Ethical Hacking

Wade Mackey

Main Content

FBI spams thousands with fake infosec advice after ‘software misconfiguration’

By Leave a Comment

In what is one of the bigger news items of the week, the FBI has had one of their servers compromised and fake emails sent out from it. Since the emails were sent from one of the FBI’s servers they appeared legitimate in nature, as they actually came from their domain. The emails that were sent out were a false warning that the FBI had detected a chain attack and that the company’s virtual servers had been exfiltrated. It also laid blame for the attack at Vinny Troia’s feet, who is the founder of infosec firms Shadow Byte Cyber and Night Lion Security. It does not appear that this is the case. In total about 100,000 of these emails were able to be sent out before the campaign was stopped.

 

https://www.theregister.com/2021/11/15/fbi_fake_emails/

Attack the block – How a security researcher cracked 70% of urban WiFi networks in one hit

By 1 Comment

A CyberArk researcher, Ido Hoorvitch, identified that many urban areas have unsafe and weak WiFi passwords that can be easily cracked. Hoorvitch collected 5,000 Wifi hashes around his neighborhood using network sniffing equipment. These were run through CyberArk’s “monster” password cracking rig which used an exploit found in PMKID hashes.

Hoorvitch noted that many people use cell phone numbers as their WiFi password. This allowed him to crack numerous hashes, obtain passwords, and then access their networks. In the cases where a phone number was used, it took approximately nine minutes for each crack. If routers do not support roaming modes, then they are not susceptible to this attack. It is recommended that complex passwords should be used with secure encryption protocols. WAP/WAP1 should be disabled.

Author: Matias Madou
Published: October 20, 2021
Link

The Top 3 Cyber Security Mistakes and How to Avoid Them

By Leave a Comment

Ransomware cost Americans an estimated $1.4 billion last year, and beyond high-profile hacks like the Kaseya and Colonial Pipeline breaches, cyber threats are more common than ever. As a result, businesses of all sizes are scrambling to learn more about cyber security and ensure that they have the proper measures in place to protect their operations. These are the top three considerations organizations must take into account when implementing or upgrading their cyber security approach.

  1. People and Training

First and foremost, there is a significant lack of cybersecurity education among employees. The human firewall is the most important defense, but it is also the most vulnerable. That means security training has to be a top priority when it comes to an organization’s cyber security. Organizations should implement a security awareness training platform which trains, tests and scores all employees. It’s important to teach employees how to identify cyber security threats and remain vigilant toward anything suspicious, such as scams, fraudulent emails, or even physical threats. It’s also important to consider implementing some sort of email gateway filter. With the rise of remote working, additional problems emerge as more people go mobile. For example, it is much easier on mobile to mix company and private mail and people tend to click quickly, which leads to errors. We all need to slow down, verify incoming requests and be cognizant of what we are clicking on so that we do not fall victim to a cyber security threat.

 

  1. Technology and System

It is also paramount that organizations ensure systems are fully patched, inclusive of their OS, firmware and applications. They must ensure each endpoint detection and response application is installed on each device, with all systems reporting back to a central location or Security Operation Center, where all notifications, events, and alarms can be correlated. A quality Detection and Response application is not only going to defend against malware and other malicious activity, but it will also identify possible insider threats by monitoring lateral traffic. Utilizing such Security SaaS should be part of the overarching security platform which will provide a level of behavioral analytics with the ability to determine what is standard for that user and/or system. Therefore, this allows organizations to identify unusual activity, even if the user has the rights to the systems being accessed.

Additionally, I would suggest V-LANs and least privilege access or even zero trust as a greater security play. For example, IoT devices should not cohabitate on the same V-LAN as the accounting or human resources department. This type of network segmentation allows for greater risk reduction.

 

  1. Staffing and Security Operations

Many organizations forgo the managed services model to create an in-house security operation center, believing they can do it themselves. There are many cyber security tools available; however, there are very few trained and certified security engineers, and these tools often rely upon alarms, event notifications, or automated messaging to provide alerts. However, this begs the question, who will be monitoring and mitigating the environment at 3 a.m. on New Year’s Eve? Effective cyber security infrastructure requires extensive resources to reduce the total volume of alerts, alarms and events to an actionable notification which requires mitigation. Vacation, training, sick time, education and retention programs are all factors to consider when creating a security operator center. There is a deficit of security analysts, engineers and architects throughout the cyber security space today. Even if you can hire a strong team of cyber security specialists, security operation centers require at least five to six people to ensure 24/7 coverage.

In addition to the personnel issues, there are also equipment, software updates and proper configuration to consider. True quality deployment will require multiple layers, and the systems will have to be integrated, monitored and managed. In comparison, an organization that outsources its cyber security needs can depend upon systems being maintained and a team of experts to support them. Simply put, organizations should secure their environment through a third-party managed security service. These services are inclusive of EDRs, patching systems, a security information event manager, behavioral analytics and east/west traffic monitoring. At best, with the current staffing shortage, an in-house SOC is an ineffective method to detect, quarantine and/or remediate an infected device and/or network.

