Wesley Dunnington

#APISecurity risks are not well understood and often overlooked. The litmus test is simple… Are you capturing your API activity at run time and at scale? Can you prove to an investor, customer, auditor or regulator that your APIs are not being misused or abused? If you are not sure, come and learn from Graylog, Inc. expert on the subject Rob Dickinson.

8

Looking forward to seeing the impact of MITRE EMB3D on #SupplyChainSecurity

3

THIS IS WILD - EXPMON Public Detected a PDF "Zero-day" PoC in the wild Which Triggers a RCE Vulnerability In Adobe Reader! Adobe has been notified, will release full details after the vendor finishes their investigation. Please note: 1. This was detected by EXPMON Public (https://pub.expmon.com) when it's on a mission to analyze a huge public PDF sample set (check it out https://lnkd.in/guFBJTFD). I've "hidden" that particular submission since I realized this finding (to give Adobe the vendor a chance to review). 2. EXPMON system detected the crash and reported it as a potential zero-day attack (see picture). 3. This seems not to be a full working exploit, but a crafted PoC, at least. As I didn't see any payload in the sample. Currently not sure if it's malicious (say, a partial unfinished 0day exploit leaked), or non-malicious (crafted PDF sample for good-purpose PDF app testing?). 4. Anyway, this does bring an exploitable crash on the latest Adobe Reader, the root cause seems to be use-after-free. However, all are based on my brief analysis, need Adobe's confirmation. Sigh.. You never know what you will find in real-world samples! More importantly, I feel EXPMON is on a good mission to fill the industry gap - looking deeply into all the files from a vulnerability/exploit perspective. :) #expmon #zeroday #0day #exploit #threatintel #adobe #pdf

50

7 Comments

There's a pretty advanced "detection in depth" (I like that name) feature I've been working on for EXPMON system for PDF zero-day exploit detection. Currently on private test, will roll out to https://pub.expmon.com when good to go. This was inspried by my personal witness at PWN2OWN this year where Adobe Reader once again got easily exploited. There're SO MANY need to be done/innovated from exploit detection perspective. Detection-in-depth in PDF is super challenging. The PDF on Adobe Reader is like a browser (JavaScript) + complicated file format + various undocumented features, combined.. Sigh.. #expmon #zeroday #exploit #detection #pdf #adobe

18

2 Comments

💡 Do I need to report PKI maturity level? Reporting your PKI maturity level isn’t just a checkbox! 🛠️ While not mandated by the PKI Consortium, documenting your PKI maturity level can: 📈 Highlight your current PKI status to stakeholders 🚀 Pinpoint key areas for improvement 📊 Track progress over time effectively Depending on your organization's needs, regulatory requirements, or improvement goals, reporting might be essential. Learn more about PKI Maturity Model: https://pkic.org/pkimm/ #pki #pkimm #pkic #maturity #improvement #assessment #benchmark #guidance PKI Consortium Paul van Brouwershaven Leigh Bailey

9

1 Comment

The modern IR guide looks more and more like this: Step 1: Find out where MFA is not enabled Step 2: Find out why logs were only partially enabled Step 3: Find out if an existing leak on BreachForums is present Step 4: Find out if which user clicked on a fake Google Ad that make them install an infostealer Step 5: Fill in your 8-K Form

6

A vulnerability has been identified, CVE-2024-27322, in the R programming language that permits arbitrary code execution by deserializing untrusted data. CERT Coordination Center (CERT/CC) has issued an advisory for CVE-2024-27322, cautioning against arbitrary code execution via malicious RDS or RDX files. What should you do? ⬆️ Update R to version 4.4.0 or later promptly. ⛔Until then, avoid interaction with untrusted RDS files or packages to mitigate risks. There is currently no public proof-of-concept or exploitation evidence available. https://bit.ly/44t7vFt

10

I’ve written a number of posts on testing and rolling out security controls safely on my blog including this one from 2020 ~ Better Testing for Better Outcomes. I have a bunch of others in a thread on X (sorry it’s the easiest right now) and on my blog. Taking the time to properly test and building tests into the software itself can prevent a lot of pain later. I explain how to do that in my posts and show examples of things not properly tested as well. https://lnkd.in/gcJ-PeG

10

4 Comments

Sravish Sridhar is right: the traditional TPRA process is broken. Questionnaires too often focus on "check-the-box" security without the necessary context of the systems in question and actual practices in place. Evidence often focuses on easily manipulated screenshots that lack context and are costly and time-consuming to verify. Despite this, the need for a quality TPRA process remains. Engaging with a new vendor inherently opens your organization to new points of risk – risk that must be surfaced, understood, and mitigated. CISOs need a process to verify the vendor's security and privacy postures and build verifiable trust. The future of TPRA lies in providing programmatic proof, enabling a quantifiable understanding of risk, and ensuring that security and privacy controls are in place. This will empower organizations to confidently engage with their vendors, knowing that their sensitive data and critical systems are protected.

