Investors in Zscaler Inc (Symbol: ZS) saw new options begin trading today, for the June 14th expiration. At Stock Options Channel, our YieldBoost formula has looked up and down the ZS options chain for the new June 14th contracts and identified one put and one call contract of

June 14th Options Now Available For Zscaler (ZS) | Nasdaq

Ritu Jha- Jay Chaudhry, founder of Zscaler, a global cloud security company, advocates a never-ex - Human beings are driven by a feeling to make a difference: Zscaler founder Jay Chaudhry at TiEcon 2024

Human beings are driven by a feeling to make a difference: Zscaler founder Jay Chaudhry at TiEcon 2024 - indica News

Key Insights Using the 2 Stage Free Cash Flow to Equity, Zscaler fair value estimate is US$261 Zscaler's US$210 share...

A Look At The Intrinsic Value Of Zscaler, Inc. (NASDAQ:ZS)

Oppenheimer identifies Zscaler as a top pick for 2024, citing upsell potential, new products and regulatory tailwinds. Read more here

Zscaler gets a top pick status at Oppenheimer for 2024 | Seeking Alpha

Oppenheimer analysts predict significant growth potential for Zscaler in 2024, backed by product expansion and regulatory tailwinds. Contrasting views prevail among other analysts.

Zscaler's Growth Potential in 2024: Oppenheimer's Outlook

Jay Chaudhry Zscaler CEO, joins 'Closing Bell Overtime' to talk cybersecurity risk ramping up and how to combat it.

Zscaler CEO Jay Chaudhry on cybersecurity in 2024

Please try another search · Position added successfully to:

Peering Into Zscaler's Recent Short Interest By Benzinga

Linden Thomas Advisory Services LLC bought a new position in Zscaler, Inc. (NASDAQ:ZS - Free Report) in the third quarter, according to the company in its most recent disclosure with the SEC. The fund bought 5,809 shares of the company's stock, valued at approximately $904,000. A number of other la

Linden Thomas Advisory Services LLC Makes New $904,000 Investment in Zscaler, Inc. (NASDAQ:ZS) - MarketBeat

Zscaler (ZS) appears to be an enticing investment option at the moment, with its strong demand environment, healthy fundamentals and upward estimate revisions.

Why Zscaler (ZS) is a Strong Contender for Portfolio Pick

Why Zscaler (ZS) is a Strong Contender for Portfolio Pick - December 28, 2023 - Zacks.com

ZapScale

zapscale

Startups of The Year 2023 Winners: North America 

13 Cybercrime Facts That Will Give You Chills

13 факта за киберпрестъпността, които ще ви побият тръпки

13টি সাইবার অপরাধের তথ্য যা আপনাকে শান্ত করবে

13 hechos sobre delitos cibernéticos que te pondrán los pelos de punta

Hotzikara emango dizuten ziberkrimenaren 13 gertakari

ゾッとするサイバー犯罪の13の事実

13 ការពិតអំពីឧក្រិដ្ឋកម្មតាមអ៊ីនធឺណិតដែលនឹងផ្តល់ឱ្យអ្នកនូវភាពត្រជាក់

13 Fakta Jenayah Siber Yang Akan Menggigil Anda

13 faktów na temat cyberprzestępczości, które wywołają u Ciebie dreszcze

13 fatos sobre crimes cibernéticos que vão te dar arrepios

Sizi Tüyler Ürpertecek 13 Siber Suç Gerçeği

13 Sự thật về tội phạm mạng sẽ khiến bạn rùng mình

Iinyani ezili-13 zoBugebenga be-Cyberculos eziya kukunika ukuzola

McLEAN, United States of America, June 26th, 2024/CyberNewsWire/--FireTail announces a free version of its enterprise-level API security tools, making them accessible to developers and organizations of all sizes. FireTail's unique combination of open-source code libraries, inline API call evaluation, security posture management, and centralized audit trails helps eliminate vulnerabilities and protect APIs in real-time. The free plan covers up to 5 APIs, includes 1M API call logs per month, offers 7 days of data retention, and provides clear developer support. FireTail, a disruptor in API security, unveils free access for all to its cutting-edge API security platform. This initiative opens the door for developers and organizations of any size to access enterprise-level API security tools. Today, over 80% of all internet traffic is computer-to-computer communication via APIs. Every mobile app, IoT device, and most modern software applications use APIs, creating a broad attack surface for potential threats. FireTail’s hybrid approach to API security blends open-source code libraries with a feature-packed cloud platform and equips businesses with a unique suite of tools to eliminate API vulnerabilities and provide robust runtime API protection. "API security is essential for modern applications, and every developer and tech team should have access to effective security tools," said Jeremy Snyder, CEO and Co-Founder of FireTail. "Security through obscurity is no longer a viable approach. We’re on a mission to secure all of the world’s APIs and our new free plan ensures ongoing access to an API security platform that delivers genuine insight into the most pressing attack vectors - design flaws in APIs. It’s perfect for smaller organizations striving for stronger API protection, and a great way for individuals or teams within larger organizations to get started. "Riley Priddle, Co-Founder and CTO at FireTail, added, "We’re excited to help organizations of all sizes to better protect their APIs. We want FireTail to become the de facto standard when it comes to API security. Just because you have a small number of APIs, it doesn’t mean they aren’t critical. We want everyone to have access to the best, enterprise-level API security tools. That’s why we offer both this free tier, as well as our open source libraries." For developers and small to medium-sized organizations needing to secure up to 5 APIs, FireTail's free tier includes comprehensive API security features such as discovery, inventory, assessment, detection and response, and inline runtime protection. Key features include: Protection for up to 5 APIs 1M API calls per month 7 days of logging retention Thomas Martin, Founder at NephoSec, shared "We’ve been working with FireTail from the outset as both a customer and a distribution partner. Having proven that the platform works for even the largest enterprises with the most complex API security requirements, it’s great to see the team opening that technology up to everyone.This will enable us to solve API security challenges for organizations of all shapes and sizes." To access the FireTail API security platform, users can visit https://www.firetail.app or join the team on Tuesday, July 2nd for an in-depth look at what FireTail’s free tier can do. About FireTail FireTail allows customers to solve all the most critical problems facing APIs today with a hybrid approach, bringing together cloud, application and code with full blocking capabilities to solve the root causes of API data breaches - flaws at the application and business logic layer in authentication, authorization and data handling. Headquartered in McLean, VA, with offices in Dublin, Ireland, and Helsinki, Finland, FireTail is backed by leading investors, including Paladin Capital, Zscaler, General Advance, and SecureOctane. Users can learn more at https://www.firetail.io. Contact Marketing Director Alan Fagan FireTail media@firetail.io This story was distributed as a release by Cyberwire under HackerNoon’s Business Blogging Program. Learn more about the program here. McLEAN, United States of America, June 26th, 2024/CyberNewsWire/--FireTail announces a free version of its enterprise-level API security tools, making them accessible to developers and organizations of all sizes. FireTail's unique combination of open-source code libraries, inline API call evaluation, security posture management, and centralized audit trails helps eliminate vulnerabilities and protect APIs in real-time. The free plan covers up to 5 APIs, includes 1M API call logs per month, offers 7 days of data retention, and provides clear developer support. FireTail, a disruptor in API security, unveils free access for all to its cutting-edge API security platform. This initiative opens the door for developers and organizations of any size to access enterprise-level API security tools. Today, over 80% of all internet traffic is computer-to-computer communication via APIs. Every mobile app, IoT device, and most modern software applications use APIs, creating a broad attack surface for potential threats. FireTail’s hybrid approach to API security blends open-source code libraries with a feature-packed cloud platform and equips businesses with a unique suite of tools to eliminate API vulnerabilities and provide robust runtime API protection. "API security is essential for modern applications, and every developer and tech team should have access to effective security tools," said Jeremy Snyder, CEO and Co-Founder of FireTail. "API security is essential for modern applications, and every developer and tech team should have access to effective security tools," said Jeremy Snyder, CEO and Co-Founder of FireTail. "Security through obscurity is no longer a viable approach. We’re on a mission to secure all of the world’s APIs and our new free plan ensures ongoing access to an API security platform that delivers genuine insight into the most pressing attack vectors - design flaws in APIs. It’s perfect for smaller organizations striving for stronger API protection, and a great way for individuals or teams within larger organizations to get started. "Security through obscurity is no longer a viable approach. We’re on a mission to secure all of the world’s APIs and our new free plan ensures ongoing access to an API security platform that delivers genuine insight into the most pressing attack vectors - design flaws in APIs. It’s perfect for smaller organizations striving for stronger API protection, and a great way for individuals or teams within larger organizations to get started. "Riley Priddle, Co-Founder and CTO at FireTail, added, "We’re excited to help organizations of all sizes to better protect their APIs. We want FireTail to become the de facto standard when it comes to API security. Just because you have a small number of APIs, it doesn’t mean they aren’t critical. We want everyone to have access to the best, enterprise-level API security tools. That’s why we offer both this free tier, as well as our open source libraries." "Riley Priddle, Co-Founder and CTO at FireTail, added, "We’re excited to help organizations of all sizes to better protect their APIs. We want FireTail to become the de facto standard when it comes to API security. Just because you have a small number of APIs, it doesn’t mean they aren’t critical. We want everyone to have access to the best, enterprise-level API security tools. That’s why we offer both this free tier, as well as our open source libraries." For developers and small to medium-sized organizations needing to secure up to 5 APIs, FireTail's free tier includes comprehensive API security features such as discovery, inventory, assessment, detection and response, and inline runtime protection. Key features include: Protection for up to 5 APIs 1M API calls per month 7 days of logging retention Thomas Martin, Founder at NephoSec, shared "We’ve been working with FireTail from the outset as both a customer and a distribution partner. Having proven that the platform works for even the largest enterprises with the most complex API security requirements, it’s great to see the team opening that technology up to everyone.This will enable us to solve API security challenges for organizations of all shapes and sizes." To access the FireTail API security platform, users can visit https://www.firetail.app or join the team on Tuesday, July 2nd for an in-depth look at what FireTail’s free tier can do. https://www.firetail.app About FireTail FireTail allows customers to solve all the most critical problems facing APIs today with a hybrid approach, bringing together cloud, application and code with full blocking capabilities to solve the root causes of API data breaches - flaws at the application and business logic layer in authentication, authorization and data handling. Headquartered in McLean, VA, with offices in Dublin, Ireland, and Helsinki, Finland, FireTail is backed by leading investors, including Paladin Capital, Zscaler, General Advance, and SecureOctane. Users can learn more at https://www.firetail.io . https://www.firetail.io Contact Marketing Director Alan Fagan FireTail media@firetail.io media@firetail.io This story was distributed as a release by Cyberwire under HackerNoon’s Business Blogging Program. Learn more about the program here. This story was distributed as a release by Cyberwire under HackerNoon’s Business Blogging Program. Learn more about the program here . here here

