Malware Devil

Friday, May 28, 2021

Polarity’s Power-up Sessions, Add an Ability in 15 Minutes – Paul Battista – PSW #696

Training is critical but it is tough to break away from the day to day. Polarity is running free 15 minute training sessions that leverage our community edition to leave you with a new ability to automate search and save time. Examples include, how to write basic regular expressions, how to find exploit code faster, basics of cyberchef, or how to read a malware sandbox report.

Segment Resources:

Sign up page: https://polarity.io/ctt/
Past 15min session with GreyNoise: https://youtu.be/sEWQbRU4Duc
Teaser for future session on searching malware sandboxes: https://youtu.be/qo3GxeVSdGg
Teaser for future session on searching for exploit code: https://youtu.be/mGcA8_8dPfg
Teaser for future session on searching for YARA rules: https://youtu.be/Fx8d_fIeFy8

Visit https://www.securityweekly.com/psw for all the latest episodes!

Show Notes: https://securityweekly.com/psw696

The post Polarity’s Power-up Sessions, Add an Ability in 15 Minutes – Paul Battista – PSW #696 appeared first on Malware Devil.



https://malwaredevil.com/2021/05/28/polaritys-power-up-sessions-add-an-ability-in-15-minutes-paul-battista-psw-696/?utm_source=rss&utm_medium=rss&utm_campaign=polaritys-power-up-sessions-add-an-ability-in-15-minutes-paul-battista-psw-696

Security and Privacy in the Emerging Cyber-Physical World: A Survey

Read More

The post Security and Privacy in the Emerging Cyber-Physical World: A Survey appeared first on Malware Devil.



https://malwaredevil.com/2021/05/27/security-and-privacy-in-the-emerging-cyber-physical-world-a-survey/?utm_source=rss&utm_medium=rss&utm_campaign=security-and-privacy-in-the-emerging-cyber-physical-world-a-survey

Thursday, May 27, 2021

A SOC Tried To Detect Threats in the Cloud … Your Won’t Believe What Happened Next

A SOC Tried To Detect Threats in the Cloud … You Won’t Believe What Happened Next

Now, we all agree that various cloud technologies such as SaaS SIEM help your Security Operations Center (SOC). However, there’s also a need to talk about how traditional SOCs are challenged by the need to monitor cloud computing environments for threats. In this post, I wanted to quickly touch on this very topic and refresh some past analysis of this (and perhaps reminisce on how sad things were in 2012).

Back in my analyst days, I’ve noticed that some traditional organizations tried to include their cloud environments in the scope of their security monitoring at some point in their cloud migration journeys. Surprisingly (Hey … you surprised about it? No? Thought so!), some of these projects have not gone well. SOC teams were not equipped to deal with various cloud challenges (old paper on this). There were also cases where both business and IT migrated to the cloud, but security was left behind and had to approach cloud challenges with on-premise tools and practices. Essentially, security was left behind … again.

Here, we wanted to quickly summarize some of the challenges, covering the usual range of people, tools, and processes:

Uncommon log collection methods (compared to on-premise systems). Cloud providers haven’t necessarily simplified this journey for customers, even though, compared to 2012, decent logs actually exist today in many cases.
Telemetry data volumes may be high (especially from all those web-facing production systems); this has sometimes led to “log fragmentation” where cloud logs never make it to a SIEM, but are left to rot in some storage buckets in the cloud.
Egress costs are there sometimes, especially if you want to move the logs from one cloud to another for analysis.
Alien licensing models for security tools (compared to on-premise), some teams can’t afford what they used to be able to afford on-premise or they can’t afford a new cloud-native tool in addition to the on-premise tool they already have.
Alien detection context— instances, containers, microservices, etc — has confused many teams born and raised on server names and IP addresses for context. This topic is big enough to be explored in a dedicated post later.
Lack of clarity on cloud detection use cases is there despite useful resources like ATT&CK Cloud. Sadly, cloud providers haven’t necessarily simplified this journey for customers either, and many traditional SOC teams are not sure what to detect in the environments that their business is using today (“is this container access bad?”).
Also, there is a lot of cloud; this means governance sprawl causes visibility gaps for the SOC. Examples include shadow IT (“BYOCloud” and SaaS purchased by departments) as well as other cloud sprawl (that is why people are reaching for all those novel attack surface management tools; this should help).
SOC teams lacking cloud skill in general; complex public/hybrid/multi — cloud scenarios require more extensive knowledge of various technologies, their security implications, diverse (and alien) data sources, while SOC teams are too busy doing D&R to grow their cloud skills.
For those organizations trying to stick to old on-premise tools many other challenges abound; tools don’t support many cloud telemetry sources — they lack collection machinery, parsing/analysis, use cases, useful visuals, etc. Also, log support is often not done at “cloud speed.”
Lack of input from SOCs into cloud decisions, ranging from provider choices to IT architecture (and even security architecture). Frankly, many SOC teams are too busy and too focused on threats and don’t have a dedicated headcount focused on preparing their organization for the cloud change …

