Articles by "Cyber Security"
Showing posts with label Cyber Security. Show all posts

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting

It is a first response tool used for threat hunting and offers intel information from Virus Total, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, InQuest and it is able to scan Android devices against VT.

It performs an initial and quick triage of malware samples, URLs, IP addresses, domains, malware families, IOCs and hashes. Additionally, Malwoverview is able to get dynamic and static behavior reports, submit and download samples from several endpoints. In few words, it works as a client to main existing sandboxes.

It can 

  • Determine similar executable malware samples (PE/PE+) according to the import table (imphash) and group them by different colors (pay attention to the second column from output). Thus, colors matter!
  • Show hash information on Virus Total, Hybrid Analysis, Malshare, Polyswarm, URLhaus, Alien Vault, Malpedia and ThreatCrowd engines.
  • Determining whether the malware samples contain overlay and, if you want, extract it.
  • Check suspect files on Virus Total, Hybrid Analysis and Polyswarm.
  • Check URLs on Virus Total, Malshare, Polyswarm, URLhaus engines and Alien Vault.
  • Download malware samples from Hybrid Analysis, Malshare, URLHaus, Polyswarm and Malpedia engines.
  • Submit malware samples to VirusTotal, Hybrid Analysis and Polyswarm.
  • List last suspected URLs from URLHaus.
  • List last payloads from URLHaus.
  • Search for specific payloads on the Malshare.
  • Search for similar payloads (PE32/PE32+) on Polyswarm engine.
  • Classify all files in a directory searching information on Virus Total and Hybrid Analysis.
  • Make reports about a suspect domain using different engines such as VirusTotal, Malpedia and ThreatCrowd.
  • Check APK packages directly from Android devices against Hybrid Analysis and Virus Total.
  • Submit APK packages directly from Android devices to Hybrid Analysis and Virus Total.
  • Show URLs related to an user provided tag from URLHaus.
  • Show payloads related to a tag (signature) from URLHaus.
  • Show information about an IP address from Virus Total, Alien Vault, Malpedia and ThreatCrowd.
  • Show IP address, domain and URL information from Polyswarm.
  • Perform meta-search on Polyswarm Network using several criteria: imphash, IPv4, domain, URL and malware family.
  • Gather threat hunting information from AlienVault using different criteria.
  • Gather threat hunting information from Malpedia using different criteria.
  • Gather threat hunting information from Malware Bazaar using different criteria.
  • Gather IOC information from ThreatFox using different criteria.
  • Gather threat hunting information from Triage using different criteria.
  • Get evaluation to hashes from a given file against Virus Total.
  • Submit large files (>= 32 MB) to Virus Total.
  • Malwoverview uses Virus Total API v.3, so there isn't longer any option using v.2.
  • Retrieve different information from InQuest Labs and download samples from there.



Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting

This tool provides a simple method for capturing network communications on a smartphone or other Wi-Fi enabled device, allowing for rapid analysis. It can be utilized to detect any dubious or harmful communication originating from a smartphone by utilizing heuristics or IoCs.

The team came up with the idea to create a small kiosk device that could be operated by non-technical individuals to test their phones for any malicious communications that may have been initiated by stalkerware or other spyware. The kiosk would be based on Raspberry Pi technology and would serve as a simple and efficient solution to this problem.

It is not limited to detecting ordinary threats, as it can also identify any harmful communications originating from cybercriminals or even state-sponsored cyberattacks. Additionally, TinyCheck empowers users to expand their detection capabilities by adding their own Indicators of Compromise through a backend system, which enables them to detect hidden threats that may be present in their network communications.



TinyCheck can be used in several ways by individuals and entities:

  • Over a network - TinyCheck is installed on a network and can be accessed from a workstation via a browser.
  • In kiosk mode - TinyCheck can be used as a kiosk to allow visitors to test their own devices.
  • Fully standalone - By using a powerbank, two Wi-Fi interfaces or a 4G dongle and a small touch screen like in this video, you can tap any device anywhere.


Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting

The US Food and Drug Administration (FDA) has announced that medical device manufacturers will now be required to fulfill certain cybersecurity standards when presenting an application for a new product. This decision has been taken in order to ensure the safety and security of the medical devices that are being introduced into the market. The FDA has identified the need for enhanced cybersecurity measures due to the growing number of cyber threats and attacks that have been witnessed in recent years. The new regulations will require manufacturers to incorporate robust security features and practices into their devices to prevent any potential cyber breaches. The FDA is hopeful that this move will not only protect patients but also create a more secure and trustworthy healthcare system.


The agency issued guidance on March 30, which outlines new requirements that are a result of the Consolidated Appropriations Act. This act was signed into law in late 2022 and includes a section called "Ensuring Cybersecurity of Medical Devices", which made changes to the Federal Food, Drug, and Cosmetic Act. The purpose of these requirements is to enhance the cybersecurity of medical devices.


The FDA has mandated that new medical device submissions must provide comprehensive information regarding cybersecurity, including the provision of a plan that outlines the identification and resolution of potential security threats and exploits within a reasonable timeframe.

It is important for companies to disclose the methods and protocols they use to issue updates and patches after a product has been released in the market. This includes the provision of routine updates and the issuance of out-of-band patches specifically designed to address critical vulnerabilities and security concerns.

As part of the information required by the FDA, a comprehensive software bill of materials (SBOM) for all commercial, open source, and pre-manufactured components must be provided.

The criteria are relevant to devices that are capable of connecting to the internet, run software, and have the potential to be susceptible to digital security hazards, commonly known as cyber devices.




Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting

The aim of creating a threat matrix for DevOps is to establish a thorough repository of information that security personnel can utilize to monitor and establish countermeasures against pertinent attack strategies. 

Leveraging the MITRE ATT&CK framework as a foundation, Microsoft aggregated methods and vectors of attack linked with DevOps infrastructures and constructed a specialized matrix designed specifically for DevOps attack tactics.

To fully understand the tactics outlined in this matrix, one must approach them from a DevOps perspective. It's important to note that the methods used for executing code in a Virtual Machine running Windows or Linux OS differ from those used in a DevOps pipeline. Specifically, when it comes to Linux, execution refers to running code within the operating system itself.



Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting

Kubernetes Security Checklist and Requirements - All in One (authentication, authorization, logging, secrets, configuration, network, workloads, dockerfile)




