The Download Manager WordPress plugin before 3.2.39 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access Read more

The vulnerability in the latest version of WordPress has been fixed by a security researcher.

De kwetsbaarheid in de nieuwste versie van WordPress is verholpen door een beveiligingsonderzoeker.

Follow the instructions, as they will assist you in mitigating the WordPress vulnerability that been reported in CVE-2022-0828. The latest version contains the CVE-2022-0828 fix. • Utilize the references The CVE-2022-0828 references have been provided for a reason.

Volg de instructies, ze zullen u helpen om het WordPress lek dat gemeld is in CVE-2022-0828 te verminderen. De laatste versie bevat de oplossing voor CVE-2022-0828. Controleer of CVE-2022-0828 is gemitigeerd.

The Download Manager WordPress plugin before 3.2.39 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the download.

Follow the instructions, as they will assist you in mitigating the WordPress vulnerability that been reported in CVE-2022-0828.
• Install the latest version of WordPress Navigate to the official WordPress website and download the latest version of WordPress. The latest version contains the CVE-2022-0828 fix.
• Perform a vulnerability assessment Perform a scan on your WordPress environment(s), and check for vulnerabilities. Verify if CVE-2022-0828 has been mitigated.
• Utilize the references The CVE-2022-0828 references have been provided for a reason. Utilize these references and make sure that you are correctly informed.

CVE-2022-0828: Wordpress plugin vulnerability

By Karim Adib, Data Analyst, The SEO Works According to a report commissioned by the UK government, 82% of job openings advertised online across the UK require digital skills. The same study attributes a 29%

When it comes to digital skills, it is a growing demand for these skills.

Er is steeds meer vraag naar digitale vaardigheden.

According to a report commissioned by the UK government, 82% of job openings advertised online across the UK require digital skills. Not only does this illustrate the importance of digital skills – it also suggests that job openings that do not require digital skills are dwindling and paying less. The Digital PR team at The SEO Works gathered data on the average salary from top UK job boards Glassdoor, indeed, and Prospects to reveal some of the most in-demand digital jobs along with how difficult it is to get started in them.

Volgens een in opdracht van de Britse regering opgesteld rapport vereist 82% van de online geadverteerde vacatures in het VK digitale vaardigheden. Dit illustreert niet alleen het belang van digitale vaardigheden, maar wijst er ook op dat vacatures waarvoor geen digitale vaardigheden vereist zijn, afnemen en minder goed worden betaald. Het Digital PR-team van The SEO Works verzamelde gegevens over het gemiddelde salaris van de belangrijkste Britse vacaturebanken Glassdoor, indeed en Prospects om enkele van de meest gevraagde digitale banen te onthullen, samen met hoe moeilijk het is om daarin aan de slag te gaan.

According to a report commissioned by the UK government, 82% of job openings advertised online across the UK require digital skills. The same study attributes a 29% higher salary and a 59% reduced risk of redundancy (due to automation-led obsolescence) for these digital jobs. Not only does this illustrate the importance of digital skills – it also suggests that job openings that do not require digital skills are dwindling and paying less.

While digital industries are booming and demand has never been higher, some niches are easier to break into than others, and some niches pay higher than others. The Digital PR team at The SEO Works gathered data on the average salary from top UK job boards Glassdoor, indeed, and Prospects to reveal some of the most in-demand digital jobs along with how difficult it is to get started in them. Here are the findings.

The data shows that the digital industry has opportunities catering to a variety of skill sets as well as a variety of interests. At a glance, it is not surprising to see a correlation between salaries and job ‘difficulty’ (how many years of training/experience are required), whereby easier jobs tend to pay less, and more ‘difficult’ jobs pay more. Here are the findings for the cyber security industry.

Cyber security: One of the toughest digital industries to get into, but not without extra benefits.

A huge advantage of many digital careers is that it’s possible for anyone to get most if not all of the skills they need online. This is not the case with cyber security, but this is not necessarily a downside. It might be harder to get into cyber security, but the demand is there and you will be compensated handsomely for your hard-earned knowledge. This is why Cyber Security Analyst has the overall second best difficulty to salary ratio in the study and Penetration Tester is ranked as the second best-paid job on the chart. When technology exists, so does the need to keep this technology safe.

Penetration Tester Is Well-Renumerated, But It’s The Hardest Job To Get Into

Penetration Tester is the second-highest paid job on the chart with an average salary of £54,000. This relatively high salary is because getting into penetration testing needs a university degree as well as 2-4 years of experience in the industry. This means on average it takes 5-6 years to be able to become a Penetration Tester – a high bar to entry when compared with, for example, a job in Digital Marketing. The demand is clearly there, but is it worth pursuing compared to other cyber security jobs, like being a Cyber Security Analyst, which offers a much better demand to difficulty ratio?

Cyber Security Analyst is a great career choice due to its difficulty to salary ratio

When looking at a job, you want to consider how tough a career is to get into versus how much the skills you get will be worth. This is why when we compare being a Cyber Security Analyst to other digital jobs it comes out as the second best career choice on the chart. The reason this ranked so well on the difficulty scale compared to other jobs in the cyber security sector was that a lot of companies do not require a university degree to apply. However, it will be difficult to find information online to get you to mastery level.

Is Cyber Security the Industry for You?

This chart is one way to consider your future career, but such a big decision is never as straightforward as it might seem at first. So, do not let the chart dictate too much about what you want to go for. One thing is for certain, however – demand for cyber security professionals is strong, and that shows no sign of changing anytime soon.

Karim Adib is a data researcher and analyst at The SEO Works. His background in civil engineering and marketing allows him to combine data analysis with storytelling to create data-led pieces.

