Satori Adds Known Exploit Chain to Enslave Wireless IP Cameras

Satori, a Mirai based IoT bot, has been one of the most actively updated exploits in recent months. It is believed that the hacker behind this bot is also the author of other Mirai variants, known as Okiru, and Masuta. FortiGuard Labs researchers recently observed a new Satori version that had added a known exploit chain (one which had been used in the past by the Persirai bot) to enable it to spread to vulnerable devices, particularly, wireless IP cameras that run a vulnerable custom version of the GoAhead web server.

The post Satori Adds Known Exploit Chain to Enslave Wireless IP Cameras appeared first on Security Boulevard.

from Satori Adds Known Exploit Chain to Enslave Wireless IP Cameras

Meltdown/Spectre Update

In addition to establishing an aggressive and proactive patch-and-replace protocol, it is essential that organizations have layers of security in place designed to detect malicious activity and malware, and to protect vulnerable systems.

The post Meltdown/Spectre Update appeared first on Security Boulevard.

from Meltdown/Spectre Update

FortiGuard Labs Discovers Vulnerability in Asus Router

Over the last few weeks, ASUS released a series of patches aimed at addressing a number of vulnerabilities discovered in their RT routers running AsusWRT firmware. The models listed at the end of this post are known to be vulnerable. If you are not sure which model or firmware you are using, I recommend double-checking the ASUS support website to get the latest information and updates.

The post FortiGuard Labs Discovers Vulnerability in Asus Router appeared first on Security Boulevard.

from FortiGuard Labs Discovers Vulnerability in Asus Router

5 Steps to Enable You to Stare Back in the Face of Inevitable Compromise

How to deal with the safe guess that your company has been breached.

The post 5 Steps to Enable You to Stare Back in the Face of Inevitable Compromise appeared first on Security Boulevard.

from 5 Steps to Enable You to Stare Back in the Face of Inevitable Compromise

Why Securing Fintech Is Necessary for Financial Startups and Industry Leaders

Financial services firms are partnering with fintech organizations to drive innovation. Learn the role cybersecurity must play in these partnerships.

The post Why Securing Fintech Is Necessary for Financial Startups and Industry Leaders appeared first on Security Boulevard.

from Why Securing Fintech Is Necessary for Financial Startups and Industry Leaders

Into the Implementation of Spectre

In this blog post, we will get into the details of the implementation of Spectre, the exploit that targets the vulnerbilities found in CPUs built by AMD, ARM, and Intel. We assume you are familiar with the concept of the attack, and you can inspect the Proof of Concept source code provided in the Appendix of the paper linked above. You might also find it easier to read this blog post with the source code side by side.

The post Into the Implementation of Spectre appeared first on Security Boulevard.

from Into the Implementation of Spectre

How Financial Services Firms Can Protect Against DDoS Attacks

Distributed denial-of-service (DDoS) attacks are becoming increasingly common across the financial services industry. DDoS attacks occur when a portion of the network is targeted, typically at the networking, transport, or application layer, with a flood of requests that overwhelm network bandwidth, causing it to slow or crash completely. 

The post How Financial Services Firms Can Protect Against DDoS Attacks appeared first on Security Boulevard.

from How Financial Services Firms Can Protect Against DDoS Attacks

Executive Insights: 2017 Threat Trends – Looking at Our Threat Reports

2017 was another landmark year for cybersecurity. In reviewing our quarterly Threat Landscape reports, it is clear that 2017 has been notable primarily for three things: the rapid digital transformation and expansion of the potential attack surface, the increasing sophistication of cyber attacks, and a lapse in basic cybersecurity hygiene, largely being driven by digital transformation coupled with the growing cybersecurity skills gap.

The post Executive Insights: 2017 Threat Trends – Looking at Our Threat Reports appeared first on Security Boulevard.

from Executive Insights: 2017 Threat Trends – Looking at Our Threat Reports

Securing Customers’ Physical and Virtual Networks with a SIEM Platform

To keep up with this threat landscape, your customers’ IT teams require security solutions that can provide real-time visibility into network activity and regulatory compliance, as well as automatically initiate a response to security events, to increase the overall efficiency of IT management teams. In order to effectively manage network security, compliance, and performance, your customers should consider implementing a SIEM (security information and event management) solution that features automation, scalability, and actionable intelligence

The post Securing Customers’ Physical and Virtual Networks with a SIEM Platform appeared first on Security Boulevard.

from Securing Customers’ Physical and Virtual Networks with a SIEM Platform

The Importance of Operational Technology (OT) Systems to Maintain a Secure Standard of Living in Today’s Modern Society

The Operational Technology (OT) networks (such as industrial control and supervisory control and data acquisition systems [ICS/SCADA]) that run today’s modern society are a collection of devices designed to work together as an integrated and homogenous system. If one of these systems fails, it can have a catastrophic domino effect. For example, electricity requires telecommunications to transfer information on wheeling power from the electrical grid.

