Ashwin Patil

Who is "kiberphant0m," the Threat Actor Behind the BSNL Security Data Breach? 🕵️‍♂️💻 'kiberphant0m,' a notorious Blackhat hacker infamous on the Dark Web. This alias has recently claimed responsibility for the breach of Bharat Sanchar Nigam Limited (BSNL), India’s prominent telecom company. 'kiberphant0m' is no stranger to high-profile cyber attacks. According to their Telegram group, this threat actor boasts possession of data from major financial institutions across the US, UK, Egypt, and India. The critical data stolen from these institutions is being sold on the dark web, posing a significant threat to global cybersecurity. BSNL Breach Details: This marks the second time in six months that BSNL has fallen victim to a data breach. This recent attack has resulted in the leak of 278GB of sensitive data, including: International Mobile Subscriber Identity (IMSI) numbers SIM card details Home location register data Critical security keys Alarmingly, this data is priced at just $5000 on the dark web. Key Questions Arising: ❓Were the necessary steps not taken after the first breach? ❓Is the security of customer data not the top priority? ❓ How effective and swift is the incident response team? ❓ What will be the long-term impact of this breach? Call to Action: Organizations must reassess their cybersecurity strategies, ensure all vulnerabilities are addressed, and prioritize customer data protection. It’s not just about responding to incidents, but proactively preventing them. Stay informed, stay secure! 🌐🔒 #CyberSecurity #DataBreach #BSNL #CyberThreats #Infosec #CyberAwareness

32

7 Comments

💥 𝐓𝐡𝐫𝐞𝐚𝐭 𝐇𝐮𝐧𝐭𝐢𝐧𝐠 𝐓𝐢𝐩 💥 𝐮𝐧𝐜𝐨𝐝𝐞𝐫[.]𝐢𝐨: is a tool designed for converting Sigma rules to various formats, including SPL (Search Processing Language) queries for use with Splunk. It helps streamline the process of translating Sigma rules, which are a format for defining detection rules used in SIEM (Security Information and Event Management) systems, into SPL, which is used by Splunk for querying and analyzing log data. In the example on the image show sigma rule To detect the creation of the scheduled task. #Cybersecurity #InfoSec #CyberDefense

26

1 Comment

Thanks Eva for such a fantastic tutorial with so many practical examples on using Numbers to perform targeted OSINT on chinese platforms for better actionable intelligence gathering. EPCYBER provides best in class training on Chinese OSINT. #OSINT #CyberSecurity

15

📚 tl;dr sec 230 BSidesSF & RSA Summaries, Cloud-Native Threat Modeling GPT, STS for GitHub ✨ Highlights 📺 Conference I wrote quick summaries of Caleb Sima's BSidesSF keynote, and Evan J Johnson's talk on Startup Security 2.0. + a nice summary of RSA announcements by SecurityWeek. 👨‍💻 AppSec 👨‍💻 - PostgreSQL Database Security Assessment Tool - Misconfig Mapper: detect security misconfigurations at scale - Intigriti - PCI DSS 4.0; Certificate Transparency Monitoring is mandatory! - Scott Helme ☁ Cloud Security ☁ - GCP IAM Brute: Tool to fuzz test permissions in GCP - scp-deny-making-agreements-purchases-and-reservations - Michael Kirchner - Patch Diffing CVE-2024-3400 from a Palo Alto NGFW Marketplace AMI - Willis Vandevanter - How an empty S3 bucket can make your AWS bill explode - Maciej Poćwierz 📦 Container Security 📦 - Tool to check Kubernetes Clusters for Deprecated API Usage - DockerPhobia: Analyze and Slim Down Docker Images - Tommy De Rossi - Hardened Container Images: Images for a Secure Supply Chain - John Speed Meyers ⛓ Supply Chain ⛓ - Chainguard releases octo-sts, STS for GitHub - Nearly 20% of Docker Hub Repositories Spread Malware & Phishing Scams - Andrey Polkovnichenko, Brian Moussalli, Shachar Menashe - How I hacked into Google’s internal corporate assets - Michael Hyndman 🛡 Blue Team 🛡 - Tool to aid in parsing protocols using Zeek, designed for ICS - ATT&CK v15: Upgraded Detections, New Analytic Format, & Cross-Domain Adversary Insights - Amy Robertson 😈 Red Team 😈 - A PoC for using Microsoft Windows printers for persistence/C2 - New tool: okta-terrify 🤖 AI + Security 🤖 - Cloud-Native Threat Modeling GPT - Jon Zeolla - Threat Actor use of AI - Rachel James - Companies Are Just a Graph of Algorithms - Daniel Miessler and much more! https://lnkd.in/gVn-VJ2u #cybersecurity #infosec #security #ciso #ai