Karim can be reached online at @karimadib99 on Twitter and at our company website seoworks.co.uk/services/digital-pr-agency/

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

The Best Cyber Security Jobs in The UK According to Data

Cloudflare this week announced new WAF, email security and API security tools, many of them available at no extra charge.

Cloudflare has announced a range of new security tools for its customers.

Cloudflare heeft een reeks nieuwe beveiligingstools voor haar klanten aangekondigd.

Cloudflare this week made several security-related announcements, offering customers a new web application firewall (WAF) engine, as well as email security and API security tools. The new email security tools, announced on Monday, are a result of Cloudflare’s recent acquisition of Area 1 Security. Once the acquisition of Area 1 closes — the deal should be finalized in the second quarter — Cloudflare will provide enterprise-grade email security tools to all customers at no additional charge.

Cloudflare heeft deze week verschillende veiligheidsgerelateerde aankondigingen gedaan en biedt klanten een nieuwe web application firewall (WAF) engine, evenals tools voor e-mailbeveiliging en API-beveiliging. De nieuwe e-mailbeveiligingstools, die maandag werden aangekondigd, zijn het resultaat van Cloudflare's recente overname van Area 1 Security. Dinsdag kondigde het bedrijf voor webprestaties en -beveiliging de beschikbaarheid aan van zijn nieuwe WAF-engine en beheerde rulests, gratis voor alle klanten.

Cloudflare this week made several security-related announcements, offering customers a new web application firewall (WAF) engine, as well as email security and API security tools.

The new email security tools, announced on Monday, are a result of Cloudflare’s recent acquisition of Area 1 Security. Once the acquisition of Area 1 closes — the deal should be finalized in the second quarter — Cloudflare will provide enterprise-grade email security tools to all customers at no additional charge.

“Control, customization, and visibility via analytics will vary with plan level, and the highest flexibility and support levels will be available to Enterprise customers for purchase,” the company explained.

On Tuesday, the web performance and security company announced the availability of its new WAF engine and managed rulests for free to all customers. The goal is to help small application owners and developers protect their products against high-impact vulnerabilities, such as the recent Log4j flaws.

Free plan users will receive access to the WAF interface in the dashboard and they will be able to configure new rulesets. However, Cloudflare’s broader set of WAF rulesets and advanced WAF features will only be available to customers with a Pro or higher plan.

On Wednesday, Cloudflare announced a new API gateway designed to help organizations manage, monitor and secure all of their APIs. The new tool leverages machine learning to automatically detect new APIs and block threats.

Cloudflare Announces New Security Tools for Email, Applications, APIs | SecurityWeek.Com

In a great many ransomware attacks, the criminals who pillage the victim's network are not the same crooks who gained the initial access to the victim organization. More commonly, the infected PC or stolen VPN credentials the gang used to…

A Russian cybercriminal has spent more than a decade selling ransomware accounts to other criminals, according to the BBC’s Alexei Lavrov.

Een Russische cybercrimineel heeft meer dan tien jaar lang ransomware-accounts verkocht aan andere criminelen, aldus Alexei Lavrov van de BBC.

More commonly, the infected PC or stolen VPN credentials the gang used to break in were purchased from a cybercriminal middleman known as an initial access broker. Wazawaka has been a highly active member of multiple cybercrime forums over the past decade, but his favorite is the Russian-language community Exploit. But in more recent years, Wazawaka has focused on peddling access to organizations and to databases stolen from hacked companies.

Dat zou kunnen verklaren waarom Wazawaka zo nonchalant is in het verbergen en beschermen van zijn cybercriminele identiteiten: Ongelooflijk, Wazawaka's alter ego op het forum XSS - Uhodiransomware - gebruikt nog steeds hetzelfde wachtwoord op het forum dat hij 10 jaar geleden gebruikte voor zijn Vkontakte account. Wazawaka lijkt het unieke communitaristische standpunt te hebben ingenomen dat wanneer organisaties die losgeld krijgen weigeren mee te werken of te betalen, alle gegevens die van het slachtoffer zijn gestolen op de Russische cybercrimefora moeten worden gepubliceerd zodat iedereen ze kan plunderen - en niet onderhands moeten worden verkocht aan de hoogste bieder. Wazawaka is de afgelopen tien jaar een zeer actief lid geweest van meerdere cybercrimefora, maar zijn favoriet is de Russischtalige gemeenschap Exploit.

In a great many ransomware attacks, the criminals who pillage the victim’s network are not the same crooks who gained the initial access to the victim organization. More commonly, the infected PC or stolen VPN credentials the gang used to break in were purchased from a cybercriminal middleman known as an initial access broker. This post examines some of the clues left behind by “Wazawaka,” the hacker handle chosen by a major access broker in the Russian-speaking cybercrime scene.

Wazawaka has been a highly active member of multiple cybercrime forums over the past decade, but his favorite is the Russian-language community Exploit. Wazawaka spent his early days on Exploit and other forums selling distributed denial-of-service (DDoS) attacks that could knock websites offline for about USD $80 a day. But in more recent years, Wazawaka has focused on peddling access to organizations and to databases stolen from hacked companies.

“Come, rob, and get dough!,” reads a thread started by Wazawaka on Exploit in March 2020, in which he sold access to a Chinese company with more than $10 billion in annual revenues. “Show them who is boss.”

According to their posts on Exploit, Wazawaka has worked with at least two different ransomware affiliate programs, including LockBit. Wazawaka said LockBit had paid him roughly $500,000 in commissions for the six months leading up to September 2020.

