De Amerikaanse wederverkoper Insight Enterprises heeft de overname afgerond van Hanu Software Solutions (Hanu). Dit van oorsprong Indiase bedrijf is gespecialiseerd in Microsoft Azure-cloud-opossingen.

An Indian company has been bought by a US firm that specialises in cloud services.

Een Indiaas bedrijf is opgekocht door een Amerikaanse onderneming die gespecialiseerd is in clouddiensten.

Dit van oorsprong Indiase bedrijf is gespecialiseerd in Microsoft Azure-cloud-opossingen. Hanu Software Solutions is een zogeheten Microsoft Azure Expert Managed Services Provider. Volgens beide bedrijven blijft de vraag naar cloudoplossingen toenemen, in het bijzonder naar die van Microsoft.

This originally Indian company specializes in Microsoft Azure cloud solutions. Hanu Software Solutions is a so-called Microsoft Azure Expert Managed Services Provider. According to both companies, demand for cloud solutions continues to grow, particularly those from Microsoft.

De Amerikaanse wederverkoper Insight Enterprises heeft de overname afgerond van Hanu Software Solutions (Hanu). Dit van oorsprong Indiase bedrijf is gespecialiseerd in Microsoft Azure-cloud-opossingen.

Hanu Software Solutions is een zogeheten Microsoft Azure Expert Managed Services Provider. Het bedrijf implementeert en beheert cloudoplossingen en versterkt het cloudaanbod van Insight wereldwijd, inclusief Europa. Volgens beide bedrijven blijft de vraag naar cloudoplossingen toenemen, in het bijzonder naar die van Microsoft. 



 Hoewel het hoofdkantoor tegenwoordig in de Verenigde Staten (Princeton) staat, beschikt het twintig jaar oude Hanu in India over diverse vestigingen, veelal technologie- en servicecentra.

Insight neemt Hanu Software Solutions over

Konami has announced that the Teenage Mutant Ninja Turtles: Cowabunga Collection will launch on August 30 for consoles and PC.

The Cowabunga collection is launching on August 30.

De Cowabunga collectie wordt op 30 augustus gelanceerd.

We’ve already had the beat-em-up Shredder’s Revenge, and now Konami has announced that the Cowabunga Collection launches on August 30. The Cowabunga Collection is, as the name suggests, a collection of 13 previously released TMNT titles. Here’s the complete list of games on the collection’s Steam page:Konami first revealed the collection at during a PlayStation State of Play show earlier this year.

We hebben de beat-em-up Shredder's Revenge al gehad, en nu heeft Konami aangekondigd dat de Cowabunga Collection op 30 augustus lanceert. De Cowabunga Collection is, zoals de naam al zegt, een verzameling van 13 eerder uitgebrachte TMNT titels. Hier is de volledige lijst van games op de Steam-pagina van de collectie:Konami onthulde de collectie voor het eerst tijdens een PlayStation State of Play show eerder dit jaar.

2022 is the year of the turtle, apparently. We’ve already had the beat-em-up Shredder’s Revenge, and now Konami has announced that the Cowabunga Collection launches on August 30.

The Cowabunga Collection is, as the name suggests, a collection of 13 previously released TMNT titles. The selection includes games from the franchise’s 8-bit and 16-bit era, from arcades and four different consoles. Here’s the complete list of games on the collection’s Steam page:

Konami first revealed the collection at during a PlayStation State of Play show earlier this year. However, the game is launching on all consoles, including Xbox Series X/S, Xbox One, Switch, PS5 and PS4. It’s also launching on PC via Steam.

GamesBeat's creed when covering the game industry is "where passion meets business." What does this mean? We want to tell you how the news matters to you -- not just as a decision-maker at a game studio, but also as a fan of games. Whether you read our articles, listen to our podcasts, or watch our videos, GamesBeat will help you learn about the industry and enjoy engaging with it. Learn more about membership.

TMNT: The Cowabunga Collection launches on Aug 30

Cyber insurance providers wants policyholders to increase their cyber resilience. A thorough incident response strategy that leverages digital forensics can help enterprises ensure they have the means to protect themselves even after an attack has occurred.

Cyber insurers are increasing their ability to protect themselves from cyber attacks, according to a new study.

Cyberverzekeraars zijn volgens een nieuwe studie steeds beter in staat om zich tegen cyberaanvallen te beschermen.

In 2021, most enterprises discovered that there is a heavy cost to protect their most valuable digital assets, especially during an historic rise in cybercrime. They felt the effects of the rise in cybercrime in their cyber insurance premiums. Enterprises have never been more at risk of suffering cyber attacks and when they do, the damages have never been higher.

In 2021 ontdekten de meeste ondernemingen dat er hoge kosten verbonden zijn aan de bescherming van hun meest waardevolle digitale activa, vooral tijdens een historische stijging van de cybercriminaliteit. Colonial Pipeline, CNA Financial Group en JBS Foods hebben het aan den lijve ondervonden toen hun systemen met ransomware werden besmet en zij samen 55 miljoen dollar betaalden om hun gegevens weer in handen te krijgen. De gemiddelde losgeldeis aan zijn polishouders is in de eerste helft van 2021 met bijna 170 procent gestegen tot 1,2 miljoen dollar.

In 2021, most enterprises discovered that there is a heavy cost to protect their most valuable digital assets, especially during an historic rise in cybercrime. There are those such as Colonial Pipeline, CNA Financial Group and JBS Foods that found out first-hand when their systems were infected with ransomware and they paid a combined $55 million to regain control of their data. Those who didn’t suffer devastating cyber attacks didn’t go unscathed. They felt the effects of the rise in cybercrime in their cyber insurance premiums.