FireTail Unveils Free Access For All To Cutting-Edge API Security Platform

The growing reliance on software-as-a-service (SaaS) applications to run critical business functions keeps expanding the cloud-based attack surface. Yet, effectively securing cloud-based third-party services and resources is a complex task often relegated to a later time when resources and knowledge will be available. Why Do You Need SSPM Recommended best practices by industry standard bearers are largely reliant on manual documentation. published by the National Telecommunication and Information Administration (NTIA) in July 2021 also relies on self-reported lists of included materials. The Minimum Elements for a Software Bill of Materials (SBOM) report Even the relies on non-digital due diligence questions related to the supplier’s reliability from multiple angles, ranging from financial stability to organizational stature, external influence, and maliciousness, including organizational security. MITRE System of Trust (SoT) The amount of manual work required to ingest these reports and coordinate their content when integrating a SaaS into a network is considerable and the process is impractical. In addition, the constant growth in sanctioned, unsanctioned, and forgotten SaaS apps has created sprawl that makes these apps difficult to govern and monitor. Without visibility, these shadow ITs proliferate, expanding the unmonitored, yet exploitable, attack surface. This is where SaaS Security Posture Management (SSPM) comes in handy. SSPM tools focus specifically on managing the security configurations and access controls of SaaS apps. What Is SSPM SaaS Security Posture Management (SSPM) tools are specialized to help manage the security settings, configurations, and access controls of a portfolio of SaaS applications. SSPM tools provide visibility into the up-to-date state of SaaS security in areas like user permissions, asset inventory, and regulatory compliance. It then enforces secure baselines and adjusts configurations to remediate issues as they occur. SSPM focuses specifically on the unique requirements of SaaS environments and the growing landscape of cloud-based apps being adopted. Gartner has recognized SSPM as an emerging market segment fueled by the growth of SaaS adoption. Supplying these dedicated security tools is a rising cluster of vendors such as Zscaler, Obsidian Security, Adaptive Shield, Spin.AI, and many others. These companies integrate with an organization’s existing identity provider and SaaS apps and then layer on analysis, monitoring, and automation capabilities purpose-built to manage ongoing security risks as user permissions rapidly expand across growing app portfolios. Exploring the Multifaceted Applications of SSPM SSPMs serve a variety of functions, each contributing to a robust cybersecurity framework: Discovering shadow IT The SSPM discovery step detects unmonitored or unauthorized SaaS applications. Aside from informing the risk mitigation process, the discovery also lists underutilized licenses which contributes to cost optimization. Identifying misconfigurations or overprivileged access SSPM tools automate the detection of compromised credentials, suspicious login locations or times, and abnormal permissioning activities. Upon detection, it alerts stakeholders to investigate and remediate threats. Automating continuous security monitoring and response specific to SaaS environments Going beyond visibility, SSPMs can instantly trigger remediation actions based on policy violations. For example, automatically disabling compromised accounts or revoking an app integration with suspicious scope creep. Supporting compliance and audit processes SSPM tools y provide an audit trail for compliance requirements related to SaaS usage and security. When audits demand evidence of controls around access, configurations, and activity, SSPMs generate reports that demonstrate policies are enforced, which reduces the compliance burden. Techniques Employed by SSPM for Enhanced SaaS Security SSPM solutions utilize a comprehensive set of techniques: : Overseeing user accounts and streamlining identity and access controls. User management and IAM administration : Managing approved SaaS applications and identifying unauthorized usage. SaaS application catalog and shadow IT detection : Monitoring third-party app integrations and changes in SaaS configurations. Connected apps analysis and configuration drift detection : Using best practice templates and advanced threat detection capabilities. SaaS app configuration templates and threat detection : Ensuring data within SaaS applications is protected and licenses are managed efficiently. Data protection and license management Enhancing SSPM Effectiveness with Advanced Integrations SSPMs integrate with various technologies: : Provide real-time visibility into SaaS applications by extracting detailed configuration and permissioning data. API integrations : Align access controls and incorporate MFA status into user risk level assessments. Identity provider integration : Track SaaS app usage and login attempts, correlating data against access policies. Browser extensions and endpoint software : Offer templates aligned with compliance frameworks for automated monitoring and swift remediation of security lapses. Pre-configured security templates Navigating the Complexities of Implementing SSPM While beneficial, adopting an SSPM solution for enhanced SaaS security comes with its own set of challenges: Privacy Concerns The deep level of monitoring of user activities and application behaviors by SSPM tools can lead to privacy concerns. Establishing transparent policies and engaging in careful change management are essential to address these concerns and maintain trust. Budgetary Considerations Adding SSPM tools to the technology stack means an additional financial commitment. Justifying this investment requires quantifying the risk reduction and productivity enhancements SSPM achieves. Keeping Pace with Evolving Threats and Regulations The constantly evolving cyber threats and regulatory requirements demand that SSPM vendors rapidly evolve their products. Staying ahead of these changes is crucial for SSPM tools to remain effective and relevant. Balancing Security with User Experience Implementing security measures, such as enforced re-authentication, can sometimes disrupt user workflows. Finding the right balance between robust security and a seamless user experience is critical to ensure that security measures do not hinder productivity. The spectrum of benefits offered by SSPMs is vast, encompassing cost optimization, access governance, threat mitigation, and audit facilitation. However, unlocking the full potential of these tools requires careful selection, aligning them with the specific needs of an organization, and ensuring that the investment matches the scale of ambition. When implemented thoughtfully, SSPMs are not just tools but pivotal allies, scaling security assurance in step with an organization's cloud adoption journey, ensuring that growth and security go hand in hand.

