Features Category

security advisoryapplication securitymemory safety

The End of “Patch and Pray”: How Rust Is Reshaping Memory Safety in Linux

Most information security best practices are built on a single, comfortable assumption: that if we find a bug, we can patch it, and once it’s patched, the system is "safe" again. . We’ve lived in this cycle for thirty years. A vulnerability is found, a CVE is issued, and sysadmins scramble to update their servers. But the recent move to bring the Rust programming language into the Linux kernel—reaching a new level of stability and integration in recent kernel releases—is the first sign that the people at the top have realized the cycle is broken. We aren't just dealing with "bugs" anymore. We are dealing with a structural failure in how our systems are built. What is C, and Why Is It Killing Us? To understand why this is a strategic shift, you have to look at the language Linux is built on: C . Computers don't actually understand "software." They understand electricity moving through physical memory addresses. C is the "translator" that sits between the human programmer and the physical hardware. It’s the industry standard because it’s incredibly fast and gives you total control over the machine. But that control comes with a catch: C has no safety rails. In C, the programmer is responsible for manually managing every single "bucket" of memory the system uses. If your program needs space to store a username, you have to ask the system for exactly 10 bytes of memory, use them, and then remember to "give them back" when you’re done. The problem? C assumes the programmer is perfect. If you ask for 10 bytes, but a user sends you 100, C doesn't stop the extra data. It just lets it spill over into the next section of memory—often overwriting the very security instructions that were supposed to keep the user out. The "70% Problem" in the Kernel In systems like the Linux kernel, these aren't just "accidents"; they are a structural reality of the language. Microsoft recently estimated that 70% of all security vulnerabilities in their products over the last decade werethese exact memory safety issues. Google found the same trend, noting that these bugs are the primary cause of stability and security issues in complex systems like Android. We’ve spent three decades telling engineers to "just write better code," but humans don't scale. If the smartest engineers at Microsoft and Google can’t stop making these translation mistakes, the problem isn't the engineers—it's the tool. As we saw with the recent Pack2TheRoot disclosure (CVE-2026-41651), a tiny gap in how a background service handles a memory request can sit in a "standard" Linux install for 12 years before someone realizes the door has been unlocked. When your foundation is built on a language that trusts a local user not to overflow a memory bucket, you aren't managing a secure server; you're managing a liability. Enter Rust: The Security Guard at the Checkpoint This is where Rust changes the philosophy of system security. In a traditional C-based system, we look for security flaws after the software is already running. That’s what your EDR, firewall, and log monitors are for—they watch for the "spill" after it happens. Rust moves that check to the compiler. The compiler is the tool that translates the human-written code into a running program. In Rust, the compiler acts like a strict building inspector. It includes a "Borrow Checker" that tracks every piece of data. If you try to write code that could cause a memory spill or a "race condition" (where two processes fight over the same data), the compiler simply refuses to build the program. In Linux, this is already showing up in new drivers and subsystems being written in Rust instead of C. This isn't just a development decision; it’s a signal that memory safety is being treated as a requirement, not a best practice. As detailed on the OSS-Security mailing list, the "default" state of a Linux host is usually its biggest risk. Rust fixes this by: Eliminating Risk Classes: We stop chasing individual bugs and start removingthe possibility of those bugs existing. Reducing the "Patching Tax": If a class of bugs can't exist in a driver, you don't have to spend your weekend patching a CVE for it. The Reality Check: Trust But Validate We have to be realistic: Linux is 30 million lines of C. We aren't swapping it all out overnight. The existing C code will dominate the kernel for years to come. And Rust isn't a magic wand. A recent audit showed that specific classes of bugs Rust won't catch—like logic errors where the code is "safe," but the math is wrong—still require human eyes. Rust can prevent you from crashing the car, but it can't prevent you from driving to the wrong address. But that’s exactly why this is a strategic win. By using Rust to handle the "boring" memory safety stuff automatically, we can finally focus our energy on the actual system logic. The Real Lesson: Stop Trusting the Defaults The shift toward Rust in Linux is a declaration of structural intolerance. It’s a signal that the industry is finally losing its patience with a model that assumes the foundation is naturally leaky. The most dangerous systems are the ones that look normal. For years, we’ve treated vulnerabilities like a weather pattern—something that just happens to us. We’ve focused on "detect and respond" because we assumed the foundation was naturally porous. Security isn't about the tools you've installed to watch the perimeter; it’s about the integrity of the core. Stop trusting that the "standard" install has your back. Start validating the foundation. . Exploring Rust's impact on memory safety within the Linux kernel and the shift from traditional C management strategies.. memory safety, Linux kernel, Rust programming, security practices, application integrity. . MaK Ulac

Apr 29, 2026 •

MaK Ulac

27.Tablet Connections Blocks Lock Esm H240

access controlLinux securityapplication security

Why Your "Shadow IT" Developer Tools Are the Biggest Risk to Your Linux Systems

Every company has a "Shadow IT" layer—a collection of developer-built dashboards, AI workflow runners, and data-science notebooks that weren't built by the central IT team. They are the convenient tools that let your teams push features faster, train models quicker, and visualize data on the fly. . The problem is that these tools have become the most dangerous assets in our stack. Because they were built for speed, they lack the security hardening of our core systems. Right now, they aren't just "support infrastructure"—they are unmonitored backdoors sitting in the middle of our production environment. If you want to know how an attacker skips our firewall and walks straight into your Linux host, it’s not through a complex, movie-style exploit; it’s by logging into a "productivity" tool that we forgot to lock down. The Invisible Doorway: Direct Access to Your Linux Host Imagine an office building with guards and locked doors. You have total control over the perimeter. But someone from the dev team installs a "smart" coffee machine that happens to have an unmonitored back door into the building’s power grid. That is exactly what is happening with our internal systems. We aren't being hacked because our front door is weak; we are being hacked because we are installing convenient platforms—often part of a sprawling Shadow IT ecosystem—that act as secret, wide-open entry points directly onto your Linux servers. Because these tools are designed to remove friction, they often bypass standard application security controls, essentially leaving the keys in the ignition. Here is how an attacker dismantles your business by hijacking your Linux host in three direct steps: Phase 1: Reconnaissance (Finding the Door) . Attackers don't waste time breaking down your front door. They use automated scanners to crawl internal network ranges, hunting for specific patterns associated with common developer platforms. They find a dashboard that lacks a login prompt—and they’re in. Phase 2: Capability Abuse (Exploiting the Linux Environment). The attacker doesn't need to break anything; they simply use the tool’s built-in features. If the interface allows file uploads, they upload a script. If it has a terminal window, they open it. Because the tool trusts anyone who reaches the URL, the dashboard executes the request on the underlying Linux host with the tool's permissions. Phase 3: Immediate Escalation (Total Host Control). The attacker runs a command to check the user context on the server. They see they have "root" (the highest level of permission on a Linux system). Because the tool was misconfigured to run as "root" for "ease of use," the attacker doesn't need to perform any complex vulnerability management or privilege escalation. They are already at the top of the food chain. They dump your .env files, scrape your SSH keys, and take full control of the Linux host. This Pattern Is Already Showing Up Across Modern Tools Marimo and FalkorDB are not outliers. They are examples of a broader design pattern that is quietly spreading across developer-facing platforms. These tools are built to remove friction—exposing powerful functionality through the browser so developers can move faster, test ideas, and interact with systems in real time. That convenience is the feature. It is also a risk. You can see the same pattern in other environments: Marimo: Exposes a browser-based terminal, turning a WebSocket endpoint into direct shell access when authentication fails. FalkorDB Browser: Allows file uploads that interact with the underlying filesystem, creating a path to overwrite and execute. Langflow: Exposes execution pipelines through UI-driven interfaces, often without strong separation between user input and backend execution. The issue is not the individual vulnerabilities; it is the consistency of the design. Shadow IT interfaces are being given direct paths to execution without strong trust boundaries in place. That shift is what attackers areexploiting. Tools That Are Also Likely To Be Exploited When we talk about compromised dashboards, we aren't talking about your Jira board or your internal HR portal. We are talking about developer-facing platforms that live inside your infrastructure but have the power to talk to your host. If you are running these in your environment, they are the first things you need to audit for application security gaps: Data Science Notebooks: Platforms like Jupyter, or custom Python notebooks. They are designed to let users write and execute code in the browser. If a user can execute code in the browser, and that browser is connected to your backend server, an attacker who hijacks that session is essentially "logging in" to your server. AI/LLM Workflow Orchestrators: Tools like Flowise are meant to bridge your data to your AI models. They often require broad filesystem access and execution permissions to "process" your data. An attacker doesn't need to break your AI model—they just need to hijack the workflow builder to run commands on the underlying host. Database Management Dashboards: Admin panels like pgAdmin or custom database management UIs that aren't properly locked down. These often have features meant to "export" or "import" data, which—if poorly secured—become simple paths for an attacker to upload a shell or read sensitive configuration files. Internal CI/CD Build Interfaces: While we usually harden our main CI/CD pipelines, smaller, "ad-hoc" build dashboards created for quick dev testing are rarely protected by the same zero-trust architecture standards. They often run with elevated permissions to save time. The Linux Security Failure These tools are not just web apps—they are execution surfaces that live inside your Linux infrastructure. For instance, CVE-2026-39987 demonstrated how a notebook tool's terminal endpoint failed to enforce any authentication, providing direct, unauthenticated shell access to the Linux host. Similarly, in tools like FalkorDB, CVE-2026-6057 showed that file upload functionality combined with path traversal leads directly to arbitrary file writes. As noted in research from Sysdig , attackers are exploiting these gaps within hours because the design patterns allow them to land on your Linux server without any complex exploit chain. Why This Matters to the Business When we talk about compromised dashboards, we are talking about your Linux-based production assets: Customer Databases: When a database management dashboard is exposed, an attacker doesn't just see "data"—they gain the ability to export your entire customer list or manipulate core business records on the Linux filesystem. Proprietary Code and AI Models: AI workflow tools bridge your data to your models. Hijacking these tools allows an attacker to steal your proprietary datasets and the models that power your business logic directly from the host. Cloud Infrastructure Keys: Many of these tools run with the same permissions as your production servers. A breach here means the attacker can move laterally from the Linux host, hijacking your cloud environment, spinning up rogue services, or shutting down your production stack. How To Shrink The Surface Area If an attacker gains host-level access through one of these notebooks or dashboards, they aren't just poking around a UI—they are accessing the keys to our cloud environment and our customer databases. We need to stop treating internal dashboards as "trusted" and start treating them as part of our core attack surface. If these platforms have the power to execute code or access files on your Linux servers, they need the same authentication, vulnerability management, and Zero Trust Architecture standards as our public-facing production apps. Treat internal tools like public services: Secure them like you would your public website. Kill the dangerous paths: Isolate or block terminal endpoints and file upload APIs unless strictly necessary. Enforce real identity: Network boundaries are not enough. Use SSO and MFA at the application level. Reduce your blast radius: Stop running these tools as "root." Use containers and sandboxes to keep the application isolated from the core Linux system. Watch the behavior: Stop looking for "logins." Use security as code to monitor traffic, command execution, and unauthorized access to your credential stores. As noted in the Global Cybersecurity Outlook 2026 , the risk from these technologies is climbing as fast as their adoption. By adopting DevSecOps best practices and implementing shift left security, we can bake these guardrails into our deployment lifecycle. Moving fast is a competitive advantage. But it’s not an advantage if the tools that help us move fast are the same ones that give an attacker the map to our entire production stack. . Shadow IT tools pose significant risks to Linux systems due to lack of security hardening and monitoring.. Shadow IT, Linux Security, Developer Tools, Application Security. . MaK Ulac

