Threat Intel Archives - Page 4 of 9 - D1 Defend D1 Defend

Threat Intel Archives - Page 4 of 9 - D1 Defend D1 Defend

x

Dangerous New Threat to Your Network’s Authentication

July 11, 2024

In the digital age, the security of your network is paramount. Businesses rely on complex authentication systems to protect sensitive data, maintain operational integrity, and ensure that only authorized individuals have access to their networks. However, a dangerous new threat has emerged that could undermine the very system designed to keep your network secure. This vulnerability, known as the “BlastRADIUS” attack, poses a significant risk to your network’s authentication process, allowing attackers to bypass login credentials entirely and gain unauthorized access from anywhere in the world.

What Is the BlastRADIUS Attack?

The BlastRADIUS attack represents a new and alarming type of cyber threat. Unlike traditional attacks that rely on phishing scams, malware, or brute force attempts to steal usernames and passwords, BlastRADIUS targets the core of your network’s authentication system. It exploits a vulnerability in the authentication process, allowing attackers to gain direct access to your network without needing to know any login credentials. This means that an attacker could potentially infiltrate your network and wreak havoc without ever triggering the typical security alerts associated with failed login attempts.

Imagine a scenario where an attacker gains access to your network as if they were an authenticated user, bypassing all the security protocols you have in place. This type of breach could lead to devastating consequences, including data theft, unauthorized access to sensitive information, disruption of business operations, and even complete control over your network. The implications of such an attack are profound, making it essential for businesses to take immediate action to protect their networks.

Why Is the BlastRADIUS Attack So Dangerous?

The BlastRADIUS attack is particularly dangerous for several reasons:

1. Complete Bypass of Authentication

The most alarming aspect of the BlastRADIUS attack is its ability to bypass the authentication process entirely. Traditional security measures, such as multi-factor authentication (MFA), strong passwords, and user access controls, are rendered ineffective against this threat. Once an attacker successfully exploits the BlastRADIUS vulnerability, they can gain direct access to your network without any need for usernames or passwords.

2. Remote Exploitation

Another critical concern is that the BlastRADIUS attack can be executed remotely. This means that an attacker does not need physical access to your network to exploit the vulnerability. Instead, they can launch the attack from anywhere in the world, making it even more challenging to detect and defend against.

3. Potential for Widespread Impact

Given the nature of the vulnerability, the BlastRADIUS attack has the potential to impact a wide range of systems and devices. Any system that relies on the affected authentication method could be at risk, making it essential for businesses across all industries to take this threat seriously.

4. Undetected Infiltration

Because the BlastRADIUS attack bypasses the standard authentication process, it can be challenging to detect. Traditional security measures, such as monitoring for failed login attempts or unusual access patterns, may not be effective in identifying this type of breach. This allows attackers to infiltrate your network and remain undetected for extended periods, increasing the potential for damage.

How Can You Protect Your Network from BlastRADIUS?

Given the severity of the BlastRADIUS attack, it’s crucial for businesses to take proactive steps to protect their networks. Here’s how we can help:

1. Comprehensive Security Solutions

We offer a range of comprehensive security solutions designed to protect your network against vulnerabilities like BlastRADIUS. Our team of experts can assess your current security setup, identify potential risks, and implement advanced protections to safeguard your network’s authentication process. This includes deploying the latest security updates, configuring network defenses, and implementing robust access controls to prevent unauthorized access.

2. Ongoing Monitoring and Updates

Cyber threats are constantly evolving, and staying ahead of the latest vulnerabilities requires continuous vigilance. We provide ongoing monitoring of your network to detect any signs of unusual activity or potential breaches. Additionally, our team ensures that your systems are regularly updated with the latest security patches and protections to defend against emerging threats like BlastRADIUS.