Wazawaka also said he’d teamed up with DarkSide, the ransomware affiliate group responsible for the six-day outage at Colonial Pipeline last year that caused nationwide fuel shortages and price spikes. The U.S. Department of State has since offered a $5 million reward for information leading to the arrest and conviction of any DarkSide affiliates.

Wazawaka seems to have adopted the uniquely communitarian view that when organizations being held for ransom decline to cooperate or pay up, any data stolen from the victim should be published on the Russian cybercrime forums for all to plunder — not privately sold to the highest bidder. In thread after thread on the crime forum XSS, Wazawaka’s alias “Uhodiransomwar” can be seen posting download links to databases from companies that have refused to negotiate after five days.

“The only and the main principle of ransomware is: the information that you steal should never be sold,” Uhodiransomwar wrote in August 2020. “The community needs to receive it absolutely free of charge if the ransom isn’t paid by the side that this information is stolen from.”

Wazawaka hasn’t always been so friendly to other cybercrooks. Over the past ten years, his contact information has been used to register numerous phishing domains intended to siphon credentials from people trying to transact on various dark web marketplaces. In 2018, Wazawaka registered a slew of domains spoofing the real domain for the Hydra dark web market. In 2014, Wazawaka confided to another crime forum member via private message that he made good money stealing accounts from drug dealers on these marketplaces.

“I used to steal their QIWI accounts with up to $500k in them,” Wazawaka recalled. “A dealer would never go to the cops and tell them he was selling stuff online and someone stole his money.”

Wazawaka used multiple email addresses and nicknames on several Russian crime forums, but data collected by cybersecurity firm Constella Intelligence show that Wazawaka’s alter egos always used one of three fairly unique passwords: 2k3x8x57, 2k3X8X57, and 00virtual.

Those three passwords were used by one or all of Wazawaka’s email addresses on the crime forums over the years, including wazawaka@yandex.ru, mixseo@mail.ru, mixseo@yandex.ru, mixfb@yandex.ru.

That last email address was used almost a decade ago to register a Vkontakte (Russian version of Facebook) account under the name Mikhail “Mix” Matveev. The phone number tied to that Vkontakte account — 7617467845 — was assigned by the Russian telephony provider MegaFon to a resident in Khakassia, situated in the southwestern part of Eastern Siberia.

DomainTools.com [an advertiser on this site] reports mixfb@yandex.ru was used to register three domains between 2008 and 2010: ddosis.ru, best-stalker.com, and cs-arena.org. That last domain was originally registered in 2009 to a Mikhail P. Matveyev, in Abakan, Khakassia.

Mikhail Matveev is not the most unusual name in Russia, but other clues help narrow things down quite a bit. For example, early in his postings to Exploit, Wazawaka can be seen telling members that he can be contacted via the ICQ instant message account 902228.

An Internet search for Wazawaka’s ICQ number brings up a 2009 account for a Wazawaka on a now defunct discussion forum about Kopyovo-a, a town of roughly 4,400 souls in the Russian republic of Khakassia:

Also around 2009, someone using the nickname Wazawaka and the 902228 ICQ address started posting to Russian social media networks trying to convince locals to frequent the website “fureha.ru,” which was billed as another website catering to residents of Khakassia.

According to the Russian domain watcher 1stat.ru, fureha.ru was registered in January 2009 to the email address mix@devilart.net and the phone number +79617467845, which is the same number tied to the Mikhail “Mix” Matveev Vkontakte account.

DomainTools.com says the mix@devilart.net address was used to register two domains: one called badamania[.]ru, and a defunct porn site called tvporka[.]ru. The phone number tied to that porn site registration back in 2010 was 79235810401, also issued by MegaFon in Khakassia.

A search in Skype for that number shows that it was associated more than a decade ago with the username “matveevatanya1.” It was registered to a now 29-year-old Tatayana Matveeva Deryabina, whose Vkontakte profile says she currently resides in Krasnoyarsk, the largest city that is closest to Abakan and Abaza.

It seems likely that Tatayana is a relative of Mikhail Matveev, perhaps even his sister. Neither responded to requests for comment. In 2009, a Mikhail Matveev from Abaza, Khakassia registered the username Wazawaka on weblancer.net, a freelance job exchange for Russian IT professionals. The Weblancer account says Wazawaka is currently 33 years old.

In March 2019, Wazawaka explained a lengthy absence on Exploit by saying he’d fathered a child. “I will answer everyone in a week or two,” the crime actor wrote. “Became a dad — went on vacation for a couple of weeks.”

One of the many email addresses Wazawaka used was devdelphi@yandex.ru, which is tied to a more recent but since-deleted Vkontakte account for a Mikhail Matveev and used the password 2k3X8X57. As per usual, I put together a mind map showing the connections referenced in this story:

Analysts with cyber intelligence firm Flashpoint say Wazawaka’s postings on various Russian crime forums show he is proficient in many specializations, including botnet operations, keylogger malware, spam botnets, credential harvesting, Google Analytics manipulation, selling databases for spam operations, and launching DDoS attacks.

Flashpoint says it is likely Wazawaka/Mix/M1x has shared cybercriminal identities and accounts with multiple other forum members, most of whom appear to have been partners in his DDoS-for-hire business a decade ago. For example, Flashpoint points to an Antichat forum thread from 2009 where members said M1x worked on his DDoS service with a hacker by the nickname “Vedd,” who was reputedly also a resident of Abakan.

STAY TRUE, & MOTHER RUSSIA WILL HELP YOU

All of this is academic, of course, provided Mr. Wazawaka chooses to a) never leave Russia and b) avoid cybercrime activities that target Russian citizens. In a January 2021 thread on Exploit regarding the arrest of an affiliate for the NetWalker ransomware program and its subsequent demise, Wazawaka seems already resigned those limitations.

