Skip to main content
Tag

prevent hacking

Flaws, Bugs, Zero Days, and Breaches: Welcome to the New Normal

By BlogNo Comments

Flaws, Bugs, Zero Days, and Breaches: Welcome to the New Normal

Business Email Compromise (BEC) breaches are turning into the go-to strategy for cybercriminals. What actions should you take?

Endless bad news typically results in people becoming inured to it. The recent media 24-7 death counts on COVID-19 caused many people to switch off. It was just too much. Rating plummeted at CNN and other networks.

In IT security, there is a danger of the same thing happening with reports of flaws, bugs, zero-day attacks, ransomware heists, and breaches. Hardly a day goes by without a new one. Some are more virulent than others. But all gain some kind of coverage. It quickly becomes too much. People tend to gloss over it and worse, get on with business as usual.

At Syxsense, therefore, as a public-spirited gesture, we will quickly summarize some of the recent carnage into one short report. Yes, it is important to know what is going on and where to be vigilant. But most importantly, it is vital to know that something can always be done about it. Those enterprises that are the least prepared are the ones that suffer the most in dangerous times like these.

Recent Flaws and Breaches
Here is an incomplete list of some recent news on security issues:

JFrog Security Research identified hundreds of malicious packages designed to steal personally identifiable information (PII) in a large-scale typo-squatting attack from Azure users. A similar supply chain attack targeting German industrial companies such as Bertelsmann, Bosch, Stihl, and DB Schenker uses the npm repository to take control over infected machines.

A C programming library for IoT products has been found to be vulnerable to Domain Name System (DNS) cache-poisoning attacks. The bug generates incremental transaction identifiers in DNS response and request network communications. Patches are being developed to resolve these issues.
Google issued a supply chain attack warning about open-source software. Despite being a proponent of open source, Google voiced its support for the Package Analysis Project of the Open Source Security Foundation (OpenSSF). The goal is to automate the detection of malware introduced into popular open source repositories such as npm for JavaScript and PyPl for Python.

Plug-ins and extensions for content management systems (CMSs) are being increasingly used to hijack websites. Sucuri’s 2021 Website Threat Research Report called attention to potential issues with WordPress, Joomla, and Drupal due to vulnerable plugins and extensions.

Hackers are getting more patient. One group stayed inside a network for 18 months before striking – quietly waiting for the right opportunity. The group is known as UNC3524 also installs backdoors so normal security tools can’t completely eliminate it. If IT finds the malware and removes it, the bad guys can reinstall it almost immediately.

Phishing success continues. One criminal set up a website to look like a U.S. Department of Defense site and diverted $23.5 million to his bank account that was supposed to go to a jet fuel supplier. And an owner of a nail salon in California tricked a public school district in Michigan into wiring its monthly health insurance payment of $2.8 million to his bank account. Meanwhile, LinkedIn has emerged as the new favorite of scammers, according to Check Point. Apparently, more than half of all phishing attacks in one month used LinkedIn. The goal is to obtain login credentials and take it from there. And of course, phishing campaigns now seek to capitalize on the latest Ukraine news to tempt people to click on a malicious link or attachment. Finally, Phishing-as-a-Service has emerged to make it easy for non-technical criminals to profit from phishing scams. One group provides phishing services aimed at Coinbase, Netflix, Amazon, and eBay users.

Ransomware claims more victims. NCC Group reported that ransomware attacks increased 53% from the previous month with Industrials (34%), Consumer Cyclicals (21%), and Technology (7%) being the most targeted areas. Examples: Coca-Cola suffered a server breach and a hacking group claims it stole 161 GB of data. The FBI warned that the agriculture sector is suffering ransomware attacks timed to coincide with spring planting or fall harvesting periods.

Industrial control systems (ICS) are a new target. An FBI investigation found that custom tools now exist that can gain access to ICS platforms and supervisory control and data acquisition (SCADA). This particularly applies to programmable logic controllers (PLCs) from Schneider Electric and OMRON Sysmac NEX, as well as Open Platform Communications Unified Architecture (OPC UA) servers. If undetected, hackers could gradually work their way up the food chain and potentially take over control of an energy facility/

A Java vulnerability known as CVE-2022-21449 allows an attacker to intercept communication and messages that should have been encrypted, such as SSL communication and authentication processes. Fixes are now available.

Enhance Your Security Now
Perhaps the worst news among all this is that the above summary represents a small fraction of ongoing hacks, breaches, and vulnerabilities. Now is the time to upgrade your security profile by implementing automated tools. Syxsense Enterprise is the world’s first Unified Security and Endpoint Management (USEM) solution, delivering real-time vulnerability monitoring and instant remediation for every single endpoint in your environment, as well as IT management across all endpoints.

