Kevin Reed

I am thrilled to announce the launch of the Singapore Cyber Landscape (SCL) 2023 report, a vital resource that underscores our commitment to enhancing cybersecurity resilience in an ever-evolving digital landscape The SCL 2023 provides invaluable insights into the current state of cybersecurity in Singapore highlighting emerging threats, trends, and the collaborative efforts of both public and private sectors. As we navigate the complexities of cyber threats, this report serves as a crucial tool for organizations to strengthen their defenses and foster a culture of security I invite all professionals in the cybersecurity field to explore the findings and leverage this knowledge to bolster our collective efforts in safeguarding our digital future. Together, we can build a safer cyberspace for everyone. #Cybersecurity #SCL2023 #CSA #DigitalSafety #Collaboration #SingaporeCyberSecurity

54

2 Comments

Last Thursday, I presented at OpenID Foundation Japan TechNight on the topic of Shared Signal Framework (SSF) protocol. With over 300 attendees, including key members of the Japanese Digital Ministry, we discussed SSF's role in providing cyber security and protecting end users' identity, privacy and data from malicious attacks. SSF, along with FIDO Alliance 2.0 and OpenID Foundation Connect, aims to enhance global identity protection. Addressing a diverse audience, I covered SSF protocols, CAEP, RISC specs, and underlining IETF technical specifications like Security Event Token (SET). The protocol, already adopted by the US Government (Login.gov) and industry leaders, is being rolled out, right now to benefit end users and the industry as a whole. My goal was to highlight the protocol's advantages and promote its adoption. For those interested, a YouTube video of the SSF TechNight event is available. While in Japanese, the auto-translate CC feature provides accurate English captions. Check it out here: https://lnkd.in/gkybacyV #OpenID #OpenIDJapan #IAM #CIAM #digitalidentity #sharedSignalFramework

48

2 Comments

📚 tl;dr sec 241 Understanding Crowdstrike, AWS Pentesting Guide, Rule Explorer Project ✨ Highlights 👨‍💻 AppSec 👨‍💻 - Tib3rius ​ on where to store JWTs - Enabling Trusted Types in a Complex Web Application - Kian Jamali, Aaron Shim - CerealKiller: automates detection of .NET binaries vulnerable to deserialization attacks - James Williams - Anyone can Access Deleted and Private Repository Data on GitHub - Joseph Leon ☁ Cloud Security ☁ - aws-whoami-golang - Ben Kehoe - An Opinionated Ramp Up Guide to AWS Pentesting - Lizzie Moratti - Capturing Exposed AWS Keys During Dynamic Web Application Tests - Aleksa Zatezalo 🛡 Blue Team 🛡 - Introducing the REx: Rule Explorer Project - Justin I. - When an Attack Technique Isn’t a Technique - Andrew VanVleet - A Five Year Retrospective on Detection as Code - David Burkett 😈 Red Team 😈 - Modular Python Tool for Cross-Platform Microsoft Graph API Enumeration and Exploitation - Python Script to Execute ELF Binaries in Memory, Bypassing Noexec Flags - Codasm: Python Tool Embedding Payloads into Binaries to Reduce Entropy - Moritz Thomas 🤖 AI + Security 🤖 - Prompt Airlines: an AI CTF by Wiz - Nir Ohfeld, Shir Tamari - Predicting AI’s Impact on Security - Caleb Sima 🐦 Crowdstrike 🐦 - Crowdstrike and Microsoft's breakdown - Patrick McCormack shares a great overview post. - Zack Allen shared a nice explanatory diagram of how Crowdstrike manages threat detection content - Posts discussing kernel-mode vs user-mode agents - Would eBPF have helped? https://lnkd.in/gUJmbmgH #cybersecurity #security #infosec #ciso #ai

