Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for How to choose an XDR ...

 Business

XDR (Extended Detection and Response) technology has already become one of the most conspicuous in the cybersecurity market. Its main advantage is its comprehensive approach to countering sophisticated cyberattacks. This is achieved by maximizing control over potential entry points and through the use of   show more ...  

top-of-the-line tools for incident detection, threat hunting, investigation and response within a single incident-handling process. Leading information technology research and advisory agencies are paying special attention to the technology – describing it as the most promising for the coming years. It therefore comes as no surprise to see the list of XDR vendors growing rapidly as many new companies enter the market. Some vendors already offer full-fledged solutions, while others continue to build convergence among their IT-security products and upscale XDR functionality. Since the XDR concept is still in the making, lets figure out what to consider when choosing an XDR vendor. In our view, a reliable XDR supplier needs to be able to provide the following: 1.      EPP and EDR synergy An EDR (Endpoint Detection and Response) solution for advanced detection and response to sophisticated cyberthreats at the endpoint level is a key element of XDR. For its part, EDR cannot do its job properly without a robust EPP (Endpoint Protection Platform) solution – a fundamental endpoint protection technology that automatically sifts out a huge number of mass threats – on top of which EDR comes into play. So, when choosing an XDR vendor, you need to look carefully at the endpoint protection features to make sure theres support for various types of endpoints: PCs, laptops, virtual machines, mobile devices, and various operating systems (OS). The quality of an XDR solution depends directly on the synergy between EPP and EDR on the vendors side. 2.      Comprehensive threat intelligence It goes without saying that reliable and up-to-date threat intelligence is vital in effectively countering modern cyberthreats. Effective response is impossible without a full overview of cybercriminal tactics and techniques. Therefore, IT-security experts who use an XDR solution must have access to comprehensive, up-to-date threat intelligence; this additional context improves process of incident investigation and response by speeding it up. 3.      Interoperability with third-party solutions Although XDR solutions are usually a single-vendor affair from the start, when comparing XDR solutions its important to consider how well they integrate and interoperate with third-party solutions. Opting for an XDR solution with a strong ability in this regard would both help sustain IT-security investments and serve the main purpose of XDR: collect, correlate data and alerts from multiple IT-security components and provided on top additional cross-product scenarios to increase efficiency of complex incident response. The more sources of data the solution collects, the more complete the picture of what is happening in your infrastructure will be. 4.      Technologies verified by independent experts and in practice It is often difficult for organizations to independently evaluate the performance of intrinsically new solutions. In the case of XDR, its important to understand that the idea behind it is the consolidation of various IT-security tools into a single concept. Hence, the different components that make up this novel technology need to have been: successfully implemented worldwide; tested extensively by independent organizations – such as MITRE, SE Labs, or AV-Test; recognized by international analytical agencies – such as Gartner, Forrester, or IDC. 5.      Clear development plans Since XDR is still a nascent infosec trend, potential buyers need to study (i) vendors plans for development of their solutions components, and (ii) vendors roadmaps for system refinement. The more purposeful and clear such intentions are – and the more willingly they are shared – the more trustworthy the vendor.   Our enterprise-level security solutions working in conjunction provide XDR capabilities to your companys cybersecurity experts. Thanks to seamless interoperability our products allow your organization to control all key entry points to your infrastructure, increase visibility and provide centralized defense. If you want to learn more please visit Kaspersky Expert Security web page.

image for The Original APT: Ad ...

 A Little Sunshine

Many organizations are already struggling to combat cybersecurity threats from ransomware purveyors and state-sponsored hacking groups, both of which tend to take days or weeks to pivot from an opportunistic malware infection to a full blown data breach. But few organizations have a playbook for responding to the   show more ...  

