Tomi Tuominen

The Danish SektorCERT reported two waves of attacks on 22 large and small critical infrastructure providers via unpatched vulnerabilities in Zyxel firewalls deployed between IT networks and the Internet. The SektorCERT report describes the first wave as exploiting a Zyxel vulnerability published two weeks before the first attack, and the second as exploiting a Zyxel zero day. The CERT further reported that in response to the attacks, utilities went into “island mode,” disconnecting their firewalls from the Internet until they could be repaired. Interested in learning more about the 68 cyber attacks that impaired operations at over 500 sites in 2023? Download the 2024 Threat Report ➡️ https://bit.ly/3wZhx58

11

Blue and Red Teams watch out: This is how Offensive Packer Development works   Our colleagues Fabian M. and Sven Rath held a workshop on malware development at the cyber security conference "x33fcon" in Gydnia, Poland. They showed how a packer can be used to bypass endpoint detection systems and how the process of packing payloads can be automated.   All information and tasks of the workshop, the presentation and code snippets have been published in our new r-tec Github repository for all interested parties: https://lnkd.in/gJ_fW5WD   Thanks to Fabian M. and Sven Rath for the preparation and for sharing!    Every year, x33fcon brings together blue and red teamers, pentesters, incident responders, analysts and researchers to learn together how attackers and defenders think and behave today. The conference features top-class presentations on team collaboration, case studies and in-depth insights into attack and defense techniques.    We are delighted that our colleagues are engaged in this area and share their expertise.   #cybersecurity #itsecurity #hacker #malware

78

Detection Engineering Weekly Issue 68 is LIVE! https://lnkd.in/dhvuCC4Y In this post: * Adam . 💎 of a post on artifact collection and understanding the importance of process and diligence in forensics. * Hope Walker drops a great follow-up post on manually querying ldap during red team exercises, investigation and detection ideation, Casey Smith on parsing DFIR Report blogs to look for detection opportunities with canaries, Dirk-jan Mollema on temporary access passes in Azure leading to NT hash dumping, Mary Asaolu and Thabet Awad on hunting in Azure subscriptions, and Diverto researchers on using Microsoft Print services as a C2 * Podcasts: Kara Swisher interviews Dmitri Alperovitch and Chris Krebs on preventing war with China and it's security implications, Odd Lots podcast on CHIPS act updates, and Mackenzie Foss and Rachel Schwalk join the Hou.Sec.Cast folks to talk threat detection and BEC * Threat landscape: Kevin Beaumont and his thoughts on CSRB's report on Microsoft, Lumen Technologies uncovers Cuttlefish malware, Hudson Rock dox on Spy Pet, and DoJ drops a dox on LockBitSupp

52

Latest security breach in Finland is good reminder that legacy identity solutions has come to an end. You must make a transformation to new cloud-based identity solutions to make sure your AI and business is secure. These two articles are good place to start to get overview what will change. If you must use VPN or proxy server, you are working in legacy environment - and it's time to change that. Start the journey today, before it's too late. "Traditional network security approaches that use legacy VPNs simply cannot scale to modern demands. Once your remote users connect to your corporate network through VPN, they are granted excessive access to your entire network, all it takes is a single compromised user account, infected device, or open port for an attacker to gain entry, move laterally, and access your most critical assets.   Microsoft Entra Private Access, an identity-centric Zero Trust Network Access (ZTNA), reduces the operational complexity and cost of legacy VPNs, while eliminating excessive access and preventing lateral movement. It modernizes access to private applications and resources, helping users quickly and easily connect to private applications from any device and any network, whether they’re at home, remote, or in their corporate office." https://lnkd.in/dakbiAz6 https://lnkd.in/dqDvcUtu #Identity #Microsoft #Entra