“Don’t shit where you live, travel local, and don’t go abroad,” Wazawaka said of his own personal mantra.

Which might explain why Wazawaka is so lackadaisical about hiding and protecting his cybercriminal identities: Incredibly, Wazawaka’s alter ego on the forum XSS — Uhodiransomware — still uses the same password on the forum that he used for his Vkontakte account 10 years ago. Lucky for him, XSS also demands a one-time code from his mobile authentication app.

Wazawaka said NetWalker’s closure was the result of its administrator (a.k.a. “Bugatti”) getting greedy, and then he proceeds to preach about the need to periodically re-brand one’s cybercriminal identity.

“I’ve had some business with Bugatti,” Wazawaka said. “The guy got too rich and began recruiting Americans as affiliate partners. What happened now is the result. That’s okay, though. I wish Bugatti to do some rebranding and start from the beginning 🙂 As for the servers that were seized, they should’ve hosted their admin panels in Russia to avoid getting their servers seized by INTERPOL, the FBI, or whatever.”

“Mother Russia will help you,” Wazawaka concluded. “Love your country, and you will always get away with everything.”

If you liked this post, you may also enjoy Who Is the Network Access Broker “Babam”?

Who is the Network Access Broker ‘Wazawaka?’ – Krebs on Security

The first step toward operationalizing cybersecurity is to start thinking of it just like any other business investment.

When it comes to cybersecurity, it’s hard to imagine that businesses are struggling to cope with the threat.

Als het op cyberbeveiliging aankomt, is het moeilijk voor te stellen dat bedrijven moeite hebben om de dreiging het hoofd te bieden.

Enterprises are investing more in cybersecurity than ever before, but we’re also seeing a record number of breaches. It can’t be denied that cyber criminals have become more organized, and more advanced tools and tactics are increasingly accessible. But the real reason all those billions of dollars aren’t making an impact on the number of breaches is that, often, the money isn’t being spent in the right way.

Het valt niet te ontkennen dat cybercriminelen georganiseerder zijn geworden, en dat geavanceerdere instrumenten en tactieken steeds toegankelijker worden. Maar de echte reden waarom al die miljarden dollars geen effect hebben op het aantal inbreuken is dat het geld vaak niet op de juiste manier wordt besteed. Er is een enorme markt van kwaliteitsoplossingen die cyberbeveiligingsproblemen proberen op te lossen, maar simpelweg met geld smijten zal uiteindelijk geen verschil maken in de beveiligingsstatus.

Enterprises are investing more in cybersecurity than ever before, but we’re also seeing a record number of breaches. More than 5.1 billion pieces of personal information were reported stolen last year, and the average cost of a breach has climbed to $4.35 million.

Have the threat actors really become that good? Or is this a business failing?

It can’t be denied that cyber criminals have become more organized, and more advanced tools and tactics are increasingly accessible. But the real reason all those billions of dollars aren’t making an impact on the number of breaches is that, often, the money isn’t being spent in the right way.

There is a huge market of quality solutions out there looking to solve cybersecurity problems, but simply throwing cash at them ultimately won’t make a difference in security standing. Solutions must be properly implemented to really help solve the problem.

This is where the concept of operationalizing security comes in.

Every business needs to deliver on several core foundations to be successful.

This includes the business culture – the set of values that brings everyone together and makes them want to work there – and the accountability each person has for their role.

Then there are the processes of the business’ operations, and the resources that enable them – all increasingly facilitated by automation. And finally, all business activity needs to produce measurable outputs.

All of this comes together to form the organization’s strategy – the North Star that gives it purpose and defines its direction.

Cybersecurity is a unique proposition as it ties into every one of these core foundations. Ultimately then, no security strategy can succeed unless it has those elements in place.

The first step toward operationalizing cybersecurity is to start thinking of it just like any other business investment. There is an unfortunate tendency for cyber spending to be almost random, with no target in mind. Naturally, this also means there is little in the way of effective measurement on performance and results.

It’s hard to imagine any other business element functioning in this way, especially with a perpetual spending increase.

Imagine a sales director asking to double their team’s headcount, but a year later this investment hasn’t led to any increase in revenue. Most firms would promptly show the sales director the door.

Yet when it comes to cybersecurity, most companies will continue to pump money into new solutions without a clear idea of whether their security posture has improved. Indeed, many organizations lack the meaningful metrics to gauge whether their investments are showing any returns at all.

So, measurement must be a top priority for operationalizing security. The metrics to achieve this need to be focused on reducing risk. Firms need to have a solid idea of what they are trying to protect with each security element they budget for, and why.

Enterprises need to identify what business functions would be most impacted by a breach, and the effect such an incident would have on business operations. Based on this understanding, firms can work backwards and construct a security strategy geared around mitigating these high priority risks.

For other business elements, enterprises know which levers to adjust when it’s apparent an element of their operation will make a loss. Some risks you mitigate, some you accept, and some you transfer – and this same thought process needs to be applied to cybersecurity.

As firms build awareness of their cyber risk priorities, they should also become familiar with their maturity levels. This isn’t a single measurement, but rather applies to each of those core foundations – culture, accountability, processes, resources, automation, and measurement.

A business can be more mature in its application of cyber risk in one area than it is another. Perhaps it has established successful automation but lacks accountability. Or vice versa.

While some business aspects are easier to define, others are more nebulous. Culture is often a somewhat vague notion in the context of security, and accountability is likewise often undefined outside of specific security roles.