80

3 Comments

✅ (6/38) CPG 1.F Third-Party Validation of Cybersecurity Control Effectiveness In this new series on the Cybersecurity and Infrastructure Security Agency Cybersecurity Performance Goals - lets look at Third-Party Validation of Cybersecurity Control Effectiveness. This CPG is all about external validation that your defenses were implemented effectively. The wording chosen is "third-party". I would tend to reject the notion that this MUST be an external consulting firm, but thats typically what is inferred. The point here is somebody else not responsible for control implementation or in the authority chain. No conflicts of interest, and somebody with a fresh perspective. This might be a consultant, or CISA, an FFRDC like a national lab, or even another team inside your organization. This is not just about mitigating vulnerabilities, but system misconfiguration and other inherently weak implementations such as systems not designed for security, legacy systems, and human or environmental risks as well. Assessments should include both external in and internal threat actors in an "assume breach" scenario. Afterall a user compromised through phishing is much the same as a malicious insider. Include multiple scenarios including contractors behaving badly, supply chain compromise, and other lateral movement scenarios. Findings should be addressed promptly in a risk-based approach. if you are finding the same high-risk issues each test, then perhaps some refocus on remediation is in order. Having a firewall or [insert control] is not a substitute for testing control effectiveness. I have seen many organizations descope assets because they assumed (incorrectly) they were protected and then realized their firewall was configured incorrectly and resembled a router more than anything. You could engage in: ➡️ Vulnerability Assessment, but ideally more than just scanning ➡️ Penetration Testing ➡️ Red/Purple Team exercises ➡️ Configuration audits ➡️ Threat Modeling ➡️ Breach and Attack Simulation tools like Atomic Red Team or MITRE Caldera ➡️ Tabletop exercises. CISA has many examples In our Notion CPG template at https://lnkd.in/efv98JVQ we discuss some potential tools, but there are many ways you can evaluate control effectiveness, penetration testing is just one way. Just implementing a tool is not sufficient, this needs to be an ongoing program activity. #cybersecurity #cpg #opensource #itsecurity #otsecurity #icssecurity #criticalinfrastructure #securityvalidation #penetrationtesting

9

🚨 Cybersecurity Updates 🚨 1. CISA has issued warnings about three actively exploited vulnerabilities: CVE-2016-3714 (ImageMagick), CVE-2017-1000253 (Linux Kernel), and CVE-2024-40766 (SonicOS). These vulnerabilities impact image processing, Linux kernel, and firewall systems.   Impact: Remote code execution, privilege escalation, and firewall crashes.   Action: Apply vendor patches or discontinue use if updates aren’t available by September 30, 2024. 2. Docker has patched vulnerabilities CVE-2024-8695 and CVE-2024-8696, which allow remote code execution.   Impact: Unauthorized system control and potential data breaches.   Action: Update Docker Desktop to version 4.34.2. 3. Fortinet has confirmed a data breach where 440GB of customer data was stolen by a hacker.   Impact: Exposed sensitive customer data stored in the cloud.   Action: Review and enhance cloud storage security configurations. 4. SolarWinds patched vulnerabilities in Access Rights Manager (ARM), including CVE-2024-28990 and CVE-2024-28991, which allow authentication bypass and remote code execution.   Impact: Unauthorized access to systems.   Action: Update to the latest ARM version 2024.3.1. 5. Phishing attacks using HTTP response headers have been reported, where users are redirected to malicious webpages.   Impact: Credential theft, especially targeting sectors like financial services and government.   Action: Deploy URL filtering tools and implement multi-factor authentication. 6. Attackers are mimicking domains from Google, Microsoft, and Amazon in phishing campaigns, using HTTPS certificates to appear legitimate.   Impact: Widespread credential theft and malware distribution.   Action: Monitor for typosquatting domains and verify URLs before entering credentials. 7. Google has introduced air-gapped backup vaults to protect against ransomware, ensuring that once data is stored, it cannot be altered or deleted.   Impact: Stronger defenses against ransomware that targets backups.   Action: Implement air-gapped backups for critical workloads. 8. Researchers discovered vulnerabilities in Microsoft’s Active Directory Certificate Services (AD CS), allowing attackers to establish long-term persistence within networks.   Impact: Privilege escalation and network persistence through misconfigured certificates.   Action: Harden certificate template settings and protect CA private keys with hardware security modules. 9. Citrix has addressed privilege escalation vulnerabilities (CVE-2024-7889 and CVE-2024-7890) in its Workspace app for Windows.   Impact: SYSTEM-level access for low-privileged users.   Action: Update to Citrix Workspace version 2405 or later. 10. WhatsApp's "View Once" feature was found to be exploitable, allowing unauthorized clients to repeatedly access media.   Impact: Undermined privacy for users sharing sensitive media.   Action: WhatsApp should enhance media access controls. #Cybersecurity #PatchUpdates #DataBreach #Phishing #Infosec #Ransomware

