Patrick Wardle

The EXPMON Public has reported several Foxit Reader crashes when processing a public PDF sample set. https://lnkd.in/gidnAhMU https://lnkd.in/gCeijxFz https://lnkd.in/grJTxu7b I've manually analyzed them and confirmed they're not zero-day attacks, they're not FPs either. They're even not new Foxit Reader vulns/bugs, as far as I've seen. The crashes could be reproduced in the specific tested Foxit Reader version 2023.2.0.21408 (so not FPs), but not in the latest version. So I'd guess it's a vuln/bug in Foxit Reader just got patched in the last several months. Yeah, sometimes, @EXPMON_ could be used to discover software vulnerabilities (for free), too. You never know what you'd encounter when processing real-world samples! :)

9

1 Comment

Andrew Ng’s take on California's proposed law SB-1047 is spot on: “There are many things wrong with this bill, but I’d like to focus here on just one: It defines an unreasonable “hazardous capability” designation that may make builders of large AI models potentially liable if someone uses their models to do something that exceeds the bill’s definition of harm (such as causing $500 million in damage). That is practically impossible for any AI builder to ensure. If the bill is passed in its present form, it will stifle AI model builders, especially open source developers. Some AI applications, for example in healthcare, are risky. But as I wrote previously, regulators should regulate applications rather than technology. Technology refers to tools that can be applied in many ways to solve various problems.Applications are specific implementations of technologies designed to meet particular customer needs. Safety is a property of applications, not a property of technologies (or models), as Arvind Narayanan and Sayash Kapoor have pointed out. Whether a blender is a safe one can’t be determined by examining the electric motor. A similar argument holds for AI.” #publicpolicy #policy #ai #machinelearning #ml #compliance #technology #society #sb1047 #opensourcesoftware #oss

4

Great PoC linking real-life identities to consumers of CSAM based on Infostealer infections. We did something similar at Hudson Rock, linking real-life identities to cybercriminals and even received a shoutout in Recorded's research. Infostealers contain troves of data from millions of infected computers, which can be used for various types of investigations. Expect even more cool Infostealer-related use cases to surface.

8

1 Comment

I often hear the question "Where/What are our biggest security exposures?" Cyentia Institute recently had the opportunity to explore this question using data from hundreds of thousands of attack path assessments conducted through the XM Cyber Continuous Exposure Management (CEM) platform. The attached figure gives a categorical breakdown of what we observed based on all entities (digital assets), total security exposures, and exposures affecting critical assets. . The left-most chart represents the attack surface based on broad categories of digital entities discovered during attack path assessments. Active Directory constitutes just over half of entities identified across all environments. On-premises IT and network devices account for another 31% of entities and cloud environments house the remaining 17%. Not all entities, however, are exposed via attack paths. If we change the scope of the attack surface to include only vetted exposures (entities susceptible to attack techniques), things look different. The middle chart captures this perspective and Active Directory exposures dominate the attack surface. But not all of those exposures affect critical assets. To be truly effective, Exposure Management must encompass all environments and account for where critical assets are most at risk. If we once again rescope the attack surface to focus on exposures to critical assets, a very different picture emerges, which is captured in the rightmost chart. Cloud environments now encompass over half of all critical asset exposures, followed by AD at 33% and IT/Network devices at 11%. Does this sync with exposures across your attack surface? Which perspective/view/chart is your primary guide for managing exposures? The full report contains tons of additional insights on exposure management. Download here: https://lnkd.in/dPfqXG7y #cybersecurity #exposuremanagement #cyberrisk

47

8 Comments

A vulnerability has been identified, CVE-2024-27322, in the R programming language that permits arbitrary code execution by deserializing untrusted data. CERT Coordination Center (CERT/CC) has issued an advisory for CVE-2024-27322, cautioning against arbitrary code execution via malicious RDS or RDX files. What should you do? ⬆️ Update R to version 4.4.0 or later promptly. ⛔Until then, avoid interaction with untrusted RDS files or packages to mitigate risks. There is currently no public proof-of-concept or exploitation evidence available. https://bit.ly/44t7vFt

