Cyrille Barthelemy

Check Your Accounts: 10 Billion Passwords Exposed in Largest Leak Ever. The article says : "check your passwords". I tell you : "still using password only?". It's not a blame it's like, if you use only a password it means you don't care and you are not worried about that platform being hacked. 10 billion stolen passwords become useless if you use notifications, MFA, FIDO, passphrases with two or three layers of authentication. So if you are eventually worried, take the chance to never use "just" the password anymore, knowing that almost all passwords belonging to humans have been #pwned. 🫶 Ten billion passwords, run the math, and add a factor or two to your logins now, mate... https://lnkd.in/dK8CAsR6 🔑👀

2

When working with the Cynomi platform and my customers, very often, the questions I ask are triggering lot of notes on their end. When we get to ask : "Does the company take active steps to protect passwords, prevent exposure of encrypted credentials and mandate updates from secure sources only?" Very often, customers are not aware of all the system hardening options (neither do I, from top of my head). This is why these exercises, while offering a security roadmap at the end, is often an eye opening on the scope of the possible security enhancement for an organization. The "hint" coming with this one is as follow (just in case you wonder) : Active steps include implementing a best-practice password policy and Local Admin Password Solution (LAPS), configuring DNS Zones to enable secure updates only, and prohibiting XML files containing 'cpassword' in System Volume (Sysvol). While you see each week how a security assessment with me,using #cynomi, works, it might also give you some hints on points to check. connected=hacked #cybersecurity #vciso #securityassessment #systemhardening #activedirectory

3

1 commentaire

♦️Secure Talk : Protect Your Apps & Websites with WAAP Imagine you built a cool treehouse – the best one on the block! But what if someone tries to sneak in and steal your stuff, or even break something? That’s not cool, isn’t it! A Web Application & API Protection (WAAP) is like a super high-tech security guard for your websites & apps. What is Web Application & API Protection (WAAP) ? WAAP is a cybersecurity tool designed to protect web apps & APIs from cyber attacks. It is crucial for businesses that use web apps and APIs to offer services to their customers or users. Here are the main things about Web Application & API Protection (WAAP): Web Application Protection: WAAP tools guard web apps from many threats, like: SQL Injection Cross-Site Scripting (XSS) Cross-Site Request Forgery (CSRF) Session Hijacking API Protection: WAAP also shields APIs, which help different software systems communicate. API protection does things like: API Gateway: Controls traffic, verifies users, enforces rules, and monitors API activity. Rate Limiting: Setting limits on API requests per user or app to stop abuse and guard against DoS attacks. Checks API messages: Ensures they are in the right format to prevent injection attacks. Security Features: WAAP tools usually come with security features like: *Web Application Firewall (WAF) *Behavioural Analysis *Encryption Why is WAAP Important? https://lnkd.in/ghX27xSK

9

1 commentaire

It is a few months now that I notice a new set of conversations growing with #cybersecurity teams. The key question : How do we improve effiency ? Be it to optimize budgets as per CFO requests or to avoid having to stretch people due the challenge in hiring talent or simply because "light is right" Some answer the need by consolidating tooling (MS O365 E5 anyone ?), others build home growth stitching scripts that rarely scale. I'm encouraged when our customers suggest new use cases for #PreCrime in this specific context and realize : - reduction of false positives , improving alert fatigue and "busywork" - reduction of false negatives, improving security posture and threat hunting - releasing cumbersome work (takedown proofs collection, takedowns requests, etc.) with automation It feels at times like the NOCs focus on optimization more than 20y ago, as more companies SOCs mature , optimization take center stage. Are you seeing the same or different ?

24

France’s cybersecurity agency, ANSSI, issues a warning regarding cyber attacks targeting French diplomatic interests. The agency reveals that state-sponsored actors linked to Russia, particularly the SVR, are behind these threats. The hacking group, known as Midnight Blizzard (also referred to as Nobelium by Microsoft), has been identified as the culprit. ANSSI distinguishes Midnight Blizzard from APT29, BlueBravo, Cloaked Ursa, Cozy Bear, and The Dukes, despite them often being used interchangeably. Additionally, Dark Halo, responsible for the SolarWinds attack in 2020, is another related threat group. Stay informed and vigilant in the face of escalating cybersecurity risks. #Cybersecurity #ThreatIntelligence #ANSSI #MidnightBlizzard #APT29 #DarkHalo https://lnkd.in/eCkTTJ8m

2

Did you deploy advanced email filtering capabilities ? Not the useless cloud defaults. "Nespress-Oh No! Phishing Attack Exploits Nespresso Open Redirect Vulnerability" This blog post delves into how a Nespresso domain is being misused to redirect victims, urging urgent actions leading to the theft of Microsoft credentials. connected=hacked #cybersecurity #phishing