Huge thanks to Iman Ghanizada (“the Certs Guy”) for his contributions to this post.

Related posts:

“Beware: Clown-grade SOCs Still Abound”
“Stop Trying to Take Humans Out of SOC … Except … Wait… Wait… Wait…”
“SOC Threat Coverage Analysis — Why/How?”
“New Paper: “Future of the SOC: SOC People — Skills, Not Tiers”
“SIEM Modernization? Is That a Thing?” (mp3)

A SOC Tried To Detect Threats in the Cloud … Your Won’t Believe What Happened Next was originally published in Anton on Security on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post A SOC Tried To Detect Threats in the Cloud … Your Won’t Believe What Happened Next appeared first on Security Boulevard.

Read More

The post A SOC Tried To Detect Threats in the Cloud … Your Won’t Believe What Happened Next appeared first on Malware Devil.



https://malwaredevil.com/2021/05/27/a-soc-tried-to-detect-threats-in-the-cloud-your-wont-believe-what-happened-next/?utm_source=rss&utm_medium=rss&utm_campaign=a-soc-tried-to-detect-threats-in-the-cloud-your-wont-believe-what-happened-next

Targeted AnyDesk Ads on Google Served Up Weaponized App

Malicious ad campaign was able to rank higher in searches than legitimate AnyDesk ads.
Read More

The post Targeted AnyDesk Ads on Google Served Up Weaponized App appeared first on Malware Devil.



https://malwaredevil.com/2021/05/27/targeted-anydesk-ads-on-google-served-up-weaponized-app/?utm_source=rss&utm_medium=rss&utm_campaign=targeted-anydesk-ads-on-google-served-up-weaponized-app

Network Security News Summary for Friday May 28th, 2021

64 Bit AV Evasion; Unpatched MacOS/iOS Vuln; VSCode Extension Vuln; M1RACLES

AV evasion with 64-bit Executables
https://isc.sans.edu/forums/diary/All+your+Base+arenearly+equal+when+it+comes+to+AV+evasion+but+64bit+executables+are+not/27466/

Unpatches WebKit Vulnerablity in iOS/macOS
https://blog.theori.io/research/webkit-type-confusion/

VSCode Extension Vulnerabilities
https://snyk.io/blog/visual-studio-code-extension-security-vulnerabilities-deep-dive/

M1RACLES
https://m1racles.com

keywords: m1; m1racles; miracles; vscode; extensions; webkit; ios; macos; evasion; 64-bit

The post Network Security News Summary for Friday May 28th, 2021 appeared first on Malware Devil.



https://malwaredevil.com/2021/05/27/network-security-news-summary-for-friday-may-28th-2021/?utm_source=rss&utm_medium=rss&utm_campaign=network-security-news-summary-for-friday-may-28th-2021

‘Have I Been Pwned’ Code Base Now Open Source

Founder Troy Hunt also announces the platform will receive compromised passwords the FBI finds in its investigations.

