iSA_LOGO_FINAL-new-3 (1)

Month: November 2017

Categories
Uncategorized

Predictions for 2018: Cyberthreats in the banking sector

Add Your Heading Text Here

Share it:

Knowing what the future holds for you or your organisation allows you to make specific preparations for challenges ahead. In cybersecurity, threats seem to evolve every year. For instance, the year 2017 witnessed a series of ransomware such as wannacry and NotPetya.

The most devastating among them is wannacry. Wannacry relied on EternalBlue to affect thousands of corporate servers with vulnerable Microsoft’s Server Message Block (SMB) protocol.

As we gradually usher ourselves into a new year, companies have strong ambitions to improve and secure data infrastucture from automated ransomware and the likes. On the flip side, cybercriminals are in the business of developing advance and subtle forms of attacks to overcome your firewalls, DNSSEC, and other security perimeters on your network.

Our security engineers researched and analyzed two major potential threats companies and even start-ups might encounter in 2018. Some of these threats might  come to pass due to certain changes developers and security engineers aim to implement to minimize cybercrime.

  • Fraud – as a – Service Model:    Similar to how your organisation purchase third-party software for specific task, cybercriminals  such as script kiddies and those in need of quick cash-outs also purchase trojans, customized ransomware from the deep web.  Thus, don’t expect cybercriminals to waste hours searching for flaws in your systems via scanners. Fraud-as-a-Service model is an advance way of phishing attacks likely to populate in 2017
  •   Malicious Web Mining:    Hackers have recently discovered a new way of benefiting from a vulnerable website or a web portal. Have you heard of crypto mining? Crypto mining simply means reaping new cryptocoins by means of lengthy and complex calculations. Malicious miners do not encrypt user data or other related essentials but consumes victims’ computing power and electricity.  Apart from consuming victim’s computing power and electricity, hackers do not need to infect websites or web portals with malware. Instead hackers upload scripts to vulnerable website that forces victims’ computers to mine money straight into their cryptowallet.

Stay alert and fix any vulnerable spots before the year 2018 arrives!!!

#ISA_informs

#ISA_ltd 

Latest Post
Categories
Categories
Uncategorized

Application Threat Model: Proxy Attacks and Prevention

Login into account in email envelope and fishing hook. Phishing scam, hacker attack and web security concept. online scam and steal. vector illustration in flat design

Add Your Heading Text Here

Share it:

Now it’s time to fix our attention on proxy attacks. However, before we delve into proxy attacks and prevention methods, let’s resolve the difference between Reverse Proxy and Forward Proxy.

Reverse Proxy:  is usually placed between a client and a web server. It receives initial HTTP connection requests, acting like the actual endpoint(web server). The reverse proxy serves as a gateway between users and  application web server.

Forward Proxy: usually sits between a client and a web server.Unlike reverse proxy, it regulates outbound traffic according to preset policies. In addition, it disguises a client’s IP address and blocks malicious traffic

For this article, we are going to look at how attackers can attack reverse proxy and how developers and application security engineers could make it difficult for attackers to achieve their malicious aims. The following are common types of attacks against reverse proxy:

  •      Cache Poisoning
  •     HTTP Response Splitting
  •    Cross-User Defacement 

Let’s briefly examine how cache poisoning works.

Cache Poisoning: Cache poisoning is quite possible because of web content caching.

 Caching web content improves web content on performance on the server-side and client-side(i.e user-side) . However, the HTTP protocol used in caching mechanism performs integrity check on the server-side only.  This specific flaw allows cache poisoning.

  •  Attackers search for and exploits flaws in the code, allowing them to place illegitimate headers in the HTTP header field
  • Attackers deletes out legitimate cached content from the cache server.
  • The attacker sends a specially crafted request to the cached server.
  • Users requesting for commonly retrieved content receives malicious content until the cache entry is flushed.

 Preventing Cache Poisoning:

  •           Make use of DNSSEC : DNS Security Extensions (DNS Security Extensions (DNSSEC) are a set of Internet Engineering Task Force standards created to address vulnerabilities in the Domain Name System (DNS) and protect it from online threats.
  •         Limit the number of recursive queries to the DNS

#ISA_informs

#ISA_ltd

Latest Post
Categories
Categories
Uncategorized

FIVE LESSONS GLEANED FROM ONEPLUS DEVICE ROOT EXPLOIT

Add Your Heading Text Here

Share it:

Many mobile devices manufactured under the OnePlus brand by China’s BBK Electronics are vulnerable to compromise via a factory-installed app called EngineerMode that acts as a backdoor providing root access to affected devices.

      A factory app is an app that is developed and pre-installed by mobile carriers and OEMS.

At this time, the exploit is beneficial to an attacker with physical access to a OnePlus device or an owner who intends to by-pass security limitation set by OnePlus in order to have  privilege access.

OnePlus develops its own customized version of the Android operating system, called OxygenOS, for their branded devices.  OnePlus mistakenly left a diagnostic app, EngineerMode to test the production build of the OxygenOS operating system.

Unfortunately, OnePlus left behind  system-signed .apk and a native library with a SHA256 hash of the password that was easily reversed.

Since the incident of OnePlus Root Exploit,  our security engineers came together and outlined five practical lessons mobile users could take heed from in order to protect themselves from mobile vulnerabilites and root exploits.

  •     Don’t trust OEM’s or Mobile Device Carriers. Hire android security researcher to assess your device if you can afford.