22

6 commentaires

A Malicious Package != A Vulnerability! Served as a public service. A common misconception I often encounter is the treatment of a malicious package as if it were a vulnerability. This assumption is flawed for several reasons: 1️⃣ A malicious package does not necessarily indicate the presence of a vulnerability. 2️⃣ Unlike a vulnerability, which may arise from carelessness, lack of knowledge, or a logical flaw in the implementation, a malicious package requires malicious intent! 3️⃣ A malicious package usually contains a malicious payload, in a sense making it more akin to malware than a vulnerability. Therefore, if a malicious package is identified in your environment, you should assume compromise and initiate incident response protocols. Simply removing the malicious package after a compromise does not "fix" the problem! 4️⃣ It’s crucial to recognize that a malicious package is often just a symptom. The real threat is the malicious actor behind it. As an industry, our goal should be to stop these actors. Also note that there are different types of malicious packages: 💥 Packages originally created with malicious intent. Attackers may use techniques like typosquatting or spoofing reputation to deceive users into deploying these packages. 💥 Benign packages that become compromised at some point in their lifecycle, possibly by a "malicious" maintainer injecting harmful behavior into the source code or by an adversary compromising the software delivery lifecycle. A recent example is the latest xz attack. Lastly, be aware that there is currently a significant gap in the documentation and tracking of malicious packages. While CWE includes a category for Embedded Malicious Code (CWE-506), it is seldom used (only about 50 such cases are recorded in the NVD). Only a small fraction of malicious packages are assigned CVE IDs which means standard vulnerability scanners will fail to identify them. While IMO tracking these packages is essential, since we established that a malicious package differs fundamentally from a vulnerability, a CVE assignment isn't necessarily the answer (I'll expand on that in a different post). While last year alone over 250K malicious packages were identified, currently the most comprehensive data source for malicious packages is the OSV ‘-MAL’ index, which contains approximately 18,300 entries. #SoftwareSupplyChain #VulnerabilityManagement #RiskManagement #CyberSecurity

121

33 commentaires

Big tech and the cloud, always, always, always the damn same story ! We deserve better ! "OmniVision discloses data breach after 2023 ransomware attack" And the usual BS : In response to this security and data breach, OmniVision took measures to secure its environment and detect suspicious activity faster. They also offer 24-month credit monitoring and identity theft restoration service to the notice recipients. Leaked data according to the article : Passport scans Nondisclosure agreements Contracts Confidential documents I mean, they sure do this, too little, too late. Consumers, DO NOT GIVE ANY DATA TO BIG TECH. Don't surrender. connected=hacked cloud=leak #cybersecurity #clowd https://lnkd.in/eHnYBtvt

22

3 commentaires

A new hype in the cloud mess ? Trying to secure workload, because so far, it's not achieved. But at the same time, it's #clowd ! "Whiteboard: The Fundamentals of Workload Identity and Access Management (WIAM)" If you cloud, be sure to consider the thousands of extra tools you need to attempt to reduce the leaks, and this one is quite interesting. #cybersecurity #cloud

9

Don’t ignore the “easy” stuff: one of the most common vulnerabilities we find in pentesting is when old versions of TLS are enabled (v1.0, 1.1) and weak ciphers are used for HTTPS encryption.  We discover these findings in at least 1 out of every 3 reports. And you don’t always need a pentester to help you improve. Qualys offers a free tool to report back and give you a grade on TLS security, for example. Make us work harder when you hire us for pentesting by already having these issues fixed BEFORE starting a pentest 😎… …because without this low hanging fruit, we’ll be even more focused on finding the obscure vulnerabilities that can can create a security issue. Don’t ignore the easy stuff. It can help find the deeper stuff. 