Syxsense demo

Schedule Your Syxsense Demo

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Schedule My Demo
||||||

10 Ways To Protect Your Organization From Cyberattacks

By News, Patch ManagementNo Comments

10 Ways To Protect Your Organization From Cyberattacks

While your first line of defense is always common sense, there are 10 actions that should be implemented to secure your organization.

This article originally appeared on ypo.org.

Many CEOs don’t want to think about cybersecurity. That’s why you hire a chief technology officer (CTO) or chief information security officer (CISO). But cybersecurity is now a board-level issue. While your first line of defense is always common sense, below are 10 actions every CEO should be implementing to secure their organization, with the help of the IT team.

 

1. Enable Two-Factor Authentication

If it has a password, make sure it supports two-factor authentication, which is a one-time code that is sent by SMS Text, email or an app on your phone like Google Authenticator (we don’t recommend SMS Text). A password is no longer enough to protect yourself. Passwords can be compromised by phishing attacks (emails asking you to enter your password) or stolen from other websites, where you might reuse the same or similar passwords.

Many companies now use Microsoft Office 365 for email and will often synchronize this with local usernames and passwords (Active Directory). If you have a breach in Microsoft Office 365, not only is Office 365 exposed, but now the attacker may have access to your local physical network.

 

2. Use Products Like Duo to Allow Two-Factor Authentication

Today Microsoft Windows and Apple Mac operating systems do not have two-factor authentication to control logons to laptops, desktops, servers, RDP, etc. By implementing tools like Duo (recently acquired by Cisco) you can add a second factor to all your physical and virtual devices. As an added bonus, you can also limit which devices accept a user’s logon.

 

3. Use a Password Manager

It is vital to have different passwords for every system you use. There have been many large-scale hacks of online services like LinkedIn (164 million accounts stolen), Adobe (152 million accounts stolen), Myspace (359 million accounts stolen), and more. This data is being used to create databases of usernames and passwords which can then be used to hack other systems. By having unique passwords for every system, you can protect against this. How do you remember all those passwords? Use a password manager like 1Password.

 

4. Make Sure You Have Backups

Backup everything! If your organization has a breach and ransomware is distributed, make sure you have backups of all your data. By far the easiest way to recover from ransomware is to wipe your devices and restore backups of data.

 

5. Disable SMB Outbound

The U.S. National Cybersecurity and Communications Integration Center (NCCIC) recently issued advice that all organizations should block outbound Server Message Block (SMB) traffic at the firewall – Ports 137/139/445.

A recent hack has been identified that leverages Windows’ ability to automatically logon to remote devices when connecting to a share. This is very useful when connecting to devices within your corporate network, however, it is a huge security hole when used by a hacker.

“Approximately 80 percent of breaches occur because IT has not kept up with software updates.”

7. Limit Access to Everything by Limiting IP Addresses

Many cloud solutions allow you to lock down security by limiting access from only certain IP addresses. For example, you might include your office public IP address and home.

 

8. Instruct Your Accounting Department to Verify Instructions to Pay or Transfer Funds by Phone

An attacker sets up an email address very similar to the CEO or CFO and then sends an email directly to the accounting team instructing them to urgently pay an invoice by wire. Implement a policy that all wires require a phone approval before payment.

 

9. Buy Cyber Insurance

This is a relatively new form of insurance and we have seen it being included in Errors and Omissions policies recently. It is vital that your organization purchases cyber insurance. This will cover the costs of investigation, responding to a breach, as well as business interruption and maybe even reputational losses.

Big Tip: If your organization experiences a breach, as soon as you finish an emergency response — like taking devices off the network — contact your insurance company, a lawyer that specializes in IT security, and let them hire all the IT security investigators. By letting your lawyers hire the IT security investigators, the results of the investigations become privileged information, legally limiting who can access details about what happened.

 

10. Encrypt Confidential Data

Many organizations use services like Dropbox to share and back up data. While these services are great and typically encrypt the data in the cloud, this data can still be decrypted by them. Also, services like Dropbox might sync the data across multiple devices, essentially creating local unencrypted versions of your data.

One approach to protect your data is to use full disk encryption, but you would need to make sure this is enabled across all your devices. Hint: IT management tools like Syxsense will tell you which devices do not have BitLocker enabled. However, this still leaves your data at risk if Dropbox has a breach. Products like BoxCryptor offer the ability to put an extra layer of encryption on the content, which protects your confidential data in the cloud and on local devices.

Patch Everything

Approximately 80 percent of breaches occur because IT has not kept up with software updates. It’s more important than ever to patch all devices, operating systems and applications, and more recently, IoT devices.

Syxsense demo

Schedule Your Syxsense Demo

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Schedule My Demo