A useful approach here is to establish the various personas that have a stake in security across the organization and create a cultural scorecard for each. More important stakeholders such as the executive leadership should have a higher maturity level, while it’s not as important for the more general workforce. If it’s apparent that a department is below the level of maturity and accountability you need, it’s time to start implementing measures such as training to improve things.

Adapting business culture is never a quick fix, so firms should expect this to be a gradual process that takes at least 12-18 months.

At the same time, businesses can start implementing solid metrics to effectively track the return on investment (ROI) of their solutions. Security key performance indicators (KPIs) should be firmly tied to business impact in a way that non-technical leadership and stakeholders can relate to.

Mean time to resolve (MTTR) is one of the most useful examples. In a cyber context, it means the time between identifying a threat or vulnerability and closing it. But it’s also well understood in a broader context for other business issues.

Breaking out of the cybersecurity spending loop

It’s become very apparent that skyrocketing cybersecurity spending is not enough in the face of equally skyrocketing security risk. This approach is unsustainable – especially as business technology itself has swiftly transformed in the last few years with factors like cloud migration and remote working.

To paraphrase Einstein: We can’t solve problems by using the same kind of thinking we used when we created them.

Rather than simply increasing their budgets for yet another year, enterprises need to take a step back and start operationalizing their security. By tracing cybersecurity’s connections to their core business foundations, firms can begin ensuring that their investments are delivering real results in reducing their risk exposure.

Why it's past time we operationalized cybersecurity

In this Help Net Security video, Erik Costlow, Senior Director of Product Management at Azul, talks about Java centric vulnerabilities and the headache

Developers are being warned about the threats they face when a new issue is released.

Ontwikkelaars worden gewaarschuwd voor de bedreigingen waarmee zij worden geconfronteerd wanneer een nieuw nummer wordt uitgebracht.

In this Help Net Security video, Erik Costlow, Senior Director of Product Management at Azul, talks about Java centric vulnerabilities and the headache they have become for developers everywhere. He touches on the need for putting security back into DevOps and how developers can better navigate vulnerabilities that are taking up all of their efforts and keeping them from being able to focus on the task at hand. Daily Newsletter - E-mail sent every business day with a recap of the last 24 hours Weekly Newsletter - E-mail sent every Monday with a recap of the last 7 days (IN)SECURE Magazine - E-mail sent when a new issue is released I have read and agree to the terms & conditions

Dagelijkse Nieuwsbrief - E-mail wordt elke werkdag verstuurd met een samenvatting van de afgelopen 24 uur. Wekelijkse Nieuwsbrief - E-mail wordt elke maandag verstuurd met een samenvatting van de afgelopen 7 dagen. (IN)SECURE Magazine - E-mail wordt verstuurd wanneer een nieuwe uitgave verschijnt.

In this Help Net Security video, Erik Costlow, Senior Director of Product Management at Azul, talks about Java centric vulnerabilities and the headache they have become for developers everywhere.

He touches on the need for putting security back into DevOps and how developers can better navigate vulnerabilities that are taking up all of their efforts and keeping them from being able to focus on the task at hand.



 Daily Newsletter - E-mail sent every business day with a recap of the last 24 hours Weekly Newsletter - E-mail sent every Monday with a recap of the last 7 days (IN)SECURE Magazine - E-mail sent when a new issue is released I have read and agree to the terms & conditions

How to manage the intersection of Java, security and DevOps at a low complexity cost

In this interview for Help Net Security, Devin Redmond, CEO at Theta Lake, talks about the risk of internal communications.

The coronavirus pandemic has caused a significant increase in the number of insider threats among employees.

De pandemie van het coronavirus heeft geleid tot een aanzienlijke toename van het aantal insiderbedreigingen onder werknemers.

In this interview for Help Net Security, Devin Redmond, CEO at Theta Lake, talks about the risk of internal communications and what companies can do to keep themselves safe. The pandemic has greatly changed internal communications within organizations which, paired with the Great Resignation, caused a higher risk for insider threats. With the ease of communication, sharing, and even creation of this material in modern communication tools, it is even easier for humans to overshare through accident or through intent the very information that can create risk and harm.

In dit interview voor Help Net Security vertelt Devin Redmond, CEO van Theta Lake, over de risico's van interne communicatie en wat bedrijven kunnen doen om zichzelf veilig te stellen. De pandemie heeft de interne communicatie binnen organisaties sterk veranderd, wat in combinatie met het Grote Ontslag een hoger risico op insiderbedreigingen met zich meebracht. Met het gemak waarmee moderne communicatiemiddelen dit materiaal kunnen communiceren, delen en zelfs creëren, is het voor mensen nog gemakkelijker om per ongeluk of opzettelijk te veel informatie te delen die juist risico's en schade kan veroorzaken.

In this interview for Help Net Security, Devin Redmond, CEO at Theta Lake, talks about the risk of internal communications and what companies can do to keep themselves safe.

The pandemic has greatly changed internal communications within organizations which, paired with the Great Resignation, caused a higher risk for insider threats. Which sectors are the most targeted and what makes them more vulnerable?

When it comes to insider threats, the most vulnerable sectors include the broader financial services (banking, wealth, insurance, etc.), healthcare, government, and tech/manufacturing sectors. Essentially, any sector that handles sensitive information across regulated personal information like PII, PCI, and PHI, and through to Material Nonpublic Information (MNPI), trade secrets, security compromising data like passwords are at high risk.

With the ease of communication, sharing, and even creation of this material in modern communication tools, it is even easier for humans to overshare through accident or through intent the very information that can create risk and harm. Think of the customer list shared in a Slack or Teams chat channel as a file or a link, or the design doc shared via a screen share in a Zoom or Webex meeting, or the credit card or password typed in a chat or recorded in a phone call.