The post The Importance of Operational Technology (OT) Systems to Maintain a Secure Standard of Living in Today’s Modern Society appeared first on Security Boulevard.

from The Importance of Operational Technology (OT) Systems to Maintain a Secure Standard of Living in Today’s Modern Society

PowerDNS Recursor HTML/Script Injection Vulnerability – A Walkthrough

PowerDNS Recursor is a high-end, high-performance resolving name server that powers the DNS resolution of at least a hundred million subscribers. The “Recursor” is one of two name server products whose primary goal is to act as resolving DNS server. On Aug. 7, 2017, I reported an XSS (cross-site scripting) vulnerability to PowerDNS and its Security Team. They assigned it the identifier CVE-2017-15092. In this report I will explain how I was able to identify and trigger the vulnerability.

The post PowerDNS Recursor HTML/Script Injection Vulnerability – A Walkthrough appeared first on Security Boulevard.

from PowerDNS Recursor HTML/Script Injection Vulnerability – A Walkthrough

Reaper: The Next Evolution of IoT Botnets

By now, everyone should be aware of two things related to IoT devices. The first is that these devices are being deployed everywhere, with no sign of slowing down. The second is that many of these devices are notoriously insecure.

The post Reaper: The Next Evolution of IoT Botnets appeared first on Security Boulevard.

from Reaper: The Next Evolution of IoT Botnets

A wrap up of HITCON 2017

The 13th annual Hacks In Taiwan Conference (HITCON) took place August 25th and 26th at Academia Sinica, Taiwan’s national academy located in Taipei. Elite cyber security researchers from across the world gather at this annual conference to share their research and exchange ideas about the global threat landscape. Approximately 1000 people registered for the conference and, according to one of the HITCON crewmembers we met, one third of the attendees were undergraduates and fresh graduates. This is a good sign, given...

from A wrap up of HITCON 2017

The Evolution of the Firewall

As the Internet and Digital Economy have grown up, the humble Firewall has continued to serve as their go-to security appliance. In this first of a two-part series, we will examine how, in spite of the evolution of the Firewall through a number of shapes, functions, and roles, it remains the security foundation for implementing the strategic pillars of Segmentation, Access Control, and Real-time analytics/action now and into the future. Change is a fact of life; what doesn’t change usually withers and dies. This is true for both the biological...

from The Evolution of the Firewall

Unmasking Android Malware: A Deep Dive into a New Rootnik Variant, Part III

In this final blog in the Rootnik series we will finish our analysis of this new variant. Let’s start by looking into the script shell rsh. Analysis of the script shell Through our investigation we are able to see how the script shell works: First, it writes the content of the file .ir into /system/etc/install-recovery.sh. The file install-recovery.sh is a startup script. When the android device is booted, the script can be executed. The following is the content of the file .ir. Next, it writes some files...

from Unmasking Android Malware: A Deep Dive into a New Rootnik Variant, Part III

Unmasking Android Malware: A Deep Dive into a New Rootnik Variant, Part II

In part I of this blog, I finished the analysis of the native layer of a newly discovered Rootnik malware variant, and got the decrypted real DEX file. Here in part II, we will continue our analysis. A look into the decrypted real DEX file The entry ...

from Unmasking Android Malware: A Deep Dive into a New Rootnik Variant, Part II

Unmasking Android Malware: A Deep Dive into a New Rootnik Variant, Part I

Part I: How to Unpack the Malware App This past January I performed a deep analysis of an Android rootnik malware variant and posted them to this blog. Since then, I have continued to monitor this Android malware family. In early June, FortiGuard Labs...

from Unmasking Android Malware: A Deep Dive into a New Rootnik Variant, Part I

Petya’s Master Boot Record Infection

Last week we started our technical analysis on Petya (also called NotPetya) and its so-called “killswitch.” In that blog post we mentioned that Petya looks for a file in the Windows folder that has the same filename (no extension) as itself (for example: C:\Windows\Petya). If it exists, it terminates by calling ExitProcess. If it doesn't exist, it creates a file with the attribute DELETE_ON_CLOSE. This seems to imply that instead of a killswitch, this file is meant to be a marker to check and see if the system has already been infected. After...

from Petya’s Master Boot Record Infection

Key Differences Between Petya and NotPetya

There have already been a lot of write-ups for the NotPetya malware. This article is just a supplement for what is already out there. Our focus is to highlight some key differences between a previous strain of the Petya ransomware and the malware that ...

from Key Differences Between Petya and NotPetya

Petya’s Master Boot Record Infection

Last week we started our technical analysis on Petya (also called NotPetya) and its so-called “killswitch.” In that blog post we mentioned that Petya looks for a file in the Windows folder that has the same filename (no extension) as itself (for example: C:\Windows\Petya). If it exists, it terminates by calling ExitProcess. If it doesn't exist, it creates a file with the attribute DELETE_ON_CLOSE. This seems to imply that instead of a killswitch, this file is meant to be a marker to check and see if the system has already been infected. After...

from Petya’s Master Boot Record Infection