  • Authentication
    •  It is recommended to use an IdP server as a provider for user authentication to the Kubernetes API (for example, using OIDC). Cluster administrators are advised not to use service account tokens for authentication.
    •  It is recommended to use a centralized certificate management service to manage certificates within the cluster (for user and service purposes).
    •  User accounts should be personalized. The names of the service accounts should reflect the purpose access rights of the accounts.
  • Authorization
    •  For each cluster, a role-based access model should be developed.
    •  Role-Based Access Control (RBAC) should be configured for the Kubernetes cluster. Rights need to be assigned within the project namespace based on least privilege and separation of duties (RBAC-tool).
    •  All services should have a unique service account with configured RBAC rights.
    •  Developers should not have access to a production environment without the approval of the security team.
    •  It is forbidden to use user impersonation (the ability to perform actions under other accounts).
    •  It is forbidden to use anonymous authentication, except for /healthz, /readyz, /livez. Exceptions should be agreed upon with the security team.
    •  Cluster administrators and maintainers should interact with the cluster API and infrastructure services through privileged access management systems (Teleport, Boundary).
    •  All information systems should be divided into separate namespaces. It is recommended to avoid the situation when the same maintainer team is responsible for different namespaces.
    •  RBAC Rights should be audited regularly (KubiScan, Krane)
  • Secure work with secrets
    •  Secrets should be stored in third-party storage (HashiCorp Vault, Conjur), or in etcd in encrypted form.
    •  Secrets should be added to the container using the volumeMount mechanism or the secretKeyRef mechanism. For hiding secrets in source codes, for example, the sealed-secret tool can be used.
  • Cluster Configuration Security
    •  Use TLS encryption between all cluster components.
    •  Use Policy engine (OPA, Kyverno).
    •  The cluster configuration is recommended to comply with CIS Benchmark except for PSP requirements.
    •  It is recommended to use only the latest versions of cluster components (CVE list).
    •  For services with increased security requirements, it is recommended to use a low-level run-time with a high degree of isolation (gVisior, Kata-runtime).
    •  Cluster Configuration should be audited regularly (Kube-bench, Kube-hunter, Kubestriker)
  • Audit and Logging
    •  Log all cases of changing access rights in the cluster.
    •  Log all operations with secrets (including unauthorized access to secrets).
    •  Log all actions related to the deployment of applications and changes in their configuration.
    •  Log all cases of changing parameters, system settings, or configuration of the entire cluster (including OS level).
    •  All registered security events (at the cluster level and application level both) should be sent to the centralized audit logging system (SIEM).
    •  The audit logging system should be located outside the Kubernetes cluster.
    •  Build observability and visibility processes in order to understand what is happening in infrastructure and services (Luntry, WaveScope)
    •  Use third-party security monitoring tool on all cluster nodes (Falco, Sysdig, Aqua Enterpise, NeuVector, Prisma Cloud Compute).
  • Secure OS configuration
    •  Host administrators and maintainers should interact with cluster nodes through privileged access management systems (or bastion hosts).
    •  It is recommended to configure the OS and software following the baseline and standards (CIS, NIST).
    •  It is recommended to regularly scan packages and configuration for vulnerabilities(OpenSCAP profiles, Lynis).
    •  It is recommended to regularly update the OS kernel version (CVEhound).
  • Network Security
    •  All namespaces should have NetworkPolicy. Interactions between namespaces should be limited to NetworkPolicy following least privileges principles (Inspektor Gadget).
    •  It is recommended to use authentication and authorization between all application microservices (Istio, Linkerd, Consul).
    •  The interfaces of the cluster components and infrastructure tools should not be published on the Internet.
    •  Infrastructure services, control plane, and data storage should be located in a separate VLAN on isolated nodes.
    •  External user traffic passing into the cluster should be inspected using WAF.
    •  It is recommended to separate the cluster nodes interacting with the Internet (DMZ) from the cluster nodes interacting with internal services. Delimitation can be within one cluster, or within two different clusters (DMZ and VLAN).
  • Secure configuration of workloads
    •  Do not run pods under the root account - UID 0.
    •  Set runAsUser parameter for all applications.
    •  Set allowPrivilegeEscalation - false.
    •  Do not run the privileged pod (privileged: true).
    •  It is recommended to set readonlyRootFilesystem - true.
    •  Do not use hostPID and hostIPC.
    •  Do not use hostNetwork.
    •  Do not use unsafe system calls (sysctl):
      • kernel.shm *,
      • kernel.msg *,
      • kernel.sem,
      • fs.mqueue. *,
    •  Do not use hostPath.
    •  Use CPU / RAM limits. The values should be the minimum for the containerized application to work.
    •  Capabilities should be set according to the principle of least privileges (drop 'ALL', after which all the necessary capacities for the application to work are enumerated, while it is prohibited to use:
      • CAP_FSETID,
      • CAP_SETUID,
      • CAP_SETGID,
      • CAP_SYS_CHROOT,
      • CAP_SYS_PTRACE,
      • CAP_CHOWN,
      • CAP_NET_RAW,
      • CAP_NET_ADMIN,
      • CAP_SYS_ADMIN,
      • CAP_NET_BIND_SERVICE)
    •  Do not use the default namespace (default).
    •  The application should have a seccomp, apparmor or selinux profile according to the principles of least privileges (Udica, Oci-seccomp-bpf-hook, Go2seccomp, Security Profiles Operator).
    •  Workload configuration should be audited regularly (Kics, Kubeaudit, Kubescape, Conftest, Kubesec, Checkov)
  • Secure image development
    •  Do not use RUN construct with sudo.
    •  COPY is required instead of ADD instruction.
    •  Do not use automatic package update via apt-get upgrade, yum update, apt-get dist-upgrade.
    •  It is necessary to explicitly indicate the versions of the installed packages. The SBOM building tools (Syft) can be used to determine the list of packages.
    •  Do not store sensitive information (passwords, tokens, certificates) in the Dockerfile.
    •  The composition of the packages in the container image should be minimal enough to work.
    •  The port range forwarded into the container should be minimal enough to work.
    •  It is not recommended to install wget, curl, netcat inside the production application image and container.
    •  It is recommended to use dockerignore to prevent putting sensitive information inside the image.
    •  It is recommended to use a minimum number of layers using a multi-stage build.
    •  It is recommended to use WORKDIR as an absolute path. It is not recommended to use cd instead of WORKDIR.
    •  It is recommended to beware of recursive copying using COPY . ..
    •  It is recommended not to use the latest tag.
    •  When downloading packages from the Internet during the build process, it is recommended to check the integrity of these packages.
    •  Do not run remote control tools in a container.
    •  Based on the results of scanning Docker images, an image signature should be generated, which will be verified before deployment (Notary, Cosign).
    •  Dockerfile should be checked during development by automated scanners (Kics, Hadolint, Conftest).
    •  All images should be checked in the application lifecycle by automated scanners (Trivy, Clair, Grype).
    •  Build secure CI and CD as same as suply chain process (SLSA)