Apr 13, 2026 •

MaK Ulac

20.Lock AbstractDigital Circular Esm H240

application securitycode analysismigration

.NET Core Migration Challenges: Enhance Security with Linux Integration

As organizations look to modernize their applications and increase performance, .NET Core can be a pivotal shift from the .NET Framework. It is the perfect platform to build secure, scalable, and future-ready solutions, with a growing emphasis on open-source technologies and cross-platform compatibility. In this article, we explore the migration process and how using Linux and open source can make it more secure and efficient before and after the migration. . Advantages of .NET Core over .NET Framework .NET Core is an open-source, cross-platform framework designed for cross-platform development to address .NET Framework limitations. Compared to .NET Framework, which is only intended to run on Windows, .NET Core permits applications to be deployed into Linux and macOS, making it an excellent choice for cloud-based web hosting. Its flexibility also works well for companies looking for a cheaper hosting option, such as cloud-based web hosting, and more flexible working. Additionally, the .NET Core is open source and has evolved rapidly among the participants of the .NET developer community, contributing to innovation and security enhancements. From a security point of view, .NET Core brings a lot of advantages. Updates and modularity mean that developers have a vehicle by which to quickly and easily remediate vulnerabilities. One of the benefits is that it makes it possible to run .NET Core-hosted apps on Linux with the security benefits that Linux offers out of the box. The ability to provide this combination of adaptability, cross-platform development, and security makes .NET Core an enterprise-worthy solution for modernizing technology. Migration to .NET Core – Hard Challenges To migrate from .NET framework to .NET core comes with its challenges. Many applications built in .NET Framework depend on legacy libraries and APIs that: They are not compatible with .NET Core. They may not be accessible via .NET Core packages. They need to be manually importedfor use. Refactoring or replacing dated components is necessary, so we need to plan accordingly. Furthermore, during the migration, organizations also have to guarantee that their applications continue to meet security technical implementation guides to meet security and compliance requirements. Another huge challenge is switching workloads to platforms unfamiliar to some teams. Although Linux's security and performance are unique, adopting it requires a change in their approach. Understanding Linux-based monitoring , logging, and security tools that administrators use is essential for leaders. The learning curve for understanding Linux can be steep in the beginning, but the payoff in the long run is well worth it. Making the Business Case for Linux and Open Source in the Migration Process Clicking into .NET Core allows an organization to integrate Linux and open source technology within its ecosystem. .NET Core apps run stably and performantly on Linux, which has built-in security features like SELinux, AppArmor, and a pumped-up network configuration. Deploying applications on Linux, establishing backup Linux systems , and combining containerization help organizations break away from proprietary systems and embrace cloud-based web hosting for improved infrastructure security. The migration process would not be as successful without open-source tools. There are plenty of utilities, including containerization tools, available to developers to make refactoring, testing, or deployment of your applications a breeze. One of the attributes of containers is their role in containerization ( Docker in particular), providing isolated .NET Core applications and their dependencies where performance can remain consistent. In addition, open-source CI/CD pipelines such as Jenkins or GitHub Actions allow for automated testing and deployment, and migrated applications are tested and deployed with quality standards to end up in production. Another equally important advantage of thisopen-source collaboration is that developers have access to extensive documentation, forums, and code samples to help expedite the migration process. This collaboration also makes security patches, updates, and cross-platform development more readily available, which helps eliminate an even larger security vulnerability—not realizing that there’s an issue in the first place. Open source development is transparent, allowing the trust and reliability necessary for mission-critical applications. Improving Security During And After Migration The migration from .NET Framework to .NET Core is of primary importance for security. Organizations have to practice ahead to identify and control potential risks. The process starts with a very good analysis of existing applications, their dependencies, and their vulnerabilities. Practical code analysis tools will help determine where code needs to be changed to support .NET Core while closing security holes introduced by unknown sources. After migration, the choice of Linux as a security hosting platform only gets better. It provides exceptional control over system configuration , especially when following a technical security implementation guide. Since access controls can be enforced and the behavior of applications can be monitored admirably, Linux is a sound, minimally privileged system, making it ideal for running backup Linux environments securely. Besides, to provide additional layers of protection against cyber threats, the use of open-source security tools, including intrusion detection systems and audit frameworks, can be beneficial. .NET Core applications need regular updates and maintenance to maintain their security status. Because .NET Core is a modular framework, updates to a particular component don’t mean that the entire application stops working, reducing downtime and ensuring the quick rollout of security patches. To stay ahead of emerging threats, organizations should create a robust patch management process and ensure they havebackup Linux systems to safeguard data. Strengthen Your .NET Core Security Posture. A move from .NET Framework to .NET Core offers organizations the chance to embrace an open-source approach, shore up security, and gain cross-platform compatibility. By exploiting the power of Linux, cross-platform development, and an abundant ecosystem of open-source tools , businesses can navigate migration challenges and achieve deeper levels of efficiency and innovation. Getting here requires good planning, but dedication to continuous improvement has its benefits. Organizations that build with .NET Core are also well-positioned to build resilient, scalable, and secure applications for the future. Maintaining the security of .NET Core projects is critical to protecting user data and applications from potential threats. By following open-source best practices for security, you can significantly decrease vulnerabilities and safeguard systems more effectively. Such practices include securing dependencies, enforcing HTTPS, managing configurations securely, and implementing robust authentication and authorization mechanisms. Additionally, organizations should conduct regular static code analysis, perform audits and penetration tests to identify security flaws and provide comprehensive logging and monitoring capabilities. Audits and pentests will help identify vulnerabilities and can identify and exploit them effectively. As you move forward, pay particular attention to taking these proactive measures to increase the security of your .NET Core apps: Regularly Update Dependencies : Use tools such as NuGet or Snyk to keep dependencies up-to-date, adhere to a security technical implementation guide , and do not originate from unknown sources. Also, implement HTTPS using Let's Encrypt . Establish HTTPS in Transit : Secure your data while transiting using migration towards HTTPS, ensuring its protection in transit by migrating all HTTPS-enabled sites using Let's Encrypt's services for SSL/TLScertificates. Secret Management : Securely store sensitive information using Azure Key Vault , AWS Secrets Manager , or HashiCorp Vault , as well as environment variables for sensitive data storage. Deploy Security Frameworks : Integrate effective authentication and authorization frameworks such as ASP.NET Core Identity, IdentityServer4, or Azure AD B2C for robust user authorization and authentication processes. Automate Code Analysis : Integrating code analysis tools like SonarQube and GitHub CodeQL into your CI/CD pipeline will help you identify issues early and detect potential threats. Enable Robust Logging and Monitoring : For comprehensive logging, consider Serilog, NLog, or cloud services such as Azure Monitor. Prometheus or Grafana may provide useful monitoring features to monitor application performance and potential security concerns. Conduct Regular Security Audits and Penetration Tests : Regular security audits and penetration tests using tools like OWASP ZAP are crucial for continuously evaluating and enhancing your security posture. By implementing these best practices and making optimal use of open-source tools, you can establish an efficient security framework for your .NET Core projects. By taking proactive steps like these, using code analysis tools, avoiding unknown sources, and leveraging open-source tools efficiently, you will significantly lower the risk of exploiting applications used by all users and ensure their safety and reliability for all. . Explore the .NET Core migration challenges and uncover how to enhance security with Linux integration effectively.. organizations, modernize, their, applications, increase, performance. . MaK Ulac