How to Manage the Complexities of SaaS Security With SSPM

Evolved Cloud Phishing Techniques Explained and Lessons Learned From Recent Dropbox & Uber Hack Cloud Computing gives phishers a new playground to harvest and grow their business. But not only that, the impacts are much broader and more dangerous. No organization, small or big, is invulnerable to phishing attacks. Therefore, it’s critical to learn how you might be targeted and what you can do to prevent it. SaaS-based phishing is already familiar. For example, over , from stolen credentials to malicious URLs. Also, according to a report from , researchers have seen a massive increase in this abuse, with the data collected by the firm showing an enormous expansion of 1,100% from June 2021 to June 2022. 90% of all data breaches are due to phishing Palo Alto Networks Unit 42 With more advancements in technology, not only can defenders leverage more sophisticated tools and techniques to detect and block phishing emails, links, and messages, but attackers are also improving on their side of the cat-and-mouse game. While most social engineering attacks are delivered by email, increased social engineering delivered via other communication platforms in 2022. one-third of IT professionals reported : These include attacks delivered via Video conferencing platforms (44%), Workforce messaging platforms (40%), Cloud-based file-sharing platforms (40%), and SMS (36%). Moreover, phishing on social media is increasingly common, and in Q1 2022, . According to report, employees at 74% of organizations have been sent fraudulent text messages (smishing), and the same percentage have been targeted on social media. LinkedIn users were targeted in 52% of all phishing attacks globally Proofpoint’s 2022 State of the Phish A Hard-to-Detect New Phishing Technique — SaaS-to-SaaS All these could happen without the attacker touching the victim’s on-prem computers/ network. Since it all happened SaaS-to-SaaS, all the existing security measures, such as Anti-Spam gateway, sandboxing, and URL filtering, will not inspect. Thus, no alert will be generated. Furthermore, with the rise of cloud office productivity and multi-user collaboration technologies, it is now possible for an attacker to of these reputable domains while remaining undetected. host and share malicious documents, files, and even malware on the cloud infrastructure Since , we saw the trend of using this “multi-stages” SaaS-to-SaaS phishing attack. the Check Point Research findings in 2020 The first stage of a phishing attack is This document can be downloaded; however, it is essential to note that to facilitate use, these cloud services open the PDF for viewing, allowing it to load in the web browser without restriction or warning. frequently a fake invoice or secure document PDF hosted on cloud services. It is hard to detect because it didn’t necessarily hit the protection deployed. As we saw on the news, as AWS Cloud Phishing attempts in , if phishing detection is implemented in the entrance and exit of emails, it will never see it happening. August All actions occurred in the Cloud (or multiple clouds); when the detection/ scanning took place, all things seemed legit and encrypted. Most likely, the phishing email will hit the victims’ machine, and all the magic will happen in the browser. Multi-stage Cloud Phishing Early this year, that prey upon those who don’t use multifactor authentication. Microsoft warned of new phishing leveraging Azure ADs This attack is thriving now but not before because attackers take advantage of via the capability of device registration using newly stolen credentials, and cloud authentication is accessible anytime, anywhere. the concept of BYOD (Bring-Your-Own-Device) Nothing out of the ordinary, it is a novel attack technique that combines traditional phishing with second-phase or even third-phase actions. The first stage steals an employee’s email like regular phishing attacks. Yet, instead of attacking the victim, the a new Office 365 account on a rogue device in the victim’s name. Once established on the new computer, the victim’s user account (and or this case, its Azure Ad) is used to send (disguised as the victim) within the company or to customers using the legitimate email account. second stage establishes internal phishing attacks If they want to gain more control or find a better “host,” they These multi-stage attacks appear legitimate and can even deploy malware on the company’s OneDrive or SharePoint systems. can find it via the first victim and then compromise the second account by internal phishing. ChatGPT (or Other AI) According to , phishing accounts for nearly 90% of malware attacks. But ChatGPT could make the whole situation even worse. Such intelligent 🧠 AI Chatbot can be . So the victim may not even know they are interacting with an AI. HP Wolf Security research a way to gather information through a human-like friendly chat https://research.checkpoint.com/2022/opwnai-ai-that-can-save-the-day-or-hack-it-away/?embedable=true demonstrating . Multiple scripts can be generated quickly, with variations. Complex attack processes can also be automated, using the LLMs APIs to generate other malicious artifacts. Check Point Research recently published an interesting article how AI models could create a full infection flow, from spear-phishing to reverse shell Another risk is more prominent. AI technology like ChatGPT will enable attackers to . For example, say generic phishing attacks send out millions of spam in the form of emails, SMS (in the case of smashing), and social media posts. But these are easy to spot, resulting in low yield. blend the volume of massive phishing with a targeted attack (or spear-phishing) With the addition of an AI Chatbot, millions of spear phishing messages could be generated in seconds. Thus, the attackers can have the best of both worlds. Therefore in 2023, we will probably see . It would be a tremendous challenge for security teams. some large-scale phishing that sends millions of unique messages generated within minutes Other Novel Phishing Techniques QRishing Attackers are now trying to deliver which makes them difficult to detect for most email security solutions. QRishing combines the words: “QR Codes” + “Phishing.” This indicates the attack is in the form of a QR code. It can potentially direct victims into connecting to an unsecured WiFi network while someone can easily capture what you are typing. malware links via QR codes embedded in emails, Some adversaries even stick malicious QR codes in restaurants or other public locations. Since the pandemic limits physical contact, QR codes are a popular tool for threat actors. We use it to access menus, check in for vaccines, and get public information. In addition, social engineering tactic is inserting fake QR codes into a phishing text (SMishing + QRishing) or social media platform. Upon scanning the malicious code, users are redirected to phishing sites, where the victim may be prompted to log in and steal their credentials. SMishing That means it is one kind of phishing sent across your mobile network in the form of text messages. Although the name uses SMS, this attack can happen on other messenger platforms, such as Facebook Messenger or WhatsApp. Common Smishing attempts to focus on everyday necessities. Missed deliveries, late payments, bank notifications, fines, and urgent notices are examples of smishing attacks. SMishing combines the words “phishing” and “SMS.” With so many people staying at home and so many daily online purchases, we’re awash in cardboard. It’s very challenging to keep track of everything coming into the house. Combining well-known delivery services with is the best recipe for a successful Smishing. fake “delivery fee” notifications Crown Jewel = Developer Accounts Why are threat actors trying to compromise developer accounts? And what can go wrong if they are stolen? Depending on the developer’s position, attackers gain access to nearly everything: SSH keys, API keys, Source Code, Production infrastructure, Access to CI/CD pipelines and, i.e., the works. Assuming a compromise with the “best scenario,” a junior engineer’s account might be stolen. At the very least, this engineer has “commit” access to the source code. On the other hand, suppose the organization does not follow the best practices of software engineering, such as code reviews and restricting who can commit to the main branch. In that case, the attacker can modify the organization’s source code to alter and infect the final product. In the worst-case scenario, which is also the most likely, the attacker will gain access to a senior developer with more permissions. This account could manually bypass some code checks, which will also have access to valuable resources (source code, SSH keys, secrets, credentials, API keys, CI/CD pipelines, and more). This scenario, where this kind of