63

1 Comment

This is how responsible disclosure should work... This year at #blackhat2024 Alon Leviev revealed two zero-days, tracked as CVE-2024-38202 (https://lnkd.in/ePMEU9dm) and CVE-2024-21302 (https://lnkd.in/e8kYYmv4), which enable downgrade attacks that can "unpatch" fully updated systems of Windows 10, Windows 11, and Windows Server, reintroducing old vulnerabilities. 💻 How It Works: These downgrade attacks manipulate the Windows update process, tricking it into rolling back OS components such as DLLs and the NT Kernel to outdated versions, while still displaying the system as fully updated. This exposes systems to past vulnerabilities that had been previously patched. 🛡️ Impact: According to Leviev, this means "the term 'fully patched' is meaningless," as this undetectable attack makes even the most secure Windows machines vulnerable to thousands of past threats. Remarkably, this attack bypasses even UEFI locks on virtualization-based security features without needing physical access. ⏲️ Microsoft's Response: Microsoft has acknowledged these vulnerabilities and issued advisories with mitigation advice, but a permanent fix is still in the works, six months after being reported. #CyberSecurity #InfoSec #MicrosoftWindows #VulnerabilityManagement #responsibledisclosure

19

Menaya has an interesting solution that bring cyber risk rating and quantification to the hundreds and thousands of SMEs out there. Looking forward to see it in action. #LapcomCybersecurityShowcase2024

3

Carrots, sticks and cupcakes.. I sat down with Allan Tan last week to discuss how embedding a #security aware #culture is critical in today's organisational ethos. We covered the What, Why and the How: from top leadership to building grassroots support, with examples from the outstanding work I've seen from Jen Waugh, Tom Ross, CISA and Ann W. - our stellar Culture, Awareness and Education leads at Okta. More on the podcast -

41

1 Comment

DDOS mitigation and traffic optimization systems today are quite complex. Sometimes they may see false positives and cause significant disturbance to service reliability. #cybersecurity #ddos https://lnkd.in/dfgmrsUr

1

This morning, our lead threat researcher (STEPHEN MONACO) noticed an article detailing an emerging supply chain attack impacting over 110,000 websites. The intent of this campaign being redirection of users browsing to infected websites to malicious and/or scam sites. Within minutes, we were able to deploy threat detection rules throughout our Collective Defense community and identify customers that have recent outbound activity to infected sites. #CollectiveDefense #SupplyChain #ThreatIntelligence

15

1 Comment

Your Security Operations Center (SOC) may be facing challenges I know inside and out. As the former Deputy Director General of the Israeli National Cyber Directorate (INCD), I was until recently in charge of leading the national operational posture and the Israeli National CERT. Now on my way to RSA, I can’t wait to share our new platform with fellow attendees. It just launched. It was built for SOC teams and leadership by expert, senior SOC and IR analysts who experienced the challenges we solve firsthand. Our work at Cyngular Security is truly remarkable, and I am proud of all our team has done to achieve it. Let’s connect there if you’re curious about our team’s groundbreaking work. Visit our website and request a demo to learn what THIRDhub is, why it is unique, and how it's going to dramatically enhance your Security Operations Center. If you can't make RSA, read more about THIRDhub in this article: https://lnkd.in/e9RBAeh9 #Cybersecurity #CloudSecurity #cloud #Cyberattack #MSSP #CloudIR #CIRA #CloudThreatHunting #ClouDFIR #CloudIR #DFIR #RSA #RSA2024

56

5 Comments

I wrote an article to explain a bit about our security solution, the motivation for our approach and how it's done - without exposing any secrets of course ;-) https://lnkd.in/eVdMz8fY

15

Lazarus Group, a North Korean state-backed APT, is deploying a new macOS trojan called “RustyAttr” to hide malicious code within extended attributes (EAs) of files. This technique, which utilizes the Tauri framework and fake PDFs related to job opportunities or cryptocurrency, allows Lazarus to evade detection by antivirus scanners. To protect against this threat, users should verify file sources, keep macOS Gatekeeper on, and utilize advanced threat intelligence solutions.