The post ‘Have I Been Pwned’ Code Base Now Open Source appeared first on Malware Devil.



https://malwaredevil.com/2021/05/27/have-i-been-pwned-code-base-now-open-source/?utm_source=rss&utm_medium=rss&utm_campaign=have-i-been-pwned-code-base-now-open-source

Welcomed Progress: Cybersecurity Executive Order Aims to Improve Nation’s Cyber Posture

Cybersecurity is not a partisan issue; it is a national security issue. While previous administrations have issued cybersecurity-related executive orders with clear calls-to-action for federal agencies to follow, this executive order is significant given the recent cybersecurity incidents. From SolarWinds to Colonial Pipeline, the increasing volume of cyber attacks has shown how incidents can significantly […]

The post Welcomed Progress: Cybersecurity Executive Order Aims to Improve Nation’s Cyber Posture appeared first on Forescout.

The post Welcomed Progress: Cybersecurity Executive Order Aims to Improve Nation’s Cyber Posture appeared first on Security Boulevard.

Read More

The post Welcomed Progress: Cybersecurity Executive Order Aims to Improve Nation’s Cyber Posture appeared first on Malware Devil.



https://malwaredevil.com/2021/05/27/welcomed-progress-cybersecurity-executive-order-aims-to-improve-nations-cyber-posture/?utm_source=rss&utm_medium=rss&utm_campaign=welcomed-progress-cybersecurity-executive-order-aims-to-improve-nations-cyber-posture

Ransomware Detection and Mitigation Strategies in OT/ICS Environments

On 9 May 21, the Federal Bureau of Investigation (FBI) issued a statement regarding a network disruption at Colonial Pipeline, one of the largest fuel pipelines servicing the eastern United States. Following immediate operational shutdowns and further initial investigation, the…

The post Ransomware Detection and Mitigation Strategies in OT/ICS Environments appeared first on LogRhythm.

The post Ransomware Detection and Mitigation Strategies in OT/ICS Environments appeared first on Security Boulevard.

Read More

The post Ransomware Detection and Mitigation Strategies in OT/ICS Environments appeared first on Malware Devil.



https://malwaredevil.com/2021/05/27/ransomware-detection-and-mitigation-strategies-in-ot-ics-environments/?utm_source=rss&utm_medium=rss&utm_campaign=ransomware-detection-and-mitigation-strategies-in-ot-ics-environments

BazaLoader Attackers Create Fake Movie Streaming Site to Trick Victims

The BazaLoader infection chain includes a live call center and “customer service” from criminals, researchers report.

The post BazaLoader Attackers Create Fake Movie Streaming Site to Trick Victims appeared first on Malware Devil.



https://malwaredevil.com/2021/05/27/bazaloader-attackers-create-fake-movie-streaming-site-to-trick-victims/?utm_source=rss&utm_medium=rss&utm_campaign=bazaloader-attackers-create-fake-movie-streaming-site-to-trick-victims

RM -RF IS THE ROOT OF ALL EVIL

Read More

The post RM -RF IS THE ROOT OF ALL EVIL appeared first on Malware Devil.



https://malwaredevil.com/2021/05/27/rm-rf-is-the-root-of-all-evil-2/?utm_source=rss&utm_medium=rss&utm_campaign=rm-rf-is-the-root-of-all-evil-2

Creating a Ghidra processor module in SLEIGH using V8 bytecode as an example

Read More

The post Creating a Ghidra processor module in SLEIGH using V8 bytecode as an example appeared first on Malware Devil.



https://malwaredevil.com/2021/05/27/creating-a-ghidra-processor-module-in-sleigh-using-v8-bytecode-as-an-example-2/?utm_source=rss&utm_medium=rss&utm_campaign=creating-a-ghidra-processor-module-in-sleigh-using-v8-bytecode-as-an-example-2

CVE-2021-31440: An Incorrect Bounds Calculation in the Linux Kernel eBPF Verifier

Read More

The post CVE-2021-31440: An Incorrect Bounds Calculation in the Linux Kernel eBPF Verifier appeared first on Malware Devil.



https://malwaredevil.com/2021/05/27/cve-2021-31440-an-incorrect-bounds-calculation-in-the-linux-kernel-ebpf-verifier-2/?utm_source=rss&utm_medium=rss&utm_campaign=cve-2021-31440-an-incorrect-bounds-calculation-in-the-linux-kernel-ebpf-verifier-2