Jan 17, 2025 •

MaK Ulac

application securitymalwaresecurity event

Cyber Warfare and 5G Risks: Insights from Black Hat 2022 and DEF CON 30

Last week, hackers, researchers, cybersecurity companies, and government officials descended on Las Vegas for Black Hat and DEFCON, lovingly referred to by many as ‘hacker summer camp”. This year’s events marked the 25th and 30th anniversaries of Black Hat and DEF CON, with more than 30,000 attendees from 111 different countries present this year. It also marked a return to form for the event amid the impacts of the COVID-19 pandemic. . What Are Black Hat and DEF CON? The Origin Story and What It Became The story behind DEF CON and Black Hat events dates back to 1993, in a time of X.25 networks and dial-up bulletin boards. In this era, fido networking was the most popular kind of networking, and Jeff Moss (the founder of DEF CON and Black Hat) held a bulletin board called ‘The Dark Tang ent System’. This bulletin board system ran a Telegard BBS – an early bulletin board software system program made for IBM pc-compatible computers running MS-DOS and OS/2. Using this system, Moss could network with more than ten different networks, each focusing on cybersecurity topics such as hacking, piracy, phone phreaking, etc. Because Moss worked multiple small jobs at the time, he could afford to fund his dial-outs to many different fido networking hubs. This made Moss’s bulletin board grow to become the main networking hub in North America at that time. What this meant for Moss was that he was now one of the most connected users in that network, an identity he held while also being a college student. Being a well-connected user, Moss talked to many different users from different networks. One such user, a user on the Canadian network Platinum Net, wanted to have a party to celebrate his dad finding a new job. However, since most of the networks were in the U.S, the user wanted the party to be in the U.S. Moss agreed to this and set about planning the party. As he was planning the party, Moss suddenly lost all connection to the user that asked him to plan it. It was like he had vanished.Unwilling to give up on the plan, Moss decided to go ahead with a new party and invite his other networking friends. However, this time there was another setback. Moss lost both his hard drive and his backups, rendering his bulletin board gone. Frustrated, Moss moved to the internet, inviting as many people as he could find. Unlike other hacking events during that time that were invite-only, Moss made it an objective that anyone could come to his event. He also made it an objective to have the event in Las Vegas so invitees would still have something to do if the event did not meet expectations. Investing over $2,000 into the event, Moss held no expectations on how everything would pan out. Instead, he felt confident in the reasoning that he had wanted to plan this event and that he tried. With speakers such as Dan Farmer and Gail Thackeray, many attendees could see and hear from the professionals they looked up to for the first time. The reaction after the event was overwhelmingly positive, making Moss’s event a substantial success! Now the world’s largest hacker convention, DEF CON attracts computer security professionals, journalists, lawyers, federal government employees, security researchers, students, and hackers interested in software, hardware modification, conference badges, and other hacker-related reasons. Their sister event, Black Hat, is now a renowned technical skill-building event for offensive and defensive hackers of all levels. Black Hat USA 2022 and DEF CON 30 Highlights, Announcements, and Notable Trends Heading into this year’s event, we expected to hear a lot of support for building resilience within security through innovative means. Now that this year’s event has come to a close, it’s safe to say that we weren’t disappointed. Here are some important highlights, announcements, and notable trends from the events. Notable Trends A Stance to Keeping The Human Element Within Application Security While automation and related integration can remove much ofthe manual work for application security, there should be no substitute for thoughtfulness, intuition, and good judgment. However, the pressures that cybersecurity professionals face are growing each year, putting a strain on this human element. In response to this reality, Adam Shostack, President of Shostack & Associates, led a session called ‘A Fully Trained Jedi, You Are Not’, a session that introduced the topic of training in application security and how better preparing developers for dealing with security issues can help decrease unnecessary risk and burnout. His suggested solution was a structured and compassionate approach to learning that complements the security tools that developer security operations professionals rely on every day to ease pressure in the workplace. In a related session, Kyle Tobener, VP and Head of Security and IT at Copado, emphasized the need for compassion and empathy when focusing on the human element as playing a part in security risk. In his session called ‘A Framework for Effective & Compassionate Security Guidance,’ Tobener discussed how cybersecurity professionals can apply harm reduction and why a compassionate approach can be more effective than prohibitive rules. Since high-risk behaviors such as falling for phishing emails happen regardless of security protocols, it is critical to provide thoughtful insight into a wide range of possible entry points. Cybersecurity is the New Warfare With the Biden administration coming out with directives and executive orders on cybersecurity, government agencies are starting to make large changes to their security efforts. For this year’s Black Hat event, cybersecurity becoming a staple of modern warfare was one of the main themes. Many participants agreed that in this new normal amid the after-effects of the pandemic, cyber-warfare, disinformation, and politics are becoming more cohesive. This harsh reality means that good cybersecurity practices in government are not just a recommendation but a must to not onlymodernize security tools but also implement zero trust concepts that reduce sensitive data exposure. David Treece, Director of Solutions Architecture at Yubico, held a session on why mandates around phishing-resistant, multi-factor authentication (MFA) are coming from the government. Since organizations with legacy MFA systems and processes are easier to attack, they’re at greater risk if government agencies don’t place emphasis on these mandates. Principal Threat Researcher Juan Andres Guerrero-Saade and Senior Threat Researcher Tom Hegel from SentinelOne were also speakers discussing the growing concerns over cyber-warfare. Their discussions over the daily cyber struggle between Russia and Ukraine reminded the audience of how similar cyber attacks were relatively rare before the war, an ominous sign that cyber attacks can so easily become global. Highlights Security Flaws Found Revealing Major 5G Risks As 5G commercial networks start to roll out, major changes and innovations are being made to accommodate faster networks. However, this l eaves room for these new networks to present new vulnerabilities, as Altaf Shaik and his colleague Shinjo Park suggest. A researcher at the Technical University of Berlin , Shaik and his colleague Park examined the application programming interfaces (APIs) offered by ten mobile carriers. They found API vulnerabilities in every one, revealing flaws that could be used to reveal SIM card identities, SIM card secret keys, billing information, and the identity of who purchased which SIM card. After years of examining potential security and privacy vulnerabilities in mobile-data radio frequency standards, Shaik was curious to investigate APIs that carriers offer to make internet of things (IoT) devices data accessible to developers. These are the pipelines that applications can use to pull, for instance, real-time tracking information for a bus or information about how much stock there is at a warehouse. Such APIs are common in web services. However, Shaikhighlights that they haven’t been widely used in core telecommunication offerings. Looking at the 5G IoT APIs of 10 mobile carriers around the world, both Shaik and Park found common but serious API vulnerabilities in all of them, some even capable of being exploited to gain access to authorized data or