Hackers are only becoming more sophisticated and, big or small, no organization can afford to go unprotected. Being aware of these three points is critical in protecting your organization from cyber threats. In the current cyber security environment, there is no room for mistakes.

The Top 3 Cyber Security Mistakes and How to Avoid Them – Cyber Defense Magazine

New macOS zero-day bug lets attackers run commands remotely

by 1 Comment

Researchers discovered a flaw in Apple’s MacOS Finder which allows for arbitrary command execution on Mac devices.  This was previously thought to be remediated, notably without a CVE number, but a workaround was found. The exploit occurs when an INETLOC file is opened which contains the File:// prefix.  These files are bookmarks that can be used to open online resources such as: (news://, ftp://, afp://) or local files (file://).

Apple’s previous patch only blocked the all lowercase file:// prefix.  Different cases, e.g. File://, fiLe://, can bypass the check added by the prior patch.  The vulnerability can be exploited via email  by including an INETLOC file as an attachment. This is particularly concerning as commands embedded by an attacker can be executed without prompting the user. Exploit proof of concepts went undetected by antimalware programs.

 

Article: New macOS zero-day bug lets attackers run commands remotely

Author: Sergiu Gatlan

Published: September 21, 2021 

Site: bleepingcomputer.com

Link: https://www.bleepingcomputer.com/news/apple/new-macos-zero-day-bug-lets-attackers-run-commands-remotely/

Filed Under: Tagged With:

Google to Auto-Reset Unused Android App Permissions for Billions of Devices

by 1 Comment

This article touches on some new app permissions Google is pushing out. They are making it so apps that haven’t been used in months will auto-reset their permissions. This is a step in the correct direction for user privacy and security, as app permission can be overreaching often times. And usually it is the apps that are forgotten about and left on the phone that are the ones with too much access. Resetting the permissions makes it so the user is more in control of what permission they are allowing apps, and for how long.

 

 

https://thehackernews.com/2021/09/google-to-auto-reset-unused-android-app.html

Ex-U.S. Intelligence Officers Admit to Hacking Crimes in Work for Emiratis

by 2 Comments

I found this trending article about how three former American intelligence officers hired by the United Arab Emirates to carry out sophisticated cyberoperations admitted to hacking crimes and to violating U.S. export laws that restrict the transfer of military technology to foreign governments.

The men helped the Emirates, a close American ally, gain unauthorized access to “acquire data from computers, electronic devices and servers around the world, including on computers and servers in the United States.

The three men worked for DarkMatter, a company that is effectively an arm of the Emirati government. They are part of a trend of former American intelligence officers accepting lucrative jobs from foreign governments hoping to bolster their abilities to mount cyberoperations.

Link: https://apnews.com/article/technology-united-states-hacking-5700a1fa8b1b4612477658b883e58f31

Bank digitisation is not all it’s cracked up to be

by 2 Comments

Article: Rapid digitisation of banks invites cyber risks as well. What are the risks, and what should banks do?
Author: Ishwari Chavan
Published: September 20, 2021, 09:24 IST
Site: CIO.com The Economic Times
Link: Article

Going digital without care is not the way to go for financial institutions. This article reports an increase in cyberattacks focused on banking institutions to a whopping 238% between Feb 2020 and April 2020 (VMWare Carbon Black). Anywhere from phishing, network scanning and probing (Recon work), viruses and website hacking has been methods used in the attempt to penetrate organizations. PII containing applications are particularly vulnerable due to the simple fact that they have “minimal to no security”. With everything moving to some kind of cloud, the boundaries have been deleted and hackers have new ways of “getting in”. Increasing the vulnerable points of an application has increased the risk. Even if the banks are secure, think about the third party applications that interface – Venmo, Facebook, Zelle, and Paypal to name a small few. The article encourages a collaborative effort for financial institutions to counter against these attacks and vulnerabilities. “Banks are required to reimagine some of their own technology and adapt to a three-year or four-year journey.”

Kali Linux 2021.3 released with new pentest tools, improvements

by 2 Comments

I thought this article was timely as we’re just getting started with Kali.  The latest version of Kali includes a new set of tools, improved virtualization support, and new OpenSSL configurations.  These new additions may come in handy later in the course as we explore related topics. 

Highlights of this release include:

  • Wide default compatibility for OpenSSL
    • Enables older, insecure protocols in OpenSSL to increase the attack surface for penetration testing.
  • New Tools
    • HostHunter looks particularly interesting for hostname recon. 
  • Improved VM support
    • The Live image can be used in a virtualized environment and supports copy, paste, and drag/drop functionality natively.
  • Smartwatch support for Kali NetHunter  
    • This looks super cool and supports Bad USB and NMap scans.  
  • Improved ARM support for devices like the Raspberry Pi.

Users can update by downloading the latest ISO at http://cdimage.kali.org/kali-2021.3/ or follow the upgrade instructions detailed in the article.  

