Security Boulevard

Authors/Presenters:Ruben Recabarren, Bogdan Carbunar, Nestor Hernandez, and Ashfaq Ali Shafin,

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – Strategies and Vulnerabilities of Participants in Venezuelan Influence Operations appeared first on Security Boulevard.

There is an increased focus on how advances in artificial intelligence (AI) and machine learning (ML) can negatively impact network security.

The post How to Maximize Network Security With AI and ML appeared first on Security Boulevard.

DEF CON conference organizations are looking for volunteers to join a Franklin initiative to help secure critical infrastructure and school systems that lack the expertise required to defend themselves against cyberattacks.

The post DEF CON Calls for Cybersecurity Volunteers to Defend Critical Infrastructure appeared first on Security Boulevard.

The post Zero Compromise with Content Disarm and Reconstruction (CDR), Powered by Zscaler Browser Isolation and Votiro appeared first on Votiro.

The post Zero Compromise with Content Disarm and Reconstruction (CDR), Powered by Zscaler Browser Isolation and Votiro appeared first on Security Boulevard.

Google cybersecurity researchers confirm that the Iranian-sponsored APT42 threat group is being ongoing phishing campaigns against President Biden, Vice President Harris, and ex-President Trump in an attempt to influence the upcoming presidential elections.

The post Google: Iranian Group APT42 Behind Trump, Biden Hack Attempts appeared first on Security Boulevard.

A couple of weeks ago, Balbix was recognized as a Representative Vendor in the newly created Exposure Assessment Platforms (EAPs) category in the Gartner® Hype Cycle™ reports for Security Operations and Managing Operational Technology, 2024. In the report, Gartner mentioned that deploying “the EAP platform has high benefits, with 20-50% market penetration expected within 2-5 …

Read More

The post Balbix Recognized in Three 2024 Gartner® Hype Cycle™ Reports appeared first on Security Boulevard.

The recent Federal Communications Commission (FCC) settlement with TracFone Wireless, Inc. (TracFone) for $16 million highlights a critical vulnerability within the mobile telecommunications industry: API security. The investigation revealed unauthorized access to customer data through weaknesses in TracFone's mobile carrier APIs. This incident reminds mobile carriers to prioritize robust API security measures to safeguard customer data and ensure network integrity.

Mobile Carrier APIs: Essential Tools with Potential Risks

Mobile networks rely heavily on APIs to connect with partners, enable customer self-service features, and integrate with third-party applications. While these APIs offer valuable functionalities, they also introduce security risks. Here's a deeper dive into the factors contributing to API vulnerabilities within the mobile landscape:

• Complex Network Ecosystems: Mobile networks are intricate environments with numerous interconnected systems and APIs. Managing and securing these APIs effectively presents a significant challenge for security teams.
• Legacy Infrastructure: Some mobile operators may still utilize older infrastructure not designed with API security as a primary focus. These legacy systems might have inherent vulnerabilities that attackers can exploit.
• Third-Party Integration Landscape: Integrations with third-party applications, while offering additional features and functionality, add complexity to the security landscape. If those third parties have inadequate API security practices, it creates potential entry points for attackers.
• Evolving Threat Landscape: Cybercriminals constantly develop new methods to exploit API vulnerabilities. Traditional security solutions might struggle to keep pace with these ever-evolving threats.

Beyond Financial Penalties: The Devastating Impact of a Data Breach

A data breach involving mobile APIs can cascade, impacting the carrier and its customers. Here's a breakdown of the potential consequences:

• Compromised Customer Identity: Exposed customer information like names, addresses, Social Security numbers, and phone numbers can be used for fraudulent activities like identity theft. This can create significant hardship for customers and damage their financial standing.
• Financial Losses for Customers: Stolen account details can lead to financial fraud and direct customer losses. This can erode trust in the mobile carrier and cause customer churn.
• Regulatory Fines and Compliance Issues: Non-compliance with data security regulations like the FCC's safeguards rule can result in hefty fines. These fines can significantly impact a carrier's profitability.
• Reputational Damage: Data breaches can severely erode customer trust and damage the mobile carrier's reputation. Building trust can be long and arduous, potentially impacting customer acquisition and retention.

