Martin Hell

The Danish SektorCERT reported two waves of attacks on 22 large and small critical infrastructure providers via unpatched vulnerabilities in Zyxel firewalls deployed between IT networks and the Internet. The SektorCERT report describes the first wave as exploiting a Zyxel vulnerability published two weeks before the first attack, and the second as exploiting a Zyxel zero day. The CERT further reported that in response to the attacks, utilities went into “island mode,” disconnecting their firewalls from the Internet until they could be repaired. Interested in learning more about the 68 cyber attacks that impaired operations at over 500 sites in 2023? Download the 2024 Threat Report ➡️ https://bit.ly/3wZhx58

12

Post-Quantum Security - Why and How The paper reviewing these subjects that I co-authored with Johanna Barzen is now online: https://lnkd.in/egrxs-Ky We show step-by-step that factorization-based and elliptic curve-based cryptography relies on the hardness of computing discrete logarithms. Shor’s algorithm (which we summarize in a nutshell too) performs this computation on a quantum computer in polynomial time, i.e. a powerful quantum computer may soon break today’s cryptography. Lattice-based cryptography is seen as a rescue - and we explain why this is the case and introduce its basics. Several reasons (like scalability of key-lengths) motivate the move towards algebraic-lattice-based cryptography and the corresponding module Learning With Error problem: we describe their underlying concepts in detail. Two of the corresponding algorithms (#Kyber and #Dilithium) that we present and explain step-by-step and with examples are currently standardized by NIST. We sketch the standardization process, actions currently taken by policy makers, and explain Mosca’s inequality that can be used to estimate how much time an organization has to move towards post-quantum safeness.  #cryptography #quantumcomputing #security #quantumsafeness #postquantumsecurity #standards

128

11 kommentarer

Detection Engineering Weekly Issue 77 is LIVE! https://lnkd.in/eEJqsTza In this post: * 💎 by David Burkett, 5 year lookback on Detection as Code and where we are going in the field * John F. on visualizing IoCs and navigating pivoting on C2 infra * Justin I. drops REx and helps me reduce a stupid amount of Chrome tabs when I do detection rule research * Robert Heaton PySkyWifi covert channel in a hilarious blog post on how to make the best use of your time on an Airplane * Rami McCarthy uses threat emulation tools to test GuardDuty, including Christophe Tafani-Dereeper's Stratus Red Team * Nathan Burns explores the concept of a "detection engine", the different types (on-host versus backend) and tees off a great series on building one * Podcast episode with yours truly talking detection engineering with Chuvakin and Timothy Peacock. DISCARDED hosts Selena Larson and Tim Kromphardt interview staff threat researcher Kyle Cucci on evasive malware * AT&T 8-K filing, Jim Walter uncovers NullBulge, Simone Kraus on CONTI's psychological techniques in ransomware, Kenneth Kinion uncovers new Lazarus infra with a single pivot, and Patrick Wardle finds some new DPRK BeaverTail samples

69

4 kommentarer

I will be speaking at the upcoming Plamadiso seminar on a new approach to AI governance based on Ostrom's Nobel Prize winning work on Common Pool Resources - https://lnkd.in/eN8rvSKb. If you are interested in learning more, you can register in the link above. #AI #Economics #techpolicy

55

“Our work unearths a side-channel vulnerability in the cryptographic library of Infineon Technologies. This vulnerability – that went unnoticed for 14 years and about 80 highest-level Common Criteria certification evaluations – is due to a non constant-time modular inversion. The attack requires physical access to the secure element in order to extract the ECDSA secret key. In the case of the FIDO protocol, this allows to create a clone of the FIDO device.” Great research and write up by NinjaLab ! 👏 And one more important point: “[…] it is still safer to use your YubiKey or other impacted products as FIDO hardware authentication token to sign in to applications rather than not using one.” https://lnkd.in/ejniS265

16

The Payment Standards graveyard has just gotten a new member 😪 Officially EUIDW-4-Payments is (of course) an active project. However, a full year without a consolidated specification says something else. In fact, there is not even a working group dedicated to the payment part of the EUIDW project! Why the depicted W3C standards ended up in the graveyard? It's simple: Apple 🍏 didn't bother supporting them. In the case of SPC (Secure Payment Confirmation), most banks had already deployed a solution (the mobile banking app), which essentially did the job. Compared to wallets like Apple Pay, SPC also appears a bit primitive. Too little and too late as they say 😎 A common issue for all three standard proposals is that they left the interface to Banks for the "Market" to figure out. Whatever, the "Market" may come up with (probably nothing...), it is most certainly not an open standard 😁 Personally, I believe this part of the payment puzzle is the most urgent to resolve, but it is unclear where and how. The Open Banking folks do not seem to be overly interested in wallets either.