10

For those waiting for the FAR update regarding #ssdf attestations... The latest Open FAR Cases report shows on May 30th Case Number 2023-002, Supply Chain Software Security, that OMB identified draft proposed FAR rule issues. OFPP, FAR and DAR staff are now working to resolve those issues. It is my understanding that this work remains opaque, and that there was no public disclosure of precisely what issues OMB identified with the proposed FAR rules relating to supply chain software security. Regardless of the status of Case 2023-002, the GSA is now requiring #ssdf attestations for anything it buys that contains software as of this past Monday morning when the government opened for business. GSA quietly updated GSA Form 7700 last month to take advantage of the CISA standard form's disclosure that "Agency-specific instructions may be provided to the software producer outside of this common form." GSA Form 7700 form has two checkboxes on page 3: Option 1: Submit the attestation online at the Cybersecurity and Infrastructure Security Agency Repository for Software Attestations and Artifacts (RSAA) portal. Option 2: Only use GSA Form 7700 submit it to a GSA specific email account. What this means to me is that if Option 1 is checked then Form 7700 is effectively a trigger mechanism for GSA to go lookup an existing attestation in RSAA. However, if Option 2 is checked, it would be interesting to know if GSA is taking that PDF and entering it into RSAA on behalf of the vendor. Option 2 also implies that a vendor may not have to attest multiple times for the same software product/version, but seemingly will have to submit multiple disparate forms to each part of the government. As we continue to see discussion about harmonizing #cybersecurity regulations, this is a great example where the government could have simply mandated using CISA RSAA. Instead, vendors will find themselves having to report using GSA Form 7700 for something through a GSA contract vehicle, and speculatively, a different form through NASA SEWP, and a different form for Dept of State, and different form for.... https://lnkd.in/eEDA-S8F If you haven't started to get serious about #software provenance ahead of the all-of-government mandate coming in September, now is a great time to start evaluating your #devsecops policies and procedures!

31

1 Comment

Before releasing tech, we should ensure that they are designed with privacy and security by default and by design. In 2024, there is no excuse for failing this. "Computer maker Zotac exposed customers' RMA info on Google Search" Assume that ANY information you put in technology is public information (unless you encrypted it BEFORE, and you keep the private key) connected=hacked cloud=leak #cybersecurity https://lnkd.in/ernTHmxd

16

2 Comments

SEC material Cybersecurity incident 8-K notification New SEC regulations require public companies to disclose a breach within 4 days of determining it is material. Such disclosures are made to the SEC in 8-K and 8-K/A (Amendment) files and published through the Edgar site. We have had multiple people ask about being notified whenever any company discloses a material incident to the SEC. Just yesterday United Healthcare disclosed more details of the ChangeHealth breach. We have created a bot that will send the link to the SEC Edgar website with all the details disclosed at the EOD every day for any filing done on a particular day. If you want to be notified of any breaches being disclosed to SEC, please provide your email in the form below: https://lnkd.in/gSsw5rKx Also created a word cloud of all the 23 disclosers done till now (in the last 4 months)! For most, we still have to get the core data of the breach! #dfir #cybersecurity #AIgovernance #CloudGovernance #CloudSecurity #SOC Evgeniy Kharam, Andrea Bonime-Blanc, Agnidipta Sarkar, Pathik Patel, Kamal Govindaswamy, Supro Ghose, Kyle Peh, Aradhna C., David Cass, Kapil Bareja, Nicola (Nick) Sanna, Pankaj Goyal, Nicolas M. Chaillan, Sid Trivedi, Pramod Gosavi, Jim Reavis, Alex Shulman-Peleg, Rupa Parekh, Shobhit M., Venkat Paruchuri, Anatoly Chikanov, Anton Chuvakin, Jonathan Rau, Marina S., Parthasarathi Chakraborty, Vivek S. Menon, Ashok Kakani, Sai Iyer

90

19 Comments

"The National Vulnerability Database is broken, and there isn't an easy fix." This is another canary in the coalmine visual. There are currently 10190 CVE's awaiting analysis (as of 8:53 am EST on 5/14/2024). Last month alone 3704 were received for analysis, 223 were analyzed (~6%). That's a significant backlog.. We don't know what we won't know for a considerable amount of time... That's concerning... https://lnkd.in/e5DCVwvr https://lnkd.in/eSBJEHg4 #penetrationtesting #vulnerabilitymanagement #infosc #cybersecurity #riskmanagement #resiliency #resilience #compliance #healthcare #HITRUST #HIPAA #criticalinfrastructure #risktolerance #NVD

2

Software supply chain security is much wider in scope than what I imagined last year. It can't be solved by building scanners or SBOM tools alone. It requires standards, tooling, industry & community participation to build the infrastructure required for "verifiable trust" between producers and consumers of software across trust boundaries (e.g. OSS project & consumer of it) Now that the hype of software supply chain security has faded in favour of "you know what", I am looking to connect and brainstorm ideas with folks who are still working on this space. Drop in a comment or DM if you want to chat. I am curious on your thoughts on how does a solution look like.

