyberSecurity #OpenSSH #Vulnerability #CVE20246387 #InfoSec #PatchManagement #LinuxSecurity LinkedIn fam, spread the word! Ensuring security is a team effort. Share this post with your network and help prevent unwanted system intrusions.

1

The CYBER THREAT OVERVIEW 2023 Report by ANSSI - Agence nationale de la sécurité des systèmes d'information! Share and follow Threat Intelligence Lab!

39

1 commentaire

[Focus on a European project 🇪🇺] DYNAMO Horizon Europe project 101069601: combines Cyber-Threat Intelligence (CTI) and Business-Continuity Management (BCM) to generate a situational awareness picture for decision support and help avoid systemic collapse caused by cyberattacks in critical sectors (Energy, Healthcare and Transport).    💡 As part of this project, IRT SystemX leads the definition of evaluation criteria and contributes to validating the DYNAMO AI-solution and resilience assessment solutions. SystemX is also a leader in developing privacy-preserving techniques for Cyber Threat Intelligence (CTI). It also provides access to and usage of the CHESS environment instantiating the DYNAMO framework in the case study locations.    🤝 A positive project carried on with Fraunhofer-Gesellschaft, TECHNIKON Forschungs- und Planungsgesellschaft mbH, Centre for Research & Technology Hellas (CERTH), Factor Social, Laurea University of Applied Sciences, NAVAL GROUP, Center for Security Studies (KEMEA), KPMG, VisionSpace, Telelink Business Services , Fondazione Policlinico Universitario Agostino Gemelli IRCCS, RHEA Group, Cork University Business School, Laborelec 🔗 Read more: https://lnkd.in/e-PNCJJq   🇪🇺 The DYNAMO project has received funding from the European Union’s Horizon Europe research and innovation programme under grant agreement No. 101069601. 

19

2 commentaires

Remote acquisition can be challenging whether it is because of the remote host goes offline or if the available bandwidth is limited. On May 8, join us for a webinar where Jean-François Brouillette will explore different #RemoteAcquisition scenarios based on real-world cases: https://ow.ly/52VI50Rytjl #DFIR

26

CVE-2024-3661 - CVSS 8.8 - EPSS We don't have an EPSS score for this CVE yet - By design, the DHCP protocol does not authenticate messages, including for example the classless static route option (121). An attacker with the ability to send DHCP messages can manipulate routes to redirect VPN traffic, allowing the attacker to read, disrupt, or possibly modify network traffic that was expected to be protected by the VPN. Many, if not most VPN systems based on IP routing are susceptible to such attacks. Ref.1: https://lnkd.in/eXEskBcn Ref.2: https://lnkd.in/e_KwDMtH

1

How attackers exploit SQL injection to bypass authentication and access sensitive data and how to protect against it ❓ SQL injection (SQLi) is a critical vulnerability that allows attackers to manipulate a database by injecting malicious SQL queries. One of the most dangerous applications of SQLi is in bypassing authentication mechanisms, which can lead to unauthorized access to user accounts, including administrative ones, exposing sensitive data. How SQL injection bypasses authentication❓ Web applications often authenticate users by checking their credentials (like username and password) against stored values in a database. In vulnerable applications, user inputs are embedded directly into SQL queries without proper validation or sanitization. This allows attackers to input specially crafted statements that alter the SQL query's logic, bypassing the authentication process altogether. For instance, an attacker could manipulate a login form by injecting specific input that tricks the query into always returning a valid result, regardless of the actual credentials. This would grant unauthorized access to any account, potentially leading to severe data breaches and even full control of the application. How to protect against SQL injection ❓     ->  A fundamental defense against SQL Injection is ensuring that user inputs are handled as data, not part of the SQL query. Using prepared statements or parameterized queries effectively separates user inputs from executable SQL commands, making it impossible for attackers to inject malicious code into the query.    ->  Another important practice is to sanitize and validate all user inputs. Inputs such as usernames and passwords should be checked against a strict set of rules, ensuring that only legitimate data is accepted. This adds an extra layer of defense, preventing any unintended or harmful inputs from being processed by the application. -> Secure by Design is a proactive way to minimize vulnerabilities, including SQL injection. Here are a couple of key practices: -->  Limit the permissions granted to the application’s database account. By restricting access to only the necessary data and functions, even if an attacker manages to exploit SQLi, the damage they can cause will be limited. -->  Avoid exposing detailed database error messages to users. These messages can give attackers valuable information about the structure of the database, making it easier to craft more effective SQLi attacks. Start applying Secure by Design principles to make your code more secure and reduce vulnerabilities from the start.   Contact us for more details and advanced techniques on how Secure by Design can help you build stronger, more resilient applications. www.cybalgoris.com www.cybernoe.com

9