Category: News

For over two years, malicious actors have been exploiting unpatched Microsoft Exchange Servers to deploy keylogger malware in targeted attacks.

These attacks primarily focus on entities in Africa and the Middle East, according to a recent report by Positive Technologies, a cybersecurity firm based in Russia.

The report details how attackers leverage known vulnerabilities collectively referred to as “ProxyShell” (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207). These vulnerabilities, patched by Microsoft in May 2021, allow attackers to bypass authentication measures, escalate privileges, and ultimately execute malicious code remotely.

Positive Technologies identified over 30 victims, including government agencies, banks, IT companies, and educational institutions. The earliest compromise linked to this campaign dates back to 2021, highlighting the ongoing threat posed by unpatched systems.

The attacks follow a specific pattern. First, attackers exploit the ProxyShell vulnerabilities to gain access to the targeted Exchange Server. They then inject malicious code into the server’s main login page (“logon.aspx”) and add a hidden function (“clkLgn()”) designed to capture user credentials when they attempt to log in. These stolen credentials are then stored in a file accessible from the internet, allowing attackers to harvest them remotely.

While the specific threat actor behind these attacks remains unknown, Positive Technologies urges organizations to prioritize patching their Microsoft Exchange Servers to the latest version. This is the most critical step in mitigating the risk of compromise.

For organizations that suspect their servers may already be compromised, Positive Technologies recommends inspecting the Exchange Server’s main login page for the presence of the “clkLgn()” function. Additionally, they advise checking the “logon.aspx” file for the path to a hidden file where stolen credentials might be stored. If a compromise is confirmed, organizations should immediately change compromised account credentials, delete the stolen credential file, and consider seeking assistance from cybersecurity professionals for remediation.

https://thehackernews.com/2024/05/ms-exchange-server-flaws-exploited-to.html

Credit images: Microsoft and Automation.com

A severe security flaw (CVE-2024-4323) in Fluent Bit, a widely used logging tool, could let attackers crash systems (DoS), steal data, or even take control (RCE).

A major security flaw has been identified in Fluent Bit, a widely used open-source logging utility. This vulnerability, dubbed “Linguistic Lumberjack” by Tenable research and tracked as CVE-2024-4323, carries a severity score of 9.8, indicating its critical nature.

Fluent Bit is no lightweight tool. Boasting billions of downloads and over 10 million daily deployments, it serves as a vital component for major cloud providers like Microsoft, Google Cloud, and Amazon Web Services (AWS). Tech giants such as Cisco, LinkedIn, VMware, Splunk, Intel, Arm, and Adobe also rely on Fluent Bit’s capabilities.

The vulnerability resides within Fluent Bit’s built-in HTTP server and stems from a memory corruption issue. This flaw could potentially be exploited by attackers to launch various malicious attacks. Tenable has confirmed that an attacker with access to the Fluent Bit monitoring API could leverage this vulnerability to:

• Launch Denial-of-Service (DoS) attacks: These attacks aim to overwhelm a system with requests, rendering it unavailable to legitimate users.
• Steal sensitive information: Attackers might be able to exploit the vulnerability to gain access to confidential data stored within the logs.
• Potentially achieve remote code execution (RCE): While Tenable acknowledges the possibility of RCE, successful exploitation depends on factors like the operating system and underlying architecture.

While creating a reliable exploit for RCE might be complex, Tenable has publicly released technical details and a proof-of-concept (PoC) exploit that demonstrates the feasibility of DoS attacks.

The good news is that a patch has been developed by Fluent Bit developers. However, it hasn’t been integrated into an official release yet. Tenable has also notified major cloud providers like Microsoft, AWS, and Google Cloud to ensure a coordinated response.