kinds of virtual “smash and grab” attacks we’ve seen recently from LAPSUS$, a juvenile data extortion group whose short-lived, low-tech and remarkably effective tactics have put some of the world’s biggest corporations on edge. Since surfacing in late 2021, LAPSUS$ has gained access to the networks or contractors for some of the world’s largest technology companies, including Microsoft, NVIDIA, Okta and Samsung. LAPSUS$ typically threatens to release sensitive data unless paid a ransom, but with most victims the hackers ended up publishing any information they stole (mainly computer source code). Microsoft blogged about its attack at the hands of LAPSUS$, and about the group targeting its customers. It found LAPSUS$ used a variety of old-fashioned techniques that seldom show up in any corporate breach post-mortems, such as: -targeting employees at their personal email addresses and phone numbers; -offering to pay $20,000 a week to employees who give up remote access credentials; -social engineering help desk and customer support employees at targeted companies; -bribing/tricking employees at mobile phone stores to hijack a target’s phone number; -intruding on their victims’ crisis communications calls post-breach. If these tactics sound like something you might sooner expect from spooky, state-sponsored “Advanced Persistent Threat” or APT groups, consider that the core LAPSUS$ members are thought to range in age from 15 to 21. Also, LAPSUS$ operates on a shoestring budget and is anything but stealthy: According to Microsoft, LAPSUS$ doesn’t seem to cover its tracks or hide its activity. In fact, the group often announces its hacks on social media. ADVANCED PERSISTENT TEENAGERS This unusual combination makes LAPSUS$ something of an aberration that is probably more aptly referred to as “Advanced Persistent Teenagers,” said one CXO at a large organization that recently had a run-in with LAPSUS$. “There is a lot of speculation about how good they are, tactics et cetera, but I think it’s more than that,” said the CXO, who spoke about the incident on condition of anonymity. “They put together an approach that industry thought suboptimal and unlikely. So it’s their golden hour.” LAPSUS$ seems to have conjured some worst-case scenarios in the minds of many security experts, who worry what will happen when more organized cybercriminal groups start adopting these techniques. “LAPSUS$ has shown that with only $25,000, a group of teenagers could get into organizations with mature cybersecurity practices,” said Amit Yoran, CEO of security firm Tenable and a former federal cybersecurity czar, testifying last week before the House Homeland Security Committee. “With much deeper pockets, focus, and mission, targeting critical infrastructure. That should be a sobering, if not terrifying, call to action.” My CXO source said LAPSUS$ succeeds because they simply refuse to give up, and just keep trying until someone lets them in. “They would just keep jamming a few individuals to get [remote] access, read some onboarding documents, enroll a new 2FA [two-factor authentication method] and exfiltrate code or secrets, like a smash-and-grab,” the CXO said. “These guys were not leet, just damn persistent.” HOW DID WE GET HERE? The smash-and-grab attacks by LAPSUS$ obscure some of the group’s less public activities, which according to Microsoft include targeting individual user accounts at cryptocurrency exchanges to drain crypto holdings. In some ways, the attacks from LAPSUS$ recall the July 2020 intrusion at Twitter, wherein the accounts for Apple, Bill Gates, Jeff Bezos, Kanye West, Uber and others were made to tweet messages inviting the world to participate in a cryptocurrency scam that promised to double any amount sent to specific wallets. The flash scam netted the perpetrators more than $100,000 in the ensuing hours. The group of teenagers who hacked Twitter hailed from a community that traded in hacked social media accounts. This community places a special premium on accounts with short “OG” usernames, and some of its most successful and notorious members were known to use all of the methods Microsoft attributed to LAPSUS$ in the service of hijacking prized OG accounts. The Twitter hackers largely pulled it off by brute force, writes Wired on the July 15, 2020 hack. “Someone was trying to phish employee credentials, and they were good at it,” Wired reported. “They were calling up consumer service and tech support personnel, instructing them to reset their passwords. Many employees passed the messages onto the security team and went back to business. But a few gullible ones—maybe four, maybe six, maybe eight—were more accommodating. They went to a dummy site controlled by the hackers and entered their credentials in a way that served up their usernames and passwords as well as multifactor authentication codes.” Twitter revealed that a key tactic of the group was “phone spear phishing” (a.k.a. “voice phishing” a.k.a. “vishing”). This involved calling up Twitter staffers using false identities, and tricking them into giving up credentials for an internal company tool that let