[Valve] critical – Signedness issue in ClassInfo message handler leads to RCE on CS:GO client (7500.00USD)

Read More

The post [Valve] critical – Signedness issue in ClassInfo message handler leads to RCE on CS:GO client (7500.00USD) appeared first on Malware Devil.



https://malwaredevil.com/2021/05/27/valve-critical-signedness-issue-in-classinfo-message-handler-leads-to-rce-on-csgo-client-7500-00usd-2/?utm_source=rss&utm_medium=rss&utm_campaign=valve-critical-signedness-issue-in-classinfo-message-handler-leads-to-rce-on-csgo-client-7500-00usd-2

[Valve] critical – RCE on CS:GO client using unsanitized entity ID in EntityMsg message (9000.00USD)

Read More

The post [Valve] critical – RCE on CS:GO client using unsanitized entity ID in EntityMsg message (9000.00USD) appeared first on Malware Devil.



https://malwaredevil.com/2021/05/27/valve-critical-rce-on-csgo-client-using-unsanitized-entity-id-in-entitymsg-message-9000-00usd-2/?utm_source=rss&utm_medium=rss&utm_campaign=valve-critical-rce-on-csgo-client-using-unsanitized-entity-id-in-entitymsg-message-9000-00usd-2

Acronis: Pandemic Hastened Cloud Migration, Prompting New Security Issues

SPONSORED: WATCH NOW — The COVID-19 pandemic has accelerated an ongoing shift in data away from business data centers to home offices and the cloud, explains Candid Wuest, VP of cyber protection research for Acronis.

The post Acronis: Pandemic Hastened Cloud Migration, Prompting New Security Issues appeared first on Malware Devil.



https://malwaredevil.com/2021/05/27/acronis-pandemic-hastened-cloud-migration-prompting-new-security-issues/?utm_source=rss&utm_medium=rss&utm_campaign=acronis-pandemic-hastened-cloud-migration-prompting-new-security-issues

5 aspectos principais de rede para conformidade com a HIPAA

O Health Insurance Portability and Accountability Act, também conhecido como HIPAA, é um padrão de conformidade que foi implementado depois que todas as informações relacionadas à saúde foram digitalizadas. O ponto crucial do ato é garantir que todas as informações …

The post 5 aspectos principais de rede para conformidade com a HIPAA appeared first on ManageEngine Blog.

The post 5 aspectos principais de rede para conformidade com a HIPAA appeared first on Security Boulevard.

Read More

The post 5 aspectos principais de rede para conformidade com a HIPAA appeared first on Malware Devil.



https://malwaredevil.com/2021/05/27/5-aspectos-principais-de-rede-para-conformidade-com-a-hipaa/?utm_source=rss&utm_medium=rss&utm_campaign=5-aspectos-principais-de-rede-para-conformidade-com-a-hipaa

Automatize sua rotina de TI com o recurso de fluxo de trabalho do OpManager

A execução das tarefas de TI do dia a dia pode ser exigente – não porque todas as tarefas sejam difíceis de realizar, mas devido à natureza repetitiva de muitas delas, fator que pode afetar drasticamente a produtividade e consumir …

The post Automatize sua rotina de TI com o recurso de fluxo de trabalho do OpManager appeared first on ManageEngine Blog.

The post Automatize sua rotina de TI com o recurso de fluxo de trabalho do OpManager appeared first on Security Boulevard.

Read More

The post Automatize sua rotina de TI com o recurso de fluxo de trabalho do OpManager appeared first on Malware Devil.



https://malwaredevil.com/2021/05/27/automatize-sua-rotina-de-ti-com-o-recurso-de-fluxo-de-trabalho-do-opmanager/?utm_source=rss&utm_medium=rss&utm_campaign=automatize-sua-rotina-de-ti-com-o-recurso-de-fluxo-de-trabalho-do-opmanager

RMM software: What is it and do you need it?