direct access to IoT devices on the network. StarLink Hacked with Homemade Circuit Board Belgian security researcher Lennert Wouters took to the stage at Black Hat to showcase how he could hack StarLink’s user terminals using a homemade circuit board. Costing him $25, the board permits a fault injection attack that bypasses StarLink’s security system and allows access to control functions that StarLink had intended to keep behind a wall. Wouters revealed the vulnerability to SpaceX last year, earning him a place on SpaceX’s bug bounty hall of fame. SpaceX issued an update to make the attack harder shortly after. However, Wouters says that unless SpaceX creates a new version of the main chip, all existing user terminals will remain vulnerable. To access the satellite dish’s software, Wouters physically stripped down a dish he purchased and created the circuit board to be attached to the StarLink dish. Once attached to the dish, the board could temporarily short the system by launching its fault injection attack. This glitch was what allowed Wouters to access previously locked parts of the StarLink system. Wouters is now making his hacking tool open source on GitHub , including some of the details needed to launch the attack. Ukraine’s Lead Cybersecurity Official’s Surprise Visit to Black Hat During his unannounced visit, Victor Zhora, the deputy head of Ukraine’s State Special Communications Service, spoke at the Black Hat event, revealing that the number of cyber incidents that hit Ukraine tripled in the months following Russia’s invasion of Ukraine in February. He also added that Ukraine had detected more than 1,600 major cyber incidents so far in 2022, includingthe discovery of the ‘Industroyer2’ malware, a malware capable of manipulating equipment in electrical utilities to control power flow. The malware was used by a Russian-backed hacking group called ‘Sandworm’ in an attempt to take down a Ukrainian energy provider. The group attempted to use the malware to disconnect the provider’s electrical substations. What’s interesting about the ‘Industroyer2’ malware is that it seems to be an adaptation of the ‘Industroyer’ malware, a malware used by the ‘Sandworm’ group to cut power in Ukraine in 2016 leaving more than 100,000 customers without electricity, two days before Christmas. This new malware, ‘Industroyer2’, was used alongside ‘CaddyWiper’, a destructive wiper malware first observed targeting a Ukrainian bank in March of this year. ‘Caddy Wiper’ was planted on systems running Windows in an attempt to erase traces of the attack. The hackers also targeted the organization’s Linux server using other variants of wiper malware called ‘Orcshred,’ ‘Soloshred,’ and Awfulshred’. The ‘Sandworm’ hacking group has also been linked to recent cyber attacks targeting U.S. satellite communications provider Viasat, an action that triggered satellite outages across central and eastern Europe. Zoom Installer Flaw Enables Root Access on macOS The COVID-19 pandemic has had a large influence on Zoom, becoming an essential communications tool for many organizations. Today, more than a million devices worldwide carry Zoom. However, this has created an opportunity for exposing security flaws. Mac security specialist Patrick Warde revealed during a talk at DEF CON that a flaw in Zoom’s installer for macOS could allow attackers to gain the highest level of access to the operating system, such as sensitive user files a nd system files. During his research, Warde discovered the Zoom macOS installer has an auto-update function that runs in the background. This auto-update function runs in the background with elevated privileges,allowing an attacker to run any program through the update function and gain those same privileges. The exploit essentially works by targeting the Zoom installer by exploiting a bug in how the updater function within the installer would install the new package after checking that it had been cryptographically signed by Zoom. This bug meant that giving the updater any file with the same name as Zoom’s signing certificate would be enough to pass the test, meaning an attacker could substitute any kind of malware program and have it be run by the updater with elevated privilege. The result is a privilege escalation attack that assumes an attacker has already gained initial access to the target system, employing an exploit to gain even more access. For instance, the attacker could begin with a restricted user account but escalate into a more powerful user type such as ‘superuser’ or ‘root’, allowing them to add, remove, or modify any files on the machine. Zoom has since fixed the issue with an update released over the weekend. However, Warde has presented one unpatched vulnerability that still affects systems today.Announcements U.S. Department of State Unmasks Alleged Conti Ransomware Operative The U.S government will offer up to $10,000,000 for information related to five individuals believed to be high-ranking members of the notorious Russian-backed Conti ransomware group. The group has been responsible for nearly 1,000 ransomware operations targeting the U.S and critical international infrastructure, including law enforcement agencies, emergency medical services, and 911 dispatch centers. The reward is offered as part of the U.S. Department of State’s Rewards for Justice (RFJ) program, marking the first time the U.S. government has publicly identified a Conti operative. The program, which specifically seeks information on national security threats, is offering the reward for information leading to the identification and location of the Conti ransomware operator known as ‘Target’, along withfour alleged Conti members known as ‘Tramp’, ‘Dandis,’ ‘Professor’, and ‘Reshaev.’ In a bonus offer, the RFJ said it would also pay up to $5,000,000 for any information leading to the arrest or conviction of any individual in any country conspiring to participate in or attempt to participate in Conti variant ransomware-related incidents. Virtu Reveals Encrypted Period-Tracking App Prototype In response to the recent overturning of Roe v.Wade, Virtu, a company best known for its email encryption service for enterprises and consumers, revealed a prototype period-tracking app at DEF CON. The app claims to give users complete control of their private information, such as information regarding period and ovulation tracking. This has come as a concern for many since there are now fears that period and ovulation tracking information can be used to prosecute people who are seeking an abortion or medical care for a miscarriage and those who assist them. Using an application that Virtu calls ‘SecureCycle,’ they can leverage open source, end-to-end encryption offered by OpenTDF to notify the user if any third party attempts to access their data. “Now more than ever, it’s important for people to know that they have a choice to protect their data. I often hear from friends that they end up using products for the features and that when it comes to security, they don’t have much of a choice. By building this app, I think we are showing the market: There is a way to protect data, and there is a way to put the control back in the hands of the individual,” says Tarryn Lambert (UX Research and Design Manager at Virtu). Conclusion This year, Black Hat and DEF CON events marked a return to a time before the pandemic. However, in many ways, it represents the effort that has been made despite these substantial challenges to innovate and grow within security. It has made us more willing to trust our abilities and also not to forget the details, especially when it comes to the software we useevery day. Did you attend, showcase a product, or speak at Black Hat USA or DEF CON this year? We want to hear about your experience. Have a trend, highlight, or story from Black Hat USA 2022 or DEF CON 30 that was not covered in this article? Please share it with us on Twitter , and we will share it with the community. Vendors and security experts: Don’t miss out on the opportunity to be featured in future LinuxSecurity articles and social media posts! Connect with us on Twitter and share your story. . Black Hat USA 2022 and DEF CON 30 highlighted vital advancements in cybersecurity, showing evolving threats and defenses in the digital world and emphasizing community-driven practices. Black Hat 2022, DEF CON 30, Cybersecurity Trends, Application Security Innovations. Hithesh Sathian. Brittany Day