Then, think of how easy it is for the wrong person to download or screen capture that information, store a recording they perhaps shouldn’t, expose it inadvertently, or use it inappropriately. Then, recognize that the security and compliance guardrails of yesterday that most companies rely on today, which mostly looks at email, traffic traversing a network or going to cloud applications, or devices, versus directly integrating with Zoom, Webex, Slack, RingCentral, Microsoft Teams and more to address the human interaction element of risks in information sharing and communication conduct that is happening everyday inside of the communications in integrated video, voice, and chat tools.

How do communications specifically pose a threat to an organization?

Related to the above, the communication tools themselves are typically secure, simply do not pose a threat, and are primary to unlocking better collaboration and cost-saving efficiencies. It’s the human element that introduces real risk where the increasing use of chat, voice and video collaboration technology is where humans can make mistakes or behave badly. It exposes that organizations are unprepared with complementary policies, procedures, and guardrail technology for the variety of conduct and information security risks that human users create inside the communications within collaboration tools.

The mismatch in tools that are designed for email, network, cloud, or device security and the reality of where communication happens and where information is shared today is where a new, expanding risk surface area has emerged.

What are the tactics companies must learn to reduce the risk of communications-related data leaks?

To reduce risks in the new digital workplace, companies must first put well-documented policies and training around the do’s and don’ts in these new communication tools. That should come with periodic policy audits and spot checks along with actual policy enforcement. Then, companies must shift to implementing purpose built technology that allows them to detect risk and take action on that risk in the communications inside of their new communication tools. These security tools should be vetted and certified by the communication platforms like Cisco, Microsoft, RingCentral, Slack, and Zoom.

By adapting security and compliance practices and using supporting technology that is trusted and certified by the communication tool providers, customers can put the guardrails in place to best protect their employees, customers and data from abuse and misuse. As information is increasingly shared and our workplace interactions take place inside and during collaboration, optimizing and ensuring compliance and security standards is a necessity.

What can businesses do to increase employee awareness?

To increase employee awareness, there should be clear posting of policies and actual training on proper procedures while implementing security and compliance technologies purpose-built for integrated voice, video, messaging, and chat tools. The same way technologies are used by companies for email security, network security, cloud application security, and endpoint security, there are technologies that help manage monitoring, automate risk detection, and coach employees inside of chat, voice, and video communications while monitoring and enforcing that users keep proper security settings enabled on the platforms themselves… The latter being a common place where users unintentionally disable the very powerful security features that companies like Zoom deliver in their products.

Second, technology can and should be transparent and set to alert employees that it is monitoring to maintain a safe digital workplace. It should be seen as a visible guardrail, warning light, and safety system that activates when needed, based on risk. For example, technology can remove a file or link to a file of customer information in a chat and replace it with a message noting that the file was blocked due to the requirement to protect that sensitive data. For another example, technology can notify employees that a video meeting is being recorded for compliance purposes and, in the meeting, users can be notified of risky actions that they should avoid. In those scenarios, security and compliance teams would only be notified of risks versus non-relevant, time-wasting non-risks.

Finally, as compliance and security teams forensically review meetings, chats, and conversations that have triggered risk, technology can be used to address the risk and notify employees. These types of visible guardrails and warning lights can dramatically reduce the most common risks and make it easier to focus on the trickier ones by reducing signal-noise.

How can organizations prevent the threat posed by disgruntled or resigning employees?

Aside from doing your best to treat employees fairly and with respect to put foundational disincentives in place for disgruntlement, the best approach to handling outlying disgruntled employees is by making the rules and repercussions for violation well known while also making it well known that there is an advanced technology that can and will detect those violations.

By being clear about all guidelines for communications, how information is shared, and how the information and communications are stored, employers can mitigate the risk surface area from the start. That is where compliance and security tools enable risk detection while pinpointing exact moments or instances of compliance issues across every collaboration interaction and conversation, whether it’s video, voice, chat, or the files shared within them. These rules and implications can be outlined and baked into the initial employment agreements and the typical privacy and conduct rules that employees sign up for as part of their onboarding.

Tackling the dangers of internal communications: What can companies do?

An Abnormal Security report explores the current email threat landscape and provides insight into the latest advanced email attack trends.

The number of email attacks in the UK has risen by more than a third over the past six months, according to research.

Het aantal e-mailaanvallen in het Verenigd Koninkrijk is de afgelopen zes maanden met meer dan een derde gestegen, zo blijkt uit onderzoek.

Abnormal Security released a which report explores the current email threat landscape and provides insight into the latest advanced email attack trends, including increases in business email compromise, the evolution of financial supply chain compromise and the rise of brand impersonation in credential phishing attacks. Most common among the 265 brands impersonated in these attacks were social networks and Microsoft products. This is especially true with brand impersonation, where attackers use urgency and fear to encourage their targets to provide usernames and passwords.”LinkedIn took the top spot for brand impersonation, but Outlook, OneDrive and Microsoft 365 appeared in 20% of all attacks.

Abnormal Security heeft een rapport uitgebracht waarin het huidige bedreigingslandschap voor e-mail wordt verkend en inzicht wordt gegeven in de nieuwste trends op het gebied van geavanceerde e-mailaanvallen, waaronder een toename van de compromittering van zakelijke e-mail, de evolutie van de compromittering van de financiële toeleveringsketen en de opkomst van merkimitatie bij credential phishing-aanvallen. Cybercriminelen deden zich niet alleen voor als interne medewerkers en leidinggevenden, maar deden zich in 15% van de phishing-e-mails ook voor als bekende merken, waarbij ze vertrouwden op de bekendheid en reputatie van de merken om medewerkers over te halen hun inloggegevens te verstrekken. Het meest voorkomend onder de 265 merken die bij deze aanvallen werden geïmiteerd, waren sociale netwerken en Microsoft-producten.

