Tal Kollender

Cyber Attack Market Research 🔎 Understanding Modern Threats - How Cyber 2.0 Tackles New Security Challenges An analysis of the major threats in the market and how we enhance protection levels. 📽️ https://lnkd.in/dsXjNX74 Hertzel Ozer Victor Ruiz Guy Tessler Tatyana Sarel Tatiana Yamin Iana Hefer Asaf Almog Galit Abramov Sapir Sason Guy Dahan srikanth sai Tal Meister #ThreatAnalysis #CyberResearch #Cyber2point0

13

2 תגובות

If you're interested in how a threat researcher from the Israeli NSA approaches SaaS Security, this is worth the short read. Nicely written, Tamar Cohen! #saassecurity #AIsecurity #Unit8200

11

This is how responsible disclosure should work... This year at #blackhat2024 Alon Leviev revealed two zero-days, tracked as CVE-2024-38202 (https://lnkd.in/ePMEU9dm) and CVE-2024-21302 (https://lnkd.in/e8kYYmv4), which enable downgrade attacks that can "unpatch" fully updated systems of Windows 10, Windows 11, and Windows Server, reintroducing old vulnerabilities. 💻 How It Works: These downgrade attacks manipulate the Windows update process, tricking it into rolling back OS components such as DLLs and the NT Kernel to outdated versions, while still displaying the system as fully updated. This exposes systems to past vulnerabilities that had been previously patched. 🛡️ Impact: According to Leviev, this means "the term 'fully patched' is meaningless," as this undetectable attack makes even the most secure Windows machines vulnerable to thousands of past threats. Remarkably, this attack bypasses even UEFI locks on virtualization-based security features without needing physical access. ⏲️ Microsoft's Response: Microsoft has acknowledged these vulnerabilities and issued advisories with mitigation advice, but a permanent fix is still in the works, six months after being reported. #CyberSecurity #InfoSec #MicrosoftWindows #VulnerabilityManagement #responsibledisclosure

19

In our latest Cybercory.com interview, we dive deep into #The_Dangers_of_Insecure_Cloud_Adoption: #Navigating_Risks_and_Building_Secure_Cloud_Strategies with #cybersecurity expert Armen Avagyan. With over eight years of experience in securing complex IT/OT environments and a focus on cloud security, compliance, and incident response, Armen shares invaluable insights on building a resilient and secure cloud infrastructure. As businesses accelerate their move to the cloud, the risks of insecure adoption are mounting—ranging from #data breaches and misconfigurations to compliance gaps. In this interview, Armen explores these risks and offers expert guidance on: 🔹 Protecting #critical assets in the #cloud 🔹 Avoiding common #security pitfalls 🔹 Implementing robust strategies for a secure #cloud adoption Whether you're in the cloud or planning to be, don’t miss this essential guide to safeguarding your digital assets! 👉 Read the full interview on Cybercory: https://lnkd.in/eiuQ7yDF

2

-7- Outlook Unleashing RCE Chaos: CVE-2024-30103 & CVE-2024-38021 - Michael Gorelik, Arnold Osipov Sometimes, a vendor releases a patch fixing a vulnerability you are working on. Disappointing, isn't it? In this talk, Michael Gorelik and Arnold Osipov show how they turned two patches for Outlook issues back into vulnerabilities! First, the focus is Outlook custom forms — a feature allowing creation of tailored messages in emails. Under the hood, forms are COM objects, defining a new form type means creating a config file for it, with a value copied to the registry specifying the COM server handler for it. So, what if we make the key point at some DLL that we control? That's immediately RCE! To block this, Outlook uses a denylist that filters out registry keys allowing RCE like `inprocserver32`, `localserver`, etc. A vulnerability from earlier this year found the denylist matching fails if you specify an absolute path rather than a relative path (so a `\CLSID\...\inprocserver32=` is a-okay!). This allows hijacking any COM object in the registry. Luckily, this vulnerability has been patched. But, remember the premise of the talk? The patch disallowed starting the path with a backslash. So what did Michael and Arnold do? Add a backslash at the end! This works because `RegCreateKeyExA` deletes the last backslash in the path. However, this happens *after* the denylist check, which passes and so we have a vulnerability! Second, the talk looks at Outlook Moniker objects—those are "smart links" in Outlook, allowing you to send emails embedding special links like Ca lender invites, Excel files, etc. Being simple pointers, it is possible for malicious actors to send emails with references to remote files, potentially leaking NTLM credentials if the user clicks them. Fortunately, Outlook blocks these links. *Unfortunately*, earlier this year it was found that if you add an exclamation mark (!) at the end of the link, Outlook blocking won't work. The reason is a bit complicated, but in short—the link is being treated as a special kind of Moniker, triggering a different flow composed of a few functions, which are vulnerable to remote file access. This vulnerability was patched by installing a hook on a certain vulnerable function at the end of the flow. The hook checks if a certain flag is set, and if so, blocks the call. The flag is set at the beginning of a function earlier in the flow. So only when the two functions are chained, the call is blocked. Notice the issue? If another Moniker flow eventually reaches the vulnerable function without passing through the first one, the flag isn't set and the patch won't work! Indeed, the researchers discovered such a flow—a link within an image tag instead of a hyperlink While a bit convoluted for someone who hasn't touched COM objects for at least a decade, this is still an eye-opening talk on the possibility of finding vulnerabilities in patches. youtu.be/GwwxeY11xMI #DEFCON #Vulnerability #Outlook

