– PSW #715

We seem to be getting better at identifying these: "The bad actor's NPM account has since been deactivated, and all the three libraries, each of which were downloaded 112, 4, and 65 times respectively, have been removed from the repository as of October 15, 2021."

Again, this sound like more of pointing out the problems, not the hard work of helping them fix the problems: "Nonprofits will also have access to free security assessments to help them understand the flaws in their endpoints, identity access, infrastructure, network, and data. The goal here is to help them create a remediation plan to protect their environments."

"Cybercriminals exploited a new remote code execution (RCE) zero-day, CVE-2021-40444, a week before a patch was released in September—that’s just one of the recent findings in a report by HP Wolf Security. On September 10, researchers discovered scripts on GitHub that automated the creation of the exploit, which ostensibly means that even less-savvy attackers can use it in their malicious actions, according to the company’s Quarterly Threat Insights Report." (Ref: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444) - Curious how they are doing this.

There is A LOT of legacy IT out there: "The Government Accounting Office (GAO) in the United States analyzed 65 federal legacy systems and revealed the 10 most critical systems were eight to 51 years old. In response, the U.S. government plans to spend over $100 billion this year on IT; most of that will go toward maintaining those older systems. " - How do we tackle this problem?

I don't believe we can regulate our way out of this problem: "Chris Clements, with Cerberus Sentinel, he isn’t convinced the efforts will make much of a dent in attacks. “First, some of the biggest purveyors of such software are based outside the U.S. where the regulation may not affect them,” Clements said. “Second, many of the most used tools are open source in nature, and it isn’t clear to me how these rules will impact their distribution.” He added, “Even if common open-source hosting organizations such as GitHub or GitLab were to enact GeoIP restrictions on the download of such designated intrusion software, it would seem trivial for a banned nation to simply VPN through a common VPN provider to bypass such restrictions."

"Unfortunately, most MFA users can be tricked into revealing their MFA codes or into letting an attacker steal their access control token by simply clicking on the wrong link sent in a phishing email. The link sends the victim to a “proxy” server that then links the victim to the legitimate destination server the victim thought they were going to in the first place. But the proxy server is now capturing everything sent from the legitimate destination server to the victim; and vice-versa. This includes any login information: login name, password and any provided MFA codes. The attacker can even capture the resulting access control token cookie, which allows the attacker to take over the victim’s session." - I don't believe MFA really prevents phishing attacks, I see it as helping prevent password brute-forcing and credential stuffing attacks.

"Congratulations to all the researchers recognized in this quarter’s MSRC Researcher Recognition Program leaderboard! Thank you to everyone for your hard work and continued partnership to secure customers." - Did you see this Apple? This is how it's done, recognition and respect for security researchers go a long way. Good job Microsoft!

What is basic cyber hygiene? Also, this is interesting and not talked about enough: "Detecting stolen credentials and resetting them before criminals can use them to infiltrate corporate networks is the most direct path to fighting ransomware before criminals can gain a foothold."

Really interesting: "The 'Gummy Browsers' attack is the process of capturing a person's fingerprint by making them visit an attacker-controlled website and then using that fingerprint on a target platform to spoof that person's identity." Better reference: https://www.bleepingcomputer.com/news/security/new-gummy-browsers-attack-lets-hackers-spoof-tracking-profiles/

Extremely technical write-ups linked in this article (you may have to read The Linux Programming Interface book first: https://man7.org/tlpi/) - One highlight I found interesting (and could actually understand): "memory corruption is a big problem because small bugs even outside security-related code can lead to a complete system compromise" (From Haroon's paper https://thinkst.com/resources/papers/38_Paper.pdf : "Memory corruption exploitation refers to the class of attacks that rely on ones ability to hijack the execution flow of a program by corrupting the applications memory space through a number of different possible attack vectors. The two most popular techniques of Stack and heap based exploitation are discussed below.")

So the solution is to do this: "People are clever and like to work things out for themselves. Ensure your awareness program takes this into account and does not patronize employees, nor make things needlessly difficult." (Make it a game, not too hard, but not too easy) and "Short and more frequent topics can be better than lengthy training sessions which take up several hours." (Break up the materials and exercises into smaller chunks) and "Part of creating a culture of cybersecurity involves removing the stigma associated with the fear that comes with having to report a mistake." (Don't punish your users) - My take: This is the same stuff we've been evangelizing and using for years. The fact remains that people still fall for phishing attacks and scams, so it's really NOT working...Also, love you Jaavid!

Whew, we are all saved now and the Internet is secure...

I was hoping to find swears and interesting stuff in the comments, a quick glance, I could not, but they did create a Hashcat shared library which is neat.

"All was well until the hippos started fucking. Now, there are up to 120 hippos roaming around Colombia, and they are considered one of the top invasive species in the world. Authorities have weighed a plan to kill the hippos off and on since 2009, and its recently gained steam." and then "Last July, Colombian attorney Luis Domingo Gómez Maldonado filed a lawsuit on the hippos’ behalf to save them from being euthanized. Instead, the case recommends sterilization. Colombian officials announced a plan to use a chemical contraceptive developed by the U.S. Agriculture Department to sterilize “the main group” of the hippos, and the region’s environmental agency Cornare began to implement the plan on Friday, darting 24 hippos." and somehow: "“So we applied for the hippos’ rights to compel their testimony in order to support the Colombian litigation, and now the [U.S. District Court for the Southern District of Ohio] has granted that application, recognizing that the hippos are interested persons.” This may seem like a minor and incremental step in the hippos’ court proceedings. But the implications of this decision could be huge. In granting this application, the district court recognized animals as legal persons for the first time in U.S. history."

https://flip.it/Ndxhia

https://flip.it/bLhSxb

At least one million users of a Chinese-run VPN service have had their personally identifiable information (PII) exposed due to a misconfigured Elasticsearch

A new survey of 300 US-based IT decision-makers found that 64% have been victims of a ransomware attack in the last 12 months, and 83% of those attack victims paid the ransom demand.

In a short tweet today, exploit broker Zerodium said that it is looking to acquire zero-day exploits for vulnerabilities in three popular virtual private network (VPN) providers NordVPN, ExpressVPN, and SurfShark VPN.