As cybersecurity products evolve to better protect against new forms of malware, trickier evasion techniques, and more organized cybercrime campaigns, the practice of cybersecurity evolves, too, providing simple, streamlined methods to manage hundreds of endpoints through one tool: RMM software.

What is RMM?

Remote Monitoring and Management (RMM) software is one of the go-to products for the types of IT shops that externally support small-to-medium-sized businesses, from dentists’ offices to independent newspapers to small retail shops. RMM tools allow those external IT shops–called “Managed Service Providers” or MSPs–to do much of their work remotely.

That means that, with a good RMM, the IT experts working at an MSP do not need to physically visit a client to fix their computer or to address any help tickets. It also means that MSPs can fix critical problems for their clients as they arise, rather than having to take scheduled, physical trips on a rotating basis just to find out whether a client’s machines and networks are operating smoothly.

But the benefit of these tools extends further than basic maintenance, as RMM software can also give MSPs an option to monitor cybersecurity protection to their clients all at once. Years ago, MSPs would have to install antivirus software on each client machine, and then individually run antivirus scans or remediation tools. For an MSP supporting just a few clients that each have 100 machines, this laborious process could eat up entire days. Thankfully, many cybersecurity tools have begun to integrate directly with RMM products, so that IT experts can directly run security scans from their RMM portal.

Essentially, an RMM can be a toolbox for any successful MSP, as they house and provide direct access to the most essential tools necessary for IT experts today.

Selecting an RMM solution for an MSP’s business needs

Picking an RMM solution is trickier than picking a product for just yourself because you need to consider both the success of your business and the safety of your clients. Imagine using an RMM platform that integrates seamlessly with top-tier cybersecurity software, but itself is open to ransomware and brute force attacks. Sure, you’ve done the right thing by giving your clients up-to-date cybersecurity protection, but your own systems could be compromised.

For MSPs considering how to select an RMM solution, there are a few features that could help their own business, including 24/7 support, a cloud-based model, data protection and restoration services, and integration with another type of tool called “professional services automation,” which boost the administration process of running an MSP, like finding potential new customers, chatting with clients, drawing up invoices, and making sure the bills get paid.

MSPs should also ask themselves a series of questions about how they want their RMM to help their business stay successful. As we wrote about last time, some helpful questions to consider when selecting an RMM solution include:

Does this vendor take security seriously as much as we do?Does this RMM adapt to new demands and scale well with the changing trends?Does the vendor provide proactive patching and show momentum in improving?How easily can my employees use this platform?Can the platform be accessed via mobile devices?

Remember, an RMM solution needs to both provide for easier management of your clients endpoints and it needs to support your business as an MSP. A solution that’s clunky and hard to use won’t set your IT experts up for success. A solution that refuses to update its offering–with cybersecurity integration, for example–likely won’t help you run your business for more than a year or two. And with so much of today’s work being on-the-go, an RMM solution that can be accessed through a mobile app could greatly benefit your team.

None of this is easy work, and finding the right tool can, and should, take serious consideration. But the benefits of an RMM are proven. Just make sure you’re finding one for your business needs in the future, not just today.

The post RMM software: What is it and do you need it? appeared first on Malware Devil.



https://malwaredevil.com/2021/05/27/rmm-software-what-is-it-and-do-you-need-it-2/?utm_source=rss&utm_medium=rss&utm_campaign=rmm-software-what-is-it-and-do-you-need-it-2

RMM software: What is it and do you need it?

As cybersecurity products evolve to better protect against new forms of malware, trickier evasion techniques, and more organized cybercrime campaigns, the practice of cybersecurity evolves, too, providing simple, streamlined methods to manage hundreds of endpoints through one tool: RMM software.

What is RMM?

Remote Monitoring and Management (RMM) software is one of the go-to products for the types of IT shops that externally support small-to-medium-sized businesses, from dentists’ offices to independent newspapers to small retail shops. RMM tools allow those external IT shops—called “Managed Service Providers” or MSPs—to do much of their work remotely.

That means that, with a good RMM, the IT experts working at an MSP do not need to physically visit a client to fix their computer or to address any help tickets. It also means that MSPs can fix critical problems for their clients as they arise, rather than having to take scheduled, physical trips on a rotating basis just to find out whether a client’s machines and networks are operating smoothly.