24

3 תגובות

🚀 CTI Workshop at BSides Athens 2024! 🚀 🧱 "Block By Block: Building Your CTI Program" 🧱 Join me on June 29, 2024, for a 2-hour workshop designed to simplify the complexities of Cyber Threat Intelligence (CTI) and provide a clear roadmap to develop your own CTI program. 🔍 What will you gain? - Understand the foundational principles of CTI and its critical role in cyber threat management. - Learn the steps to initiate a CTI program and integrate it seamlessly into your business processes. - Discover practical strategies for quick wins and establishing core CTI capabilities. - Explore how to leverage technology to empower your CTI efforts, enhance the skills of CTI analysts, and use maturity models to measure and boost your program's effectiveness. 🎯 Who should attend? - Cybersecurity professionals at any stage of CTI implementation, from those considering starting a program to those refining an existing one. - Business leaders looking to understand how CTI can safeguard and add value to their operations. 📅 Mark Your Calendar! Date: June 29, 2024 Event: BSides Athens 2024 Session: Block By Block: Building Your CTI Program Don’t miss this chance to transform your approach to cyber threat intelligence. Whether you're starting from scratch or scaling up, this workshop will arm you with the insights and tools you need to succeed. 🔗Link to BSides Athens 2024 Agenda -https://lnkd.in/dFdV3J_H See you on Saturday! #BSidesAthens #CyberSecurity #CTI #ThreatIntelligence #InfoSec #threatintel #BSides #threatmanagement #cyberthreat #training #athens #greece

236

3 תגובות

🔒 #ICS Under Attack: How to Stay Secure 🔒 Recently, we've witnessed a significant rise in attacks targeting Industrial Control Systems, including incidents at the Municipal Water Authority of Aliquippa [1] and irrigation systems in Israel [2]. ICS manufacturers are responding by releasing numerous patches in a "patch Tuesday" fashion [3], however, in the OT space, having a patch is just the beginning; deploying it can be a complex and time-consuming task. So, how can you reduce your risk of getting hacked? As Rockwell Automation and CISA advises, "Disconnect Devices from the Internet" [4][5]. While this is sound advice, it's challenging to implement since organizations need to monitor and control these systems, often located in remote, hard-to-reach areas. What should defenders do? Place these systems behind a Remote Privileged Access Management (#RPAM) solution like Cyolo PRO (Privileged Remote Operations). Cyolo's solution provides Just In Time (#JIT) 1st and 3rd party #SRA, offering agentless access to many OT systems. 🎥 See it in action: Connecting to Rockwell PLC without an agent: https://lnkd.in/gHZTF_Kg Just In Time access via ServiceNow ticketing: https://lnkd.in/gy9tAHqH #CyberSecurity #IndustrialSecurity #OTSecurity #RemoteAccess [1] https://lnkd.in/gZjFTPrQ [2] https://lnkd.in/g6Td_6DB [3] https://lnkd.in/g_W5uRRX [4] https://lnkd.in/gt8tFja7 [5] https://lnkd.in/gmZZBtiz

16

"With great power comes great responsibility." - Uncle Ben A few months ago, I received a call from a dedicated member of OTI - The Israeli Autism Association. They had noticed suspicious activity in their email system and had heard about OP Innovate's Digital Forensics and Incident Response (DFIR) services. Without hesitation, Omer Pinsker, Ben B., Mickey Alton, and I decided to help. In our free time, we thoroughly investigated the situation to ensure the organization's data was secure. We also conducted a penetration test to confirm that the attacker would not find another way in. It's infuriating to think someone would target a non-profit organization that supports autistic children. If I could, I would confront the attacker personally for attempting to harm such a noble cause. At OP Innovate, we always stand by those who need cyber protection the most. If you are a non-profit organization facing cybersecurity challenges, feel free to reach out to me on LinkedIn. #CyberSecurity #PenetrationTesting #DFIR #NonProfitSupport #OPInnovate

46

1 תגובה

Great to know to protect! Threat Actor in Focus - Emerging Threat: Void Manticore’s Destructive Cyber Campaigns Targeting Israeli Organizations Threat Actors: Void Manticore Attack Type: Public-facing web server Objective: Espionage Target Technology: Windows Target Geographies: Israel Target Industries: Government & Critical Infrastructure Business Impact: Data Loss, Data exfiltration