Enterprises have never been more at risk of suffering cyber attacks and when they do, the damages have never been higher. According to cyber insurance provider Coalition, claims have skyrocketed for enterprises in multiple sectors, including IT at 46 percent, materials at 99 percent and industrials at 263 percent. The average ransom demand made to its policyholders, meanwhile, increased by almost 170 percent to $1.2 million in the first half of 2021.

With their policyholders under great threat, cyber insurers are at equal risk of having to provide them with significant payouts to cover damages linked to cyber incidents. They’ve mitigated this risk by raising the price of cover. In the U.S., cyber insurers raised their pricing by 130 percent in the fourth quarter of 2021 alone, according to insurance provider Marsh. They’ve also demanded that their policyholders do more on cybersecurity to even qualify for coverage. For enterprises looking to increase their cyber resilience to qualify for coverage or to lower their premiums, the answer may lie in digital forensics and incident response.

No preventative cybersecurity measures are capable of stopping 100 percent of the attacks they face. When a cyber attack does eventually succeed, enterprises need to be prepared to respond to it. The actions they take after a cyber attack are just as important to their protection as the actions they take in advance of one.

Digital forensics and incident response tools give enterprises a vehicle to respond to cyber attacks by investigating them. After a ransomware attack, analysts use the technology to trace a cybercriminal’s steps and determine how they gained access, how many endpoints were compromised and what files they encrypted and exfiltrated. The same can be said for business email compromises, where a tried and tested incident response plan that leans on digital forensics can quickly verify that a payment took place and collect the necessary evidence to reverse it. When it comes to insider attacks, the same methods can be used to identify employees misappropriating data. With this information in hand, enterprises can stop further damage from occurring and begin recovery.

Digital forensics and incident response technologies are now essential to the modern cybersecurity toolkit. The National Institute of Standards and Technology’s cybersecurity framework, which provides security teams with best practices, lists digital forensics as a key action that takes place during the “respond” phase. Cyber insurers recognize the NIST cybersecurity framework and some of them use it to assess the maturity of cybersecurity strategies.

This is in line with what has emerged as an industry trend: Cyber insurers are asking applicants and policyholders to increase their own cyber resilience in response to the increased threat level. In the U.S., some of these decisions have come in response to cybersecurity policy actions taken by the Biden administration to introduce minimum cybersecurity standards for federal agencies.

Most cyber insurers followed suit and also mandated their current and prospective policyholders have minimum security standards in place. U.K.-based cyber insurer Griffiths & Armour, for example, lists advanced endpoint detection and response protection, incident response plans and security incident and event management systems among the list of necessary controls insurers may ask for before offering coverage. “For some insurers non-compliance with the above can result in them declining to provide any level of cover,” the firm warns. Marsh, meanwhile, has mandated endpoint detection and response technology and lists incident response planning and testing, in which digital forensics is a key element, as one of seven controls that will weigh heavily on the firm’s decision to accept a new client.

Throughout the application and renewal process, cyber insurers evaluate potential customers based on their internal and external cybersecurity capabilities. This is regularly done through the use of surveys that pose a variety of cybersecurity questions to applicants and assess the risk of insuring them.

How are incidents reported? Do you have an incident response policy? Do you have a dedicated digital forensics and incident response team or do you have a third party on retainer? Answer incorrectly and the cost of coverage may soar, if you’re even offered coverage in the first place.

Some enterprises keep an external digital forensics and incident response firm on retainer, while others may have a small internal team. What cyber insurers prefer is the most risk-averse option: A combination of the two.

For cyber insurers, an enterprise that solely relies on an external party for its digital forensics and incident response functionality still carries significant risk because of the potential payouts. Third-party digital forensics and incident response firms bring valuable expertise, specialized services and products to the table, but it comes at a cost that cyber insurers know they’ll need to cover. Third-party service providers often charge hundreds of dollars per hour and per endpoint they need to examine. Responding to a ransomware attack, for example, might require analysts to examine dozens of endpoints over multiple weeks. The costs for these services alone could easily surpass $100,000. Cyber insurers account for this risk with higher premiums.

Having an internal team significantly decreases the risk of large payouts to cover digital forensics and incident response costs. With an internal team to respond to cyber incidents, enterprises no longer need to refer every cyber investigation to a third-party and rack up costs that will need to be covered by cyber insurers. That doesn’t mean cyber insurers want enterprises to discard external firms altogether.

The reason a combination of the two is the most optimal option is because internal digital forensics and incident response teams are small. According to a study published by Magnet Forensics and IDC, the average digital forensics and incident response team at an enterprise with 1,000 to 2,499 employees has four members. Companies with 5,000 to 9,999 employees only have an average of eight. A ransomware attack can be too much for teams of this size to handle. Being able to call on external reinforcements lowers the risk for both an enterprise and a cyber insurer and that should be reflected in premiums.

In an incredibly high-risk environment, cyber insurers are within their legal rights to deny coverage or offer less for higher premiums to enterprises that have not acted to do more on cybersecurity. A thorough incident response strategy that leverages digital forensics can help enterprises ensure they have the means to protect themselves even after an attack has occurred. It ensures they have the necessary cyber resilience to operate in this new risk environment and plays a key role in determining whether enterprises can earn coverage, maintain it and do so at a reasonable cost.

Your Digital Forensics and Incident Response Capabilities — Or Lack Thereof — May Be Weighing on Your Cyber Insurance Premiums

Accountants- en adviesorganisatie Mazars raadt zakelijke klanten aan om met Russische software, zoals die van Kaspersky te stoppen, en die door alternatieven te te vervangen. ...

The use of Russian security software is "playing with fire".

Het gebruik van Russische beveiligingssoftware is "spelen met vuur".

