Danielle Aminov

Data Breach Alert ☣  - Alleged data sale of Harel Group Threat actor claims to be selling the data of Harel Group, the largest insurance group in Israel. The leaked data reportedly contains 1.8 million records, including names, identity card numbers, dates of birth, addresses, cities, zip codes, phone numbers, and more. - #data_breach #data_leak #infosec #dark_web #DataBreach  #DataLeak  #Services  #CyberThreat  #CyberAttack

29

2 תגובות

🚀 CTI Workshop at BSides Athens 2024! 🚀 🧱 "Block By Block: Building Your CTI Program" 🧱 Join me on June 29, 2024, for a 2-hour workshop designed to simplify the complexities of Cyber Threat Intelligence (CTI) and provide a clear roadmap to develop your own CTI program. 🔍 What will you gain? - Understand the foundational principles of CTI and its critical role in cyber threat management. - Learn the steps to initiate a CTI program and integrate it seamlessly into your business processes. - Discover practical strategies for quick wins and establishing core CTI capabilities. - Explore how to leverage technology to empower your CTI efforts, enhance the skills of CTI analysts, and use maturity models to measure and boost your program's effectiveness. 🎯 Who should attend? - Cybersecurity professionals at any stage of CTI implementation, from those considering starting a program to those refining an existing one. - Business leaders looking to understand how CTI can safeguard and add value to their operations. 📅 Mark Your Calendar! Date: June 29, 2024 Event: BSides Athens 2024 Session: Block By Block: Building Your CTI Program Don’t miss this chance to transform your approach to cyber threat intelligence. Whether you're starting from scratch or scaling up, this workshop will arm you with the insights and tools you need to succeed. 🔗Link to BSides Athens 2024 Agenda -https://lnkd.in/dFdV3J_H See you on Saturday! #BSidesAthens #CyberSecurity #CTI #ThreatIntelligence #InfoSec #threatintel #BSides #threatmanagement #cyberthreat #training #athens #greece

236

3 תגובות

🚨 Urgent Security Alert! 🚨 The Morphisec team, with special recognition to Arnold Osipov, Michael Gorelik, and Shmuel Uzan for their outstanding work, has discovered a critical vulnerability, CVE-2024-30103 in Microsoft Outlook. This zero-click remote code execution vulnerability poses a significant threat to organizations worldwide. We strongly urge all organizations to apply the patch released on June 11th to mitigate this risk. Join us at #DEFCON32 this year for our presentation, "Outlook Unleashing RCE Chaos: CVE-2024-30103" where we'll share technical details and a proof-of-concept (POC). Stay tuned for more insights, as we will be revealing additional RCE vulnerabilities once they are patched. Learn more about our team's discovery: https://bit.ly/45suUr9 #CyberSecurity #InfoSec #Morphisec #DEFCON #Outlook #RCE #VulnerabilityManagement

40

🔍 Rising Cyber Threats: Inside the Digital Tactics of Pro-Israel Groups 🔍 Our latest analysis highlights the diverse tactics used by pro-Israel groups in cyber operations, with key attack methods including: 💻 Website Defacement (44.8%): Groups supporting Israel may make unauthorized changes to the appearance or content of a targeted website. These changes are usually made to the site's homepage and include a page with the attackers' message or purpose. 🌐 DDoS Attacks (%29.9): Pro-Israel groups have been using Distributed Denial of Service (DDoS) attacks against Iranian online services. These attacks involve sending massive traffic to make targeted websites temporarily inaccessible. 🕵️‍♂️ Cyber Espionage and Information Collection (%10.4): Pro-Israel groups may engage in cyber espionage to collect sensitive data from specific individuals or organizations. ⚠️ Social Engineering and Ransomware (%7.5): Pro-Israel groups use social engineering tactics to achieve their goals. They may also use ransomware to harm their targets or steal information. 🎣 Phishing Attacks (%7.5): In some cases, pro-Israel organizations may resort to phishing attacks to obtain sensitive information from targeted groups or individuals. These findings underscore the broad and evolving nature of cyber threats posed by groups aligned with Israel. Stay informed and vigilant. For more insights, check out the full report 👉🏻 https://lnkd.in/eK_MWHeV #CyberSecurity #CyberThreats #DDoSAttack #WebsiteDefacement #CyberEspionage #Phishing #Ransomware #ProIsraelGroups #DigitalDefense #StaySafeOnline