70

2 Comments

Detection Engineering Weekly #70 is live! https://lnkd.in/eQubGHYj I had a copy/paste error (human operator error) in the initial post, so it's now fixed :) In this post: *  💎 by David Burkett on being an analyst vs. an engineer and the gatekeepy-ness security people tend to leverage in this conversation * Microsoft's Ross Bevington unveils a part of their deception infrastructure and how infosec Twitter discovered one of their honeypot domains * Pass/Vail vs A-Grade security projects by Phil Venables <-- this one I copy-pasted content from Notion and the original post in email had the incorrect text. It's now updated! * Truvis T. detection opportunities and leveraging Microsoft Sentinel for Linux auditd * Victor Manuel Alvarez launches YARA-X * The Vertex Project thesilence on threat clustering * Podcasts featuring Jeff Bollinger on how LinkedIn does detection & response, and Mandiant researchers on 0-day and N-day vulnerability and incident response * Daniel Stepanic and samir bousseaden on LATRODECTUS as a drop-in replacement for ICEDID, Volexity unveils some detection opportunities for Palo Alto GlobalProtect devices, Rockwell Automation wants us to pull the plug on their devices connected to the internet, BlackBasta infra hunting and a new Linux backdoor from Kimsuky

53

2 Comments

Are you aware of Tycoon 2FA phishing KIT? No :O? Maybe you should go on reading the article… https://lnkd.in/dmy7BKGF #software #programmer #cloud #phishing #cybersecuritytraining #networking #itsecurity #ransomware #hacked #internet #computer #data #iot #hackingtools #networksecurity #bhfyp #cloudcomputing #anonymous #databreach #ai #windows #cloudsecurity #java #developer #microsoft #cybersecuritynews #innovation #datascience #machinelearning #bugbounty

1

Great information, Here are few more: - Having Compliance-Driven Priorities (focusing too much on non-technical aspect of security) - Absence of Remediation Framework (not knowing what to do after getting the vulnerabilities detected) - Lack of Vulnerability Management (Knowing what to do with vulnerabilities, but not being able to drive a system to keep it running for a really long time)

9

3 Infostealers related blogs we published this month ⬇ 1. Single Citrix Compromised Credential Results in $22,000,000 Ransom to Change Healthcare (https://lnkd.in/dV_GTvuk) 2. Identity Behind Massive Discord Spying Tool Revealed due to Infostealer Infection (https://lnkd.in/dyFkgSwJ) 3. Initial Access Brokers, Infostealers, and Everything Between Them (https://lnkd.in/d7Hx2znF) Submit your email to get free alerts in case you ever get infected by an Infostealer!

26

5 Comments

Reminder of the obvious...or not! Both anonymisation and pseudonymisation are used to technically implement data protection principles such as data minimization. Pseudonymisation is also explicitly mentioned in the GDPR and Kenya DPA as a technique that can support data protection by design (Art. 25 GDPR) and (Art. 41 Kenya DPA) and security of personal data processing (Art. 32 GDPR). Pseudonymised data, which can be (re)attributed to a natural person with the use of additional information, are personal data and GDPR and KDPA data protection principles apply to them. Anonymous data are not considered as personal data - anonymous information refers to information which does not relate to an identified or identifiable natural person. “𝘈𝘯 𝘦𝘧𝘧𝘦𝘤𝘵𝘪𝘷𝘦 𝘢𝘯𝘰𝘯𝘺𝘮𝘪𝘴𝘢𝘵𝘪𝘰𝘯 𝘴𝘰𝘭𝘶𝘵𝘪𝘰𝘯 𝘱𝘳𝘦𝘷𝘦𝘯𝘵𝘴 𝘢𝘭𝘭 𝘱𝘢𝘳𝘵𝘪𝘦𝘴 𝘧𝘳𝘰𝘮 𝘴𝘪𝘯𝘨𝘭𝘪𝘯𝘨 𝘰𝘶𝘵 𝘢𝘯 𝘪𝘯𝘥𝘪𝘷𝘪𝘥𝘶𝘢𝘭 𝘪𝘯 𝘢 𝘥𝘢𝘵𝘢𝘴𝘦𝘵, 𝘧𝘳𝘰𝘮 𝘭𝘪𝘯𝘬𝘪𝘯𝘨 𝘵𝘸𝘰 𝘳𝘦𝘤𝘰𝘳𝘥𝘴 𝘸𝘪𝘵𝘩𝘪𝘯 𝘢 𝘥𝘢𝘵𝘢𝘴𝘦𝘵 (𝘰𝘳 𝘣𝘦𝘵𝘸𝘦𝘦𝘯 𝘵𝘸𝘰 𝘴𝘦𝘱𝘢𝘳𝘢𝘵𝘦 𝘥𝘢𝘵𝘢𝘴𝘦𝘵𝘴) 𝘢𝘯𝘥 𝘧𝘳𝘰𝘮 𝘪𝘯𝘧𝘦𝘳𝘳𝘪𝘯𝘨 𝘢𝘯𝘺 𝘪𝘯𝘧𝘰𝘳𝘮𝘢𝘵𝘪𝘰𝘯 𝘪𝘯 𝘴𝘶𝘤𝘩 𝘥𝘢𝘵𝘢𝘴𝘦𝘵.” Data anonymisation is an optimization problem between two conflicting parameters: data utility and re-identification protection. In fact, data anonymisation is achieved by altering the data, either by noising or by generalizing. Data anonymisation therefore entails finding the best trade-off between these two parameters. This trade-off often depends on the application and the context (i.e., how the dataset is distributed and used). 𝘈𝘥𝘢𝘱𝘵𝘦𝘥 𝘧𝘳𝘰𝘮 𝘌𝘕𝘐𝘚𝘈 𝘗𝘌 𝘙𝘦𝘱𝘰𝘳𝘵 Image Creds: Decalex #dataprivacy #dataprotection Privacy Innovation Lab