38

19 kommentarer

Detection Engineering Weekly Issue 68 is LIVE! https://lnkd.in/dhvuCC4Y In this post: * Adam . 💎 of a post on artifact collection and understanding the importance of process and diligence in forensics. * Hope Walker drops a great follow-up post on manually querying ldap during red team exercises, investigation and detection ideation, Casey Smith on parsing DFIR Report blogs to look for detection opportunities with canaries, Dirk-jan Mollema on temporary access passes in Azure leading to NT hash dumping, Mary Asaolu and Thabet Awad on hunting in Azure subscriptions, and Diverto researchers on using Microsoft Print services as a C2 * Podcasts: Kara Swisher interviews Dmitri Alperovitch and Chris Krebs on preventing war with China and it's security implications, Odd Lots podcast on CHIPS act updates, and Mackenzie Foss and Rachel Schwalk join the Hou.Sec.Cast folks to talk threat detection and BEC * Threat landscape: Kevin Beaumont and his thoughts on CSRB's report on Microsoft, Lumen Technologies uncovers Cuttlefish malware, Hudson Rock dox on Spy Pet, and DoJ drops a dox on LockBitSupp

52

Detection Engineering Weekly Issue 98 is live! https://lnkd.in/eE3ydPGn In this post: * 💎 by Dobin Rutishauser on their Anti-EDR Compendium. Massive technical blog post and documentation how Windows internals as they pertain to EDRs * Alexandre Dulaunoy and Pauline Bourmeau publish an RFC to standardize the naming of threat actors * Burak Karaduman publishes their AttackRuleMap * Karol Mazurek gives readers a crash course on Drivers in MacOS * Charlie Egan and the OPA folks publish OPA 1.0 * Michaela Adams Roman Daszczyszak and Steve Luke bring more pain to threat actors with a network detection model on top of their host based model * Threat landscape: BeyondTrust breach disclosure, Saurabh Sharma and Vasily Berdnikov reverse engineer EAGERBEE, Spur Intelligence Corporation publishes a huge list of Astrill VPN IPs potentially leveraged by DPRK IT Workers, John Tuckner technical deep dive on the Cyberhaven breach, and North Korean Internet Research discovers Hangro

86

2 kommentarer

Detection Engineering Weekly #70 is live! https://lnkd.in/eQubGHYj I had a copy/paste error (human operator error) in the initial post, so it's now fixed :) In this post: *  💎 by David Burkett on being an analyst vs. an engineer and the gatekeepy-ness security people tend to leverage in this conversation * Microsoft's Ross Bevington unveils a part of their deception infrastructure and how infosec Twitter discovered one of their honeypot domains * Pass/Vail vs A-Grade security projects by Phil Venables <-- this one I copy-pasted content from Notion and the original post in email had the incorrect text. It's now updated! * Truvis T. detection opportunities and leveraging Microsoft Sentinel for Linux auditd * Victor Manuel Alvarez launches YARA-X * The Vertex Project thesilence on threat clustering * Podcasts featuring Jeff Bollinger on how LinkedIn does detection & response, and Mandiant researchers on 0-day and N-day vulnerability and incident response * Daniel Stepanic and samir bousseaden on LATRODECTUS as a drop-in replacement for ICEDID, Volexity unveils some detection opportunities for Palo Alto GlobalProtect devices, Rockwell Automation wants us to pull the plug on their devices connected to the internet, BlackBasta infra hunting and a new Linux backdoor from Kimsuky