account is compromised, would be devastating for an organization. Developer accounts usually come with GitHub or other code repository access. Dropbox & Uber In September, Later, we discovered that the hack was related to Uber disclosed that hackers had stolen the personal information of about 57 million customers and drivers . obtained by a “ ” a hard-coded credential remote social engineering attack. In November, due to a phishing attack against its developers. They were lured into by a phishing email into a fake website, What makes these incidents scary is that this wasn’t just a random user from a business function; it was developers with privileged access to many Dropbox and Uber data. Dropbox had a security incident filling in their Github credentials despite multifactor authentication (MFA) in place. MFA Fatigue Both cases from these two giant tech companies implemented multifactor authentication. Still, hackers find a way to bypass or work around this measure that can prevent most credential theft. In the case of Uber, the hacker (allegedly a 17-year-old) was creative and came up with a low-tech but very effective method — The attacker attempts to log in repeatedly, sending a flood of push requests to users asking the victim to confirm a sign-in. Once the victim stopped clicking “no” on their phone, followed by an “authorized login,” thus, MFA failed. an “ ” MFA-fatigue attack. For the Dropbox case, which is much simpler. The phishing email purported to . Then the realistic-looking phishing site tricked the developer into typing the credential and the one-time password. Thus, MFA also failed. originate from the code integration and delivery platform, CircleCI Code Repo and More As we saw in these incidents, With the proper permissions, attackers can obtain intellectual property, source codes, and other sensitive data. GitHub and other platforms in the continuous integration/ continuous deployment (CI/ CD) pipeline space are the new “crown jewels” for many companies. But it doesn’t stop there, as GitHub often integrates with other platforms, which lets the allowed “users” go even further. In addition, developers’ accounts are usually granted access to the deepest level, as maintaining and developing the core application may be part of their job responsibility. That makes the developer account a crown jewel for attackers. How to Improve Your Phishing Defenses According to , the average organization receives dozens of phishing emails per day, with financial losses compounding as losses from malware and ransomware attacks drive up the average cost of landed phishing attacks year over year. Facing all the threats highlighted requires extra effort, and while you can’t eliminate the risk of phishing attacks, you can learn from observed trends and incidents to better manage them. industry statistics For example, here are the recommendations from : the recent Zscaler report Understand the risks to inform policy and technology decisions better Leverage automated tools and actionable intel to reduce phishing incidents Implement zero-trust architectures to limit the blast radius of successful attacks Deliver timely training to build security awareness and promote user reporting Simulate phishing attacks to identify gaps in your program Apart from the five basic mitigations of phishing attacks, we can do more. Therefore, I will end this article with tips you can bring along. , having a greater extent of cyber-resilience would be an excellent way to begin. Knowing that phishers will eventually find a way to get to you Tips #1: Multi-layered phishing defenses approach Typical email security against phishing often relies exclusively on a single guard point, such as email gateways and endpoint/ mobile agents. Everything passing through that gate would depend on users being able to spot phishing messages. Not to mention attackers are now sharpening their weapons with multi-stage phishing. Conversely, Moreover, there would be multiple chances to detect and catch a phishing email. a layered defense approach could improve cyber-resilience without disrupting business productivity. Reach — Prevent the email from reaching the user’s inbox. This can be achieved by introducing anti-phishing security software such as spam filters. In addition, anti-spoofing controls should be implemented, such as; DMARC, DKIM, and SPF records. Identify — Most data breaches are initiated through a phishing email due to human error. Therefore, staff should have regular training in identifying the latest potential phishing emails. This will enable them to follow the company process when an incident does occur, which should include reporting the incident to the relevant team. Protect — Protections should be in place for when incidents do occur. These protections include but are not limited to; enforcing multifactor authentication (MFA), password managers, regular IT health checks, and endpoint defenses. Response — Staff should be able to report phishing incidents to the relevant team. A dedicated security logging and the alarming system should be in place, as well as an Incident Response Plan. Even though some attacks get through, this approach will help with incident response and minimize the impact. Tips #2: Just-in-time (JIT) Access Approach Privilege access entails a significant danger, claims . The risk posed by users with standing privileges persists even with PAM tools, and it is considerable. They suggest just-in-time (JIT) solutions be used by identity and access management (IAM) leaders to finally achieve a posture of no standing privileges. Gartner also provided a solution to counter it — The Just-in-Time approach. For example, when developers use these credentials to set up or modify production resources, granting them the appropriate permissions is crucial, with only the capabilities required to complete specified tasks. Gartner The JIT approach, which deals with information security, only gives users access to privileged resources while working. This reduces the attack surface and eliminates the risk brought on by persistently held-over privileges. Tips #3: Review Mailbox Forwarding Threat actors use compromised accounts not only to steal internal data but also, for example: Read users’ emails, Distribute malware, Spamming, Learn about the user and to further launch second-stage phishing, and Forwarding emails to external recipients. Attackers may set up email rules to conceal their malicious activities from the user to hide incoming emails in the compromised user mailbox. They may also create rules in the compromised user mailbox to delete emails, move them to a less visible folder, such as an RSS folder, or forward emails to an external account. Emails can be manually or automatically forwarded using forwarding rules. Automatic forwarding can be accomplished in various ways, including While manual forwarding requires users to take direct action, they may need to be aware of all auto-forwarded emails. Inbox Rules, Exchange Transport Rules (ETR), and SMTP Forwarding. It would be wise to schedule a review of all email forwarding rules to external addresses and check that it is not an unusual IP address and corresponds to the user’s usual activities. Final Words as long as the human factor is in the formula. As a result, the best we can do for the long term is It would be a much more granular design of the multi-layered defense approach. The reality is that no one can stop phishing entirely to adopt Zero Trust Architecture for email security. A Zero Trust approach to email can assist organizations in defending against email impersonation attacks by — ensuring that emails entering the corporate environment or landing in end users’ inboxes are from legitimate individuals, brands, and domains. focusing on Authentication (Verifying User/ Device Trust) https://hackernoon.com/introduction-to-the-zero-trust-security-architecture-a-concept-not-a-product?embedable=true A privileged position exists for software developers in every technical organization. They are the lynch-pin in any modern company because of their upstream access to the products distributed to clients and their access to production systems and infrastructure. The security organization would fail if developers weren’t protected, leading to catastrophe. If you, unfortunately, fall for a phishing attack, please do the followings: Contact the IT department and let them know the situation Reset password for related applications Please don’t use a repeated password. Instead, reset the account with the same password as the applications above. Monitor the account with care for 30 days Finally, NIST developed a method to help the security team to see why users click on the phishing email: https://www.nist.gov/news-events/news/2020/09/phish-scale-nist-developed-method-helps-it-staff-see-why-users-click?embedable=true Thank you for reading. May InfoSec be with you🖖.

