Stuart Schwartz

Today's Adobe security update has patched the in-the-wild zero-day PoC that EXPMON Public (https://pub.expmon.com) detected couple months ago (https://lnkd.in/ghQYYzXR). https://lnkd.in/gqxHHCfe Note: not want to cause confusion - this is not a working exploit, but a good PoC. Users are recommended to update their Adobe Reader ASAP, as we're going to point to the public sample with all the details soon in the next few days.

12

** There's New Development about this case ** We tested the (exactly the same) sample on the "patched" Adobe Reader version, it displayed additional dialogs, but if the user clicked/closed those dialogs, the app still crashed! Same UAF bug! We're contacting Adobe to find out what's going on and will update here. For now, we have to postpone the release of the details because the bug seems not properly fixed. [Update on Monday] Adobe has confirmed to us that the bug is not properly patched. "I can confirm our Acrobat product team has identified a secondary fix that is required to fully address this issue. We are actively reviewing and working to prioritize the fix in an upcoming patch. I will be sure to follow up with you once we have a clear release timeframe." Guess we have to hold our blog posts until the new patch becomes available to users. Sigh.. https://lnkd.in/gbBDuDHC #expmon #adobe #pdf #zeroday #0day #detection

8

For any organization that is working with the government, CMMC Compliance is coming. This talk really helps to explain what the requirements are and how you meet them.

3

Important update for the DIB, worth reading.

5

With the rapid advancement of AI technologies comes novel threats. MITRE ATLAS helps to navigate these threats to AI enabled systems through real-world insights. We're looking for your feedback -- help us make ATLAS stronger. #MITREatlas #AI #AISecurit

28

Implementing phishing-resistant multi-factor authentication (MFA) is crucial in today's threat landscape. Axiad Cloud FedRAMP: - Turnkey Solution: Combines PKI and FIDO2 authentication. - Compliance Made Easy: Meets federal mandates efficiently. - Unified Platform: Simplifies management across users and devices. Enhance your security posture and accelerate Zero Trust adoption with Axiad.

5

Thanks to @Scott Small and Wade Baker, Ph.D. and the teams at Tidal and Cyentia. To my fellow cyber risk quant folk you know how strongly we drive our partners and customers to define risk scenarios using specific threat actors and/or specific TTP’s to enhance the accuracy of likelihood determination! The work both organizations are doing to help articulate the TTP’s being used for ransomware attacks can help provide a greater level of defensibility of your results. By executing adversarial simulation using these TTP’s increasingly accurate likelihood can be attained.

4

Some out of band NIST guidance on synced passkeys! Thanks for working on this Ryan Galluzzo and Andrew Regenscheid! "Syncable authenticators will not be appropriate for all use cases. However, when deployed in a manner that is consistent with the guidelines contained in this supplement, they can achieve alignment with AAL2 risk mitigations and promote the adoption of phishing-resistant authentication more broadly." "Attestations SHOULD NOT be used for broad public-facing applications. Such a requirement (i.e., one that blocks some public users’ syncable authenticators if they do not support attestation) may divert users to less secure authentication options that are vulnerable to phishing, such as Short Message Service (SMS) one-time password (OTP)."

92

1 Comment

They're not the only ones. I could see replicating something like historian data for business analytics in the cloud but certainly not putting any portion of functional and operational SCADA there. I have seen some use cases, predominantly in utility field area networks, for field to cloud with some sort of edge compute. In this case, additional steps are usually taken to attempt to implement either zero trust at the field edge or some sort of private cloud interface, which then replicates the analytics data into a public cloud. Those vendors pushing/selling foundationally cloud-based SCADA systems have a difficult path to navigate. #SCADASecurity #OTCybersecurity DirectDefense

3

EC2 Compromise Leads to S3 Bucket Exfiltration

53

This is funny to me; many have said this for years and now NIST is aligning with it. What companies need to be focusing on is password-less methods, not trying to make a legacy password method "less-bad". Windows Hello for Business, passkey, or other phishing resistant methods are the only real way to increase your security posture. Even with a 24-character password, end users will still write that on a sticky note. 😄

9

Are your firm’s electronic communications up to par with FINRA rules? Dive into the criticality of supervising electronic correspondence and how to create effective Written Supervisory Procedures (WSPs) with insights from Soniya Bopache. Learn more: https://vrt.as/4esgpqv

3

Are your firm’s electronic communications up to par with FINRA rules? Dive into the criticality of supervising electronic correspondence and how to create effective Written Supervisory Procedures (WSPs) with insights from Soniya Bopache. Learn more: https://vrt.as/4esgpqv

1

A large webshop fraud ring has been exposed, highlighting the importance of vigilance against online scams. The ring tricked victims into making fake purchases on bogus websites, stealing credit card information and attempting to process millions of dollars in fraudulent orders. They also resold stolen credit card details. This is a stark reminder of the ever-present threat of cybercrime. As security professionals, we can help educate our networks about online safety and best practices for identifying legitimate websites. #cybersecurity #webshopfraud #onlinesafety https://lnkd.in/ghzUiK4p

6

A lot of talk regarding CMMC lately, at Island we believe that a more user-friendly way of protecting CUI is possible. Take a look at what we pulled together: https://lnkd.in/e8UjeKqE

42

There's a pretty advanced "detection in depth" (I like that name) feature I've been working on for EXPMON system for PDF zero-day exploit detection. Currently on private test, will roll out to https://pub.expmon.com when good to go. This was inspried by my personal witness at PWN2OWN this year where Adobe Reader once again got easily exploited. There're SO MANY need to be done/innovated from exploit detection perspective. Detection-in-depth in PDF is super challenging. The PDF on Adobe Reader is like a browser (JavaScript) + complicated file format + various undocumented features, combined.. Sigh.. #expmon #zeroday #exploit #detection #pdf #adobe

18

2 Comments