Accountants- en adviesorganisatie Mazars raadt zakelijke klanten aan om met Russische software, zoals die van Kaspersky te stoppen, en die door alternatieven te te vervangen. Mazars, steeds meer actief op gebied van digitale transformatie en it-consultancy alsmede it-audit, stuurt haar klanten vandaag hierover een dringend advies. Mazars, met kantoren in Nederland en België, wijst met name op de gevaren van Kaspersky's veiligheidsoplossingen die veel bedrijven gebruiken.

Mazars, increasingly active in the fields of digital transformation and it consulting as well as it auditing, is sending its clients urgent advice on this today. Mazars, with offices in the Netherlands and Belgium, particularly points out the dangers of Kaspersky's security solutions that many companies use. 'You don't know what's in it,' warns Jan Matto, partner IT Audit & Advisory at Mazars Netherlands.

Accountants- en adviesorganisatie Mazars raadt zakelijke klanten aan om met Russische software, zoals die van Kaspersky te stoppen, en die door alternatieven te te vervangen. Mazars, steeds meer actief op gebied van digitale transformatie en it-consultancy alsmede it-audit, stuurt haar klanten vandaag hierover een dringend advies.

Mazars, met kantoren in Nederland en België, wijst met name op de gevaren van Kaspersky's veiligheidsoplossingen die veel bedrijven gebruiken. ‘Je weet niet wat er in zit,’ waarschuwt Jan Matto, partner IT Audit & Advisory bij Mazars Nederland. Vooral updates moeten worden gewantrouwd. ‘Wat krijg je daarmee binnen? ‘Je kunt momenteel niets vertrouwen.’ Hij noemt het gebruik van Russische software ‘spelen met vuur’.



 Kaspersky claimt weliswaar de broncode van haar beveiligingsoplossingen openbaar te maken, maar het is bijna ondoenlijk daarin zwakheden te ontdekken. Bovendien hangt de software aan internet. Juist de connecties die daarachter zitten, maken het gebruik ervan gevaarlijk. Als de software verbinding maakt met een foute server, is het kwaad volgens Matto snel geschied. Ook is de kans groot dat software van derden door statelijke actoren wordt geïnfecteerd. 'In het verleden hebben we daar meerdere voorbeelden van gezien.'

Verder raadt hij klanten die (nog) zaken doen met Rusland en niet snel kunnen stoppen, hun systemen te segmenteren. Het is verstandig deze systemen apart te zetten. Niet alleen Russische (staats)hackers vormen een bedreiging, maar ook allerlei activistische bewegingen die partij kiezen. Matto: ‘Het is heel onrustig. Je kunt erop wachten dat het een keer mis gaat.’

Eerder waarschuwde de Duitse overheidsinstantie BSI voor de Russische (anti-virus)software. De ‘Duitse NCSC’ acht het mogelijk dat Kaspersky tegen zijn wil wordt gedwongen om doelsystemen aan te vallen. Ook bestaat de kans dat het bedrijf wordt gebruikt als instrument voor aanvallen op zijn eigen klanten.

Kaspersky ziet achter de oproep van BSI politieke motieven. ‘Het besluit is niet gebaseerd op een technische beoordeling van Kaspersky-producten,’ zo meent het bedrijf uit Moskou. Kaspersky biedt BSI en andere regelgevers aan samen middelen te vinden om de zorgen weg te nemen.

Overigens is in Duitsland Deutsche Telekom onder vuur komen te liggen over het Rusland-beleid. De zakenkrant Handelsblatt zet vraagtekens achter het feit dat dochter T-Systems in St. Petersburg tweeduizend ontwikkelaars laat werken aan software die infrastructuur van T-Mobile ondersteunt. 



Een woordvoerder van T-Mobile in Nederland ontkent desgevraagd dat ook Nederlandse projecten hierbij zijn betrokken. ‘Het klopt dat T-Systems, onderdeel van Deutsche Telekom, softwareontwikkelaars in St. Petersburg heeft. Er is echter in deze geen connectie tussen T-Systems en T-Mobile Nederland. De medewerkers van T-Systems ontwikkelen geen software ter ondersteuning van de it-infrastructuur voor T-Mobile en glasvezelprojecten in Nederland. De dienstverlening uit St. Petersburg is stopgezet, en overgenomen door andere ontwikkelteams in Europa,’ verklaart het bedrijf.

Mazars adviseert met Kaspersky te stoppen

The Record by Recorded Future gives exclusive, behind-the-scenes access to leaders, policymakers, researchers, and the shadows of the cyber underground.

Twilio has said it is investigating a cyber-attack on its mobile phone service.

Twilio heeft gezegd dat het een cyberaanval op zijn mobiele telefoondienst onderzoekt.

A successful phishing campaign earlier this month targeting Twilio, which allows users to register cheap digital phone numbers, had fallout for Signal users, the encrypted messenger service said Monday. Around 1,900 Signal users either had their linked phone numbers exposed, or had the text message verification code used to register with Signal revealed, the service wrote in a blog post. The attackers also explicitly queried Twilio’s systems for three of the 1,900 numbers, according to Signal.

Een succesvolle phishing-campagne eerder deze maand gericht op Twilio, waarmee gebruikers goedkope digitale telefoonnummers kunnen registreren, had gevolgen voor Signal-gebruikers, zei de gecodeerde messenger-dienst maandag. Terwijl de aanval actief was, kon de Twilio-infiltrant proberen om de Signal-account opnieuw te registreren op een ander toestel, en in één bevestigd geval deed hij dat met succes. Signal raadde gebruikers ook aan een PIN-code in te stellen voor hun accounts en het registratieslot in te schakelen, een functie die een PIN-code vereist voordat een nummer opnieuw kan worden geregistreerd bij de dienst.