3. Third-Party Security Analysis

An objective, third-party security analysis is a critical component of any comprehensive cybersecurity strategy. Our team can conduct a thorough assessment of your network to identify any weaknesses or vulnerabilities that may have been overlooked. This analysis provides valuable insights into your current security posture and helps us develop a tailored plan to address any risks and strengthen your defenses.

4. Expert Consultation and Support

Navigating the complexities of cybersecurity can be challenging, but you don’t have to do it alone. We offer expert consultation and support to help you understand the implications of the BlastRADIUS threat and what steps you can take to protect your business. Whether you need assistance with implementing new security measures or guidance on best practices for network protection, our team is here to help.

Don’t Let BlastRADIUS Compromise Your Network

The BlastRADIUS attack is a sobering reminder of the ever-present dangers in the cybersecurity landscape. This vulnerability poses a significant threat to the integrity of your network’s authentication process, making it essential for businesses to take immediate action to protect themselves. By implementing comprehensive security solutions, conducting regular monitoring and updates, and leveraging expert support, you can safeguard your network against BlastRADIUS and other emerging threats.

Don’t wait until your network is compromised—take action now to ensure your systems are secure. If you’re interested in learning more about how we can help protect your network from BlastRADIUS and other vulnerabilities, contact us today to schedule a security analysis.

Contact Us Today!

Threat Intelligence: JavaScript Supply Chain Attack Alert: Polyfill.js Compromise

July 3, 2024

We’re reaching out today to alert you to a significant JavaScript supply chain attack that may have impacted millions of legitimate websites. According to our research, tens of millions of websites, accounting for about 4% of the web, use Polyfill.js, an open-source library designed to improve compatibility with older browsers by embedding JavaScript code.

The Threat

Earlier this year, a Chinese company named Funnull acquired the domain and the GitHub account associated with Polyfill.js. Following this acquisition, they modified the Polyfill.js code to insert malicious code into websites. Any script adopted from cdn.polyfill.io was susceptible to downloading malicious code from Funnull’s site.

Response from Major Players

Cloudflare, Google, and even the Polyfill.io domain provider have taken steps to prevent sites with the malicious “plugin” from loading. Despite these measures, the attacks continue to persist. It is highly recommended that websites using these scripts remove them immediately to prevent further exploitation.

Quick Points

  • Scope of Attack: JavaScript supply chain attacks via Polyfill.io have affected tens of millions of legitimate websites, as stated by Cloudflare’s CEO, Matthew Prince.
  • Nature of the Attack: Websites using the compromised script have been turned into “watering-holes” for Chinese cyber-attackers, redirecting users to scam sites or malware.
  • Affected Entities: Major websites such as Hulu, Intuit, Nintendo, JSTOR, and the World Economic Forum have been affected.
  • Preventive Actions: Cloudflare and Google are starting to restrict sites using these malicious scripts.

Immediate Actions

  • Review and Remove: Assess your websites for any dependency on Polyfill.io and remove the scripts as necessary.
  • Monitor Activities: Keep an eye on unusual activities or signs of malicious code.
  • Use Clean Versions: Utilize Fastly or Cloudflare’s “clean” versions of Polyfill scripts when necessary.

Pentest Report Findings

In your next penetration test, look for these report findings:

  • Under the “External IP Vulnerability Analysis Log” and “Internal Vulnerability Analysis Log,” you will find Polyfill-related findings listed under the “Web Application Scanning Consolidation / Info Reporting” section.

Stay Secure

As always, we are dedicated to your security. Take these steps promptly to safeguard your digital assets from this ongoing threat.

Contact Us Today!

How Cybercriminals Use AI to Power Their Attacks

July 2, 2024

Managing a business on your own is challenging enough without worrying about cyberattacks. However, there is cause for alarm as hackers are using artificial intelligence (AI) to launch sophisticated cyberattacks to steal your data and disrupt business operations.

The good news is there are steps you can take to protect your business. This blog will explain how AI is being used in cybercrime and how you can safeguard your business.