Article: Kali Linux 2021.3 released with new pentest tools, improvements

Author: Lawrence Abrams

Published: September 15, 2021

Link:https://www.bleepingcomputer.com/news/security/kali-linux-20213-released-with-new-pentest-tools-improvements/

The Increase in Scope of Cybersecurity from Software to Hardware Protection

by 1 Comment

Consumer focused hardware companies are delivering more products than ever before due to the popularity of IoT technology. IoT devices promise to save consumers time and money by automating repeat takes and applying insights that previously weren’t possible. “The GSM Association estimates that by 2025 there will be almost 25 billion IoT devices deployed in the world.” The prevalence of IoT hardware comes with an increased cybersecurity risk.

Connected hardware has an increased cybersecurity risk because it is tangible. In other words, it can directly affect the world in which it resides.  The article provides an interesting example of a robot being compromised and directed to move to a new location to be sold for parts.

The author provides a few suggestions for hardware manufacturers to pursue to help increase cybersecurity in their products.

  • Design with cybersecurity in mind and allow products to be updated in response to new threats.
    • Improve firmware verification and error checking.
    • Support for encryption methods like AES, DES, etc.
    • Adding secure key storage 
  • Expand Data Access Controls
    • User vetting and verification must be added to the user authentication pipeline. 
      • “Keys and other access mechanisms are methods, they are not proofs of identity. We cannot blindly trust the keyholder. This is security backward. The keyholder must be vetted as well.”
  • Increase CIO/CISO Roles in hardware IoT companies
    • Companies cannot afford to risk losing competitive advantages by not having CIO/CISO

Article: The Increase in Scope of Cybersecurity from Software to Hardware Protection

Author: Neil Okikiolu

Published: September 8, 2021

Link: https://cisomag.eccouncil.org/the-increase-in-scope-of-cybersecurity-from-software-to-hardware-protection/

Private and Public Collaboration Initiative in the US

by 1 Comment

Article: CISA Launches JCDC, the Joint Cyber Defense Collaborative
Author: Kelly Jackson Higgins
Published: August 5, 2021, 8:55 PM
Site: DARKReading.com

What is the best defense against all the cyber attacks our country has experience in the last few years? What is the best response? What is the best approach and strategy?

Jen Easterly may have an answer – COLLABORATION! Easterly is the newly appointed Cybersecurity and Infrastructure Security Agency director and has launched an initiative to band the public and private sectors of the security industry to work together and “proactively address and defend” against the cyberattacks in the US. The initiative is called Joint Cyber Defense Collective (JCDC) goals are to increase awareness on the threat landscape that we face today and map that landscape to actual operational “blueprints”.

The first items on the agenda are ransomware and cloud security. Goals are to plan a “framework to respond to cyber incidents affecting CSPs”.

The collaborating pool of entities is impressive!

  1. Government: CISA, Dept of Defense, US Cyber Command, NSA, FBI and Office of the Director of National Intelligence.
  2. Future: Dept of Energy, Transportation, EPA, & FDA will be soon to follow.
  3. Private: AWS, AT&T, CrowdStrike, FireEye Mandiant, Google Cloud, Lumen, Microsoft, Palo Alto Networks, and Verizon.

This is an exciting turn of events and about time. The US needs to leverage the knowledge and strengths from ALL sectors to combat the ever growing mal-actors that are waiting in the sidelines to disrupt our world. I look forward to following this initiative closely and even looking into how to get involved! Cyber security is our future and the sooner we become part of the solution the better.

Vanessa

Reference:

https://www.darkreading.com/threat-intelligence/cisa-launches-jcdc-the-joint-cyber-defense-collaborative/d/d-id/1341592

 

McDonald’s Email Blast Includes Password to Monopoly Game Database

by 2 Comments

I found this article very entertaining because it is hard to believe such simple mistakes are made like this. Emails were blasted out to the winners of McDonald’s Monopoly game last week and within those emails contained userID and passwords that had access to a server containing the information for the game. McDonald’s has since stated that the passwords were changed and the initial email was due to a human error. It is just another example that no matter how robust the security of an organization is that the human element is always the most dangerous and unpredictable.

McDonald’s Email Blast Includes Password to Monopoly Game Database

Bold Cybercriminals

by 1 Comment

Article: BlackMatter Ransomware Attacks Threaten Healthcare, HC3 Says

Author: Jill McKeon

Published: Sept 09, 2021

Probably the most interesting article I’ve read all week! BlackMatter is a ransomware group that provides RaaS – Ransomware as a Service that has one motivation – $$.

BlackMatter has roots in Eastern Europe and have targeted victims North/South America and Asia with a focus on real estate, IT, F&B, architecture, education and finance sectors. Though it claims to “not target hospitals, critical infrastructure facilities, nonprofit companies, government, the defense industry, or the oil and gas industry” it is imperative to know that it’s connection to DarkSide and REvil/Sodinokibi is making that claim doubtful. (Darkside was the threat actor in the the Colonial Pipeline hack.)

The BlackMatter group makes it a business to sell credentials, VPN logins  and webshells to ransomware groups.

Highly recommend you read the article. It is insightful into how bold these cybercriminals are. No longer even a secret. Now it’s a service.

Source: https://healthitsecurity.com/news/blackmatter-ransomware-attacks-threaten-healthcare-hc3-says