A successful phishing campaign earlier this month targeting Twilio, which allows users to register cheap digital phone numbers, had fallout for Signal users, the encrypted messenger service said Monday. The attack highlights the ripple effect attacks on digital service providers can have on the security of other platforms — including those relied on for that very security.



Around 1,900 Signal users either had their linked phone numbers exposed, or had the text message verification code used to register with Signal revealed, the service wrote in a blog post. The attackers also explicitly queried Twilio’s systems for three of the 1,900 numbers, according to Signal.



While the attack was active, the Twilio infiltrator could attempt to re-register the Signal account to a different device, and in one confirmed instance did so successfully.



Although an attacker re-registering would not gain users’ access to message history or contact lists, “they could send and receive messages from that phone number on Signal.”



“For all 1,900 of the users potentially affected, we will unregister Signal on all devices that the user is currently using (or, that an attacker registered them to) and require them to re-register Signal with their phone number on their preferred device,” the company wrote.



The messenger service said it is directly notifying all affected via text message. 



Signal also recommended users set a PIN for their accounts and turn on registration lock, a feature which requires a PIN before a number can be re-registered with the service.



“The kind of telecom attack suffered by Twilio is a vulnerability that Signal developed features like registration lock and Signal PINs to protect against,” the service wrote. “While we don’t have the ability to directly fix the issues affecting the telecom ecosystem, we will be working with Twilio and potentially other providers to tighten up their security where it matters for our users.”



Signal accounts are tied to phone numbers, but using a number from a service like Twilio is one way for users to register and have access to the end-to-end encryption offered by the app without using a personal phone number.



This workaround has sometimes been recommended as an added safety step to at-risk groups, including journalists — who often rely on encrypted communication channels to connect with sensitive sources, but are also frequently the target of sophisticated digital surveillance.



Twilio reported last week that it discovered an attacker used a text-based phishing campaign to gain access to its customer support console. In an update Wednesday, it reported that the company had “identified approximately 125 Twilio customers whose data was accessed by malicious actors for a limited period of time” and had notified them of the breach.



“Twilio generally does not comment on specific customer situations. However, with respect to the matter disclosed by Signal, we are aware of it and take any potential incident involving the protection of our customers’ information seriously,” Twilio Director of Corporate Communications Cris Paden told The Record. “We have been in close contact with Signal and are working together with them to aid their investigation.”

Twilio breach exposed some Signal users’ numbers

The new packages were masquerading as one of the most popular open-source packages on PyPI

A security team has revealed a new batch of malicious packages that could trick victims into installing malware.

Een beveiligingsteam heeft een nieuwe reeks schadelijke pakketten onthuld die slachtoffers ertoe kunnen verleiden malware te installeren.

Two more malicious Python packages have been discovered in the Python Package Index (PyPI) repository, days after security researchers from Check Point spotted 10 of them. The two additional packages were also found, this time by Kaspersky, who posted an advisory describing them on their blog. According to the security team, both new packages were masquerading as one of the most popular open-source packages on PyPI.

Er zijn nog twee kwaadaardige Python-pakketten ontdekt in de Python Package Index (PyPI) repository, dagen nadat beveiligingsonderzoekers van Check Point er 10 hadden gespot. De twee extra pakketten werden ook gevonden, deze keer door Kaspersky, die een advisory op hun blog plaatste waarin ze werden beschreven. Volgens het beveiligingsteam waren beide nieuwe pakketten vermomd als een van de meest populaire open source pakketten op PyPI.

Two more malicious Python packages have been discovered in the Python Package Index (PyPI) repository, days after security researchers from Check Point spotted 10 of them.

The two additional packages were also found, this time by Kaspersky, who posted an advisory describing them on their blog.

According to the security team, both new packages were masquerading as one of the most popular open-source packages on PyPI.

“The attacker used a description of the legitimate ‘requests’ package in order to trick victims into installing a malicious one,” wrote Kaspersky.

Additionally, the description contained faked statistics, suggesting the package was installed 230 million times in a month and had more than 48,000 “stars” on GitHub.

“The project description also references the web pages of the original 'requests' package, as well as the author’s email,” Kaspersky said. “All mentions of the legitimate package’s name have been replaced with the name of the malicious one.”

The code of the malicious packages was also extremely similar to the code of the legitimate ‘requests’ package, except for one file called exception.py.

The modified version of the script (dated July 30, the date of publication of the malicious package), was responsible for delivering a malicious payload.

“The script writes another Python one-liner script into a temporary file and then runs that file via the system.start() function. Then that one-liner script downloads the next-stage script,” Kaspersky explained.

The next stage of the attack would then rely on a downloader obfuscated with a publicly available tool named Hyperion, which would deploy the final stage payload featuring a script allowing it to achieve persistence on the infected machine.

The final payload, dubbed “W4SP Stealer” by its author in the code, is a Trojan written in Python and obfuscated with the same obfuscator as the downloader.

The malware can steal IP addresses, and work with cryptography for decrypting cookies and passwords from browsers. After initial infection, the Trojan starts collecting Discord tokens, saved cookies and passwords from browsers in separate threads.

“The injected script monitors the victim’s actions such, as changing their email address, password or billing information. The updated information is also sent to the Discord channel,” read the advisory.

Kaspersky ended the document by confirming it reported the two packages to both the PyPI security team and Snyk Vulnerability Database.

The discovery of the malicious packages comes weeks after PyPI announced it would start enforcing a mandatory two-factor authentication (2FA) policy for projects categorized as “critical.”

Two Additional Malicious Python Libraries Found on PyPI Repository

Best 7 cyber security tools for threat hunters. The tools can be used for threat detection and response, threat hunting and more.

