John Lambert

With an increase in consumer banking done online post-pandemic, and the current geopolitical situation, it’s important for the Public and Private sectors to share threat intelligence to stop bad actors and Secure the Internet.

5

A vulnerability has been identified, CVE-2024-27322, in the R programming language that permits arbitrary code execution by deserializing untrusted data. CERT Coordination Center (CERT/CC) has issued an advisory for CVE-2024-27322, cautioning against arbitrary code execution via malicious RDS or RDX files. What should you do? ⬆️ Update R to version 4.4.0 or later promptly. ⛔Until then, avoid interaction with untrusted RDS files or packages to mitigate risks. There is currently no public proof-of-concept or exploitation evidence available. https://bit.ly/44t7vFt

10

The EXPMON Public has reported several Foxit Reader crashes when processing a public PDF sample set. https://lnkd.in/gidnAhMU https://lnkd.in/gCeijxFz https://lnkd.in/grJTxu7b I've manually analyzed them and confirmed they're not zero-day attacks, they're not FPs either. They're even not new Foxit Reader vulns/bugs, as far as I've seen. The crashes could be reproduced in the specific tested Foxit Reader version 2023.2.0.21408 (so not FPs), but not in the latest version. So I'd guess it's a vuln/bug in Foxit Reader just got patched in the last several months. Yeah, sometimes, @EXPMON_ could be used to discover software vulnerabilities (for free), too. You never know what you'd encounter when processing real-world samples! :)

9

1 Comment

There's a pretty advanced "detection in depth" (I like that name) feature I've been working on for EXPMON system for PDF zero-day exploit detection. Currently on private test, will roll out to https://pub.expmon.com when good to go. This was inspried by my personal witness at PWN2OWN this year where Adobe Reader once again got easily exploited. There're SO MANY need to be done/innovated from exploit detection perspective. Detection-in-depth in PDF is super challenging. The PDF on Adobe Reader is like a browser (JavaScript) + complicated file format + various undocumented features, combined.. Sigh.. #expmon #zeroday #exploit #detection #pdf #adobe

18

2 Comments

THIS IS WILD - EXPMON Public Detected a PDF "Zero-day" PoC in the wild Which Triggers a RCE Vulnerability In Adobe Reader! Adobe has been notified, will release full details after the vendor finishes their investigation. Please note: 1. This was detected by EXPMON Public (https://pub.expmon.com) when it's on a mission to analyze a huge public PDF sample set (check it out https://lnkd.in/guFBJTFD). I've "hidden" that particular submission since I realized this finding (to give Adobe the vendor a chance to review). 2. EXPMON system detected the crash and reported it as a potential zero-day attack (see picture). 3. This seems not to be a full working exploit, but a crafted PoC, at least. As I didn't see any payload in the sample. Currently not sure if it's malicious (say, a partial unfinished 0day exploit leaked), or non-malicious (crafted PDF sample for good-purpose PDF app testing?). 4. Anyway, this does bring an exploitable crash on the latest Adobe Reader, the root cause seems to be use-after-free. However, all are based on my brief analysis, need Adobe's confirmation. Sigh.. You never know what you will find in real-world samples! More importantly, I feel EXPMON is on a good mission to fill the industry gap - looking deeply into all the files from a vulnerability/exploit perspective. :) #expmon #zeroday #0day #exploit #threatintel #adobe #pdf

50

7 Comments

Yet another report from Forescout Research - Vedere Labs. This time we looked into exploited vulnerabilities, the catalogues available and the impacted devices! Have a read. https://lnkd.in/griGMznV

17

Nice work #ThistleTechnologies! Signed firmware is a security measure taken by software vendors by digitally signing their firmware image using a private key. When firmware carries this cryptographic signature, a device goes through a verification-like process before accepting and installing the firmware. If discrepancies or alterations in the firmware's integrity are detected, the device declines the firmware upgrade. The use of this technique to sign firmware or software images before they are loaded onto the device's hardware helps protect against unauthorized modifications, malware injection, and other security threats enhancing the overall security posture of the system by preventing malicious modifications to the firmware which could result in: Viruses inserted into the firmware, data theft, destruction and manipulation, protection from counterfeit drives, verifiecation of the authenticity and integrity of firmware, reduces physical and logical attacks...and more.