28

Week in review: VMware ESXi zero-day exploited, SMS Stealer malware targeting Android users: Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Why a strong patch management strategy is essential for reducing business risk In this Help Net Security interview, Eran Livne, Senior Director of Product Management, Endpoint Remediation at Qualys and Thomas Scheffler, Security Operations Manager of Cintas Corporation, discuss their experiences with automated patch management. Securing remote access to mission-critical OT assets In this Help Net Security interview, Grant Geyer, … More → The post Week in review: VMware ESXi zero-day exploited, SMS Stealer malware targeting Android users appeared first on Help Net Security.

1

PTaaS VS BugBounty... PTaaS (Penetration Testing as a Service): ✅ Actively tackles the root cause of vulnerabilities ✅ Strives to find fewer issues over time Bug Bounties: ✅ Celebrate finding vulnerabilities ✅ Thrive on ever-growing bounty pots Which approach is more suitable for a lean security budget? #CyberSecurity #PTaaS #BugBounty #Infosec

22

3 תגובות

Another perfect example of the challenges in our CVE data/ecosystem: https://lnkd.in/e2kmCGin - Bug is difficult to reproduce, not clear whether it is exploitable anywhere at all - Bug was reported/discussed 6 years ago - CVE created 4 years ago - 3 years ago someone asks whether this was fixed - No activity since - CVE: Exists and gets reported by scanners.

5

Attacks on Israeli orgs ‘more than doubled’ since October 7, cyber researcher says. Key takeaways: 1. Cyberattacks on Israeli organizations, particularly those tied to defense, have surged dramatically since October 7. With an average Israeli organization experiencing more than 2,200 attacks each week, this points to a shift in geopolitical and cyber warfare strategies. 2. The majority of these cyberattacks are politically motivated, with involvement suspected from Iranian state-sponsored groups and Hezbollah, marking an evolution in these groups' tactics and a significant threat to nations' security infrastructure. 3. The scope of these attacks extends beyond Israel, with countries including the U.S., Canada, and the U.K. also targeted. This highlights the global nature of cybersecurity threats and the need for collective international actions to counter these advanced persistent threats. Learn more by visiting The Record from Recorded Future News: https://lnkd.in/eKUYWJCq

2

This is how responsible disclosure should work... This year at #blackhat2024 Alon Leviev revealed two zero-days, tracked as CVE-2024-38202 (https://lnkd.in/ePMEU9dm) and CVE-2024-21302 (https://lnkd.in/e8kYYmv4), which enable downgrade attacks that can "unpatch" fully updated systems of Windows 10, Windows 11, and Windows Server, reintroducing old vulnerabilities. 💻 How It Works: These downgrade attacks manipulate the Windows update process, tricking it into rolling back OS components such as DLLs and the NT Kernel to outdated versions, while still displaying the system as fully updated. This exposes systems to past vulnerabilities that had been previously patched. 🛡️ Impact: According to Leviev, this means "the term 'fully patched' is meaningless," as this undetectable attack makes even the most secure Windows machines vulnerable to thousands of past threats. Remarkably, this attack bypasses even UEFI locks on virtualization-based security features without needing physical access. ⏲️ Microsoft's Response: Microsoft has acknowledged these vulnerabilities and issued advisories with mitigation advice, but a permanent fix is still in the works, six months after being reported. #CyberSecurity #InfoSec #MicrosoftWindows #VulnerabilityManagement #responsibledisclosure

19

🔒 Mastering Endpoint Security - Best Practices for 2024 🔓 Join our Check Point CheckMates Webinar on Onboarding & Best Practices for Harmony Endpoint (This time in English 😉 ), where Yehonatan Cohen will share his expertise and will dive into the best practices for deploying, optimizing, and boosting your Endpoint security experience with Harmony Endpoint. 📆 When - July 31. 💥 Register here - https://lnkd.in/dEddEWwN #Harmony #EndpointSecurity #BestPractices Check Point Software