10

1 Comment

#WebTPA a medical provider posted a notice of a data security #incident https://lnkd.in/ebM6njS8 . h/t to Riskybiz for flagging this one in their great newsletter From a close reading of their notice, we still don't really know anything about this breach, or if they have removed the attacker from their network. Lets break out the magnifying glass and dive in🕵‍♂️. > WebTPA Employer Services, LLC (“WebTPA”) recently detected a data security incident impacting certain systems on our network Good that they detected it, but not a useful statement as there's no details. Could it have been their central database of PII, could it have been a backup, an open file store? We don't know, just something on their network > On December 28, 2023, we detected evidence of suspicious activity prompted... > The investigation concluded that the unauthorized actor may have obtained personal information between April 18 and April 23, 2023 Great that they had the logs to go back in time 8 months from December to look at the activity once they detected it. However, it's concerning that nowhere in the statement do they talk about how the threat actor gained initial access, or acknowledge that they don't know. There's also no explanation about why the threat actor stopped on the 23rd. Is it because they took a system offline? or because they downloaded all the records and left? we don't know > ....(something is missing) Lastly this statement never says that this threat actor was removed from their network. This leaves me to wonder if they are still in the network, or did they sell this access to another threat actor and this isn't the end. WebTPA says they concluded their investigation so either this is sloppy writing, or they don't know if they have removed the threat actor from their network. As always #hugops to the security team at WebTPA, they have been doing some work. When you are working a security incident you have all the details in your head, but as outsides this notice is all we have. This notice doesn't really tell us anything, or restore any confidence.

3

1 Comment

It's awesome to see Auguria, Inc. on this list! Chris Coulter and Keith Palumbo are building something amazing, especially if you're working with XDR or cloud alerts and telemetry. Security teams should never need to talk about ETL or pipelines or have to beg, borrow, or steal tools from other domains. They need something where bad data goes in, and good data comes out, before it hits the SIEM, lake, or any analyst, whether AI or human. If you want to see how something like that works, let's talk.

16

5 Comments

Here we go again. There's another Foxit Reader crash detected by EXPMON Public (https://pub.expmon.com). Unlike the previous ones that were actually patched in the latest version (https://lnkd.in/g_wPzfkJ), this one does cause a crash on the latest Foxit Reader. However, my brief analysis has found that: 1. This is not a malicious exploit, just a real-world PDF sample happens to trigger a bug in Foxit Reader. 2. It seems to be a null pointer dereference crash (so probably not exploitable). Nonetheless, I've sent the sample to the vendor (Foxit Software), for safety reasons. Will share out the particular sample after the vendor finishes their investigation. As reported, recently EXPMON Public has detected some "zero-day" PDF crashes including one notable crafted/exploitable Adobe Reader crash (https://lnkd.in/ghQYYzXR), when it's just on its mission to analyze a (huge) public PDF sample set - WILD. EXPMON is designed and built for detecting any exploitation-related activities. Because application crash is a big and important indicator for potential exploitation, EXPMON carefully reports them. So, if you see Indicator related to application crash when using EXPMON, you should pay attention to that submission. #expmon #ExploitDetetcionInnovations #foxitreader #pdf

24

SBOM may not produce vulnerability management value for many software consumers without CMDB correlation. There's a bunch of great SBOM tools out there today, illuminating vulnerability risks in our software supply chain. But if you are part of the vuln team, what do you do with this information? You are not fixing software in a vacuum. You are updating a software package on an asset, upgrading firmware, or implementing mitigating controls like IPS rules or ADC configurations. You are probably also asking your vendor when they will issue a security patch. But if you don't know which assets are affected, actioning all of this is going to be really hard to do. We have to start somewhere, but we really need a lot more focus on connecting these disparate datapoints. Your supply chain risk team and your security operations and vulnerability management folks need to come together and figure out how to get this done. Otherwise, your SBOM program might only be a compliance exercise. We cover these topics and a lot more in SANS SEC547 Defending Product Supply Chains at https://lnkd.in/ezXxQhtz and we'd love to see you in an upcoming course. Please register below, or drop me a line if you have questions or comments. #cybersecurity #sbom #supplychainsecurity #securityoperations #vulnerabilitymanagement

39

9 Comments

Last year, 59% of surveyed enterprises reported delaying their application rollout due to API security issues. And this is a valid fear as over 34% of executives were not confident if their existing API inventory was complete. In an already dire situation, integrating more APIs can certainly be challenging. But it doesn’t have to be this way. API adoption was meant to accelerate business growth, not limit it. To ensure that you can securely ship new code to prod daily/weekly or as frequently as you’d like, we Levo.ai provide regular updates regarding any changes to your internal, external, and third-party APIs. Have a look ⬇️ #apis #apisecurity #appsec #cybersecurity #tech #businessgrowth

46

1 Comment

Great write-up, and great talk (encourage everyone to watch, link in comments). For security leaders running analytics on Snowflake who want help with normalization, Tarsal offers a variety of options, and you can normalize to the standard you want.

11

1 Comment

If you value time, efficiency, and minimal effort, then this tutorial is for you. Leveraging EJBCA with Ansible is made easy using our open-source Ansible playbook and EJBCA Enterprise 30-day free trials available on AWS or Azure marketplaces. You will get a full PKI up and running smoothly, minimize errors, and save your energy for more critical tasks. You can become a PKI Automation Fanatic in no time. You can find more information and the link to the YouTube tutorial here: https://lnkd.in/dkVkS4qf #PKI #EJBCA #Automation

31

Armis is uniquely capable of managing and prioritizing risk in complex higher education environments. Learn how Lehigh is using Armis to see, protect, and manage IT, IoT, OT, all the T's!

6