Salt Security: Proactive Defense for Mobile Network Security

Salt Security offers a comprehensive API security platform explicitly designed to address the unique challenges mobile carriers face. Our solution leverages advanced AI and machine learning to identify and prevent real-time API attacks. Here's how Salt Security empowers mobile carriers to fortify their networks:

• Comprehensive API Discovery and Inventory: Our platform goes beyond traditional methods to discover all APIs within your network, including potentially hidden "shadow APIs" that might be overlooked by manual processes. This complete visibility allows for a more holistic security approach.
• Real-Time API Attack Detection & Automated Threat Prevention: Salt Security's AI-powered platform continuously analyzes API traffic to identify real-time suspicious activity and potential breaches. This rapid detection lets you immediately act and prevent unauthorized access or data exfiltration attempts.
• Compliance Assurance: Salt Security helps ensure continuous compliance with industry regulations and security standards like the FCC's safeguards rule. This reduces the risk of regulatory fines and allows you to demonstrate your commitment to data security.

Prioritizing API Security: A Strategic Imperative for Mobile Carriers

The TracFone case illustrates the critical need for robust API security in the mobile telecommunications industry. By implementing a comprehensive API security solution like Salt Security, Tracfone would have been protected from and notified of the attacks that lead to PII exposure and unauthorized access to their APIs. In today's digital age, prioritizing API security is not just an option but a strategic imperative for mobile carriers.

If you would like to learn more about Salt and how we can help you on your API Security journey through discovery, posture management, and run-time threat protection, please contact us, schedule a demo, or check out our website.

The post TracFone Breach Underscores Critical Need for Mobile Carrier API Security appeared first on Security Boulevard.

Did you know that 75% of people are already using Generative AI (GenAI) at work? GenAI tools are defined as any artificial intelligence that can generate content such as text, images, videos, code, and other data using generative models, often in response to prompts. Examples include Open AI’s ChatGPT, GitHub’s Copilot, Claude, Dall-E, Gemini, and […]

The post Your Employees are Already Using GenAI. How Will You Communicate the Security Risks? appeared first on CybeReady.

The post Your Employees are Already Using GenAI. How Will You Communicate the Security Risks? appeared first on Security Boulevard.

Data breaches and privacy concerns are all too common today. That’s why the Australian Health Records and Information Privacy Act 2002 (HRIPA) is highly relevant. This legislation ensures that your privacy is rigorously protected when you share your medical history or undergo a procedure. HRIPA mandates strict protocols for healthcare providers, requiring them to handle […]

The post The Key Components of HRIPA Compliance appeared first on Centraleyes.

The post The Key Components of HRIPA Compliance appeared first on Security Boulevard.

The team at CyberSaint is thrilled to announce the latest additions and updates made to the CyberStrong solution. These latest updates will focus on reporting and remediation. To start off, we’ve made it easier to customize reporting with our latest changes to remediation reports. Additionally, we’ve implemented revisions to the RoSI calculations for enhanced risk analysis and introduced custom risk values and presets.

The post August Product Update appeared first on Security Boulevard.

Security is enhanced with the introduction of dynamic zero-trust security, a method that continuously assesses the security posture of devices and users on the network.

The post Beyond Zero-Trust: The Impact of Adaptive Micro-Segmentation on Network Security appeared first on Security Boulevard.

Currently accessing the free legacy DNS Blocklists (DNSBLs) via the Public Mirrors, and using GoDaddy's network? You'll need to make some minor changes to your email infrastructure. The changes are simple to implement, but if you fail to do so, you could find that at some point post-September 26th 2024, all or none of your email is blocked!

The post If you query the legacy DNSBLs via GoDaddy move to Spamhaus Technology’s free Data Query Service appeared first on Security Boulevard.