1

I'm sharing a critical alert from the Singapore Cyber Emergency Response Team (SingCERT) regarding a phishing scam targeting the public. Scammers are impersonating officers from the Cyber Security Agency of Singapore (CSA) and the Police to trick victims into believing they are facing legal action. The Scam: * You receive a fraudulent email claiming a court order has been filed against your IP address due to illegal activities. * The email threatens legal proceedings if you don't respond within 24 hours. Don't Fall for It! Here's How to Spot the Scam: * CSA and SPF will never: * Ask you to transfer money. * Request your banking, SingPass, or CPF information. * Ask you to click on suspicious links. * Request you to download software or apps from unofficial sources. What to Do: * If you receive such an email: * Do not respond or follow any instructions. * Report the incident to SingCERT at [email protected] or SingCERT Incident Reporting Form. * Always verify the authenticity of emails: * Contact the agency directly using official channels (phone numbers or email addresses listed on their website). By staying vigilant and informed, we can protect ourselves from these cyber threats. Let's spread the word and keep our online community safe! #cybersecurity #phishing #onlinesafety #singcert https://lnkd.in/g5iPbvf4

58

CxOs, it's time to rethink your network security approach. ZTNA alone won't cut it in today's threat landscape. Discover why ZTNA integrated into SASE is the key to securing your business end-to-end 👇 #SASE #ZTNA

3

In my latest CISO Monthly Roundup, I share details from the Zscaler #ThreatLabz team research on North Korean hiring campaigns; unpack findings from the recent mobile, IoT, and OT threat report; cover the Dark Angels record-breaking ransomware demand; introduce a new tool for combating SmokeLoader infections, and more. Read the full roundup: https://lnkd.in/gwjJ33fX 

132

2 Comments

This year our group had three works presented in CCS 2024 (Part 2). The second one is "Payout Races and Congested Channels: A Formal Analysis of Security in the Lightning Network", Ben Weintraub, Satwik Prabhu Kumble, Cristina Nita-Rotaru and Stefanie Roos. This is a collaboration with TU Delft and University of Kaiserslautern-Landau and was presented by Ben Weintraub. The Lightning Network, a payment channel network with a market cap of over 192M USD, is designed to resolve Bitcoin’s scalability issues through fast off-chain transactions. There are multiple Lightning Network client implementations, all of which conform to the same textual specifications known as BOLTs. Several vulnerabilities have been manually discovered, but to-date there have been few works systematically analyzing the security of the Lightning Network. We take a foundational approach to analyzing the security of the Lightning Network with the help of formal methods. Based on the BOLTs’ specifications, we build a detailed formal model of the Lightning Network’s single-hop payment protocol and verify it using the Spin model checker. Our model captures both concurrency and error semantics of the payment protocol. We then define several security properties which capture the correct intermediate operation of the protocol, ensuring that the outcome is always certain to both channel peers, and using them we re-discover a known attack previously reported in the literature along with a novel attack, referred to as a Payout Race. A Payout Race consists of a particular sequence of events that can lead to an ambiguity in the protocol in which innocent users can unwittingly lose funds. We confirm the practicality of this attack by reproducing it in a local testbed environment. Full paper is available here https://lnkd.in/df9pPbHA

43

1 Comment

Well, seems the SSH experiment is over, time to move back to Telnet. /ducks to avoid heavy things being thrown my way //no, don't get rid of SSH, just patch, ok? ///seriously, patch. That part isn't a joke. #SSH #Telnet #RemoteCodeExecution

5

New report on Top Influential Regulations reveals 37% say TSA Security Directives is most influential. Full Report = https://lnkd.in/gmmzSQQa Bravo to all who work on #CyberSecurity at OTORIO including Kfir Tzukrel and Gail Kosloff

7

1 Comment

Symantec’s Threat Hunter Team has uncovered a new Linux backdoor developed by the North Korean Springtail espionage group (aka Kimsuky) that is linked to malware used in a recent campaign against organizations in South Korea.  The backdoor (Linux.Gomir) appears to be a Linux version of the GoBear backdoor, which was used in a recent Springtail campaign that saw the attackers deliver malware via Trojanized software installation packages. Gomir is structurally almost identical to GoBear, with extensive sharing of code between malware variants. #symantec #linux #backdoor

4