64

1 תגובה

I am thrilled to share that I have been recognized as one of the top contributors in the CVE category of Israel National Cyber Directorate - מערך הסייבר הלאומי for June. This is also a good time to remind everyone: If you find a vulnerability (whether it's a 0-day or a 1-day) in an Israeli digital asset exposed to the internet, there's one address to report it to help us protect the country in the cyber realm: [email protected]

26

5 תגובות

🔐 **Zero Standing Privileges & Just-in-Time Access: kezako ?** 🔐 In today’s rapidly changing threat landscape, organizations must remain vigilant to protect their most valuable asset: data. Two strategies gaining prominence in cybersecurity are **Zero Standing Privileges (ZSP)** and **Just-in-Time (JIT) access**. 🌐 **𝐙𝐞𝐫𝐨 𝐒𝐭𝐚𝐧𝐝𝐢𝐧𝐠 𝐏𝐫𝐢𝐯𝐢𝐥𝐞𝐠𝐞𝐬 (𝐙𝐒𝐏)**: ZSP eliminates permanent access privileges for all users, ensuring no one has unnecessary permissions that could be exploited. By applying the principle of least privilege and removing standing access, organizations minimize the risk of internal or external attackers exploiting dormant or overprivileged accounts. Access is only granted when absolutely necessary. Key benefits: - Drastically reduced attack surface - Elimination of unnecessary, lingering privileges - Enhanced control over sensitive resources ⏳ **𝐉𝐮𝐬𝐭-𝐢𝐧-𝐓𝐢𝐦𝐞 (𝐉𝐈𝐓) 𝐀𝐜𝐜𝐞𝐬𝐬**: JIT access works in tandem with ZSP, allowing users to acquire the privileges they need only when required, and for a limited period of time. This dynamic allocation of access ensures that no one has more permission than they need at any given time, drastically reducing the risks associated with privileged account compromise. Key benefits: - Reduced window for potential attacks - Minimized risk of privilege abuse - Compliance with least privilege principles Together, **ZSP** and **JIT** provide a powerful, risk-based approach to cybersecurity, significantly limiting opportunities for attackers to exploit access points. As organizations move deeper into digital transformation, embracing these strategies is not just a recommendation—it’s a necessity. 💡 How is your organization handling privileged access management? #Cybersecurity #ZeroStandingPrivileges #JITAccess #DataProtection #ITSecurity #DigitalTransformation #identitysecurity #cyberark

15

If you're interested in how a threat researcher from the Israeli NSA approaches SaaS Security, this is worth the short read. Nicely written, Tamar Cohen! #saassecurity #AIsecurity #Unit8200

11

🚨Critical Security Advisory: OpenSSH Remote Root (regreSSHion , CVE-2024-6387)🚨 All it takes is a leap of faith -- The Interrupters, "Leap of Faith" In complex systems, old bugs never truly die - they just hibernate. -- Anonymous LLM Qualys researchers discovered, successfully exploited, and disclosed critical vulnerability in OpenSSH's server (sshd), affecting versions 8.5p1 to 9.7p1 on glibc-based Linux systems. This vulnerability, a signal handler race condition, can lead to remote code execution with root privileges. Key Points: - Working exploits for older and current 32-bit OpenSSH versions - Regressing from a previous issue (CVE-2006-5051) fixed in 2006. - Affects default sshd configuration without authentication. - Exploitable on glibc-based Linux systems due to async-signal-unsafe functions in the SIGALRM handler. - Successful exploitation allows unauthenticated remote code execution as root. - 64-bit exploitation believed possible but not yet demonstrated. Immediate Action Required: - Update to OpenSSH 9.8p1 or apply suggested mitigations - Check your cloud provider for security notifications - Review systems logs for potential exploit attempts #CyberSecurity #OpenSSH #Vulnerability #LinuxSecurity For technical details and mitigation strategies, see: * Qualys Advisory: https://lnkd.in/dN_4Xpy8 * OpenSSH Release Notes: https://lnkd.in/dvT2Wibg The fact that regreSSHion is a regression of a 2006 fix is both fascinating and frustrating. More detailed analysis to follow.

57

Vulnerabilities will always exist. No software is perfect. Focus on rapid detection and remediation to minimize the window of exposure. #product #security #remediation #development

12