In the meantime, users deploying Fluent Bit within their own infrastructure can implement mitigation strategies. These include restricting access to the tool’s API and disabling the vulnerable endpoint if it’s not actively used.

https://www.securityweek.com/vulnerability-found-in-fluent-bit-utility-used-by-major-cloud-tech-companies

In today’s rapidly evolving digital landscape, cybersecurity has become a critical concern for organizations across all industries. As threats continue to proliferate and regulations become more stringent, the need for effective Governance, Risk, and Compliance (GRC) practices has never been greater. GRC professionals play a vital role in helping organizations navigate the complex cybersecurity landscape, manage risks, and ensure compliance with regulatory requirements. If you’re passionate about cybersecurity and interested in pursuing a career as a GRC professional, this comprehensive guide will provide you with the insights and steps needed to embark on this rewarding journey.

Understanding GRC in Cybersecurity

Before diving into the specifics of becoming a GRC professional, it’s essential to have a solid understanding of what GRC entails in the context of cybersecurity. Governance refers to the establishment of policies, procedures, and oversight mechanisms to ensure that cybersecurity efforts align with organizational objectives and regulatory requirements. Risk management involves identifying, assessing, and mitigating cybersecurity risks to protect the organization’s assets and interests. Compliance entails adhering to relevant laws, regulations, and industry standards to maintain legal and regulatory compliance.

GRC professionals integrate these three components to develop comprehensive cybersecurity strategies that address governance, risk, and compliance requirements effectively. They collaborate with various stakeholders, including executives, IT teams, legal counsel, and regulatory authorities, to establish robust cybersecurity frameworks and ensure adherence to best practices.

Steps to Becoming a GRC Professional in Cybersecurity

1. Gain a Strong Foundation in Cybersecurity: Start by acquiring a solid understanding of cybersecurity principles, concepts, and technologies. Pursue relevant certifications such as CompTIA Security+, Certified Information Systems Security Professional (CISSP), or Certified Information Security Manager (CISM) to validate your knowledge and skills in the field.
2. Develop Expertise in GRC: Familiarize yourself with the principles and practices of Governance, Risk, and Compliance. Learn about relevant frameworks and standards such as ISO 27001, NIST Cybersecurity Framework, and GDPR. Understand the role of GRC in cybersecurity governance, risk assessment, compliance management, and audit processes.
3. Acquire Industry Experience: Gain hands-on experience in cybersecurity and GRC through internships, entry-level positions, or volunteer opportunities. Work in roles such as cybersecurity analyst, risk assessor, compliance specialist, or auditor to develop practical skills and insights into real-world challenges and solutions.
4. Enhance Soft Skills: Develop strong communication, leadership, problem-solving, and analytical skills. GRC professionals need to effectively communicate complex cybersecurity concepts to non-technical stakeholders, collaborate with cross-functional teams, and make informed decisions to address risks and compliance issues.
5. Stay Updated on Industry Trends: Keep abreast of the latest developments, trends, and emerging threats in cybersecurity and GRC. Attend industry conferences, webinars, and workshops, participate in professional networking events, and engage with online communities and forums to stay informed and connected.
6. Obtain Advanced Certifications: Consider pursuing advanced certifications in GRC to further enhance your credentials and expertise. Certifications such as Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Auditor (CISA), or Certified Information Security Manager (CISM) are highly regarded in the GRC field.
7. Build a Professional Network: Network with fellow cybersecurity professionals, GRC practitioners, industry experts, and potential employers. Join professional organizations such as ISACA, (ISC)², or the Information Systems Security Association (ISSA) to expand your network, access resources, and explore career opportunities.
8. Continuously Learn and Grow: Cybersecurity is a dynamic and evolving field, so it’s crucial to embrace lifelong learning and professional development. Stay curious, pursue advanced training and certifications, and seek opportunities for mentorship and career advancement.

Conclusion

Becoming a GRC professional in cybersecurity requires a combination of technical expertise, GRC knowledge, industry experience, and soft skills. By following the steps outlined in this comprehensive guide and remaining committed to continuous learning and growth, you can embark on a fulfilling career path in GRC and contribute to safeguarding organizations against cyber threats while ensuring regulatory compliance and good governance.

In recent years, the landscape of ethical hacking and penetration testing has seen a significant transformation with the emergence of automated tools. These tools play a crucial role in accelerating the testing process, aiding organizations in safeguarding their information and systems. Ethical hacking not only fortifies defenses but also enhances the skill sets of security professionals within an organization, making it an invaluable component of security efforts.