Abnormal Security released a which report explores the current email threat landscape and provides insight into the latest advanced email attack trends, including increases in business email compromise, the evolution of financial supply chain compromise and the rise of brand impersonation in credential phishing attacks.

The research found a 48% increase in email attacks over the previous six months, and 68.5% of those attacks included a credential phishing link. In addition to posing as internal employees and executives, cybercriminals impersonated well-known brands in 15% of phishing emails, relying on the brands’ familiarity and reputation to convince employees to provide their login credentials. Most common among the 265 brands impersonated in these attacks were social networks and Microsoft products.

“The vast majority of cybercrime today is successful because it exploits the people behind the keyboard,” said Crane Hassold, director of threat intelligence at Abnormal Security.

“By compromising people rather than networks, it’s easier for attackers to circumvent conventional security measures. This is especially true with brand impersonation, where attackers use urgency and fear to encourage their targets to provide usernames and passwords.”

LinkedIn took the top spot for brand impersonation, but Outlook, OneDrive and Microsoft 365 appeared in 20% of all attacks. What makes these attacks particularly dangerous is that phishing emails are often the first step to compromising employee email accounts. Acquiring Microsoft credentials enables cybercriminals to access the full suite of connected products, allowing them to view sensitive data and use the account to send business email compromise attacks.
• Over a third of credential phishing attacks involving brand impersonation targeted educational institutions and religious organizations.
• There was a 150% year-over-year increase in BEC attacks, showcasing the increased threat of these most financially-damaging attacks.
• BEC attacks target every industry, but advertising and marketing agencies remain the most at risk with an 83% chance of receiving a BEC attack each week.
• Financial supply chain compromise is continuing at a steady pace and targeting nearly every size organization, with 89% of large enterprises receiving at least one vendor attack each week.

“We know that email attacks target organizations of all sizes across all industries, but this data continues to reiterate that point. Brand impersonation is particularly worrisome for cybersecurity leaders, since the most sophisticated attacks are incredibly difficult to differentiate from a legitimate email from that brand,” stated Mike Britton, CISO at Abnormal Security.

“As we see this trend continue to increase across the threat landscape, organizations should look to add security solutions that can detect these attacks, even when they come from legitimate domains and use never-before-seen links.”

Credential phishing attacks skyrocketing, 265 brands impersonated in H1 2022

In Q2 2022, Kroll observed a 90% increase in the number of healthcare organizations targeted in comparison with Q1 2022.

The number of healthcare businesses targeted by ransomware has risen to its highest level, according to a report by cybersecurity firm Kroll.

Het aantal bedrijven in de gezondheidszorg dat het doelwit is geworden van ransomware is tot het hoogste niveau gestegen, zo blijkt uit een rapport van cyberbeveiligingsbedrijf Kroll.

While phishing continued to be the vector used for initial access, there was a vast increase in external remote services (such as VPNs and RDP environments) being compromised, up 700%. • 90% increase in number of healthcare organizations targeted compared to Q1, 2022• Ransomware incident most likely to begin by an external remote service being compromised in Q2• External remote services as an initial access method for attackers was up 800%, and CVEs were exploited 70% more for initial access in Q2• Conti was associated with only 18% of attacks in Q2 compared with 20% in Q1 and 35% in Q4, while Black Basta rose from 0 to 13% of all incidents in this quarter alone. Ransomware is always disruptive, but its ability to grind company operations to a halt, becomes more significant in an environment where business continuity means saving lives.

Ransomware droeg bij aan deze opleving tegen de gezondheidszorg, aangezien de aanvallen dit kwartaal toenamen en opnieuw de grootste bedreiging vormden, op de voet gevolgd door het compromitteren van e-mail. Hoewel phishing nog steeds de vector was die voor de eerste toegang werd gebruikt, was er een enorme toename van het aantal gecompromitteerde externe diensten (zoals VPN's en RDP-omgevingen), met 700%. Dit wijst op een groeiende kwetsbaarheid in de afgelegen omgevingen waarop velen van ons nu vertrouwen.

In Q2 2022, Kroll observed a 90% increase in the number of healthcare organizations targeted in comparison with Q1 2022, dropping the final nail in the coffin for the “truce” some criminal groups instituted earlier in the COVID-19 pandemic. Ransomware helped to fuel this uptick against healthcare as attacks increased this quarter to once again became the top threat, followed closely by email compromise.

While phishing continued to be the vector used for initial access, there was a vast increase in external remote services (such as VPNs and RDP environments) being compromised, up 700%. This indicates a growing vulnerability in the remote environments many of us now rely on.
• 90% increase in number of healthcare organizations targeted compared to Q1, 2022
• Ransomware incident most likely to begin by an external remote service being compromised in Q2
• External remote services as an initial access method for attackers was up 800%, and CVEs were exploited 70% more for initial access in Q2
• Conti was associated with only 18% of attacks in Q2 compared with 20% in Q1 and 35% in Q4, while Black Basta rose from 0 to 13% of all incidents in this quarter alone.

Laurie Iacono, Associate Managing Director for Cyber Risk at Kroll said: “It is concerning to see healthcare rise so dramatically up the most targeted industry list, at a time when services are undoubtedly still under pressure as they recover from the strained environment caused by COVID-19. Ransomware is always disruptive, but its ability to grind company operations to a halt, becomes more significant in an environment where business continuity means saving lives.