Cyber security is one of the biggest challenges of our time.

Cyberbeveiliging is een van de grootste uitdagingen van onze tijd.

This overview will highlight some of the best cyber security tools for threat hunters and anyone that works in the cyber security industry. In most cases, cyber security tools should speed up the process of performing:I have included the tools which I use myself. It is impossible to list all of the cyber security tools in the world, but I hope that this selection will help you forward.

De genoemde cyberbeveiligingsinstrumenten hebben eenvoudig te gebruiken dashboards, en de meeste ondersteunen API-toegang. In dit overzicht worden enkele van de beste cyberbeveiligingstools belicht voor threat hunters en iedereen die werkzaam is in de cyberbeveiligingsindustrie. In de meeste gevallen moeten cyberbeveiligingsinstrumenten het proces van uitvoering versnellen:Ik heb de hulpmiddelen opgenomen die ik zelf gebruik.

Cyber security demands that you remain on top, and by good fortune, there are some good cyber security tools which I will list down for you to try out. The mentioned cyber security tools have easy-to-use dashboards, and most of them support API access.

This overview will highlight some of the best cyber security tools for threat hunters and anyone that works in the cyber security industry.

In most cases, cyber security tools should speed up the process of performing:

I have included the tools which I use myself. I like the accessability of these tools and the fact that API requests is supported. This means that I can automate a lot of tasks and I can quickly get the info I want via these cyber security tools. It is impossible to list all of the cyber security tools in the world, but I hope that this selection will help you forward.

The Shodan.io search engine is a very powerful cyber security tool. It allows you to hunt with their massive list of available queries. You can quickly identify Cobalt Strike C2 servers, vulnerable systems, open directories and a lot more. In the best case, you can use Shodan to hunt and to monitor your IT infrastructure.

This is one of the biggest online malware repositories that you can find. Virustotal allows anyone to utilize the 50+ antivirus engines which they have included in their (malware) sandbox system. You can search for hashes, domains and URLs, and if there is a report available, you will get a lot of details that can help you to perform cyber security steps such as:

This online community by Alienvault shares details (pulses) on cyber attacks, these pulses contain IOC information and references to blogs and articles which discuss malware and cyber attacks. Alienvault is free to use and the community also allows API access.

SNORT is a powerful intrusion prevention system (IPS). Once it is configured and used correctly SNORT can become part of your cyber security process. SNORT is open-source and the community behind it is very active. SNORT can detect various types of attacks, it works on any platform and is often used to perform real-time network traffic analysis. This is yet another great cyber security tool which has proven itself over the years.

Cyber security tools enable the usage of various checksums such as SHA1, SHA256, MMH3 and MD5. This tool focuses on getting the MMH3 checksum of Favicons.

Once the MMH3 favicon checksum has been found, the checksum can be used by cyber security engineers and threat hunters to create detection signatures and hunting signatures. For example, it can be used to find websites which are using the same Favicon.

TinEye allows anyone to search the web for an picture. Using TinEye to identify phishing attacks or fake profiles is a use-case. It has been created to try out different methods and techniques to identify matching images on the web, the counterpart is Google Image Search. The TinEye API is well documented and you can include it in any of your programs.

MXtoolbox is one of those sites that just won’t go away (thankfully). They provide a list of tools which allows anyone to perform active look-ups. The site has a tool that allows blacklist check-ups on IP addresses and domains, this allows any cyber security analyst to perform a quick external blacklist check.

The queries you can perform on MXtoolbox;

Wireshark will come back in any list that you will find online. This network traffic analysis tool allows quick access to captured (or streaming) network data, it makes the data visible to the eye and it allows the user to create filters (these can be signature to detect malware).

A lot of XDR solutions and cyber security monitoring tools actually store network data in the form of a PCAP. These PCAP’s can be opened by Wireshark, so yes, this tool is a must have in any arsenal.

I cannot forget to include Kali Linux, this operating system contains hundreds of cyber security tools, and most of them are already pre-installed. Kali Linux is used globally and it can be customized very easily to fit your needs. The tools included in Kali Linux are simple to use, and they only need an update for the first time use.

Metasploit has a collection of penetration tools that are used globally by cyber security experts to manage security evaluations and discover vulnerabilities. It is used to evaluate the security condition of infrastructures and it can be used during penetrations tests to perform some steps of the cyber kill chain.

AIL is a modular framework made by CIRCL for analyzing potential information leaks from unstructured data sources. This means that you can add any feed or source and stream it towards AIL.The AIL framework is flexible and can be extended to other uses.

Cybersecurity is an ongoing task: you must constantly scan for threats, check for vulnerabilities in your network, and take corrective action. A proactive approach where you use the right cyber security tools to simulate attacks, patch vulnerabilities to prevent (network) breaches and quickly identify a will help you stay on top and move faster on threats.

Cyber security can be challenging, and the right tools and expertise can help you to configure your environment or task to be performed correctly, done right, it can completely change the way you do cyber security.

9 best cyber security tools for threat hunters

Don't worry, elections are safe. Our Security Researcher Cameron Camp is right there at the DEF CON 30, to provide us highlights from the conference.

In our series of letters from African journalists, novelist and columnist Adaobi Tricia Nwaubani looks at what happens in the US presidential election.

In onze serie brieven van Afrikaanse journalisten kijkt romanschrijfster en columniste Adaobi Tricia Nwaubani naar wat er gebeurt bij de Amerikaanse presidentsverkiezingen.

Scattered around a bevy of tables in the election hacking village here at DEF CON 30 are all the devices – opened wide – that are supposed to keep elections safe. Luckily, they contain a myriad of tamper-resistant defenses, but from the looks of the tables, none of that has stopped, or hardly slowedracking them open to take a look. During the last US presidential election cycle, even the of foul play was enough to attract lawsuits.