the hackers reset passwords and multi-factor authentication setups for targeted users. In August 2020, KrebsOnSecurity warned that crooks were using voice phishing to target new hires at major companies, impersonating IT employees and asking them to update their VPN client or log in at a phishing website that mimicked their employer’s VPN login page. Two days after that story ran, the FBI and the Cybersecurity & Infrastructure Security Agency (CISA) issued their own warning on vishing, saying the attackers typically compiled dossiers on employees at specific companies by mass-scraping public profiles on social media platforms, recruiter and marketing tools, publicly available background check services, and open-source research. The joint FBI/CISA alert continued: “Actors first began using unattributed Voice over Internet Protocol (VoIP) numbers to call targeted employees on their personal cellphones, and later began incorporating spoofed numbers of other offices and employees in the victim company. The actors used social engineering techniques and, in some cases, posed as members of the victim company’s IT help desk, using their knowledge of the employee’s personally identifiable information—including name, position, duration at company, and home address—to gain the trust of the targeted employee.” “The actors then convinced the targeted employee that a new VPN link would be sent and required their login, including any 2FA [2-factor authentication] or OTP [one-time passwords]. The actor logged the information provided by the employee and used it in real-time to gain access to corporate tools using the employee’s account.” Like LAPSUS$, these vishers just kept up their social engineering attacks until they succeeded. As KrebsOnSecurity wrote about the vishers back in 2020: “It matters little to the attackers if the first few social engineering attempts fail. Most targeted employees are working from home or can be reached on a mobile device. If at first the attackers don’t succeed, they simply try again with a different employee.” “And with each passing attempt, the phishers can glean important details from employees about the target’s operations, such as company-specific lingo used to describe its various online assets, or its corporate hierarchy.” “Thus, each unsuccessful attempt actually teaches the fraudsters how to refine their social engineering approach with the next mark within the targeted organization.” SMASH & GRAB The primary danger with smash-and-grab groups like LAPSUS$ is not just their persistence but their ability to extract the maximum amount of sensitive information from their victims using compromised user accounts that typically have a short lifespan. After all, in many attacks, the stolen credentials are useful only so long as the impersonated employee isn’t also trying to use them. This dynamic puts tremendous pressure on cyber incident response teams, which suddenly are faced with insiders who are trying frantically to steal everything of perceived value within a short window of time. On top of that, LAPSUS$ has a habit of posting screenshots on social media touting its access to internal corporate tools. These images and claims quickly go viral and create a public relations nightmare for the victim organization. Single sign-on provider Okta experienced this firsthand last month, when LAPSUS$ posted screenshots that appeared to show Okta’s Slack channels and another with a Cloudflare interface. Cloudflare responded by resetting its employees’ Okta credentials. Okta quickly came under fire for posting only a brief statement that said the screenshots LAPSUS$ shared were connected to a January 2022 incident involving the compromise of “a third-party customer support engineer working for one of our subprocessors,” and that “the matter was investigated and contained by the subprocessor.” This assurance apparently did not sit well with many Okta customers, especially after LAPSUS$ began posting statements that disputed some of Okta’s claims. On March 25, Okta issued an apology for its handling of the January breach at a third-party support provider, which ultimately affected hundreds of its customers. My CXO source said the lesson from LAPSUS$ is that even short-lived intrusions can have a long-term negative impact on victim organizations — especially when victims are not immediately forthcoming about the details of a security incident that affects customers. “It does force us to think about insider access differently,” the CXO told KrebsOnSecurity. “Nation states have typically wanted longer, more strategic access; ransomware groups want large lateral movement. LAPSUS$ doesn’t care, it’s more about, ‘What can these 2-3 accounts get me in the next 6 hours?’ We haven’t optimized to defend that.” Any organizations wondering what they can do to harden their systems against attacks from groups like LAPSUS$ should consult Microsoft’s recent blog post on the group’s activities, tactics and tools. Microsoft’s guidance includes recommendations that can help prevent account takeovers or at least mitigate the impact from stolen employee credentials.