How hackers use AI

Here are some of the ways cybercriminals are exploiting AI:

Deepfakes: Hackers use AI to create highly realistic fake videos or audio recordings to impersonate someone you know, like your boss or a trusted friend. These deepfakes can be used to trick you into sending money or sharing sensitive information.

How to spot it: Closely look for details like unnatural facial movements or sloppy voice synchronization.

AI-powered password cracking: With the help of AI, cybercriminals can effortlessly crack common and easy passwords. Hackers with access to advanced computation offered by AI can automate the breaching process, so they can try millions of combinations to guess your password.

How to fight back: Always use unique passwords. Consider using a password manager.

AI-assisted hacking: Hackers no longer have to spend hours looking for vulnerabilities. Instead, with the help of AI, they can create automated programs that not only identify weaknesses in your system but also create new types of malware.

How to stay ahead: Keep your security systems and software updated. Also, a mandate should be set up to scan for vulnerabilities routinely.

Supply chain attacks: Threat actors use AI to insert malicious code into legitimate vendor products, which eventually will compromise your system as well. 

How to protect yourself: Only download software from trusted sources. Always be vigilant with updates and patches.

Boost your defenses

AI-powered cybercrime is a growing threat. That’s why having a strong IT partner by your side can be the ultimate weapon in your arsenal. Partner with us to leverage advanced technology to fortify your defenses.

Reach out to us today for a  consultation and learn how our team can secure your business against evolving cyber risks.

Contact Us Today!

Threat Intelligence: Alert: Critical Ivanti VPN Vulnerabilities

Posted: January 24, 2024

Two critical vulnerabilities, identified as CVE-2024-21887 and CVE-2023-46805, are opening the door for data to be stolen, and they don’t stop there.  In addition, they allow for modifications to existing files in your environment and for remote files to be downloaded. 

So please REMOVE COMPROMISED DEVICES from your network and immediately prepare for an upcoming patch. 

There has been an emergency directive issued by CISA to mitigate all Ivanti 0-day vulnerabilities. 

Quick Points: 

  • Vulnerabilities: CVE-2024-21887 (Command Injection) and CVE-2023-46805 (Authentication Bypass) 
  • Likelihood: Low to Medium. Approximately 15,000-20,000 VPN gateways are potentially exposed 
  • Impact: High. Potential for unauthenticated remote code execution, data theft, file modification, and reverse tunneling 
  • Current Mitigation IS UNSTABLE: Ivanti has released an XML file as a temporary workaround that IS UNSTABLE 

Contact Us Today!

Threat Intelligence 2024 Special Edition

Posted: December 29, 2023

What a year! 

I think we all deserve a quieter 2024, and that’s why I’m sending out this special edition Threat Intelligence.  Let’s see what we can learn from 7 dangerous themes that emerged in 2023 and apply those lessons to your MSP and your clients’ organizations.  

1. Ransomware Renaissance: Top of the list?  Yep.  The big casino heist. Was this the worst event of 2023? Probably not. It does, however, help us understand that no one is safe. The most important point of this story – casinos are highly regulated, have great training programs, and have people who are great at following rules.

a. BOTTOM LINE: cybersecurity risk mitigation isn’t ONLY about following rules.   
b. PRO TIP: In 2024, make sure you’re creating strategic overlap within not only your advanced security solution stack, but also inside your administrative implementations (policy and training)

2. Credential Crisis: This got really ugly in 2023.  Attackers got onto networks like normal users, then moved throughout the environment with privileged access. How is this lateral movement happening? The attackers were able to move through the network using single sign on tokens. Whether you’re using passwords, multifactor authentication, or password-less authentication – as long as trust exists in the network, a temporary login artifact is stored. That login artifact can often be replayed, leading to this lateral movement.  

a. BOTTOM LINE: In 2024, this type of lateral movement will continue.  

b. PRO TIP: Make sure you have user identity management and a mechanism in place to protect that user identity management system. Tokens and login artifacts should be treated as the crown jewels of your network. What mechanisms do you have in place to protect them from hackers? 