Original Equipment Manufacturer is abbreviated as OEM. An Original Equipment Manufacturer is a company that produces parts and equipment that may be marketed by another manufacturer. A mobile carrier is a service provider that supplies connectivity services to mobile phone and tablet subscribers.

  •      Avoid side-loading mobile applications and be extra careful when download apps on Google playstore.
  •       Always have effective mobile anti-virus solution installed on your mobile device . 

Effective mobile anti-virus solution make it difficult for hidden malware apps to escalate their malicious motives. However, mobile anti-virus solution is not a complete solution to malware eradication

  •         For android users, uncheck “install from other or unknown sources”. via device administration settings.
  •     Finally, hope that none of these pre-installed applications on your devices do not have backdoor embedded.

#ISA_informs

#ISA_ltd 

Latest Post
Categories
Categories
Uncategorized

Application Threat Model: Protecting User’s Account

Add Your Heading Text Here

Share it:

Last week, we begun with the first major part of Application Threat Model series for both web/mobile developers, security engineers as well as other stakeholders interested in securing data and protecting sensitive resources from hackers.

We emphasized briefly on how web/mobile developers can secure login page as well as make it difficult for attackers to by-pass authentication. Securing login page is the first and most important step for every company interested in creating effective and practical application threat model.

Eventually, we outlined common attacks such as sql injection attackers may rely on to by-pass authentication put in place by application security engineers and web/mobile developers.

Furthermore we suggested limited solutions for developers just to make it difficult for attackers to by-pass authentication.

This week we are going to throw light on how developers, security engineers and CIO’s could create effective and practical threat model template for web/mobile application. This is just a continuation of application threat model series.

                                                       

                                                      Importance of Protecting User’s Account 

Developers and Security Engineers need to attach a great deal of importance to user’s account on web/mobile portals. When user’s account is compromised, it affects business reputation.

How then can developers and security engineers secure user’s account? Below is an example of a less common attacks hackers can use to compromise users account’s on the client-side.

  • IDOR attacks

There many other attacks apart from IDOR. However, we will focus briefly only on Insecure Direct Object Reference for now.

IDOR Attacks:

Insecure Direct Object Reference allows attackers to manipulate references to gain access to unauthorized data.It is impossible to say what the potential impact of IDOR is, as it varies. Depending on what kind of data or file the attacker may get hold of, attacker can manipulate user’s balance sheet, transfer money from user’s account and so on.

Solution:

We strongly recommend  developers to check the access before using a direct object reference from an untrusted source.The user needs to be authorized for the requested information before the server provides it.

This is just a brief solution of how developers and security engineers could rely on application threat model template to predict type of attacks attackers can use to attack web/mobile applications and how developers/Security Engineers can use secure applications against these attacks.

You can research ahead to find out about other attacks against user’s accounts.

Next week,  we shall move onto the next part of our application threat model series focusing on proxy and code logic attacks. Thanks!

#ISA_informs 

#ISA_ltd 

Latest Post
Categories
Categories
Uncategorized

Application Threat Model Series [Part 1] : Securing the Main Entry

Add Your Heading Text Here

Share it:

This week we are going to focus on how companies could generate effective application threat model  to secure web applications facing the internet or on the public domain. Threat Model simply means how a web application could be attacked from an attacker’s perspective. For the first part of this series, we will start from the client side by placing emphasis on the main entry to web application which is the login page.

In real-world scenario, anybody seeking to protect his resources focuses on the main entrance. Likewise web developers interested in securing users’ data from attackers focuses on the login page primarily. Attackers attack login page of web application via the following attacks:

  • Sql Injection
  • Brute Force(or Password Guessing Attacks)
  • Default Password
  • Phishing
  • User-name Enumeration

Five Steps to Secure Your Login Page

  • To prevent sql injection, advise your developers to use prepared statements with parameterized queries.
  • To prevent brute forcing, lock out accounts after defined number of incorrect password attempts. Recover locked accounts after a specified duration. In addition, include a complex CAPTCHA to make it difficult for attackers using computerized means to brute force login page.
  • Don’t dare use default passwords. It is basic wisdom not to do so.
  • To prevent phishing, create a daily or monthly awareness program on dangers of web phishing attacks. It is difficult and tricky to escape from phishing attacks. Thus,  we have program purposely for phishing attacks and prevention. You can contact us on our website for further details.
  • To prevent user-name enumeration, prevent attackers from probing your site whether a user-name exists or not. You can  prevent user-name enumeration by allowing users to sign or log in with email addresses instead of usernames. Allowing user-name enumeration makes it easy attackers to implement bruteforcing attacks.

Although these steps could help secure web application from the above-mentioned attacks, there are other ways attackers could by-pass web authentication. Thus, we suggest that developers should put in place detection measures to capture or log malicious attempts.

Logging malicious attempts helps you to know which technique attackers  tried to by-pass your login page and how you can secure your  web application against such attacks.

In our next series, we shall focus on attacks against user’s accounts and how developers and application security engineers could make it difficult for malicious users to access user’s account.

#ISA_info

#ISA_ltd 

Latest Post
Categories
iSA_LOGO_FINAL new 2
Information Security Architects (ISA) Ltd is one of the leading Data Privacy and Security Practitioners in Ghana West Africa.
Services
Products
Newsletter

Sign up our newsletter for update information, insight and promotion.

Facebook Instagram Twitter Linkedin
Copyright © 2021, All rights reserved. Powered by Lynt Digital.