Verspreid over een schare tafels in het dorp van de verkiezingshackers hier op DEF CON 30 staan alle apparaten - wijd open - die geacht worden verkiezingen veilig te houden. Gelukkig zijn ze voorzien van een groot aantal anti-manipulatiesystemen, maar aan de tafels te zien heeft dat het openbreken niet tegengehouden, of nauwelijks vertraagd. Fabrikanten van apparatuur hebben zich in het beste geval verzet tegen veiligheidsonderzoekers, en in het slechtste geval een rechtszaak aangespannen.

Scattered around a bevy of tables in the election hacking village here at DEF CON 30 are all the devices – opened wide – that are supposed to keep elections safe. Oh, the irony. It’s unclear how some of these devices ended up here, another unsolved mystery.

Luckily, they contain a myriad of tamper-resistant defenses, but from the looks of the tables, none of that has stopped, or hardly slowedracking them open to take a look.

Since the tamper resistance seems to be about as effective as sticking your hand out the car window is at resisting the wind, how much faith should we put in the digital circuitry inside or the software that runs on it, the real “secure” brains?

Here, equipment manufacturers have been resistant at best to security researchers, litigious at worst. During the last US presidential election cycle, even the of foul play was enough to attract lawsuits. That doesn’t help research.

That sentiment has cooled, if only cautiously, but it’s still unclear how close to a lawsuit you’d be by even asking about the insecurity of some of these machines.

Luckily, similar vendor dynamics have already played out in other realms like the PC, mobile, and cloud. Players in those spaces have long realized it’s better to dialog with researchers than to threaten them. Even at DEF CON, in the car hacking village, there are manufacturers willing to dialog.

Not that DEF CON is really filled with researchers – more like curious hackers-in-training looking at shiny, digital things. But some are also the next generation of defenders, so they can’t all be bad. Some will eventually be making house payments and helping to defend us all, so we need to invest in them, like by bringing a pile of voting machines to a cluster of tables and leaving them unattended, so their warrantees can be horribly violated.

At one village talk the presenter responded to how much an individual vote really matters by saying something like “Look at how hard foreign adversaries are working to change them: they wouldn’t spend that much effort if a vote didn’t matter.” Maybe she’s right in a sort of overarching sense, but a few votes flipped here and there would be devilishly hard to thwart at scale. Speaking of scale, she was here appealing to the community to help her scale the message, in ways not many outside of a DEF CON context know how to do.

Activists reaching out to the community does seem like a good move.

Even if there were perfect security, a shady bet at best, thousands of volunteers litter the backwoods, the cities, and the in-between, operating these machines in a non-perfect manner. Add to this what happens once the votes come in, get tallied and digested by all the machinery, in near real time, to create election results. For instance, it’s rare in election recounts that the results are the same to the number. Errors happen.

The US government has offered a whopping bounty of US$10 million for tips about foreign adversaries meddling with elections, but in nation-state economies, the economic advantage of a favorable trade deal from a swung election would handily eclipse that amount, so it may still be worth it to play.

In the end, the vendors here at DEF CON have to warm up and welcome researchers trying to help, even if aspiring hackers have to acknowledge some sort of “do no harm” statement they have to agree to in order to gaining entrance into the medical hacking village.

That part was useful, since a friend of mine there was able to get root on a medical device in that village. But he’s a Good Guy. That part made the medical device manufacturer much happier, if only cautiously. Once he agreed to disclose everything he did, their relief increased palpably. So, I guess his actions improved their mental health in the end?

DEF CON – “don’t worry, the elections are safe” edition

Zero trust is a great way to approach security, but we need to change the paradigm to prevent threats, instead of just detecting them.

Companies are increasingly struggling to protect themselves from cyber attacks, but what do they do to prevent them?

Bedrijven hebben steeds meer moeite om zich te beschermen tegen cyberaanvallen, maar wat doen ze om ze te voorkomen?

The kind of anxiety depends on the organization, and the solutions for it depend on what cybersecurity company they are talking to: some deal in improving threat response, while others solve specific problems, such as detecting and remediating malware attacks. While awareness and vigilance are not the biggest worry today, the real issue we now face is that all these security companies are focused on dealing with security after the fact, once indicators of compromise have surfaced. By then, the damage is done; the latest annual IBM Cost of a Data Breach report found the cost of a data breach has hit a record $4.35 million on average, and that doesn’t count all the damage to reputation and other intangibles that follows a cyber attack.

Zero Trust is zo wijdverbreid dat het wat van zijn stopkracht heeft verlorenAlleen al uit het aantal cyberbeveiligingsfirma's dat de afgelopen jaren is opgedoken, valt op te maken dat we een moment van verhoogde bezorgdheid doormaken. Bewustmaking en waakzaamheid zijn niet de grootste zorgen van vandaag, maar het echte probleem waarmee we nu worden geconfronteerd, is dat al deze beveiligingsbedrijven zich concentreren op de aanpak van beveiliging achteraf, zodra er indicatoren van een compromis aan het licht zijn gekomen. Tegen die tijd is de schade al aangericht; uit het laatste jaarlijkse IBM-rapport over de kosten van een datalek blijkt dat de kosten van een datalek gemiddeld een recordhoogte van 4,35 miljoen dollar hebben bereikt, en dan hebben we het nog niet eens over alle schade aan de reputatie en andere immateriële zaken die volgt op een cyberaanval.