1

🔒 Mastering Endpoint Security - Best Practices for 2024 🔓 Join our Check Point CheckMates Webinar on Onboarding & Best Practices for Harmony Endpoint (This time in English 😉 ), where Yehonatan Cohen will share his expertise and will dive into the best practices for deploying, optimizing, and boosting your Endpoint security experience with Harmony Endpoint. 📆 When - July 31. 💥 Register here - https://lnkd.in/dEddEWwN #Harmony #EndpointSecurity #BestPractices Check Point Software

64

1 תגובה

an introductory meeting with a senior manager in a leading organization in Israel. When I raised the issue of information security and the need to invest in protecting the organization, he smiled confidently and said: "Why would they want to hack into us? We are not a defense company or a bank. Everything will be fine." Familiar? 📌 The belief that organizations that do not operate in security or financial fields do not need cyber protection is wrong and dangerous. There are several possible reasons for hacking organizations, which may apply to any organization: ☑ Random and large-scale attacks, regardless of the specific target ☑ Attacks for economic gain ☑ Supply chain attacks ☑ Theft of sensitive data such as customer information, employee information, and business information ☑ Ideological and political motives Therefore, it is important for every organization to understand the importance of information security and protect its systems accordingly. Prudence and proper investment in protection can save significant future costs and damages. By the way, the same senior manager finally understood the importance of protecting the organization. Better to go through an hour and a half of understanding than never 🛡 Have you heard this phrase from directors before? What do you think of it? #cyber Israel National Cyber Directorate - מערך הסייבר הלאומי CyberIntelligence riskmanagement-insurance-training Bynet Data Communications Microsoft Azure

1

What’s happening with Tenable in Israel? Check out our new LinkedIn and Instagram pages for the latest on events, activities, news and research. LinkedIn: https://lnkd.in/gFRd-6nR Instagram: @TenableIsrael

6

You can’t correct what’s not accounted for, like orphaned identites with execessive access to sensitive information. Cyera now automatically uncovers one of the most targeted attack surfaces and maps it to risk. #identity #human #nhi #cyera

14

🛡️GYTPOL 2.0 Live Event is coming, Sunday June 16th! GYTPOL, one of Israel 🇮🇱 leading cyber companies, and a world leader in Endpoints Misconfiguration Security technology, is bringing together users and information security leaders from across Israel for an incredible day of learning and networking. Enjoy expert lectures, cyber success stories, a GYTPOL 2.0 walkthrough, professional panel, entertainment, and giveaways. I'll be moderating the event, as well as CISOs panel on "Balancing Business Continuity and Security," diving into the key components of scalable security across various sectors like healthcare, manufacturing, finance, and public. We'll explore how to weigh threat risks against operational disruption and resource constraints.  Our esteemed panelists include: Haim Inger - Clal Insurance & Finance- כלל ביטוח ופיננסים Avivit Kotler, - Clalit Health Services Alberto (Deto) Hasson - ICL Group Roy Avrahami - Ashdod Port Company Chen Amram - EL AL Israel Airlines 👉Register here: https://lnkd.in/djnns3UW Don't miss this opportunity to level up your cybersecurity game. See you there, cybersecurity champions! Don't Hesitate, Accelerate!!!🚀🚀🚀  Tal Catran Startups & Accelerators GURU Tal Kollender Gilad Raz Yakov Kogan Snir Cohen Ilan Mintz Orya Shemer Mor Bikovsky #cybersecurity #cyberthreats #businesscontinuity

32

2 תגובות

🗣️ You have to speak the same language. Remember when Ira Winkler joined Neatsun Ziv on #CyberOxTales to discuss-Obtaining Security Budgets You Need (Not Deserve)? He emphasized the importance of understanding business metrics and highlighted how CISOs need to effectively communicate real threats and potential financial losses to justify their budget requests. Have a listen! https://gag.gl/Vrcpph #Cybersecurity #CISO #Budgeting #BusinessMetrics #CyberOxTales

5

Great article from Alexander Bolshakov, explaining how we've designed and implemented ETL strategy in our SOC Team on the example of GWS: https://lnkd.in/dcxEKtYT

16

Wool is being pulled *Translation required "ASEC (AhnLab Security Intelligence Center) publishes weekly and quarterly phishing email statistics reports through its blog every week, and fake login, delivery, and purchase order types are the main types. However, we have recently confirmed that phishing emails impersonating large domestic entertainment agencies are being distributed domestically. The attackers disguised themselves as demanding action to be taken because their images were used without permission in Facebook and Instagram advertisements, and induced users to click on hyperlinks to check which photos were used. When the link is clicked, a Python-based infostealer is created, and to disguise it as a PDF, the icon is changed to PDF and the application (EXE) extension is hidden by adding a lot of spaces to the file name. As shown in the picture below, if a lot of spaces are added, the file is hidden by “…” unless you click on it once. The attacker is targeting this and fills in “.pdf” before it is hidden, intending to deceive users into thinking that it is a real PDF file."

1