2

https://lnkd.in/dMYyXUpz Helsinki suffers #databreach after #hackers exploit unpatched flaw The City of #Helsinki has recently discovered a data breach in its #education division that has impacted tens of thousands of students, guardians, and personnel. While the #breach was initially reported in May, authorities have now shared further details in a press conference. It was revealed that an unauthorized actor exploited a vulnerability in a remote access #server to gain access to a network drive. Although a #security patch for the vulnerability was available, it had not been installed at the time of the attack. While most of the accessed files did not contain personally identifiable information, some included #usernames, #email addresses, personal IDs, and physical addresses. The #investigation is ongoing, and the city is taking all necessary measures to prevent such #breaches in the future. #endpoint #cloudsecurity #smallbusiness #infosec #business  #bankingindustry #cyber #endpointsecurity #iotsecurity #IoT #UK #informationsecurity #cyberawareness #technology #datasecurity #cloud #google #microsoft #windowssecurity #vulnerability #securityawareness #riskmanagement #dataprivacy #infrastructure #globalsecurity #threatintelligence #socialmedia #news #defensivemeasures #EU #knowledgebase #linkedin #networksecurity #vulnerability #smartcity #HomelandSecurity #smartcities #internetofthings #UnitedKingdom #EuropeanUnion #AsiaPacific #emailsecurity

4

Social engineering attacks are on the rise, powered by AI. Learn how attackers use deepfakes, voice synthesis & chatbots to bypass defenses. But there's hope! Discover how AI-powered MDR can fight fire with fire & protect your organization. #cybersecurity #AI #MDR

17

1 Comment

ChatGPT gives you the basics, but NIS2 is more than compliance checkboxes. OT pros: In this guide we avoid the obvious and discuss the practical implications of NIS2 for OT professionals - In other words, have to use NIS2 to your advantage #NIS2days #NIS2 ➡️ https://lnkd.in/drWzvU7G

8

NIS2 Directive. This becomes law in 5 months (mid October) and recent poles show that 34% of in-scope organisations haven't started their preparation. Many organisations are unsure if they are even in NIS2 scope or not. Also, many think NIS2 is just about Cyber, which is only part of the picture. NIS2 is about the survivability of your organisation when challenged by multiple types of threat, varying from environment to supply chain.

3

Unlock Full SIEM Potential: Effortlessly Ingest CrowdStrike Events Into Your Open Source SIEM!

36

So critical to move protections and most importantly, visibility, directly to graph nowadays. In a world that moved to APIs a decade ago, it’s been hard as a customer to leverage security at this level before.

7