Aug 22, 2022 •

Brittany Day

application securitySQL injectionsecurity testing

Protect Your Websites With Wapiti: A Comprehensive Security Audit

Globally, there are roughly 30,000 web-based cyberattacks daily, primarily targeting smaller businesses and smaller websites. To put it into perspective, that is an estimated 1 cyberattack every 3 seconds that targets websites specifically. . Cybercriminals will not hesitate to attack your website, so how can you possibly find any security issues and entry points? The answer is simple: Website Vulnerability Scanners. Follow along with us as we take a look at what a Vulnerability Scanner is and how we use WAPITI Web Scanner to test some websites. What is a Website Vulnerability Scanner? Do YOU Need It? Before we get into WAPITI Scanner, let's define a Website vulnerability and how a Website Vulnerability Scanner can help you. A website vulnerability is a flaw or vulnerability in the code of a website or web application that allows cybercriminals to gain control of the site and possibly even the web hosting server. Cybercriminals have gone so far as to write scripts that scrape the web for specific platforms in search of familiar and publicized vulnerabilities that they can exploit to steal information, access confidential documents or data, spam the site, or even inject scripts. If these attacks are successful, cybercriminals can cause irreparable damage to a business's hardware and public image, as well as raise questions about whether that company has the resources to keep their data secure, as well as the data of potential future clients. Understanding and preventing website vulnerabilities is especially important for any business or corporate institution that maintains or plans to maintain a website or web application. A website vulnerability scanner is designed to look for these security flaws in a website. It searches for flaws in web services and web servers. Because cybercriminals are quick to exploit these vulnerabilities, you should be implementing regular use of a web scanner as well. Routine web vulnerability testing will allow you to patch security flaws before cyber attackers canmanipulate them. These scanners simply examine the application's code for web flaws like SQL injections, cross-site scripting (XSS), and path traversal. Wapiti Scanner: Brief Description Wapiti gives you the ability to audit the security of your web apps. It performs "black-box" scans, which means it does not examine the application's source code but instead scans the deployed web app's webpages for scripts and forms into which it can inject data. Wapiti then acts like a fuzzer, injecting payloads to see if a script is vulnerable. Watch: Wapiti Web Vulnerability Scanner - Review + Test Wapiti Features Main Scanning Features: SQL Injections (Error based, boolean-based, time-based) and XPath Injections SQL Injection is a type of injection attack that makes it possible to execute malicious SQL statements that can control a database server behind web applications. Attackers can use SQL Injection vulnerabilities to bypass application security measures. Scanning for SQLi vulnerabilities is a must to make sure that important information is not accessed and to furthermore, be able to reinforce your server to mitigate SQL injection attacks. XPath injections are attacks where malicious user input can be used to grant unauthorized access or reveal sensitive information such as XML document structure and content. These attacks are carried out by making the user's input be used in the construction of the query string. XPath Injection scans check how your server handles malicious XPath queries. If the scan does not return information on vulnerabilities, it will be considered secure. Cross-Site Scripting (XSS) reflected and permanent Cross-site scripting targets an application's users by injecting code, usually a client-side script such as JavaScript, into a web application's output. The concept of XSS is to manipulate client-side scripts of a web application to execute in the manner desired by the attacker. XSS allows attackers to execute scripts in the victim's browser which can hijack usersessions, deface websites or redirect the user to malicious sites. Cross-Site Request Forgery (CSRF) basic detection Cross-Site Request Forgery is a malicious attack where a user is tricked into performing an action he or she didn't intend to do. A third-party website will send a request to a web application that a user is already authenticated against (e.g. their bank). The attacker can then access functionality via the victim's already authenticated browser. Targets include web applications like social media, in browser email clients, online banking, and web interfaces for network devices. CRLF Injection CRLF injection attacks are one of several types of injection attacks. It can be used to extend more malicious attacks such as cross-site scripting, page injection, cache poisoning, and cache-based tampering. A CRLF injection attack occurs when Cyber Criminals are able to inject CRLF characters into a web application. The most common use for CRLF injection attacks is log poisoning, where the Cyber Criminal forges log file entries which ultimately, can be used to hide other attacks or confuse system administrators. Although CRLF isn’t amongst the most commonly known web vulnerabilities, it is still a big threat. Due to the fact that CRLF injections are used to hide and escalate possibly stronger and potentially more dangerous attacks, it is best to use a scanner to help mitigate the exploitation of this vulnerability. XXE (Xml eXternal Entity) injection An XML External Entity attack is an attack that abuses a widely available but rarely used feature of XML parsers. Using XXE, Cyber Criminals are able to cause Denial of Service attacks on top of being able to access local and remote content and services. XXE can be used to perform Server Side Request Forgery forcing the web application to make requests to other applications. Furthermore, XXE may even enable port scanning and lead to remote code execution. There are two types of XXE attacks: in-band and out-of-band. Cyber Criminals can use XMLentities to cause a denial of service by embedding entities within entities within entities. Other Scanning Features: File disclosure detection (local and remote include, require, fopen, readfile...) Command Execution detection (eval(), system(), passtru()) Search for potentially dangerous files on the server Bypass of weak htaccess configurations Search for copies (backup) of scripts on the server Shellshock Folder and file enumeration Server Side Request Forgery Open Redirects Detection of uncommon HTTP methods Basic CSP Evaluator Brute Force login form Checking HTTP security headers Checking cookie security flags Fingerprinting of web applications using the Wappalyzer database Enumeration of Wordpress and Drupal modules Subdomain takeovers detection Log4Shell (CVE-2021-44228) detection Wapiti supports both GET and POST HTTP methods for attacks. It also supports multipart and can inject payloads in filenames. Furthermore, Wapiti displays a warning when an anomaly is found which makes the difference between permanent and reflected XSS vulnerabilities. How to Install Wapiti for Linux Distributions: With root permission, update the apt database with apt-get using the command: root@server:~# apt-get update Kali Linux and Ubuntu Installation: root@kali:~# apt-get install wapiti Debian Installation: root@debian:~# apt -y install wapiti UNIX-like Systems Installation: Prerequisites: Packages must be updated and Python must be installed. Run the command apt-get install python3 OR apt-get install python Let's grab the most recent Wapiti tar file from their page using this command below: root@kali:~# wget githubusercontent Lets extract the tar file from our download using this command below: root@kali:~# tar -xzvf wapiti3-3.1.2.tar.gz Extracting the tar file will create a directory in the directory in which you downloaded and extracted the tar file. Below, lets change to that directory using the cdcommand: root@kali:~# cd wapiti3-3.1.2/ We should now be in the wapiti3-3.1.2 directory. If we run the ls command, we should see the contents of the directory: root@kali:~/wapiti3-3.1.2# ls Bin INSTALL.md MANIFEST.in README.rst setup.py wapiti3.egg-info Doc LICENSE PKG-INFO setup.cfg VERSION wapitiCore We should now be able to install Wapiti by running the command python3 setup.py install just like below: root@server:~/wapiti3-3.1.2# python3 setup.py install Wapiti Help: For this instance, I used Kali Linux. Run the command wapiti -h to pull up a list of arguments that wapiti accepts. Wapiti in Action: For this instance, I will be using Kali Linux. Let’s use Wapiti to test Two sites, one that is generally considered secure and one that is vulnerable. Run the command below, substituting the proper url: root@kali:~# wapiti -v2 -u https://monsterhost.com/promo/ Google.com Test: For this example, we ran this command against Google . This is what wapiti will output: As you can see in the example above, we ran wapiti in verbose mode and it generated a report in html format. We use open /path/to/file to open the html file in a web browser. Below is what that looks likes: From this generated report, we see that we have a possible vulnerability with Content Security Policy Configuration. As you can see, the issue is with our CSP which helps mitigate and detect attacks such as XSS. Keep following along below to see the solution wapiti returns: The solution above is provided by wapiti. Rather than a solution, it is more of a highly recommended suggestion that you can choose to heed or not. Configuring our CSP would allow for better deterrence of attacks. HTTP Flag Cookie: In the image above, we also see that we receive a vulnerability with the HTTPOnly Flag cookie. The HttpOnly flag is not set to true in this instance. Setting it to true will help mitigate the risk of client side scripts accessing protected cookies. Secure Headers Error: In the image above, we also see that we receive a vulnerability stating it is an HTTP Secure Headers Error. Modern browsers support many HTTP headers that can improve web application security to protect against clickjacking, cross-site scripting, and other common attacks. Wapiti refers to some links that will help in hardening your web applications. Mutillidae Test: For this example, we ran this command against Mutillidae, a deliberately vulnerable web application. Whilst running, wapiti will show you real-time the tests it is running like below: In the image above, whilst wapiti was running tests, it found an XSS Vulnerability. In the image below, it found a SSRF vulnerability: When wapiti is all finished with its scans, this is what it will output: As you can see in the example above, we ran wapiti in verbose mode and it generated a report in html format. We use open /path/to/file to open the html file in a web browser. Below is what that looks like: From this generated report, we see that we have possible vulnerabilities with Content Security Policy Configuration. As you can see, the issue is with our CSP which helps mitigate and detect attacks such as XSS. Keep following along below to see the solution wapiti returns: The solution above is provided by wapiti. Rather than a solution, it is more of a highly recommended suggestion that you can choose to heed or not. The CSP is not set; configuring our CSP would allow for better deterrence of attacks. Path Traversal: A path traversal vulnerability allows Cyber Criminals to access files on your web server to which they should not have access. They do this by tricking either the web server or the web application running on it into returning files that exist outside of the web root folder. Using code access policies and chrooted jails along with using file path code to prevent users from entering the full path, we can fix thesen vulnerabilities. HTTPOnly Flag Cookie: In the image above,we also see that we receive a vulnerability with the HTTPOnly Flag cookie. The HttpOnly flag is not set to true in this instance. Setting it to true will help mitigate the risk of client-side scripts accessing protected cookies as shown in the solution below: Secure Headers Error: In the image above, we also see that we receive a vulnerability stating it is an HTTP Secure Headers Error. Modern browsers support many HTTP headers that can improve web application security to protect against clickjacking, cross-site scripting, and other common attacks. Wapiti refers to some links that will help in hardening your web applications like below: SQL Injection (SQLi): SQL injection attacks allow CyberCriminals to spoof identity, tamper with existing data, destroy the data or make it otherwise unavailable, and possibly, even become administrators of the database server. Scanning for possible SQLi vulnerabilities will help prevent your database from possibly taking over. As you can see above, Wapiti even provides us with a solution: User input must not directly be embedded in SQL statements. Instead, user input must be escaped or filtered or parameterized statements must be used. Depending on the company, getting this information to the proper team is essential to get it resolved. Server Side Request Forgery (SSRF): Solution: SSRF allows attackers to carry out scans and collect information about internal networks. Once an attacker has gained access to the server, they can use this information to compromise other servers within the network. Quite a few breaches within the past couple years such as Capital One and MS Exchange have all included SSRF attacks. SSRF vulnerabilities allow CyberCriminals to send requests from the back-end server of the web application and they do this to target internal systems that are behind firewalls and are not accessible externally. Scanning against SSRF will aide in mitigating these attacks and hopefully, keeping your system secure. Wapiti provides uswith a solution as shown above. The more frequently you scan, the closer we are to avoiding another Capital One-like instance. Cross-Site Scripting (XSS): Solution: Cross-site scripting works by manipulating a vulnerable website so that it returns malicious JavaScript to users. Cybercriminals can fully compromise users interaction with web applications by executing this malicious Javascript code/scripts. The way to ensure that you, your users, and your web app are safe is to ensure that the application does checking and validation of headers, cookies, query string, forms, and hidden field. Moreover, encoding user output can help mitigate these types of attacks. Wapiti Summary Wapiti is a well-known tool that is widely used amongst security researchers, regular users, and even System Administrators. As Cyber Criminals continue to exploit new found vulnerabilities and even existing ones due to poor security management, Wapiti is the perfect solution to auditing your website and webservers. The commands and arguments are fairly simple to use, it is a powerful tool, and the report provided in HTML format allows for any user to see urgent issues and their possible solutions without having to sit, search, and create a solution. It provides you with a baseline understanding of your vulnerabilities and a baseline path to a solution. Our Thoughts Web applications are the technological base of modern companies. That’s why more and more businesses and corporate institutions are looking to monitor their websites and web apps more often and wapiti is the perfect tool to do so. It is amongst many well-known web vulnerability scanners and can play an essential role in assisting daily users and System Administrators alike to deter attacks. We hope you found this article useful! Be sure to stay tuned for more tips and advice on Linux security tools. . Cybercriminals will not hesitate to attack your website, so how can you possibly find any security i. globally, there, roughly, web-based,cyberattacks, daily, primarily, targeting, smaller, busines. . Brian Gomez