42

4 Comments

This Kiteworks article provides a comprehensive guide to navigating the complex landscape of sensitive content communication risk within the context of NIST CSF 2.0. It's crucial for organizations to understand and mitigate these risks effectively, especially considering the ever-evolving cybersecurity threats. Well worth a read for any organization serious about safeguarding sensitive information in today's digital age. NIST CSF 2.0: The Ultimate Guide to Managing Sensitive Content Communications Risk 👉 Learn more: https://gag.gl/BSKceP #cybersecurity #compliance #NIST #NISTCSF #CybersecurityFramework

12

1 Comment

Thoughts on Just-In-Time procedures and NIST SP 800-171 / #CMMC compliance... At Kieri Solutions - Authorized C3PAO , we figured out that people follow procedures best when they 𝘢𝘳𝘦𝘯'𝘵 𝘱𝘳𝘰𝘤𝘦𝘥𝘶𝘳𝘦𝘴. ??? Let me explain. You're onboarding a new user. To be compliant with #CMMC, your onboarding team needs to go through a convoluted process involving getting details about the new user, verifying NDA, background checks, training, requesting permissions, justifying permissions, reviewing permissions, authorizing permissions, creating accounts, creating records of the accounts, creating records of the permissions for the accounts, assigning expiration dates for each account, setting up a laptop, authorizing the laptop...!!! It goes on and on. If your strategy is to tell your HR and IT team that they need to perfectly follow a 70 step process on page 19 of ye old 𝐈𝐓_𝐏𝐫𝐨𝐜𝐞𝐝𝐮𝐫𝐞𝐬_𝐌𝐚𝐧𝐮𝐚𝐥, 𝘺𝘰𝘶 𝘮𝘪𝘨𝘩𝘵 𝘢𝘴 𝘸𝘦𝘭𝘭 𝘱𝘢𝘤𝘬 𝘶𝘱 𝘺𝘰𝘶𝘳 𝘣𝘢𝘨𝘴 𝘳𝘪𝘨𝘩𝘵 𝘯𝘰𝘸. The error rate will be upwards of 80%, unless you nag and threaten 😡 everyone constantly, in which case you might get down to an error rate of 30% (and your team will quit). Instead, if you use a combination of a well-designed Access Request Form and an Account Management database, all your team needs to do is remember to start with the correct form. 📝 The form should have fields and just-in-time instructions for each step of the process between HR and your IT Department. All your team needs to do is fill out each field in the form and they will complete the background screening, training, permissions, justifications, etc. naturally without nagging. Then, a well designed Account Management database helps your team manage the accounts long-term by including checks ◻️ for commonly-forgotten steps (like user agreements), next-review dates, annual training refresher dates, mapping the user to their supervisor, granular "should-be" permissions for both digital systems and facilities, and historic authorization notes. The last step for perfect procedures is a regular review to look for and fix errors. But again, if you want to be successful, don't expect your team to remember your dusty policies and procedures book in the corner. Instead, use a scheduled task, a ticket, or a checklist with just-in-time instructions to make sure that the review gets done. Pro-tip: next-review-dates are an excellent way to spread this task across time, instead of trying to do it all in one lump. Are your compliance policies and processes working for you, or against you? There is a better way. Use thoughtful design in your compliance system to reduce errors and streamline functionality. Screenshot below is from the Kieri Compliance Documentation's Account Management Database, showing some of the magic of our full-featured 800-171 / CMMC Level 2 compliance program. I'll put the link in comments, for anyone that is interested.

54

5 Comments

Episode 3039 - Billions are spent annually on security solutions, yet ransomware sieges continue to escalate. Will AI change the game in favor of attackers or defenders? How does encryption work, and does it introduce overhead into the mass management of enterprise endpoints? Brett H. Chief Growth Officer at Cigent Technology, Inc. answers these questions and more in this Post-RVAC Briefing. Maureen McGregor and Lindsay T., Thank you! #cybersec #cybersecurity #disruptive #innovation #encryption #endpointdataprotection #cigent # Watch the briefing here: https://lnkd.in/guDbDDQr

1

Watch Your Word Templates "AhnLab SEcurity intelligence Center (ASEC) recently confirmed that RemcosRAT is being distributed using steganography techniques. Starting with a Word document using the Template Injection technique, download and run RTF that uses the equation editor (EQNEDT32.EXE) vulnerability. RTF downloads a VBScript with the “.jpg” extension from C2 and additional VBScript from “paste.ee”, a service similar to “Pastebin” that lets you upload text for free. The downloaded VBScript is obfuscated with several special characters and ultimately executes the PowerShell Script through Replace." Like this? Subscribe to Cyberwarfare, Espionage & Extortion for more: https://bit.ly/3HnJbKx

1

Beware of the pitfalls with XDR vendors—here’s what you need to watch out for: - XDR is not SIEM: Don't mistake XDR for a log management system. The more logs you shove into it, the worse it performs. XDR is designed for precision, not data hoarding. Manage it wisely, or you'll lose control. - SIEM isn’t XDR: Merely slapping “Nextgen” in front of your SIEM doesn’t transform it into XDR. SIEM is inherently limited by variety and high data volume—understand its boundaries before you push them. - Ignore the hype: Claims that cloud-based XDR offers better correlation are just marketing fluff. Data isolation is crucial, regardless of where it's stored. If your data isn't loaded into the cloud, it should not impact the quality of threat detection. Vendors can upload everything necessary for detection to your on-prem instance. Remember, the main difference between on-prem and cloud is cost and ease of implementation/use. Stay sharp and don’t let vendor slick talk cloud your judgment. #XDR #SIEM

99

9 Comments