5

Follow the DVMS Institute for exciting announcements on "HOW" organizations of any Size, Scale, or Complexity can Operationalize a NIST Cybersecurity Framework Digital Value Management System™ capable of delivering the Trusted, Resilient, and Auditable digital outcomes government auditors expect

16

Andrew Ng’s take on California's proposed law SB-1047 is spot on: “There are many things wrong with this bill, but I’d like to focus here on just one: It defines an unreasonable “hazardous capability” designation that may make builders of large AI models potentially liable if someone uses their models to do something that exceeds the bill’s definition of harm (such as causing $500 million in damage). That is practically impossible for any AI builder to ensure. If the bill is passed in its present form, it will stifle AI model builders, especially open source developers. Some AI applications, for example in healthcare, are risky. But as I wrote previously, regulators should regulate applications rather than technology. Technology refers to tools that can be applied in many ways to solve various problems.Applications are specific implementations of technologies designed to meet particular customer needs. Safety is a property of applications, not a property of technologies (or models), as Arvind Narayanan and Sayash Kapoor have pointed out. Whether a blender is a safe one can’t be determined by examining the electric motor. A similar argument holds for AI.” #publicpolicy #policy #ai #machinelearning #ml #compliance #technology #society #sb1047 #opensourcesoftware #oss

4

Recent shifts within The NIST NVD operations have raised alarms among researchers and practitioners. ⚠️ These changes have led to delays in vulnerability analysis and a noticeable decline in enriching CVEs with critical data such as CPEs, CVSS scores, CWEs, and references. This creates significant hurdles for organizations striving to effectively identify and prioritize vulnerabilities. 💡 Meet DeviceTotal, a transformative solution reshaping this vulnerable pyramid. Our AI-powered technology propels vulnerability management into a new era, offering substantial enhancements in accuracy, speed, and automation. 🚀 DeviceTotal sources security information directly from vendors, ensuring data is updated well before it reaches the NVD. This proactive approach empowers organizations with timely insights, enabling swift and informed actions to mitigate threats. 💪 On top of that, DeviceTotal provides actionable insights for every threat, offering precise indications for available updates, mitigation options, workarounds, End-of-Life alerts, and more.  And the best part? No agents, no installations—just swift value delivered directly to your organization. Don't let your vulnerability management strategy crumble—elevate it with DeviceTotal. Experience the difference today. #VulnerabilityManagement #CyberSecurity #DeviceTotal #cybersecurity #infosecurity #riskmanagement #vulnerabilitymanagement #nationalsecurity (cartoon copyright by XKCD.com)

24

There's a new cyberespionage campaign targeting government agencies in EMEA and Asia by a group called SneakyChef. They use lures that are scanned documents related to government affairs. This campaign uses a wider range of targets and infection techniques than previous ones. Stay vigilant and educate your colleagues about these threats! #cybersecurity #APT #governmentthreats https://lnkd.in/dM9qz5EM

18

Imperva protects customers from CVE-2024-4577, a critical vulnerability in PHP. See this blog from Imperva Threat Research for details and an analysis of attack activity. #CyberSecurity

7

Soak in some great analysis from Ben Edwards on the state of National Institute of Standards and Technology (NIST) NVD, CVE Program and Cybersecurity and Infrastructure Security Agency's vulnrichment project... #cybersecurity #infosecurity #riskmanagement

11

Great article for a proactive approach on threat hunting within Azure. It’s important to effectively hunt down and mitigate potential risks, ultimately fortifying the security posture.

16

Vintage OSINT tool : How it started - How its going https://lnkd.in/eFEdSdtU

19

12 Comments

Here's some good news for Defense Contractors: the National Security Agency is offering real help in the form of their NSA Cybersecurity Collaboration Center. I'm very excited about the NSA's 𝐏𝐫𝐨𝐭𝐞𝐜𝐭𝐢𝐯𝐞 𝐃𝐨𝐦𝐚𝐢𝐧 𝐍𝐚𝐦𝐞 𝐒𝐞𝐫𝐯𝐢𝐜𝐞𝐬 offering in particular. Essentially the NSA hosts a DNS server that your organization uses to resolve internet addresses. If a URL goes to a bad place, the NSA's DNS server refuses to resolve its address and the user gets an error message that the site is down instead of downloading a virus. This breaks many attack chains in an elegant manner. Because this service is a government offering, if you are working toward CMMC compliance, this service doesn't need to be CMMC certified or FedRAMP Authorized. It counts as a Specialized Asset - Government Property. We can trust that the government will keep it secure for us. Find out more, and sign up for services, at nsa.gov/ccc #cmmc Kieri Solutions - Authorized C3PAO

54

6 Comments

In my latest blog post, I discuss the role of weak fingerprinting signals in the context of bot and fraud detection. I use the example of language-related signals to illustrate how even signals that may look insignificant can be leveraged to detect inconsistencies introduced by bot frameworks and anti-detect browsers. https://lnkd.in/eZ2hcKeH

35

4 Comments