Jul 04, 2022 •

Brian Gomez

application securitysocial engineeringpatch management

Cybersecurity Trends from Black Hat USA 2021 and DEF CON 29 Highlights

Black Hat USA 2021 and DEF CON 29 have come to an end, and this year’s events did not disappoint, generating plenty of cybersecurity news, highlighting key industry trends and introducing some exciting new products. LinuxSecurity has been following both conferences, speaking with expert trainers and presenters and keeping our followers up-to-date on Twitter. Here are the highlights, key takeaways and notable trends we identified as Black Hat USA 2021 and DEF CON 29 unfolded that you should be aware of. . What Are Black Hat and DEF CON? Black Hat USA, a renowned event that features briefings and trainings taught by experts from around the globe, providing offensive and defensive hackers of all levels with invaluable opportunities for firsthand technical skill-building, celebrated its 24th anniversary this year. Black Hat USA 2021 was conducted in a unique hybrid format, which began with fourdays of real-time online Virtual Trainings, followed by the two-day main conference (both a Vitual and Live at the Mandalay Bay in Las Vegas. Each year, Black Hat USA is immediately followed by DEF CON, an infamous hacker conference also held in Las Vegas. The event consists of several tracks of speakers with expertise in the realm of computer security and hacking, as well as cybersecurity challenges and competitions (known as hacking “wargames”). Black Hat USA 2021 & DEF CON 29 Highlights, Announcements & Notable Trends As Cloud & Container Adoption Continues to Increase, Security Falls Behind & Ransomware Risk Skyrockets Cloud, Container, Kubernetes and Serverless environments have become the norm in modern infrastructure. Cloud and container adoption is rapidly increasing, as these technologies and frameworks enable organizations to grow and evolve at a very high velocity compared to the traditional workloads. In an recent interview with LinuxSecurity, Cloud Native Security Architect and instructor of the Black Hat USA 2021 course A Practical Approach to Breaking & Pwning Kubernetes ClustersMadhu Akula explained, “The challenges we see mostly arise from misconfiguration issues, which can have a big impact like the compromise of data and infrastructure. The recent Red Hat State of Kubernetes Security Report states that 94% of respondents experienced at least one security incident in their Kubernetes environments in the last 12 months, and concludes that security misconfigurations are to blame for the majority of these issues.” He elaborates, “These past few months have shown that supply chain attacks have serious implications when it comes to the security of modern infrastructure, as everything is codified including policies, infrastructure, applications - even security. With the ever-changing technology landscape, it’s hard for organizations and teams to keep up with securing Cloud and container environments, as doing so requires them to understand the latest technology prior to solving security problems.” In the wake of the Colonial Pipeline ransomware outbreak and other recent supply chain attacks, the US National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) have released Kubernetes hardening guidance which includes various tips and best practices for securing Kubernetes. NSA & CISA Kubernetes Hardening Advice Scan containers and pods for vulnerabilities or misconfigurations. Run containers and pods with the least privileges possible. Use network separation to control the amount of damage a compromise can cause. Use firewalls to limit unneeded network connectivity and encryption to protect confidentiality. Use strong authentication and authorization to limit user and administrator access and limit the attack surface. Use log auditing so that administrators can monitor activity and be alerted to potential malicious activity. Periodically review all Kubernetes settings and use vulnerability scans to help ensure risks are appropriately accounted for, and security patches are applied. However, security researcher and DEFCON 29speaker Robert Graham doesn't necessarily think that hardening defenses is the best approach to protecting against ransomware and other persistent cyber threats. Graham explains, “The way you secure a bank is not by locking the front door; the bank has to be open for business and you have to have people come in. It's the same thing with networks.” He also believes that awareness is not enough without a comprehensive understanding of the threats organizations face and the security defenses required to combat them, stating, “So the approach to ransomware is that we're aware, but we're not actually aware of the details.” Guardian Digital , the open source email security company, also recognizes this growing issue, and has created a free toolkit to help businesses understand their email risk profile and how they can bolster their email security strategy to repel ransomware and other dangerous email-borne attacks in less than two minutes. Madhu Akula’s A Practical Approach to Breaking & Pwning Kubernetes Clusters Black Hat USA 2021 course covered multiple real-world security issues by showcasing hands-on labs for participants to teach and assess for security issues, misconfigurations and insecure defaults, going beyond basic attacks to privilege escalation, exploitation, lateral movement, persistence, defense evasion and many other advanced techniques. OSINT Powers Social Engineering Attacks & Security Awareness Training Designed to Combat Them OSINT (Open Source Intelligence) is the foundation on which all engagements are built. Without credible, actionable information, social engineering attacks designed to manipulate psychology can neither be developed nor performed effectively. All forms of social engineering, be it phishing, vishing, or impersonation, begin with information gathering in order to understand the target and tailor attacks that are meaningful and relevant enough to generate engagement. In a recent interview with LinuxSecurity for this article, Social-Engineer, LLC ChiefOperating Officer and instructor of the Black Hat USA 2021 course Practical OSINT for Social EngineersRyan MacDougall explained the importance of social engineering in modern cyberattacks, “Social engineering is the mechanism behind the great success of phishing, BEC, and other email threats. Without purposeful social engineering, attackers are just sending emails to targets that will likely be ignored. Real world attackers do not have to train their targets after an attack, so they can employ malicious and manipulative techniques to induce strong negative emotions in their targets, which leads to compromise.” He elaborates, “From the ethical social engineering standpoint, once you employ scientifically proven techniques to influence a target, that is where you construct the teachable moment to train employees to critically think about a possible attack while in the moment, and still preserve their dignity and integrity. Without the information obtained via OSINT that is required to build a realistic attack, there is no training that can be provided after the engagement.” Qualys Demonstrates CSAM & Zero Touch Patch Management Qualys is demonstrating Cybersecurity Asset Management (CSAM) to help users detect security gaps and respond to risk and Zero Touch Patch Management , which helps organizations to “proactively patch prioritized vulnerabilities with ‘intelligent’ automation – before attacks can exploit them,” the company asserts. At this year’s Black Hat USA event, the leading provider of disruptive cloud-based IT, security and compliance solutions, announced its collaboration with Red Hat to drive greater security for both the container and host operating system for Red Hat OpenShift. Built on the Qualys Cloud Platform, the solution seamlessly integrates with customers’ vulnerability management workflows, reporting and metrics to help reduce risk. Qualys Cloud Agent for Red Hat Enterprise Linux CoreOS on Red Hat OpenShift helps customers: See the Full Inventory –Continuous visibility of installed software, open ports, and Red Hat Security Advisories (RHSA) for all Red Hat Enterprise Linux CoreOS nodes with comprehensive reporting. Manage Host Hygiene – Fully integrated on the Qualys Cloud Platform to automatically detect and manage host status related to patches and compliance adherence for known vulnerabilities. Easily Deploy to the Host - Simplified deployment via the Qualys Cloud Agent to secure the host operating system. This approach eliminates the need to modify the host, open ports, or manage credentials. Get Complete Coverage – Full coverage of Red Hat OpenShift and Qualys Container security delivers comprehensive visibility from the host operating system through to images and containers running on OpenShift. Sparrow Co. Introduces Two New AppSec Solutions Sparrow Co. introduced two new application security solutions at this year’s Black Hat USA conference — Sparrow Cloud and Sparrow SCA. Sparrow Cloud offers application security as a service by “performing static and dynamic analysis anytime and anywhere at minimum cost.” Sparrow SCA is an open-source management solution that “automatically identifies open-source software in use and detects security vulnerabilities in the source code and binary,” the company says. Atakama & Spirion Showcase a Joint Multi-Level File Encryption Solution Atakama and Spirion showcased a joint solution for classifying and protecting sensitive data through multi-factor file-level encryption at Black Hat USA 2021. The passwordless encryption solution is cross-compatible with all major OSes, and eliminates one of the