Zero Trust has become so prevalent that it has lost some of its stopping power

Just based on the number of cybersecurity firms that have popped up in the last few years, it’s not hard to see that we’re having a moment of heightened anxiety. Some organizations are on alert because they know their networks have already been targeted by state-sponsored hackers, others know their executives are being targeted by fraudsters, and yet others are worried about insider threats and intellectual property theft.

The kind of anxiety depends on the organization, and the solutions for it depend on what cybersecurity company they are talking to: some deal in improving threat response, while others solve specific problems, such as detecting and remediating malware attacks.

While awareness and vigilance are not the biggest worry today, the real issue we now face is that all these security companies are focused on dealing with security after the fact, once indicators of compromise have surfaced. By then, the damage is done; the latest annual IBM Cost of a Data Breach report found the cost of a data breach has hit a record $4.35 million on average, and that doesn’t count all the damage to reputation and other intangibles that follows a cyber attack.

So an ounce of prevention is definitely worth a pound of cure when it comes to cybersecurity. Companies need to place a stronger focus on prevention, just as they now dedicate to detection and response. To make a difference in cybersecurity, rather than deal with incidents after they've already happened, defenders need to prevent them; fight the disease, not its symptoms.

Many companies have embraced zero trust architectures as a prevention tool, but zero trust has become so prevalent that it has lost some of its stopping power. Everybody now has a different definition of what zero trust is to their organization, and the bad guys are finding ways around the certificate handshakes and verifications that make it work.

Zero trust has fallen out of the realm of prevention. If your security’s starting point is denying access to everything and working up to the necessary access, things become too hard to manage. You trade off a sense of security for endless configuration and maintenance. It’s like a treatment on an exclusion diet: an endless process of adding one thing at a time until the patient gets sick to identify what the problem is.

Obviously, shutting attackers out is crucial, but how do we make sure that this doesn't happen again? Few security companies or software tools take this proactive approach. That’s the problem with the cybersecurity industry: investors are putting money into a lot of tools that aren't addressing prevention. It’s as if we searched for a cure for cancer by investing in chemotherapy and radiation, instead of researching what actually makes cancer cells mutate.

Most security staff spend their days on watch for alerts, chasing down and patching software vulnerabilities and resetting suspect credentials. We need to free them to become more proactive so they can focus on prevention, at a time when security operations centers (SOCs) are already operating low on staff — due to the shortage of cybersecurity talent.

Since most business and productivity tools used by organizations are now accessed through a web browser, it has become a gateway to the network and a target for bad actors. One technology that’s been around for a while is remote browser isolation, or RBI. It executes web applications in the cloud, so attacks only affect a temporary browsing instance that is terminated once the user closes it. This approach ensures that any malware doesn’t affect a company’s systems, and attackers can’t learn anything about its IT attack surface because they are only able to see the isolated session.

Since RBI is essentially transparent to users, it doesn’t rely on them being hypervigilant or to always make the right security decisions. This also means that security teams can stop spending all their time on user training and making endpoints bulletproof, and can focus on other work to add defense in depth inside the network.

Meanwhile, a stronger emphasis on threat intelligence can feed the prevention focus. We know that threat actors’ are endlessly mutating their tactics and techniques, like aggressive cancers. Knowing what to look for is the first step to heading off attacks before they present in your network.

There are many excellent researchers and research organizations continuously working to identify and publicize threats. Armed with advanced network monitoring tools and algorithms for parsing data, researchers are increasingly producing better and more actionable intelligence about who the bad guys are and how they operate. In addition, they are able to identify the infrastructure belonging to threat actors, sometimes before they even use it. Since this intelligence can be consumed by many security products, it can play an important role in helping organizations proactively head off and mitigate threats.

But mostly, we need to change the way that we think about security. Zero trust is a great way to approach security, but we need to change the paradigm to prevent threats, instead of just detecting them. That’s how we will make much more progress.

The Future of CyberSecurity is Prevention | SecurityWeek.Com

The Cisco network breach was traced back to an employee's personal Google account. It was protected by multi-factor authentication (MFA), but the attacker tried a number of different voice phishing attempts.

Hackers are increasingly trying to steal sensitive data from their employees, according to the BBC’s Chris Stokel-Walker.

Hackers proberen steeds vaker gevoelige gegevens van hun werknemers te stelen, aldus Chris Stokel-Walker van de BBC.

The Cisco network breach was traced back to an employee’s personal Google account that was syncing their company login credentials via Google Chrome. The Google account was protected by multi-factor authentication (MFA), but the attacker tried a number of different voice phishing attempts to bypass it. MFA fatigue is thought to have been a factor as the target eventually accepted one of these requests simply to silence them, kicking off the network breach as the attacker was given access to the Cisco VPN via the user’s account.

De inbraak in het Cisco-netwerk was terug te voeren op de persoonlijke Google-account van een werknemer die zijn bedrijfslogingegevens synchroniseerde via Google Chrome. De Google-account was beveiligd met multifactorauthenticatie (MFA), maar de aanvaller probeerde via een aantal verschillende voice phishing-pogingen deze te omzeilen. Vermoedelijk speelde MFA-moeheid een rol, omdat het doelwit uiteindelijk een van deze verzoeken accepteerde om het zwijgen op te leggen, waardoor de netwerkinbraak begon, aangezien de aanvaller via de account van de gebruiker toegang kreeg tot het Cisco VPN.

A network breach at Cisco that took place in May appears to have stemmed from a compromised employee account. The target was peppered with voice phishing attempts and push notifications until “MFA fatigue” finally caused them to fall victim.

The Cisco network breach was traced back to an employee’s personal Google account that was syncing their company login credentials via Google Chrome. The Google account was protected by multi-factor authentication (MFA), but the attacker tried a number of different voice phishing attempts to bypass it. They reportedly also posed as the technical support departments of legitimate well-known companies and sent a barrage of push requests to the target’s mobile device. MFA fatigue is thought to have been a factor as the target eventually accepted one of these requests simply to silence them, kicking off the network breach as the attacker was given access to the Cisco VPN via the user’s account.