Cloud Phishing: New Tricks and the Crown Jewel

Phishing en la nube: nuevos trucos y la joya de la corona

Cloud Phishing : de nouvelles astuces et le joyau de la couronne

क्लाउड फ़िशिंग: न्यू ट्रिक्स एंड द क्राउन ज्वेल

クラウド フィッシング: 新しい手口と王冠の宝石

Phishing na nuvem: novos truques e a joia da coroa

Lừa đảo trên đám mây: Thủ thuật mới và viên ngọc quý

云网络钓鱼：新技巧和皇冠上的明珠

The has been present for a while, and security experts have fought it substantially. They have provided on individuals and enterprises. However, the techniques of malicious actors are also evolving at the same pace to continue causing damage. ransomware attack methods to decrease the prevalence of this attack In 2019, the world experienced a new method of a ransomware attack- Double extortion. The attack, which was by a malicious group- , targeted Allied Universal, a security company. 10% of stolen data from the security company was later made public as a warning from the threat actors for noncompliance. Maze group also demanded $3.5 million as ransom, or they would leak the remaining 90% of data. The Maze 2020 Also saw malicious groups like the REvil, Ragnar-locker, and Lock bit joining the Maze to participate in successful and devastating exploitation of enterprises. Already, more than have fallen victim to this tactic, which cost about and is projected to cost $265 billion by 2031. One of the companies was Cognizant, a large IT service provider. The company lost about 70 million US dollars to , one of the most lethal in history. 1200 enterprises $20 billion in 2021 the attack What Is Double Extortion Ransomware Attack In a Double extortion ransomware attack, malicious actors gain unauthorized access to a network to extract and encrypt data in the hope of a ransom payment. Contrary to the mere ransomware attack, this method decreases the effect of backed-up data. Attackers now leverage the extracted data to pressure victims. They can go as far as publishing the data or selling to a competitor should the victim refuse to comply. Double extortion with unforgivable results when successfully executed. Victims either face financial loss to threat actors or compliance and public defacement. In 2022, this attack procedure is still on the rise. According to the , the health care sector saw an increase of double extortion by 650%, while the food service by 450%. Also, other sectors are vulnerable to this attack, and the toll keeps going high with the involvement of RAAS. Zscaler Threatlabz report How Does Double Extortion Ransomware Attack Work Double extortion ransomware attack starts as a passive attack that turns into a devastating active attack like Encryption of data, and DDOS. The sequence of these attacks starts with a process where the attacker has to gain access to the company’s system through any attack vectors. The attack vectors can be social engineering or programming, which include phishing, brute force on Remote desktop servers, malware, vulnerabilities exploitations, etc. After the actor gains access to the system, he conducts a reconnaissance attack through lateral movement. At this stage, it is still a passive attack because the actor is masquerading as the original user to escape detection and gain valuable information for their potential attack. When the malicious actor has gathered valuable data, he exfiltrates the data and deploys the malicious code, which encrypts the data. Impact Of Double Extortion Ransomware Attack on Enterprises Group IB, in their report, , stated that double extortion ransomware attack had about 935% increment in damages. The impact of these damages on affected companies can be huge, depending on their size. More so, the time frame for recovery of these enterprises depends on how quickly they respond and the depth of the attack. Hitech crime trend 2021/2022 Brand Defacement Enterprises risk brand defacement because of data leakages and DDOS. Travelex, a travel agency, saw its reputation go down the drain in the on new year's eve of 2019. REvil attack After disrupting their services, which left customers stranded, REvil also threatened to publish exfiltrated data if the company refused to pay the ransom. The double extortion ransomware attack here was devasting because even if Travelex complied to restore services and prevent data leakages, the breach of confidentiality and DDOS damaged their reputation. Loss of funds Enterprises depend on backed-up data to avoid losing lots of funds to ransomware events. Nevertheless, the chances that this is still very effective are low in the case of double extortion. Attackers now leverage exfiltrated data; hacked companies will be required to pay the ransom, worth millions of dollars, or get their sensitive information leaked in the public domain. With valuable data of these firms exposed to the public, they can accrue heavy compliance fines, as was with . Equifax in 2017 More so, enterprises that are unyielding to the demands risk losing the value of their stock when they are short-sold. According to the FBI’s cyber division advisory- , this method was introduced in 2020 by a Revil Ransomware member in a hacking forum. And Attackers are relentlessly using this means to facilitate extortion. Hence, organizations are bound to lose huge funds once they experience this form of attack. Private industry notification Vulnerability Of Third-Party Associates Since attackers have complete access to an enterprise network, they can escalate their access to partners and consumer data. With this, threat actors can exfiltrate these data and demand ransom from partners or consumers. An example of this event was in the case of Patients whose data were accessed needed to pay a ransom. Another was the event where to pay up a 50millon dollars ransom. It was difficult for Apple because of the compromise of their valuable information with Quanta Computer Inc. the Vastaamo hackers- REvil alerted Apple Inc. Prevalence Of Double Extortion Ransomware Attacks The usage of the Double extortion method has tripled because of how successful it has been. records about a 106% spike in data exfiltration, and a 60% success rate for attackers in 2022. The odds are tilting to favor malicious actors and no enterprise is free from being hacked or hacked again. Titaniam Ransomware research report, Loss Of Valuable Staff The nefarious effect of this incident can ensure that an enterprise loses most of its valuable staff. According to the 2022 , 40% of enterprises lost their staff because they were sacked or resigned after an attack. Cybereason Ransomware report Some small and big enterprises lose their employees because they cannot afford wages after a significant loss of funds. In some scenarios, the high loss of funds is because the attackers demanded double ransom. On the other hand, it can happen because their stocks sink after exposure to significant information on platforms like NASDAQ. Mitigating Double Extortion Ransomware Attack With double extortion ransomware attacks on the rise, you do not have to wait until post-attack before taking action. Proactiveness is the best way to combat this attack. While it might not eliminate the chances of infiltrating an enterprise, it minimizes the chances. Also, it minimizes loss in case of breaching. Apply Zero Trust Policy Enterprises let individuals gain privileged access to their network, even to the most sensitive areas. When this happens, they put architecture in a vulnerable spot for a ransomware attack. Enterprises must practice a zero-trust policy by restricting access to their network. They must see all elements in their network, including insiders, as a probable threat. There should be compulsory authentication of elements before granting access. Another recommendation is to create a network segmentation for all granted access. This practice will limit the spread of malware. Encrypt Data The pressure point for malicious actors who use this string of attacks is that they have exfiltrated your data and can publish it if you refuse to pay a ransom. However, enterprises can be one step ahead by encrypting their data from the start. By encrypting your data, you have denied the malicious actor access to your data, hence, reducing his bargaining power. The threat actor can no longer threaten with data leakages; the worst he can do is to double encrypt your data. Offline Back-Up Double extortion has made Offline backup appear as a less efficient option to mitigate malicious actions. Nonetheless, offline backup can save your company from damages if you practice data encryption. This way, even when the attackers double encrypt your data, you can fall back to the backed-up data offline. Employee Education The emergence of covid 19 saw the rate of remote jobs skyrocket. More employees can now access sensitive networks through an external router. While this development makes life easier for workers, it creates more vulnerabilities for their employers. Attackers leverage the ignorance of some employees for their exploits. Even employees can be an unintentional threat; nonetheless, this can be averted with sensitization. The recommendation is for enterprises to intensify internal awareness of ransomware attacks and the implications. Evaluate Your Network and Patch Vulnerabilities Enterprises assess loopholes in their network in two ways, depending on the size of their infrastructure. They can conduct a vulnerability assessment or simulation by a pen tester. With this, they can spot any security gap and misconfiguration that make a potential attack easy. It is also critical to quickly patch up all vulnerabilities and conduct necessary security updates, or all effort is futile, as it was in the case of Travelex. Before the REvil attack, Kevin Beaumount, a security researcher, stated that since August 2019. However, Travelex was reluctant to patch it up, hence their downfall. s vulnerabilities were found in some organizations’ network Monitoring Data Log Enterprises can observe packet activities in their network with tools that will alert them when something unusual occurs. By monitoring the data log, you can immediately spot a malware attack and cut it off before it escalates. Conclusion While enterprises and cyber security professionals are doing their best to secure their infrastructure, Ransomware attackers are doubling their efforts to make the job tedious. Besides double extortion, other tactics used by ransomware attackers include triple extortion and quadruple extortion. Cybersecurity experts have to update their knowledge and skill to combat this issue. Also, enterprises should be more intentional and dedicated to their security infrastructure. They must embrace the recent security trends and implement them in their organization.