biggest threats facing organizations today - data exfiltration. Atakama explains, “Each encrypted file receives its own unique AES encryption key with 256 bits, which is fragmented into components and distributed across multiple physical devices. The file is available only to authorized users, which they can unlock through a multi-factor approval process. By encryptingevery file with its own unique encryption key, Atakama renders a breach almost completely useless.” Optiv Security Launches a MXDR Service, Exabeam Unveils its XDR Alliance & SecureWorks Showcases its XDR Services Optiv Security launched a technology-independent Managed Extended Detection and Response (MXDR) service which the company states “enables clients to take rapid and decisive action against today’s most critical cyberattacks and strengthen their security posture.” Cloud-native logging and security analytics provider Devo has been a foundational partner in Optiv MXDR. Exabeam also unveiled its XDR Alliance at this year’s Black Hat USA event. The cybersecurity leader states that the alliance seeks to “foster an open approach to XDR (eXtended Detection and Response), which is essential to enable organizations everywhere to protect themselves against the growing number of cyberattacks, breaches, and intrusions.” Secureworks also showcased its innovation and expertise in the realm of cloud-bases XDR products and services at the conference. The MSSP showed how Taegis XDR, Taegis VDR and Threat Intelligence can help organizations reduce the risks and consequences of a breach. The leading cybersecurity provider also discussed a new Taegis XDR Adversary Software Coverage (ASC) tool, which the MSSP says “allows users to interactively explore how Secureworks Taegis XDR maps coverage and countermeasures to the tactics and techniques used by over 500 adversarial software types against the MITRE ATT&CK framework, including ATT&CK v9”. CrowdSec Wins a Black Unicorn Award as One of the Top 10 Cybersecurity Companies of the Year CrowdSec was named a winner for the Top 10 Cybersecurity Startups for 2021 at the Black Unicorn Awards for cybersecurity innovators, which are hosted by Cyber Defense Magazine and take place each year during the Black Hat USA conference. The judging panel announced, “We’re pleased to name CrowdSec as a Winner for the Top 10 Cybersecurity Startups for 2021among a small, elite group of startups in our third annual Black Unicorn awards.” On July 8, 2021, the CrowdSec team released CrowdSec v1.1.x - the latest version of their free and open-source cybersecurity solution designed to protect Linux servers, services, containers, or virtual machines exposed on the Internet with a server-side agent - with new packages and repositories, as well as improvements to to the CrowdSec agent itself. In a recent interview with LinuxSecurity, CrowdSec CEO and co-founder Philippe Humeau explains the company’s mission, “The goal is to leverage the power of the crowd to create a real-time IP reputation database. Ultimately, CrowdSec harnesses the power of the community to create an extremely accurate IP reputation system that benefits all its users. With its collaborative, transparent roots, Open Source has provided and continues to provide our team with the optimal framework to accomplish this mission”. DEF CON 29 Badge Embraces the New Normal DEF CON 29 was an event to remember, with its unique hybrid format due to the pandemic. Following this theme, the DC29 badge doubles as a practical tool for virtual attendees and an electronic puzzle for those who are able to bring a few of them together physically. On its own, the DC29 badge is a four-key RGB mechanical macro pad that connects to your computer over USB-C. Featuring highly configurable software, hot-swappable switches, and customizable keycaps, the DC29 badge is a surprisingly robust and flexible little macro pad. While a DC29 badge is quite useful on its own, it’s also designed to work in conjunction with other badges, as the edge connectors and silkscreen messages hint. Multiple badges can either snap together or be interlinked via USB cables, and they conveniently do not need to be tethered to the computer for power. DEF CON 29 attendees: Have you tried connecting your badge with others? If so, share a picture or a video of what happened when you did with us on Twitter - we’ll share it withour followers and give you a shoutout. Did you attend, showcase a product, or speak at Black Hat USA or DEF CON this year? We want to hear about your experience. Have a trend, highlight, or story from Black Hat USA 2021 or DEF CON 29 that was not covered in this article. Please share it with us on Twitter and we will share it with the community. Vendors and security experts: Don’t miss out on the opportunity to be featured in future LinuxSecurity articles and social media posts! Connect with us on Twitter and share your story. . Discover key trends from Black Hat USA 2021 and DEF CON 29, emphasizing cybersecurity innovations and practices.. black, year’s, events, disappoint. . Brittany Day

Aug 08, 2021 •

Brittany Day

application securitysql injectionweb security

Essential PHP Security Practices To Avoid SQL Injection Risks

Today on Hacks From Pax we'll be discussing PHP web application security. PHP is a great language for rapidly developing web applications, and is very friendly to beginning programmers, but some of its design can make it difficult to write web apps that are properly secure. We'll discuss some of the main security "gotchas" when developing PHP web applications, from proper user input sanitization to avoiding SQL injection vulnerabilities. . Many PHP application vulnerabilities are caused by not properly initializing variables. This is an example of how PHP, by not requiring the developer to initialize a variable before using it, sacrifices security for ease of use. For example, the following code is easily exploitable. if (user_auth()) { $access = true; } if ($access) { do_sensitive_things(); } This could be exploited by tacking an ?access=true to the end of the url, and the if ($access) test would be passed despite the user_auth() function returning false. This hole could be closed easily by adding a $access = false; at the top of the script, but not all security holes are this easy to spot. Thankfully, PHP now defaults the register_globals option to off. This setting would pass the access variable sent by the url to the script as $_GET[access] rather than just $access . This closes off many of these types of vulnerabilities, but when writing PHP code, especially code for distribution, you should never assume that this option will be set correctly, and always initialize your PHP variables. Users in a shared hosting environment may not have the ability to set these options to their most secure setting. Always initialize PHP variables before using them. Always set register_globals to off, but never write code that assumes this setting. You can use the ini_get() function to determine if register_globals is set at runtime. Another common cause of PHP application holes is improper sanitization of user provided data. For example, if you allow a user to fill out a form and then pass data from a field on that form to a function like system() or exec() the data could contain something malicious, like an ; rm -rf * command tacked onto it. Never trust user provided data. Beware functions that launch system commands, think long and hard about checking any data that is passed to them. Another related but common security flaw in PHP applications is a SQL injection vulnerability. The magic_quotes_gpc option can mitigate this, but as with register_globals you should not assume this setting is on. For example, in your PHP script you might ask the user for a user id and password, and then check for the user by passing the database a query. SELECT * FROM users WHERE name='$username' AND pass='$password'; However, if the user logging in is malicious and devious, he may enter the following as his password: ' OR '1'='1 This causes your query to become: SELECT * FROM users WHERE name='known_user' AND pass=' OR '1'='1'; The user has just logged in with no password, and your application has been penetrated. To avoid this, check for the status of magic_quotes_gpc() using the ini_get() function and if it is disabled, pass all user input that must be included in a query through addslashes() . This will escape the single or double quotes in the user input with backslashes, thereby thwarting the attempted SQL injection attack. Use magic_quotes_gpc , but don't assume it is on or depend on it. The addslashes() function should be used on user data passed to SQL queries. Again, you simply cannot trust user provided data. The PHP online manual contains an entire chapter on PHP security . It's an excellent resource, and goes into much more detail on the PHP security issues I've discussed in this article. Until next time, stay secure, and don't blindly trust any user provided data. -- Pax Dickinson has over ten years ofexperience in systems administration and software development on a wide variety of hardware and software platforms. He is currently employed by Guardian Digital as a systems programmer where he develops and implements security solutions using EnGarde Secure Linux. His experience includes UNIX and Windows systems engineering and support at Prudential Insurance, Guardian Life Insurance, Philips Electronics and a wide variety of small business consulting roles. . PHP developers must be aware of common security pitfalls such as SQL injection and XSS that can expose applications to threats, implementing effective strategies to mitigate risks. php security, sql injection, secure coding practices. . Brittany Day