3

[ #SQLi ] How to Protect Against SQL injection ? #SQLiFixer is your first Line of Defense against SQLi Attacks AI is a powerful resource against SQL injection attacks. AI-powered SQLiFixer provides a key protection where traditional methods fall short. " AI-powered SQLiFixer solution elevates your security against SQL Injection threats " ✨ How patented SQLiFixer protects against SQL injection ? Unlike traditional security approaches that identify risks and require extensive manual correction, SQLiFixer automates the entire process, including tags and documentation of corrections. SQLiFixer sophisticated algorithm analyze patterns and rewrites vulnerable code into prepared statements with customized parameterized queries. This process ensures that data and code are distinctly separated, therefore protecting against SQL injection. ✨ Why Choose SQLiFixer? - Immediate Correction of SQLi Vulnerabilities: Essential before each deployment, each code review, or for urgent security needs. and no manual - Enhanced Application Security: By incorporating SQLiFixer into your development lifecycle, you preemptively fix vulnerabilities before deployment, reducing the risk of data breaches, fostering a proactive rather than reactive security strategy. - Peace of Mind: Ensuring your application is shielded against SQL injection attacks offers confidence to both developers and end-users, building trust in your software. ✨ SQLiFixer is an essential component of a comprehensive security strategy. SQLiFixer works seamlessly with other security measures to provide a multi-layered defense, ensuring that your applications are resilient against (future) vulnerabilities. Implementing SQLiFixer helps maintain a proactive security posture, enhancing your organization's overall protection and compliance. 📍Step Up Your Security Game! Don’t wait for attackers to exploit vulnerabilities. Visit us at sqlinjectionfixer.com (or sqlifixer.com) to see how SQLiFixer can fortify your applications against SQL injection attacks. Secure your operations, protect your data, and maintain peace of mind with just a click. ⚡️ Let's discuss! How is AI shaping your approach to cybersecurity? #WebSecurity #SQLInjection #CyberSecurity #AI #DataProtection #SQLiProtection

2

Introducing the dynamic duo 🚀 : Levo.ai now seamlessly integrates with Splunk! At the current development and deployment levels, addressing all security threats is a difficult task. Especially since the number of threat vectors has increased massively with #microservices and #APIs. Splunk addresses this pain point by compiling everything security-related into a single pane of glass, making it a popular tool amongst the security community. To ensure that API-related vulnerabilities are not left out, our customers can now view every API changelog, sensitive data discovery detail, and API vulnerability within Splunk. By keeping all this information in one place, they can connect to their existing workflows and set up dashboards, reports, and notifications. We are excited about this one, and some customers already love it. Give it a try! #integrations #featurelaunch #tech #devsecops #enterprisesecurity

78

3 commentaires

📚 tl;dr sec 231 XZ Utils Backdoor Scanner, CISA's Enriched CVEs, SOC 2 Compliant CI/CD ✨ Highlights 👨‍💻 AppSec 👨‍💻 - SignSaboteur: Burp extension for attacking signed tokens - Semgrep Academy - Tanya Janca - Building a SOC 2 compliant GitOps CI/CD Pipeline with GitHub Actions - Mathieu Larose - Relative Path File Injection - Ian Hickey ☁ Cloud Security ☁ - A tool to clean up your unused AMIs - Michael Wittig, Andreas Wittig - Scout Suite 5.14.0 now supports Digital Ocean - Asif Wani - AWS CloudQuarry: Digging for Secrets in Public AMIs - Eduard Agavriloae, Matei Anthony Josephs - Deterring Attackers with HoneyTrail: Deploying Deception in AWS - Adan Álvarez Vilchez 📦 Container Security 📦 - Tool to create/approve Client Signing Request in Kubernetes - Rory McCune - Detecting Manual Actions in EKS Clusters - Saif Rajhi ⛓ Supply Chain ⛓ - XZ Utils Made Me Paranoid - Kevin Haubris - Techniques Learned from the XZ Backdoor - Vulnrichment: CISA's enriched CVE repo - dependabot-core is now open source with an MIT license - Poisoning Pipelines: Azure DevOps Edition - Francesco Iulio 😈 Red Team 😈 - Adversary Simulators High-Fidelity Intelligence and Reporting Toolkit - Joe Rozner, John Kennedy - Everyday Ghidra: Symbols - Prescription Lenses for Reverse Engineers 🤖 AI + Security 🤖 - LLMjacking: Stolen Cloud Credentials Used in New AI Attack - Alessandro Brucato - Building an AI AppSec Team - Srajan Gupta - HackerOne co-founder Jobert Abma on AI in bug bounty - Quick Recap of Google I/O 2024 - Hello GPT-4o And much more! https://lnkd.in/dp8DTrmT #cybersecurity #infosec #security #ciso #ai

73

8 commentaires

We just updated Top ATT&CK Techniques with: ➕ Support for the most recent version of MITRE ATT&CK ➕ Improved user experience ➕ Expanded and refreshed telemetry data from Sightings 2.0 Top ATT&CK Techniques is one of our most widely used projects because it is applicable to any team that uses ATT&CK. Both highly sophisticated teams and those that are just getting started with ATT&CK use it to systematically prioritize ATT&CK techniques to focus on next.  “Where should I start with ATT&CK?” - > Top ATT&CK Techniques is an easy entry point for all teams. Top ATT&CK Techniques https://lnkd.in/ejhURpXH Sightings 2.0 https://lnkd.in/ebHgjmXT #threatinformeddefense Center for Threat-Informed Defense

106

😃check out what security consultants and the business, can do to revise approaches, promote better engagement, build better rapport, bring greater value to the process, along with avoiding some of the common mistakes that we’ve all been known to make! 👀😎

2