8

Mailing #pwned learn how LFI lead system Takeover and how easy to crack the password of the user. LFI Mitigation: Input Validation: This is the primary defense. Validate all user-supplied input to ensure it only contains expected characters and doesn't point to unauthorized files. Disable Directory Listing: Web servers often offer directory listings, which can reveal file paths and structures. Disable this feature to prevent attackers from guessing potential file locations. Use Safe Functions: Employ functions designed for file inclusion, such as include_once in PHP, which prevent loading arbitrary files. Avoid using functions like include or eval that can execute code based on user input. Strong Password Practices: Length is Key: Aim for passwords at least 12-15 characters long. The more characters, the harder it is to crack. Complexity is Crucial: Combine uppercase and lowercase letters, numbers, and symbols for maximum strength. Avoid Common Phrases: Don't use personal information, dictionary words, or easily guessable phrases. Uniqueness for Each Account: Don't reuse passwords across different platforms. A data breach on one site shouldn't compromise your others. Password Managers: Consider using a password manager to generate and store strong, unique passwords for all your accounts. #HTB #CTF #pentest #Vulnerabilities #Cybersec

13

1 Comment

Great information, Here are few more: - Having Compliance-Driven Priorities (focusing too much on non-technical aspect of security) - Absence of Remediation Framework (not knowing what to do after getting the vulnerabilities detected) - Lack of Vulnerability Management (Knowing what to do with vulnerabilities, but not being able to drive a system to keep it running for a really long time)

9

Extracting Data for Dummies "This article explains various techniques and readily available tools for extracting data from an encrypted virtual disk. For incident-response situations in which the entire virtual disk has been encrypted, these tools and techniques may – may – enable the investigating team to retrieve data from the encrypted system. Efforts to extract data from encrypted virtual disks can potentially lead to multiple positive outcomes: recovering customer data that is irretrievable via standard methods, helping rebuild virtualized customer infrastructure that has been compromised, and / or enriching an incident investigation timeline. So far, we’ve used these techniques successfully in DFIR investigations involving the LockBit, Faust / Phobos, Rhysida, and Akira ransomware groups. We’ll say this at the beginning of the article and we’ll say it again at the end: Results are not guaranteed. No data-extraction method in existence is certain to yield full data from an encrypted VM. We will also highlight that while these methods have seen quite a high success rate in extracting forensic data that is valuable for the investigation (such as event logs, registry forensics, and the like), the success rate of retrieving data that can be used as part of the recovery process of production systems, such as databases, is much lower." Like this? Subscribe to Cyberwarfare, Espionage & Extortion for more: https://bit.ly/3HnJbKx

1

Great point about the differences between #IT and #OT. Something that’s becoming increasingly important is the convergence between both worlds. With the integration of technologies, OT systems are more connected to IT networks, expanding the cyber risk landscape. This fusion not only demands new technical solutions but also greater collaboration between IT and OT teams to protect both physical and cyber safety. The protection of critical infrastructure depends on this synergy 🏭

9

✅ (5/38) CPG 1.E Mitigating Known Vulnerabilities In this new series on the Cybersecurity and Infrastructure Security Agency Cybersecurity Performance Goals - lets look at Mitigating Known Vulnerabilities. We have a lot of focus on vulnerability management in cybersecurity, it might be the most talked about topic. But like so many other concerns, we can't address everything so we need a way to focus on what is most important. Remember, the CPGs are about establishing a baseline of measurable security goals, not a perfect security posture. The Known Exploited Vulnerability catalog from CISA is an important resource because it captures those vulnerabilities that are actively exploited. These are not theoretical, these are active hazards that need to be mitigated ASAP! You could certainly go deeper than this, but let's start with mitigating internet-exposed vulnerabilities in the KEV catalog. So how do we do this? ➡️ Identify Internet-facing systems captured in CPG 1.A. ➡️ Consider removing anything exposed that does not need to be behind the firewall. See 2.F., 2.W. and 2.X. This will reduce your scope and is more effective than patching. ➡️ Use OpenVAS (or another vulnerability scanner) to scan for known vulnerabilities. There are better scanners, but OpenVAS is free. ➡️ Prioritize and apply patches or compensating controls for critical vulnerabilities. ❗ This CPG suggests a set of compensating controls for OT when patching is not possible, but frankly this is probably your first objective - to get OT off the internet! Additional OT mitigations include monitoring and additional segmentation or access controls. It's also important to consider any trust relationships your OT assets may have with other IT assets that are exposed. An indirect impact through a pivot is still an impact! This CPG is a good starting point, but once you eliminate the exposed KEV-able vulnerabilities you will want to look at your larger vulnerability management program. You might also want to consider the IACS Star developed by Don C. Weber of Cutaway Security, LLC that is partially based on the OWASP® Foundation Risk Rating model. Dale Peterson interviewed Don about this approach at https://lnkd.in/ef4ACeZp The OWASP model is extremely flexible, and I've built multiple vulnerability scoring models using this approach. Different factors, different weights, etc. This CPG is directly related to 1.A, 1.F, 2.F, 2.W, 2.X and once we get through this series we will look at how some of these CPGs interact with each other. In our Notion CPG template at https://lnkd.in/eEAXvhrc we discuss one possible approach to accomplishing this objective using OpenVAS and the CISA KEV list. #cybersecurity #cpg #opensource #itsecurity #otsecurity #icssecurity #criticalinfrastructure #vulnerabilitymanagement

5