Impacts of Double Extortion Ransomware Attack on Enterprises and Mitigation

Impactos del ataque de ransomware de doble extorsión en las empresas y mitigación

Impacts de l'attaque de ransomware par double extorsion sur les entreprises et atténuation

डबल एक्सटॉर्शन रैनसमवेयर अटैक का उद्यमों और शमन पर प्रभाव

Double Extortion ランサムウェア攻撃が企業に与える影響と軽減策

Impactos do ataque de ransomware de dupla extorsão em empresas e mitigação

Tác động của cuộc tấn công bằng mã độc tống tiền kép đối với doanh nghiệp và giảm thiểu

双重勒索勒索软件攻击对企业的影响及缓解措施

Crypto Crash? Not Really... 

As mobile users begin to connect uncontrolled devices and business applications to the Internet, there is a growing need for trust-free security. Security models designed to protect the perimeter leave network-penetrating threats uncontrolled, invisible, and can change and move at will, extracting valuable and sensitive business data. Zero-Trust (ZT) is a term for an evolving set of cybersecurity paradigms that move defense away from static network-based environments and focus instead on users, assets, and resources. Zero Trust believes that assets and user accounts receive implicit trust due to their physical network location (e.g. Local networks, Internet-based assets) and ownership (corporate assets). The original Department of Defense (DoD) Zero Trust reference architecture was designed to reduce the DoD's attack area and ensure that devices, networks, and users can be compromised, but the damage can be limited. It describes seven pillars of Zero Trust (user devices, network environment, application use, data visibility, analytics, automation, and orchestration) and outlines how Zero Trust capabilities are aligned. On 20 February 2015, the Swiss Federal Institute of Intellectual Property published a new architecture based on networks of trust and trust. In 2019 the National Technical Authority and the National Cyber Security Centre of the UK recommended that network architects consider a zero-trust approach to new IT deployments with significant cloud services and plans. Zero Trust, Zero Trust Network, or Zero Trust Architecture refers to a security concept in which the threat model no longer assumes that actors, systems, or services operate within a security area that can be trusted to ensure that anyone who tries to connect to their systems has access to it. On the contrary, your starting point is to consider all potential threats to be subject to verification. Zero trust is a security framework that requires all users on an enterprise network to authenticate, authorize, and validate security configurations and attitudes before granting or retaining access to applications and data. In this philosophy, any device, user, or application that tries to interact with your architecture is considered not safe. Only untrusted devices and users can gain privileged access. Zero Trust requires a traditional network, an edge network, a local cloud, or a combination of hybrid resources and work sites. The zero-trust architecture focuses on the business needs and functions of an organization and implements a network-centric data security strategy that provides specific access to those who need it. A network without trust uses a positive model of security enforcement with specific rules for access to resources. Zero Trust prevents attacks on access with the least privileges, which means that the organization gives users and devices the least access possible. In old networks, organizations have little visibility and control over the use of network data, but in a zero-trust architecture, all network traffic is seen via segmentation gateways that contain granular policies on data, applications, and asset access that are strictly enforced. In the event of an infringement, these subsidies help to limit lateral movement in the network and minimize the target area. Protection is environment agnostic, so applications and services can be backed up while communicating with the network environment without requiring architectural changes or political updates. The zero-trust model uses micro-segmentation, a security technology that involves dividing the perimeter into smaller zones and maintaining separate access to parts of the network to contain attacks. This can be achieved through next-generation firewalls with decryption features. Zero Trust is a strategic initiative to prevent successful data breaches by removing the concept of trust in an organization's network architecture. It is based on the "never trust, always check" principle to protect the modern digital environment by leveraging network segmentation to prevent lateral movement, prevent Level 7 threats and simplify granular user access control. A broken trust model assumes that the identity of a user cannot be compromised unless he or she acts in a manner of trust. The value of using zero trust in the cloud is not only to enhance an organization's cloud security but also to enable them to use enterprise applications without compromising performance or user experience. Gartner estimates that by 2022, 75% of global organizations will be operating container applications that benefit from faster release cycles and increased scalability, reliability, and resilience. This is all the more important as more and more employees work with data that has migrated to the cloud. On the other hand, The Zero Trust Architecture (ZTA) is an enterprise cybersecurity plan that leverages the Zero Trust concept and encapsulates all components of relations, workflow planning, and access policies. Zero trust in the infrastructure of corporate networks (physical, virtual, and operational) exists in all enterprise products and in plans for a zero-trust architecture. ZTA is designed in response to corporate networks used by remote users, user-owned devices (BYOD), and cloud-based assets that are not within the company's original network boundaries. ZTA focuses on protecting resources within a protected network segment. This means that by default, only one person of trust and network verification is required to gain access to resources within the network. In a nutshell, Zero Trust assumes that there is no implicit internal trust that assets and user accounts are privileged due to the physical location of the network, that property, authentication, and authorization of assets is between a person or device on the network, and that discreet functions performed during sessions within the company's network-wide resources. According to Microsoft Zero Trust ; components Identities: Verify and secure each identity with strong authentication across your entire digital estate. Endpoints: Gain visibility into devices accessing the network. Ensure compliance and health status before granting access. Apps: Discover shadow IT, ensure appropriate in-app permissions, gate access based on real-time analytics, and monitor and control user actions. Data: Move from perimeter-based data protection to data-driven protection. Use intelligence to classify and label data. Encrypt and restrict access based on organizational policies. Infrastructure: Use telemetry to detect attacks and anomalies, automatically block and flag risky behavior, and employ least privilege access principles. Network: Ensure devices and users aren’t trusted just because they’re on an internal network. Encrypt all internal communications, limit access by policy, and employ micro-segmentation and real-time threat detection. Cited Sources https://www.infradata.com/resources/what-is-a-zero-trust-architecture/ https://www.cloudflare.com/learning/security/glossary/what-is-zero-trust/ https://edge.siriuscom.com/security/4-major-myths-of-zero-trust-architecture https://gcn.com/articles/2021/05/17/disa-zero-trust-architecture.aspx https://www.forcepoint.com/cyber-edu/zero-trust https://www.mcafee.com/enterprise/en-us/security-awareness/cloud/what-is-zero-trust.html https://www.fedscoop.com/nist-zero-trust-architecture-definition/ https://www.jdsupra.com/legalnews/zero-trust-architecture-is-officially-2104792/ https://csrc.nist.gov/publications/detail/sp/800-207/final https://www.zscaler.com/resources/security-terms-glossary/what-is-zero-trust https://www.nccoe.nist.gov/projects/building-blocks/zero-trust-architecture https://www.crowdstrike.com/cybersecurity-101/zero-trust-security/ https://www.paloaltonetworks.com/cyberpedia/what-is-a-zero-trust-architecture https://doubleoctopus.com/security-wiki/network-architecture/zero-trust/ https://en.wikipedia.org/wiki/Zero_trust_security_model https://www.illumio.com/cybersecurity-101/zero-trust