 Malware and Vulnerabilities

CVE-2021-45382 is a Remote Code Execution (RCE) vulnerability that exists in all series H/W revisions D-Link DIR-810L, DIR-820L/LW, DIR-826L, DIR-830L, and DIR-836L routers via the DDNS function in ncc2 binary file.

 Trends, Reports, Analysis

The rate of online fraud attacks increased by 233% between 2019 and 2021, according to RiskOps platform, Feedzai. The figure was included in the company's newly released quarterly financial crime report.

 Trends, Reports, Analysis

e-Commerce sites are frequently targeted by cyberattackers and there isn’t much attention paid to the cybersecurity measures at brick-and-mortar retailers. Many cybercriminal groups rely on banking trojans to steal customer credit/debit card information or internet banking credentials from the networks of retailers.   show more ...  

 Online retailers are suggested to review their budgets and allocate an adequate portion to secure themsleves.

 Companies to Watch

Washington, DC-based API security firm Corsha has raised $12 million in a Series A funding round led by Ten Eleven Ventures and Razor’s Edge Ventures, with participation from 1843 Capital.

 Govt., Critical Infrastructure

The Australian Department of Home Affairs has commenced work on a new national data security action plan as part of the federal government's wider digital economy strategy.

 Expert Blogs and Opinion

It’s no surprise that many organizations are struggling with how to best manage their data and secure it, especially when data and systems reside not only in separate siloes, but within different teams, on-premises, and in the cloud.

 Trends, Reports, Analysis

Although e-Commerce sites are frequently targeted by cyberattackers, there isn’t much attention paid to the cybersecurity measures at brick-and-mortar retailers. Hackers target local stores for a variety of reasons including personal data theft, skimming payment card details, and sometimes extorting from victims.

 Trends, Reports, Analysis

According to a report by Tromzo, 42% of developers push vulnerable code once per month. Developers fix only 32% of known vulnerabilities. 33% believe that developers and security are siloed.

 Malware and Vulnerabilities

Lambda is a scalable compute service offered by Amazon Web Services (AWS) for running code, server and OS maintenance, capacity provisioning, logging, and operating numerous backend services.

 Identity Theft, Fraud, Scams

According to the Australian Competition & Consumer Commission, the losses reported in Q1 2022 are estimated to be $270,000 (up by 301% compared to 2021), which add up to losses incurred by victims who previously fell for the same type of scam.

 Feed

Red Hat Security Advisory 2022-1209-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Issues addressed include denial of service and out of bounds read vulnerabilities.

 Feed

Red Hat Security Advisory 2022-1213-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include denial of service and out of bounds read vulnerabilities.

 Feed

cmark-gfm, Github's markdown parsing library, is vulnerable to an out-of-bounds write when parsing markdown tables with a high number of columns due to an overflow of the 16bit columns count.

 Feed

Red Hat Security Advisory 2022-1199-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Issues addressed include a use-after-free vulnerability.

 Feed

Block, the company formerly known as Square, has disclosed a data breach that involved a former employee downloading unspecified reports pertaining to its Cash App Investing that contained information about its U.S. customers. "While this employee had regular access to these reports as part of their past job responsibilities, in this instance these reports were accessed without permission after

 Feed

The U.S. Treasury Department on Tuesday sanctioned Hydra, the same day German law enforcement authorities disrupted the world's largest and longest-running dark web marketplace following a coordinated operation in partnership with U.S. officials. The sanctions are part of an "international effort to disrupt proliferation of malicious cybercrime services, dangerous drugs, and other illegal

 Feed

Threat actors have been distributing malicious applications under the guise of seemingly harmless shopping apps to target customers of eight Malaysian banks since at least November 2021. The attacks involved setting up fraudulent but legitimate-looking websites to trick users into downloading the apps, Slovak cybersecurity firm ESET said in a report shared with The Hacker News. The copycat

 Feed

Ukraine's technical security and intelligence service is warning of a new wave of cyber attacks that are aimed at gaining access to users' Telegram accounts. "The criminals sent messages with malicious links to the Telegram website in order to gain unauthorized access to the records, including the possibility to transfer a one-time code from SMS," the State Service of Special Communication and

 Feed

Communication is a vital skill for any leader at an organization, regardless of seniority. For security leaders, this goes double. Communicating clearly works on multiple levels. On the one hand, security leaders and CISOs must be able to communicate strategies clearly – instructions, incident response plans, and security policies. On the other, they must be able to communicate the importance of

 Feed only

Graham Cluley Security News is sponsored this week by the folks at Axonius. Thanks to the great team there for their support! From new device types to the shift to hybrid work, the introduction of cloud infrastructure, and the rapid increase in SaaS adoption, complexity is increasing rapidly in IT and security environments. And what … Continue reading "Control IT and SaaS complexity with Axonius"

2022-04
Aggregator history
Wednesday, April 06
FRI
SAT
SUN
MON
TUE
WED
THU
AprilMayJune