53

2 kommentarer

🌟 Boosting Efficiency in InfoSec and Compliance with AI 🌟 In the evolving world of information security and compliance, integrating AI is essential. With the upcoming Digital Operational Resilience Act (DORA) in early 2025, financial entities must adapt swiftly. Inspired by the OWASP Gothenburg meetup last night, where prompting custom GPTs for code generation was discussed, I experimented with some pre-prompting of a custom GPT created by Fredrik Blix which gave impressive results! The custom GPT "Security.eu DORA" offers expert guidance on the new regulation, helping financial entities understand and implement ICT risk management strategies. This assistant can help you analyze agreements and documents, it can provide definitions and explanations of DORA regulations and provide answers to any DORA-related questions. AI assistants can significantly speed up your workflow by: 1. Generating Drafts: Quickly creating initial drafts for policy and process documentation. A little pre-prompting goes a long way. 2. Summarizing Documents: Efficiently summarizing long and complex regulatory texts (remember to always fact check the output). 3. Providing FAQ Functionality: Offering a “chat with regulatory documents” capability with references to underlying sources. 💡 How do you use AI to speed up your work? Share your tips and experiences! Let's collaborate to harness AI's power for greater efficiency and resilience in our industry. Contact us CShift if you want to continue the dialogue on DORA! #InformationSecurity #Compliance #AI #DigitalResiliency #DORA #FinancialEntities #AI #CustomGPT

25

1 kommentar

Are You An Organisation Based in the EU? You Need To Be Fully NIS2 Compliant In 72 Days Time is running out to comply with NIS2 regulations. Starting your compliance journey sooner rather than later is crucial. See directive requirements below: https://lnkd.in/e3Baxbpp A typical NIS2 compliance process, including security assessments, auditing, consulting, and tool implementation, takes approximately 12 months. Download our NIS2 Mapping Guide – and find out how Seceon can help accelerate your compliance https://lnkd.in/eXY38gyw #seceon #nis2 #compliance #cybersecurity #nis

21

What Are The Penalties If You are In The EU And Not NIS2 Fully Compliant In 71 Days? Penalties for NIS2 Violations The NIS2 Directive sets out specific penalties for non-compliance, these include: Non-monetary remedies Administrative fines Criminal sanctions These penalties can be imposed on essential entities and important entities for infraction such as failure to meet security requirements and failure to report incidents. The specific fines will vary depending on the Member State, but the Directive establishes a minimum list of administrative sanctions for breach of the cybersecurity risk management and reporting obligations. Non-monetary Penalties NIS2 gives national supervisory authorities the authority to enforce non-monetary remedies, including: compliance orders binding instructions security audit implementation orders threat notification orders to entities’ customers. Administrative Fines With regard to administrative fines, the NIS2 directive carefully distinguishes between essential and important entities. For essential entities, it requires Member States to provide a maximum fine level of at least €10,000,000 or 2% of the global annual revenue, whichever is higher. For important entities, NIS2 requires Member States to fine for a maximum of at least €7,000,000 or 1,4% of the global annual revenue, whichever is higher.

4

Unlike Surströmming ... this session on CRA and Machinery Regulation is not just for Sweden! As a manufacturer of digital products, in the UK and Ireland this session will five you insight into the specific requirements placed on you. The focus will be to identify how these two correlate and which compliance road you should select as a manufacturer based on the type of product you produce.

3

This is a fantastic article by John Althouse. It does a deep dive on new security research into TCP Fingerprinting - JA4T. This builds tremendously on the previous research into TLS fingerprinting, JA4, which you now see being implemented in WAF solutions, such as AWS WAF. Fingerprinting TCP allows you to gain visibility into what devices are being used, whether the traffic is proxied, or even what cellular provider the device is on. This will enable firewalls to build more robust logic to protect against TLS as well as non-TLS traffic https://lnkd.in/ehtSxP8d

12

First - read the tweet. Then understand that Max Schrems often points out, that EUs NIS2 IS NOT addressing FISA-702, which grants the U.S. intelligence the right to demand data provided to them, by companies subject to the law. This means US vendors. Up for anti FISA-702 medicine, anyone ?? Blink-blink - you could reach out if you’re concerned - the Zafepass Prevent & Protect platform does what NIS2 doesn’t. More [email protected]

9