“The legacy of the pandemic can perhaps also be seen in the vulnerability of external remote services. In Q2, we saw many ransomware groups take advantage of remote environments by using security gaps in those tools to compromise networks. All organizations – and especially those in healthcare – would do well to test the resilience of their external remote services and preparedness for ransomware in light of this latest report.”



 Daily Newsletter - E-mail sent every business day with a recap of the last 24 hours Weekly Newsletter - E-mail sent every Monday with a recap of the last 7 days (IN)SECURE Magazine - E-mail sent when a new issue is released I have read and agree to the terms & conditions

Ransomware is back, healthcare sector most targeted

As Microsoft has begun disabling macros by default, hackers have already found alternatives. Here's how to protect your organization.

Microsoft has been accused of exploiting a growing number of email threats, according to researchers at proofpoint.

Microsoft is beschuldigd van het uitbuiten van een groeiend aantal e-mailbedreigingen, aldus onderzoekers van proofpoint.

Hackers have been exploiting macros in Microsoft Office products for years, but now their tactics are changing as Microsoft has begun blocking macros by default. Such documents are common in enterprises, and the Microsoft Office suite is widely used. Macros remove the hassle of writing VBA or XL4 code, which would likely take more time and effort.

Hackers maken al jaren misbruik van macro's in Microsoft Office-producten, maar hun tactiek verandert nu Microsoft is begonnen macro's standaard te blokkeren. Gevorderde gebruikers kunnen een subset van de commando's gebruiken die beschikbaar zijn in een specifieke taal, zoals XL4 (Excel) of VBA (Visual Basic for Applications). Macro's maken het schrijven van VBA- of XL4-code overbodig, wat waarschijnlijk meer tijd en moeite zou kosten.

Hackers have been exploiting macros in Microsoft Office products for years, but now their tactics are changing as Microsoft has begun blocking macros by default.

The typical attack scenario involves phishing via email attachments, such as Word, Excel or PowerPoint documents containing malicious macros infected with malware.

Such documents are common in enterprises, and the Microsoft Office suite is widely used. Macros are meant to add functionality and handle some tasks automatically. The problem is that behind the scenes macros execute code, and that’s an opportunity for hackers.

Advanced users can employ a subset of the commands available in a specific language, such as XL4 (Excel) or VBA (Visual Basic for Applications). Macros remove the hassle of writing VBA or XL4 code, which would likely take more time and effort. However, hackers can use them to embed malicious code.

If they manage to make legitimate users execute their instructions, the victims unwittingly become their partners in crime. It’s not uncommon for hackers to use this approach to start unauthorized sessions and deploy ransomware.

Microsoft is now blocking macros by default, so users have to take steps to enable those macros in documents they trust. It’s not the first time Microsoft has attempted such a change; previous attempts were rolled back due to negative user feedback. Nevertheless, threat actors are already moving to alternative approaches.

According to Proofpoint, “threat actors are adapting to a post-macro world.” The company has observed a “significant decrease in macro-enabled documents leveraged as attachments in email-based threats,” as shown below:



Proofpoint researchers said Microsoft uses a MOTW (Mark Of The Web) attribute to block VBA macros by default.

If a document contains macros, Microsoft will display the following alert:



The MOTW attribute is added by Windows to files that come from an untrusted location, like browser downloads or email attachments. It works, but hackers can use compression formats like .zip, .rar or .iso files to bypass security checks.

If the compressed file has the MOTW attribute but not the file inside, users can decompress and open infected documents without raising any alert.

Attackers may include deceptive instructions in their mail or even call the victims to trick them into enabling macros. The compressed archives can also be used to deliver payloads such as LNKs (Shell Link shortcuts), DLLs (dynamic link libraries), or .exe files directly.

In addition, MOTW is an NTFS feature and does not apply to NTFS alternatives such as FAT, which is the older version of the file system in Windows but is also supported by all versions.

Many drives are formatted with this old format. Everything that is mounted or extracted from such drives would likely be treated as local files without protection.

Proofpoint researchers concluded “this is one of the largest email threat landscape shifts in recent history,” and hackers will continue to use container formats to bypass Microsoft macro security.

Active protection on all endpoints is strongly recommended to detect unusual behaviors and suspicious processes early. These phishing attacks have been largely underestimated for years and frequently used in ransomware attacks.

The shift in initial access does not mean Microsoft’s change is completely ineffective. Everything that can restrict unwanted code execution in the background is a step in the right direction. However, it’s certainly not sufficient in the current threat landscape.

See the best Endpoint Detection & Response (EDR) Solutions

CVE-2022-0828: Wordpress plugin kwetsbaarheid

Vergelijkbare publicaties

Waarom het tijd is om cyberbeveiliging te operationaliseren

Hoe beheert u het snijvlak van Java, beveiliging en DevOps tegen lage complexiteitskosten

De gevaren van interne communicatie aanpakken: Wat kunnen bedrijven doen?

Aanvallen via credential phishing rijzen de pan uit, 265 merken geïmiteerd in H1 2022

Ransomware is terug, gezondheidszorg sector meest doelwit

Hackers vinden alternatieven voor Microsoft Office Macro's

Gevonden topics

De beste cyberbeveiligingsbanen in het VK volgens de gegevens

Cloudflare kondigt nieuwe beveiligingstools aan voor e-mail, toepassingen, API's | SecurityWeek.Com

Wie is de netwerktoegangsmakelaar 'Wazawaka'? - Krebs on Security