Aug 08, 2005 •

Brittany Day

risk managementsecurity practicesapplication security

Essential Takeaways from Sean Boran's Guide to IT Security Solutions

Over the past five years, Sean Boran has put together what has become the most comprehensive online Internet security resource available. LinuxSecurity recently had an opportunity to chat with the author, talk about its new home at LinuxSecurity.com, and a few words about the resource itself. . The IT Security Cookbook contains valueable information for security professionals, computer users, and system administrators on topics including security policy development, operating system security, application security issues, and much more. LinuxSecurity.com, the community's center for security, has made available the resources within the IT Security Cookbook to its users and provided Boran Consulting with a new home, as well as email and DNS services. Sean Boran , author of the IT Security Cookbook and president of Boran Consulting explains that the resources of LinuxSecurity.com provides less expensive hosting for his free resource. Sean adds, "It also increases its exposure to Linux readers, given the pull that LinuxSecurity has." "I was already a pretty frequent visitor to LinuxSecurity.com," writes Sean, "so it seemed quite a natural place to host the cookbook, when the idea was proposed." LinuxSecurity.com: Why is it important for IT professionals to read your cookbook? Sean Boran: Because it starts at the top (policies) and goes all the way down to technical recommendations. LinuxSecurity.com: What is the intended audience? Sean Boran: Well there a general policy/classification section that is probably of interest to a large audience, where as the technical chapters on UNIX and Windows are useful to administrators of these systems. More precisely: Line managers (Chapters 1-4, 6). Computer Users (Chapters 1, 2, 6.2 User Policy) System administrators, Security administrators: Chapters 7-22 Technical Project leaders: Chapters 1-7, 15. LinuxSecurity.com: Why did you write the cookbook in the first place? Sean Boran: I didn't see anything similar on the net at the time (back in 1995/6), there was a few documents here and there, but little that pulled the various security issues together. I also wanted to make my contribution to the Internet, instead of "just taking" ... For example I use lots of free software developed by others, this was my way of "doing my bit". Security was a pretty closed affair a few years back, before SANS and all the new portals such as LinuxSecurity.com, I wanted to share ideas and allow peer review of my ideas. LinuxSecurity.com: How long has it taken to write? Sean Boran: About 1 year, with many additions/corrections over the last 5 years. Mind you like much "software" it's probably due a rewrite! LinuxSecurity.com: What does Boran Consulting do? Sean Boran: We provide IT Security and Operations services to our customers. The exact focus depends on the environment and customer needs. Last year we did a lot of work on Intrusion detection systems and audits, a few years back the focus was more on education, policy, strategies and concepts. Over the last two years many articles were written for SecurityPortal until it's demise last summer. These articles allowed me to better document and generalise tools and ideas I was using in the consulting practice. LinuxSecurity.com: What are your future plans for the reference? Sean Boran: I've been working on a series of accompanying articles on Solaris hardening, ssh and Linux. These are not yet integrated into the book, but can be reach at Sean Boran's Published Articles . I really need to review and review the book entirely, expecially the techie chapters, but am having trouble finding the time.. LinuxSecurity.com: What are some of the major pitfalls Linux administrators fall into? Sean Boran: Complacency Using default settings (though the vendors are improving a lot here) Installing too much software Notmonitoring logs Don't have policy, or have never really analysed the risk: they may be concentrating in the wrong area. LinuxSecurity.com: How can your reference solve these problems? Sean Boran: Many Linux users are techies and have a pretty good grasp of the techical issues of secuity, and sites like LinuxSecurity can keep them up to date. But a crash course on Policies and Risk management would do no harm. This book crosses many boundaries, from policy to security management to firewalls, from penetration testing to securing NFS to using encryption. LinuxSecurity.com: What do you feel is the most common Linux vulnerability? What can be done to prevent it? Sean Boran: The buffer overflow. Measures: Only install what you really need. Watch the logs of any active network daemons carefully, and chroot 'em if you can, don't run them as root if possible. Only let people access your system who really need to. Setup a regular patching schedule Pray that SW will get better... LinuxSecurity.com: Do you believe the open source nature of Linux provides a superior vehicle to making security vulnerabilities easier to spot and fix? Sean Boran: In the long run yes, but it's been painful. The basic problem is that 99% of people USE open source, but only 1% or so have to do all the work and write the stuff. I'm convinced that it's a good thing and we should all do our bit to support open source, I'd especially like to see large corporations committing programmers to key OpenSource projects. LinuxSecurity.com: Sean, thanks for taking a minute to speak with us today. . Explore core principles outlined in the IT Security Cookbook designed for both experts and end-users regarding essential protective measures and security regulations.. IT Security Cookbook, Security Guidance, Online Security Resource, System Administration, IT Security Practices. . Brittany Day

Feb 25, 2002 •

Brittany Day

Community Poll

More Polls

Should Linux servers automatically install security updates?

Yes — critical security patches should install automatically.
No — every update should be tested before deployment.
Only critical vulnerabilities should auto-install.
I patch when Reddit starts panicking.

Stay Ahead With Linux Security Features

Refine features

Get the latest News and Insights

Community Poll

Should Linux servers automatically install security updates?

Trending Features

Cron Job Abuse For Linux Persistence Mechanisms Detection

Essential Cybersecurity Practices for Businesses to Protect Data

HTTP/2 Bomb: Why Linux Infrastructure is Vulnerable to a New Low-Bandwidth DoS Attack

Red Hat npm Package Compromise Highlights a Growing Supply Chain Problem

Explore Latest Linux Security features

The End of “Patch and Pray”: How Rust Is Reshaping Memory Safety in Linux

Why Your "Shadow IT" Developer Tools Are the Biggest Risk to Your Linux Systems

.NET Core Migration Challenges: Enhance Security with Linux Integration

Cyber Warfare and 5G Risks: Insights from Black Hat 2022 and DEF CON 30

Protect Your Websites With Wapiti: A Comprehensive Security Audit

Cybersecurity Trends from Black Hat USA 2021 and DEF CON 29 Highlights

Essential PHP Security Practices To Avoid SQL Injection Risks

Essential Takeaways from Sean Boran's Guide to IT Security Solutions

Get the latest News and Insights

Community Poll

Should Linux servers automatically install security updates?

Trending Features

Cron Job Abuse For Linux Persistence Mechanisms Detection

Essential Cybersecurity Practices for Businesses to Protect Data

HTTP/2 Bomb: Why Linux Infrastructure is Vulnerable to a New Low-Bandwidth DoS Attack

Red Hat npm Package Compromise Highlights a Growing Supply Chain Problem

Powered By

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

QUICK LINKS

subscribe to newsletters!

Stay Ahead With Linux Security Features

Refine features

Topics

Authors

Published Date

Get the latest News and Insights

Community Poll

Should Linux servers automatically install security updates?

Trending Features

Explore Latest Linux Security features

Get the latest News and Insights

Community Poll

Should Linux servers automatically install security updates?

Trending Features

Search Topics

Powered By

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

QUICK LINKS

subscribe to newsletters!