Zero Trust Architecture: An Introduction

2020 is a rough year for everybody. I don’t want to add another article on the pile of articles about the coronavirus pandemic, but what I’m about to say next is happening, first of all, due to the current worldwide situation. First, the good news! The today is the same as two and a half months ago (~ January 1st) when the economy was unaffected by global events. While the majority of stock investors are losing big chunks of their investments and the EU and the US are to stop the decline, your cryptocurrency funds are keeping their value. Maybe you were expecting more action this year after two years into the lows, especially with the halving happening soon but, let me tell you something – you are doing better than the majority and that’s a win in the investment business! total market capitalization printing money Now, the bad news and why you, as a cryptocurrency owner, are at risk to lose everything during this period! The past few weeks had, most likely, a huge impact over your life and, more specifically, on how you are spending your days. With most outside entertainment places closed and the social distancing awareness in place, you might find yourself spending more time on your devices than before. Actually, the time each person spends on their phone almost doubled during the lockdown, according to the . Apple screen time report Some just discovered Zoom as a substitute for in-person meetings, some prefer to binge-watch their favorite TV series on Netflix, and some are actively working remotely from the comfort of their home. During these unusual circumstances, I won’t even dare to point fingers and remind you about the medical risks you are exposing to. I’m sure that you are very aware of these. Anyway, most of you are not aware of the cybersecurity risks you are directly exposing your devices during this period. If your screen time doubled, be sure that your risks quadrupled (at least!) Here are the main reasons: Cyberattacks are directly related to the you are actively using at the time of the attack. For example, Zoom was the subject of and with the absence of end-to-end encryption, the privacy concerns are rapidly increasing. activity and software personal data leaks are under self-isolation as well. But instead of watching movies or having video calls, they prefer to spend their time trying to hack into your devices. Black hat hackers Actually, you don’t even need to be a programmer or even be tech-savvy to steal credentials, data or cryptocurrency. On the dark web, is sold for as little as $2 and, guess what, the sales for such products increased lately. digital currency stealing malware In 2019, hackers have worth of cryptocurrencies. stolen $1.1 billion In the first quarter of 2020 alone, more than were registered. 907.000 Covid-19-related threats How can you protect yourself in 2020? Given the recent data, you should prepare for the worst. There is no such thing as ‘too secured’. Security is security and combining good practices with utility tools could make you less of a target and protect your data and, more importantly, your digital assets. Source: xkcd.com Starting from this premise, I scraped the internet for the most complete software solutions that could get your digital environment from 0 to a virtual fortress that could scare away even the most determined hackers. No matter where your security level is right now, these applications can help you increase it and keep you up to date in this fast-moving space. And the best thing is that they are either free or only cost a few dollars a month, which is incredibly underpriced given the amount of money you could lose if an attacker would get access to your private keys. – I’ll start with a well-known name, Norton which partnered with LifeLock and created a suite of products that could offer you identity theft protection. The traditional device security software is included in the package: antivirus, firewall, cloud backup, password manager, VPN. All under Norton’s approval and developed by their cybersecurity experts. Norton 360 with LifeLock Select What’s new, though, and here’s what LifeLock brought to the mix is the dark web monitoring service that sends you alerts if any breaches related to your email addresses or card credentials have been found. From this point, an entire restoration process should start where the company is helping you with assistance and legal support. However, the whole strategy of this package (which is available for $9.99/month) is around trying to recover your data and funds AFTER you’ve already been exposed. It’s true that you have an antivirus in place, protecting you day and night (and consuming resources while doing so) but these solutions don’t have a and I doubt Norton and its lawyers would be able to do anything if the hacker already transferred your crypto away. 100% protection rate Rubica – The company began as a research-and-design project and today is offering a complete product focused on keeping you secure. The company believes that a software solution is not enough (so do I.) While Norton has a team ready to help you restore any lost data or recover funds, Rubica is offering human support 24/7 in order to assist you in the continuous battle against hackers, viruses, and unforeseen events. Imagine a team of highly trained cybersecurity experts helping you set up a secured digital environment. Seems ideal. Anyway, I can easily see some flaws in this approach too. While the human component is essential to make contextual decisions, in the end, you are going to make these decisions. Of course, you can ask their experts anytime (24/7 support, right?) but that will only lead to taking more time becoming a chore. Cybersecurity is not hard to learn and apply in your day to day activities. They are making it as it is. Plus, I don’t want to mention that probably the tools they are helping you to set up are from their own suite and they might not be able to help you with anything outside their own products. – New product, new company, and decentralized! You hear me correctly, their solution is focused on cryptocurrency-related protection. They might be new on the market, but the team has vast experience in cybersecurity. There’s no surprise that they are already partnering with CoinMarketCap (their only cybersecurity partner), Etherscan, TradingView, and many other companies you most likely heard or even used their products. HackenAI All these signs are pointing out to an increased number of cyberattacks this year - which is already happening right now: Cybercrime will surge in 2020 according to HackenAI at least 150% "This global crisis is an emergent vulnerability in the broadest sense possible," Lukasz Olejnik, an independent cybersecurity researcher says In March, Zscaler, cloud security company, has seen nearly 20,000 unique incidents of phishing attacks And, if the points above are not enough, here’s a . Spoiler alert: 1.5 billion records breached in only one month! list of data breaches and cyber-attacks from January 2020 I apologize for the FUD (fear, uncertainty, and doubt) but there’s no other way to explain the importance of cybersecurity and the huge risk that you are exposing yourself to if you are not taking it seriously - especially if you own cryptocurrency. You don’t need to be an active trader or to own a large amount to become a target. According to studies, if you are a you have the profile for the perfect target. Getting started is when you make the most mistakes. If you are a veteran, don’t relax yet. Hackers you either! new cryptocurrency investor won’t spare The author is not associated with any of the projects mentioned.

Why 2020 Could Be A Bad Year for Crypto HODLers?