3. Supply Chain Siege: In 2023, hackers didn’t just use vulnerabilities.  They also gained access through vendors and supply chain attacks. In one example, over 60 Credit Unions’ networks were held for ransom. The way in? Using access one of their vendors had to their networks to deploy ransomware. These supply chain attacks are not single events, or unlucky breaks for the victims. They represent a continued trend that hackers where are exploiting weakness in an organization’s supply chain. 

a. BOTTOM LINE: This trend will continue into 2024 and beyond.  

b. PRO TIP: Steps to reduce the risk of supply chain threat include vendor evaluation, least privilege, and testing. The easiest way to test supply chain risk or insider threat exposure is a recurring penetration test focused on these threat vectors. As leaders in cybersecurity, educating organizations of this risk and testing is a necessity. 

3. Data Deluge: The biggest data breaches we’ve ever seen: 3.8 billion email and password combinations leaked to the dark web. You might be thinking you have multifactor authentication, so this isn’t a big deal. But here’s the thing: this data is used to improve the models hackers use to socially engineer their victims. The data is imported into tools to build social webs and AI models that allow hackers to figure out how people are connected and how to create an effective pretext while phishing users. 

a. BOTTOM LINE: This has been lucrative for hackers, so it’s probably part of their 2024 success plan already. 

b. PRO TIP: User training will be a critical component of your 2024 cyber security strategy. 

5. Email Compromise: Got a story about someone who wired money to a scam?  Well, join the crowd.  That was a huge issue in 2023, and if you haven’t heard a story about it, well, you’ve been living under a rock.   

a. BOTTOM LINE: The data shows that the number of victims and the amounts of money lost to these attacks continues to rise. 

b. PRO TIP: I recommend having a Funds Transfer Policy as part of the decisions you are guiding your clients on about security in Q1 of 2024. You’ll also want to include a M365 hardening project as part of your 2024 recommendations. Check out SecOps 160 for more details on this one. There’s even a script and a worksheet that will help you get it done. 

6. Unpreparedness Unraveled: Organizations often make assumptions about how prepared they are, and this is truly dangerous. This year, I personally helped 11 different MSPs respond to ransomware events. Only one of them had a solid plan that was both documented and tested with their client.   

a. BOTTOM LINE: Many organizations are assuming their IT teams have this under control.  

b. PRO TIP: Your opportunity in 2024 is to educate your clients that incident response and recovery is an operational issue, not just an IT issue. Help your clients by offering tabletop exercises as a starting point to find out where they need practice. Build this into your compliance as a service offering. And yes, all of your clients need compliance as a service. 

7. Compliance Conundrum: Compliance has changed cybersecurity forever and it’s just getting started. CMMC might only impact less than 5% of your clients, and maybe it will be years before any real case law exists or enforcement happens around it. However, cyber insurance requires a compliance program, and when people sign up for cyber insurance, they make commitments to security controls. Making these commitments means, not only do you have to implement them, but you also have to gather evidence that these controls are implemented.  The key is to build out a compliance program that will be able to be iterated and expanded to support other standards like SOC2, ISO27001, CMMC, PCI, or FTC Safeguards as they become more mainstream. 

a. BOTTOM LINE: In 2024, part of your security strategy should include introducing your clients to compliance programs and educating them. This elevates you from a security perspective into a thought leader and advisor. 

b. PRO TIP: To get started, we have a turnkey system in the portal that you can use on your clients and your own MSP to build your compliance program. 

Ultimately in 2024 the MSPs who will see the most growth are also the ones that are thinking about what happened in 2023 from a security standpoint and coming up with ways to reduce these risks in their 2024 offerings.  

Inquire now to get you started on this journey!

Contact Us Today!

Schedule a Call