Understanding Hacking Tools and Software Hacking entails utilizing various computer programs and scripts to access unauthorized data for the purpose of bolstering security measures within computer systems or networks. These hacking tools, developed by skilled developers, are employed by security professionals to identify weaknesses in operating systems, web applications, servers, and networks. While they are available in both open-source and commercial forms, it’s essential to recognize their intended purpose and usage.

The Evolution of Network Administration The realm of network administration has experienced remarkable growth, transitioning from mere network monitoring to encompassing tasks such as firewall management, intrusion detection systems (IDS), VPNs, and anti-virus software. This evolution underscores the increasing complexity and importance of maintaining network security.

Prominent Hacking Tools Some of the most renowned hacking tools in the market include Nmap (Network Mapper), Nessus, Nikto, Kismet, NetStumbler, Acunetix, Netsparker, Intruder, Metasploit, and Aircrack-Ng. These tools empower security professionals to conduct tasks such as network scanning, vulnerability assessment, and intrusion testing effectively.

Understanding the Importance of Hacking Software Despite concerns about potential damage to computer systems, the reality is that ethical hacking tools are instrumental in safeguarding valuable assets and data from malicious attacks. Employers recognize the critical need for expert professionals who can protect their systems from threats. Hacking software offers essential features such as inside and outside security for end-users, network testing and vulnerability assessment capabilities, thereby enhancing overall security posture.

Ethical hacking, crucial for safeguarding information and systems, relies heavily on automated tools. These tools, designed to identify vulnerabilities, assist security professionals in fortifying defenses. Here’s a concise overview of some top ethical hacking tools:

1. Nmap: Network security mapper for host and service discovery.
2. Nessus: Widely-used vulnerability scanner for unpatched services, weak passwords, and system vulnerabilities.
3. Nikto: Web server scanner for identifying outdated software and dangerous files.
4. Kismet: Wireless network testing tool for detecting hidden networks.
5. NetStumbler: Detects wireless networks and unauthorized access points.
6. Acunetix: Automated web vulnerability scanner for XSS and SQL Injection.
7. Netsparker: Identifies web application vulnerabilities like cross-site scripting and SQL Injection.
8. Intruder: Automated scanner for cybersecurity weaknesses with over 9000 security checks.
9. Metasploit: Open-source framework for penetration testing and exploit development.
10. Aircrack-Ng: Command-line tool for assessing Wi-Fi network security.
11. Wireshark: Packet analyzer for deep inspection of data packets.
12. OpenVAS: Fully-featured vulnerability scanner for authenticated and unauthenticated testing.
13. SQLMap: Automates detecting and exploiting SQL Injection flaws in database servers.
14. Ettercap: Content filtering and live connection sniffer.
15. Maltego: Link analysis and data mining tool.
16. Burp Suite: Web vulnerability scanner with scan scheduling and CI integration.
17. John the Ripper: Password cracker for UNIX passwords.
18. Angry IP Scanner: Scans IP addresses and ports for network analysis.
19. SolarWinds Security Event Manager: Automatically detects threats and monitors security policies.
20. Traceroute NG: Network path analysis tool for host names and packet loss detection.
21. LiveAction: Diagnoses network issues with packet intelligence.
22. QualysGuard: Cloud-based vulnerability testing for compliance and security.
23. WebInspect: Automated dynamic testing tool for web application security.
24. Hashcat: Cracking tool for auditing password security and retrieving lost passwords.
25. L0phtCrack: Password recovery and audit tool for local networks and machines.
26. Rainbow Crack: Uses rainbow tables to crack hashes.
27. IKECrack: Authentication cracking tool for dictionary or brute-force attacks.
28. Sboxr: Vulnerability testing tool with customizable security scanners.
29. Medusa: Speedy password cracker for parallel testing.
30. Cain and Abel: OS password recovery tool for Microsoft systems.
31. Zenmap: Official Nmap Security Scanner for network discovery and analysis.