The attacker was reportedly able to escalate privileges once in, but was not able to reach “critical” systems with direct access to Cisco products before they were detected and removed. Cisco reports that the attacker spent weeks after the removal attempting to re-establish access to the network. After Cisco mandated that employees change passwords due to the network breach, the attacker targeted compromised accounts that it believed would make only a simple single-character change to their prior password and also registered several “copycat” domain names that were most likely intended for a phishing campaign. Cisco security noticed these registrations and took action before they could be leveraged.

John Gunn, CEO of Token, observes that it only takes a relatively small chink in the armor such as this to get by some of the world’s most advanced cybersecurity programs: “Even when protected by an army of 4 million IT Security Pros with a combined IT defense spend in excess of $150 billion, we are still seeing devastating hacks that exploit the most basic element of security – user authentication. The industry needs to wake up to the fact that Push Notification is not the panacea it was sold as.”

The attackers appear to have been quite sophisticated not only in their evasion of security after accomplishing the network breach, but in their repeated voice phishing attempts. The target reported receiving calls from several different people claiming to be working with several different well-known companies, all speaking English in a variety of international dialects. Cisco’s Talos Intelligence, the group performing a forensic investigation on the network breach, has identified a known initial access broker (IAB) that has ties to North Korean state-sponsored hackers and several ransomware gangs as the culprit.

The company believes that the Yanluowang ransomware gang, a group that has been observed targeting US companies throughout 2022, was working with the broker on this attack. In late July, the attacker emailed Cisco executives several times enclosing screenshots of compromised files and indicating that they intended to extort the company. However, they never made any specific demands and did not attempt to deploy any ransomware while they had access to the network.

Voice phishing growing along with MFA fatigue as network breach threats

Talos closed out their public account of the network breach by encouraging organizations to educate employees about how to handle errant or suspicious push requests, ensuring a clear point of contact is established in the event a malicious push request is suspected, enforcing stricter device controls to keep out unknown and unmanaged devices, and implementing network segmentation where possible along with centralized log collection. Voice phishing can also be addressed via familiarity with the conditions under which tech platforms will cold-call a user, which are usually extremely limited.

Though a private for-profit criminal group appears to be responsible for this particular incident, some nation-state actors have turned to various methods of voice phishing as an attack method. The attack on defi platform Ronin in March reportedly involved fake job interviews conducted by North Korea’s state-backed hackers, which are unique among these threat groups in aggressively seeking to steal money for the regime. At least one fake crypto investment app that was taken down recently also employed women to chat with affluent male investors on the phone and convince them to make large deposits by flirting with them; while not a direct instance of voice phishing, it was an unusual length for an attacker to go to in order to inspire confidence in the target.

MFA fatigue is also increasingly appearing as a means of initial access, with attackers simply pestering targets with constant messages in the hopes they’ll agree to one. The push notification generally accompanies a login attempt, which could overlap with a period of legitimate use of the service by the target and confuse them into approving the attempt. Some may also start agreeing to the notifications simply to make them stop. The MFA fatigue approach was observed in use by Russian state-sponsored hackers in 2021, targeting Microsoft Office 365 users via phone. For those susceptible to MFA fatigue due to dealing with push notifications all day, most services now offer a two-digit phone sign-in option that has the requester confirm a number that is only displayed to the legitimate user.

Erfan Shadabi, cybersecurity expert with comforte AG, adds more general advice for protection after an initial breach: “Organizations need to prepare for this (ransomware) eventuality with robust recovery capabilities combined with proactive data-centric protection. The former restores the IT and data environment to a pre-breach state, while the latter ensures that threat actors can’t extract sensitive data. Data-centric security methods such as tokenization and format-preserving encryption protect the data itself rather than the environment around it. Even if hackers get their hands on data, they can’t blackmail organizations with the threat of imminent release of that data.”

And Tim Prendergast, CEO of strongDM, believes that the emergence of methods such as voice phishing and MFA fatigue should prompt organizations to rethink access control strategies entirely: “Attackers are continually going after credentials because people inevitably make mistakes when moving fast to keep up with the pace of day-to-day operations. Employees might miss a misspelled word, an unknown email address or other phishing sign while going from task to task. Eliminating this risk isn’t about providing more training or putting up more access walls. Instead, organizations need to implement a process whereby users never know their credentials to critical infrastructures like servers, databases or Kubernetes clusters. Rather than point fingers, it is important for CISOs to re-evaluate the visibility and control of access across both applications and infrastructure.”

Insight neemt Hanu Software Solutions over

Vergelijkbare publicaties

Twilio-inbreuk heeft de nummers van sommige Signal-gebruikers blootgelegd

Twee extra kwaadaardige Python bibliotheken gevonden op PyPI Repository

9 beste cyberbeveiligingstools voor bedreigingsjagers

DEF CON - "maak je geen zorgen, de verkiezingen zijn veilig" editie

De toekomst van CyberSecurity is Preventie | SecurityWeek.Com

Netwerkinbreuk bij Cisco terug te voeren op aangetast persoonlijk Google-account; geraffineerde aanvaller gebruikte combinatie van voicephishing en MFA-moeheid

Gevonden topics

TMNT: De Cowabunga collectie lanceert op 30 augustus

Uw capaciteiten op het gebied van digitaal forensisch onderzoek en incidentenrespons - of het gebrek daaraan - kunnen van invloed zijn op uw cyberverzekeringspremies

Mazars adviseert met Kaspersky te stoppen