Hackers might not attack you. Bots will. Don’t like reading? The content of this blog was presented at /dev/world 2017. Many of the points are still very relevant, but the data will be a bit old. Quote: “The content is topical and delivery is quick (not droning) and engaging”. I also play a prank on an audience member. It’s pretty epic. When I talk to developers about security, the common theme I hear is: My app is too small, no one is going to attack me. This is because developers (and non-developers) assume that their attacker looks like a stock image hooded individual with an unbranded laptop surrounded by matrix text. Which is partially true, there are some excellent security professionals and cyber criminals that look great in a hoodie and that are attacking applications and their associated servers — but for the rest of the lower profiled applications, it is more likely that their threat is going to be: • A search bar, or • a bot There are three main attack vectors that an attacker will focus their attacks on. The application binary (your app), the network the app is on, and the server holding the data for your app. The application Let’s talk about reverse engineering. Now if you’re not familiar with this concept — let me just start with this: Developers give away their application. Every user has the app and its logic. Within the application is the code and associated values. It’s pretty easy to get those into a human readable form. On Android, it gets it back to almost the exact code a developer wrote. Hopper on the left (iOS). JD-GUI on the right (Android) There are many developers out there But as you can see above (and the many tutorials online), they’re easily recoverable. storing secrets and keys into applications and assuming they’re secret because the app is “compiled”. Reverse engineering is not a new threat, but there have been some pretty amazing advances with Big Data. There are databases of code. Millions of apps of code. So, with one of my clients here in Australia, I have the privilege of working with a company called Mi3Security (now bought by Zimperium). Special thanks to the team at Mi3Security for letting me publish some of their data publicly. They have such an amazing database. The threat analysis they are capable of is incredible! I asked my contact there really nicely, if he could tell me how many apps within their database (around 65–70% of all public apps) are currently not implementing Application Transport Security correctly by implementing NSAllowsArbitaryLoads > 100,000 apps are potentially susceptible to downgrade attacks. The result was instant. I was shocked. I mean.. I know how database lookups work, but holy crap, in front of me was a portal to source code for millions of apps. So, what do I ask? At the time, the memory of Uber trying to fingerprint user’s information was pretty fresh in my mind. If you’re not familiar with it, you can view the story . here So we checked how many other apps also used the line of code that got Uber into trouble: Banks track more information than I realise… Looks like Uber took the heat, but we know there are many other apps doing something similar. This information was gathered quite quickly. How many agencies have a database like this? I can think of only a few companies / countries that might have something like this… Then I had an epiphany… I can probably do regex matching on this database… Searching with Regex So, I thought it would be a good idea to try a basic regex. “http only, send password” I’m not even checking TLS security. Zero encryption. Http only. Login/signup/signin URLs within apps. I had seen a high-profile example before from Zscaler (research found ) where they found this exact vulnerability in one of India’s top shopping apps. But I figured it didn’t really happen anymore… here I had faith in the development community. I posted the regex query to the Mi3Security team, and even suffixed this statement to the team saying: “It’s okay if that query finds zero apps” What a stupid thing to say… There are over 30,000 apps that do not implement HTTPS for a query that looks like it involves a password. The worst part is: You would never know if the app is using HTTPS or not There’s no green lock, no certificate error or lack of either — there’s just a login page inside an app. It’s impossible to know from an app GUI if they are communicating using a secure TLS connection, have poor TLS configuration or no TLS configuration at all. Thanks to Mi3Security, we now know that at least 30,000 apps have zero login security. Now obviously — there may false-positives, my regex statement isn’t perfect (and if you have a more precise statement, let me know, I’ll get them to run it and credit you) I asked InfoSec twitter for feedback: What else can we check? Thanks to those who suggested options. 140 characters meant my question lacked detail. 280 characters here we come! Twoof my favourite suggestions came from Don Lor and the amazing egyp7. The classic. Static private keys within an app. BEGIN RSA SECRET == 193,329 apps. 🤦🏻‍♂️🤦🏻‍♀️ Now this number seemed pretty high to me, so I’ll likely write a follow up to understand why so many developers are storing private keys in their apps Don Lor had an excellent suggestion to look for AWS keys in mobile apps. This is pretty common mistake for people to store it in github, but I wonder how many apps think it is “secret in their code” Regex for AWS Private Key is: This query produced 694 apps out of 1.3m Android apps. That’s not a high number, but it’s still almost which should never be exposed. [^A-Za-z0–9/+=][A-Za-z0–9/+=]{40}[^A-Za-z0–9/+=] 700 applications that have their AWS private key exposed How can I protect against Reverse Engineering? There’s not a lot you can do to protect against reverse engineering. You’re giving away your app. However, avoid storing secrets within an app. Keep all secrets on your server. If you ‘must’ store a secret, you can make it harder for an attacker by obfuscating your secret. This definitely doesn’t make it impossible, just more annoying to find for an attacker. If you’re on iOS, you can use something like this: https://github.com/pjebs/Obfuscator-iOS On Android, ProGuard should be used at a minimum. If you have a bit of money, DexGuard or another commercial obfuscator can be quite useful. 2. The Network There are two main attacks for mobile applications. • Developers have mis-configured HTTPS / no HTTPS. • Users are using free wifi One of the biggest network security concerns in mobile apps that you cannot validate the security of the HTTPS certificate while using the application. Where’s the green lock? Where’s the cert button? Is it even using HTTPS? No one knows from this interface. Developers need to do the right thing with their web servers. Here’s are some good resources to make sure your web server is configured correctly: Qualys SSL Server Test is an excellent resource to test your server and check the health of your TLS certificate 2. I’ve come across this website recently that helps people check what security features are exposed in the header. Strict-Transport-Security is the one we care most about for HTTPS security, but the others are good too. (My Bank got a D grade based on their security headers. Something for me to look at the consequences of next week) https://securityheaders.com/ 3. To set up HTTPS, the amazing Troy Hunt has an excellent resource that . every web dev should read Once developers have set up proper TLS, they need to assume the users are on a hostile Wi-Fi. A user can be tricked into using a malicious network and one of the methods we use to protect a user from a malicious actor on a network is HTTPS. Now, in order for HTTPS to be considered secure for an app, two things need to be correct: 1. The Server needs to be configured correctly (see the above resources) 2. The client / app need to be configured correctly. In order to achieve point 2 — we can utilise Application Transport Security (ATS) on iOS and Network Security Configuration (NSC) file on Android. These move the burden of certificate verification from the app (where developers and libraries have made mistakes in the past) to the Operating System, where we have some level of trust that Apple and Google will do the right thing. If you want to take an extra secure step, you can also implement Certificate Pinning, which is an excellent way to ensure your app is almost definitely talking to the right server. For more information on Certificate Pinning, view my talk as I go into it with a unique example. “Unique example”. I am such a bad person… 3. Your Server There are lots of attacks on web servers and web applications [citation needed]. There are books, blog posts, videos, and countless online resources discussing this. This blog post is more focused on automation and attacks, and one of the biggest we’ve seen in the development space is finding simple vulnerabilities using two sources: Google Hacking Database — for doing very quick google searches finding poorly hidden information. As an example, here’s an example of websites potentially leaking databases with the table orders in it: intext:”Dumping data for table `orders` You can find more at the Google Hacking Database 2. Shodan search engine for any open port to the internet. Security researchers and malicious actors use Shodan to find unauthenticated webcams, industrial control system pages and databases. Many databases have weak, or no authentication blocking them. Shodan researchers published that there was a staggering amount of data being leaked from MongoDB and HDFS databases. MongoDB used to be leaking >600TB a few years ago. For the whole write up, visit the links below. The HDFS Juggernaut It's the Data, Stupid! It's Still the Data, Stupid! These unauthenticated servers came under attack earlier this year. They were encrypted and held for ransom. Not because of some advanced apex attacker, but due to security not being enabled by default. How to fix this? There are hardening guidelines for your web stack. Summary Let’s go back to my original point: My app is too small, no one is going to attack me. A bot doesn’t care that your app is too small. A search engine doesn’t care. If you are low-hanging fruit, you will be attacked. Web servers, email servers have been experiencing this for years. Mobile apps will be joining their ranks soon (and they are already). What’s the takeaway? Mobile App Developers need to understand these three things: 1. A mobile app is reversible to get to any string / url/ secret within an app 2. Network security need to be configured correctly at the server AND the client to be effective 3. Automating attacks on servers has never been easier, it needs to be hardened and patched regularly. Lots of 👏🏻 and ❤️ to @sammy_lee12 on twitter who attended my talk and sketched me my talk on a single page. You rule in so many ways! Seriously, Sam, you’re the best. First thing I did was get this laminated. You made it to the end! Nice one! Press the clap as many times as you like, it gives me warm happy feelings ☺️. Think I’m cool enough to follow on twitter? I post and retweet InfoSec stuff. @proxyblue is where you’ll find me. Still want to hear a bit more? Here is my 3-minute lightning talk from the same conference. “How to talk like a developer”. Yak Shaving, Bikeshedding and more! Here’s a link to the original “How to succeed as a Red Shirt without even dying” talk: Thanks for reading! Want to read a bit more from me? 10 things InfoSec professionals need to know about networking https://hackernoon.com/10-things-infosec-professionals-need-to-know-about-networking-d159946efc93 Introducing the InfoSec colour wheel — blending developers with red and blue security teams. https://hackernoon.com/introducing-the-infosec-colour-wheel-blending-developers-with-red-and-blue-security-teams-6437c1a07700 What devs need to know about Encoding / Encryption / Hashing / Salting / Stretching https://hackernoon.com/what-devs-need-to-know-about-encoding-encryption-hashing-salting-stretching-76a3da32e0fd You ‘do’ InfoSec right? What do you read? Who do you listen to? https://louis.land/you-do-infosec-right-what-do-you-read-who-do-you-listen-to-e8d00b7d8ace

Stories, News & Mentions about ZAPSCALE

Zapscale’s Stories on HackerNoon

Zapscale's News & Mentions