HAR files, Okta breach, EO on AI, Ransomware, Solarwinds CISO charged, and Bagels! – ESW #338

I recorded a simple HAR file of me logging into a VERY simple website that I regularly use. Maybe I need to do additional testing, but it was not possible for me to figure out which cookies or other elements to sanitize from the HAR file. The variable/cookie names looked randomly generated - there was nothing labeled "password", "secrets", or "OAuth key". Browsing the HAR file manually was also difficult, and I failed to locate the OAuth key that way as well.

In summary, I don't think the average employee would be successful in sanitizing HAR files, and I don't see a straightforward way to automate this process.

However, the attackers seem to have found a process to take advantage of them, however! They don't have to understand the HAR file or perform surgery on it, they can just use it as is to have a logged-in session.

Initially created by NCSC and now maintained by CISA, Logging Made Easy is a self-install tutorial for small organizations to gain a basic level of centralized security logging for Windows clients and provide functionality to detect attacks. It's the coming together of multiple free and open software platforms, where LME helps the reader integrate them together to produce an end-to-end logging capability. We also provide some pre-made configuration files and scripts, although there is the option to do it on your own.

Logging Made Easy can:

• Show where administrative commands are being run on enrolled devices
• See who is using which machine
• In conjunction with threat reports, it is possible to query for the presence of an attacker in the form of Tactics, Techniques and Procedures (TTPs)

I'm sad we overlooked the opportunity to call this the "Skynet Prevention Act"

Penetration tests have always had gaps. It's unavoidable - you just can't do everything the bad guys can do, like installing malware with a worm component in production environments. But it strikes me that, with the popularity of SaaS these days, pentests might be missing entire environments. The term SaaS, environments like Salesforce, M365, Google Workspace, Okta never come up in this NetSPI report.

Working in product marketing for a SaaS security vendor, one of my challenges has been figuring out why SaaS security isn't higher on folks' priority lists, and I suspect this might be part of the reason why. I mean, I get it - folks still have NT4, Server 2003 on their networks (hell, they still have "networks"), and that's scary as hell. But an Okta/M365 admin takeover is pretty scary as well, no?

Is SaaS in scope for modern pen tests? Is it even on pen testers' radars?

On its face, refusing to pay ransoms sounds like a great idea. However, 'winning' against cybercrime always comes with a cost. Here's my logic:

1. We convince everyone to stop paying ransoms and we win! Cybercriminals stop using ransomware and extortion as a means of making money.
2. The cybercriminals didn't go away, so they're going to use their sizable numbers, R&D budget, time, and skills to come up with a new way of making money.
3. They'll either shift to something else that's currently working (e.g. BEC, which is already several times more profitable than ransomware), or come up with something new.
4. Are we prepared for the new? Do we follow the trend and shift focus away from ransomware prevention to the new thing?
5. Most companies don't have fundamentals down, so this plays out badly for us. Again.

Could we even consider stopping ransomware a success, or a reasonable goal, given that most orgs won't be prepared for what comes next?

join this discussion here on LinkedIn

https://youtube.com/watch?v=hCOYg02hMA4&feature=shared

https://www.sec.gov/news/press-release/2023-227

Maybe there's an upside here though? Now CISOs can push back on pressure to bend the truth or lie, pointing to cases like these?

Lastly, we are continuing to push the envelope in vulnerability response and security updates for our cloud platforms.