Stewart and Trey join us to talk about driving cybersecurity policies for the nation, what makes a good policy, what makes a bad policy, supply chain research and policies, and overall how we shape policies that benefit cybersecurity. Show Notes

The post BTS #36 - Supply Chain Policies - Stewart Scott, Trey Herr appeared first on Eclypsium | Supply Chain Security for the Modern Enterprise.

The post BTS #36 – Supply Chain Policies – Stewart Scott, Trey Herr appeared first on Security Boulevard.

The search landscape is undergoing a seismic shift. Traditional search engines are being challenged by AI-powered platforms like Perplexity and SearchGPT. This new era promises more personalized, intuitive, and efficient information retrieval. Are you ready for the future of search?

The post The Future of Search: AI-Powered Transformation appeared first on Security Boulevard.

Authors/Presenters:uhong Nan, Sun Yat-sen University; Xueqiang Wang, University of Central Florida; Luyi Xing and Xiaojing Liao, Indiana University Bloomington; Ruoyu Wu and Jianliang Wu, Purdue University; Yifan Zhang and XiaoFeng Wang, Indiana University Bloomington

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – Are You Spying on Me? Large-Scale Analysis on IoT Data Exposure through Companion Apps appeared first on Security Boulevard.

The post 8 Must-Ask Questions for AI Security Vendors  appeared first on AI-enhanced Security Automation.

The post 8 Must-Ask Questions for AI Security Vendors  appeared first on Security Boulevard.

Analyst firms play an important role in the tech vendor landscape. Their reports help buyers and would-be buyers learn about vendors and their offerings. In cybersecurity, in particular, buyers use analysts’ outputs to build shortlists prior to thee kick-offs of their individual deep dive evaluations — in some categories of tools, the field is simply […]

The post Five Gartner Reports. Four Categories. What Does OX Security Do Anyway? appeared first on OX Security.

The post Five Gartner Reports. Four Categories. What Does OX Security Do Anyway? appeared first on Security Boulevard.

See These CVEs: Patch Tuesday—ten zero-days, seven Critical vulns, zero time to waste.

The post August Patch Pileup: Microsoft’s Zero-Day Doozy Dump appeared first on Security Boulevard.

Your home or small office (SOHO router) is likely being targeted by cybercriminals, malware, and nation-state actors alike. Though this targeting often has nothing to do with wanting to spy on you, your SOHO router can be a valuable resource for threat actors looking to conceal their malicious traffic and activity.

Unfortunately, targeting of SOHO routers is growing primarily due a multifaceted problem - which includes vendors selling routers with poor security and many users not understanding the importance of updating their devices.

TABLE OF CONTENTS

• Who targets SOHO routers?
• The poor state of SOHO router security
• • Misconfigurations, poor updating practices, and use of EOL devices
  • ISP routers are even less "safe"
• State-backed threat actors targeting SOHO routers
• Malware targeting SOHO routers
• Cybercriminals targeting SOHO routers
• Mitigating threats to SOHO routers
• • Resources
• Final thoughts

Who targets SOHO routers?

Malware, cybercriminals, and state-backed threat actors target SOHO routers. They've done so increasingly over the last few years.

To backtrack a little , it's important to understand that a lot of threat actors target routers - which can include modems and gateways - alongside internet-of-things (IoT devices). Here I will focus on "routers" as general term, as this can include gateways (which are router/modem combinations and extremely popular for home/small offices users).

For simplicity's sake, I'll also focus on malware, cybercriminals, and state-backed threat actors. (Yes, state-backed APTs or hackers have and do target SOHO routers in pursuing their own goals.)

To be fair, malware, botnets and cybercriminals often go together; botnets are often used by cybercriminals to carry out their goals, whether that is overloading servers to keep a service offline or launching distributed credential stuffing attacks. However, botnets regularly use malware like Mirai variants - which are considered a self-replicating worm - to "automatically" launch attacks and recruit devices into the botnet, so it felt important enough to make the distinction.

The poor state of SOHO router security

Before diving into why threat actors find "regular" consumer routers interesting enough to bother "hacking" them, it's important to understand the security landscape of the SOHO router market. Admittedly, this topic itself could be an entire post (or website - check out routersecurity.org, but put simply - it's not good.