But the benefit of these tools extends further than basic maintenance, as RMM software can also give MSPs an option to monitor cybersecurity protection to their clients all at once. Years ago, MSPs would have to install antivirus software on each client machine, and then individually run antivirus scans or remediation tools. For an MSP supporting just a few clients that each have 100 machines, this laborious process could eat up entire days. Thankfully, many cybersecurity tools have begun to integrate directly with RMM products, so that IT experts can directly run security scans from their RMM portal.

Essentially, an RMM can be a toolbox for any successful MSP, as they house and provide direct access to the most essential tools necessary for IT experts today.

Selecting an RMM solution for an MSP’s business needs

Picking an RMM solution is trickier than picking a product for just yourself because you need to consider both the success of your business and the safety of your clients. Imagine using an RMM platform that integrates seamlessly with top-tier cybersecurity software, but itself is open to ransomware and brute force attacks. Sure, you’ve done the right thing by giving your clients up-to-date cybersecurity protection, but your own systems could be compromised.

For MSPs considering how to select an RMM solution, there are a few features that could help their own business, including 24/7 support, a cloud-based model, data protection and restoration services, and integration with another type of tool called “professional services automation,” which boost the administration process of running an MSP, like finding potential new customers, chatting with clients, drawing up invoices, and making sure the bills get paid.

MSPs should also ask themselves a series of questions about how they want their RMM to help their business stay successful. As we wrote about last time, some helpful questions to consider when selecting an RMM solution include:

Does this vendor take security seriously as much as we do?Does this RMM adapt to new demands and scale well with the changing trends?Does the vendor provide proactive patching and show momentum in improving?How easily can my employees use this platform?Can the platform be accessed via mobile devices?

Remember, an RMM solution needs to both provide for easier management of your clients endpoints and it needs to support your business as an MSP. A solution that’s clunky and hard to use won’t set your IT experts up for success. A solution that refuses to update its offering—with cybersecurity integration, for example—likely won’t help you run your business for more than a year or two. And with so much of today’s work being on-the-go, an RMM solution that can be accessed through a mobile app could greatly benefit your team.

None of this is easy work, and finding the right tool can, and should, take serious consideration. But the benefits of an RMM are proven. Just make sure you’re finding one for your business needs in the future, not just today.

The post RMM software: What is it and do you need it? appeared first on Malwarebytes Labs.

The post RMM software: What is it and do you need it? appeared first on Malware Devil.



https://malwaredevil.com/2021/05/27/rmm-software-what-is-it-and-do-you-need-it/?utm_source=rss&utm_medium=rss&utm_campaign=rmm-software-what-is-it-and-do-you-need-it

The Cybersecurity Executive Order: Why CMMC May Be the One Standard to Rule Them All

Security practitioners across the US spent most of Thursday, May 13, reading over, hashing, rehashing, and then re-rehashing the “Executive Order on Improving the Nation’s Cybersecurity” (the Executive Order). Between the mandate for agencies to adopt zero trust, short timelines, and the “Software Bill of Materials,” the Executive Order seems to be far reaching and […]

The post The Cybersecurity Executive Order: Why CMMC May Be the One Standard to Rule Them All appeared first on TechSpective.

The post The Cybersecurity Executive Order: Why CMMC May Be the One Standard to Rule Them All appeared first on Security Boulevard.

Read More

The post The Cybersecurity Executive Order: Why CMMC May Be the One Standard to Rule Them All appeared first on Malware Devil.



https://malwaredevil.com/2021/05/27/the-cybersecurity-executive-order-why-cmmc-may-be-the-one-standard-to-rule-them-all/?utm_source=rss&utm_medium=rss&utm_campaign=the-cybersecurity-executive-order-why-cmmc-may-be-the-one-standard-to-rule-them-all

Barbary Pirates and Russian Cybercrime

In 1801, the United States had a small Navy. Thomas Jefferson deployed almost half that Navy—three frigates and a schooner—to the Barbary C...