Without even considering the technical ability of the end user, SOHO routers are routinely plagued with issues - top of the list are security vulnerabilities. While it is not reasonable or feasible to expect firmware and software to be completely free of security issues, perhaps in the modern age some shouldn't be as prevalent as they are (ex: failing to sanitize input or straight up broken security controls). There are many reasons security vulnerabilities can crop up in SOHO routers, but I am willing to bet many are due to lack of security-oriented review and/or just insecure design.

Security vulnerabilities in router firmware is too large of a topic to cover in just a section of this post. Fortunately, there are many examples where consumer routers had some pretty nasty vulnerabilities I can point you to:

• In April 2024, unpatched TP-Link Archer routers were targeted by attackers for mass exploitation of a previously disclosed and patched command injection vulnerability. Specifically, the vulnerability was in the web management interface of this model.
• In September 2023, multiple high-end ASUS routers marketed to gamers had format strong vulnerabilities, which could be exploited remotely and without authentication. Exploitation could lead to remote code execution.
• In July 2023, 900,000 MikroTik devices were exposed to a privilege escalation bug, which when exploited could lead to code execution. The researching firm (VulnCheck) noted: "It wasn’t until RouterOS 6.49 (October 2021) that RouterOS started prompting administrators to update blank passwords. Even when an administrator has set a new password, RouterOS doesn’t enforce any restrictions..."

The problem has not gone unnoticed by agencies in the US - and some other government agencies from other governments.

In light of the nation-state actor Volt Typhoon exploiting security vulnerabilities in SOHO routers (there's more information on that later in this post), the US Cybersecurity and Infrastructure Security Agency (CISA) has urged vendors to incorporate "Secure by Design" principles into their firmware/software. The Federal Communications Commission (FCC) has proposed the "US Cyber Trust Mark" for smart devices - though it could (and should) include SOHO routers.

Misconfigurations, poor updating practices, and use of EOL devices

This section primarily pertains to end user behavior, which when combined with router manufacturer blunders, makes quite the interesting (and compounded) issue.

While misconfigurations can certainly be default values, users may misconfigure their routers by enabling or disabling features. For example, some SOHO routers may support remote management. Some users may enable this despite not truly needing it while not understanding the risk of exposing the administrator login panel of their router to the public internet.

In fact, even CISA has described the risks of exposing administrative interfaces of devices like routers to the public internet. While their guidance is directed towards more sophisticated organizations, the basics do apply here.

Many people do not know or understand that router firmware should be updated regularly, as updated firmware can include security fixes for vulnerabilities. As such, millions of SOHO routers either do not have the most recent updates installed or updates are installed after a considerable amount of time has passed - enough time for possible exploitation by attackers. As I've noted in other posts, this is important as the time between vulnerability disclosure and exploitation attempts continues to shorten.

Automatic updates can fix this, but the availability of automatic updates (and whether they are even enabled by default) depends on manufacturer, model, and submodel. Of course, users should realize (automatically) updating is not without slight risk of introducing new bugs or inconveniences, but it's certainly better than the alternative in most situations - on the receiving end of n-day vulnerability exploitation.

Just like with any other device, router models eventually become "old" or "legacy" after a number of years. Eventually, manufacturer support - including updates for the firmware - for some models ceases, reaching end of life (EOL). Since devices may not be "broken" or "dead" when the EOL period arrives, many people fail to replace their devices. As such, vulnerabilities discovered in these EOL models often do not get updates, leaving them open for exploitation by attackers:

• In June 2024, it was reported that hackers exploiting a vulnerability affecting all D-Link DIR-859 WiFi routers to collect information, such as passwords, from the device. D-Link released a security advisory but did not release a patch for the vulnerability as this...

The post Your SOHO Router is a Juicy Target for Hackers appeared first on Security Boulevard.

This article provides a comprehensive overview of threat intelligence services, highlighting the importance, methodology, benefits, etc.

The post What is Threat Intelligence? appeared first on Security Boulevard.