Source: Vinum-Security
Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting

The Defence Institute of Advanced Technology managed by the Department of Defence Research and Development under the Defence Research and Development Organisation (DRDO) has started two short-term online programmes on Artificial Intelligence (AI) and Machine Learning (ML) and Cyber security. There will be a daily two-hour long online session on five days a week. The interested candidates will have to appear for separate entrance tests for whichever course they wish to pursue. Candidates with a graduate degree in any stream will be eligible for the entrance tests. The entrance tests will be free of cost but the course fee will be Rs 15,000 each which will have to be paid after qualifying the entrance exam.




DIAT CERTIFIED INFORMATION ASSURANCE PROFESSIONAL

12 weeks intensive course, the experts will teach the fundamentals of cyber security and advanced topics including digital forensics, reverse engineering, malware analysis, vulnerability analysis, exploit mitigation and tools and techniques for Cyber Security professionals. The sessions include theory as well as hands-on practice sessions for the topics. Syllabus of the course is designed by a team of academicians, DRDO experts and Cyber security advisors. 


DIAT CERTIFIED ARTIFICIAL INTELLIGENCE PROFESSIONAL

AI is being elevated constantly for some time and being considered as revolution in the whole IT field. There is a strong need for AI professionals who are skilled to deliver state-of-the-art AI solutions. The objective of the course is to impart the essential knowledge of AI and ML to serve the needs of multidisciplinary research ongoing in different research labs and industries in the country.


Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting

APICheck is a complete toolset designed and created for testing REST APIs.

APICheck is an environment for integrating existing HTTP APIs tools and create execution chains easily. Designed with integration third party tools in mind. APICheck aims to be a universal toolset for testing REST APIs, allowing you to mix and match the tools it provides, while enabling interoperability with third party tools. This way we hope that it will be useful to a wide spectrum of users that need to deal with REST APIs.




APICheck focuses not only in the security testing and hacking use cases, the goal of the project is to become a complete toolset for DevSecOps cycles. The tools are aimed to different user profiles:

  • Developers
  • System Administrators
  • Security Engineers & Penetration Testers

APICheck is comprised of a set of tools that can be connected to each other to achieve different functionalities, depending on how they are connected. It allows you to create execution chains

Download APICheck Project

Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting
A Simple CVSS (Common Vulnerability Scoring System) Calculator



Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting
Google has released Open Source Vulnerability scanner.

 It is an extensible network scanner for detecting high-severity vulnerabilities with as little false-positives as possible.

 It is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence. It is an extensible network scanning engine for detecting high severity vulnerabilities with high confidence in an unauthenticated manner.

 Features
  • Tsunami supports small manually curated set of vulnerabilities
  • Tsunami detects high severity, RCE-like vulnerabilities, which often actively exploited in the wild
  • Tsunami generates scan results with high confidence and minimal false-positive rate.
  • Tsunami detectors are easy to implement.
  • Tsunami is easy to scale, executes fast and scans non-intrusively.
Google leverages Google's Kubernetes Engine (GKE) to continuously scan and protect all of our externally facing systems with the Tsunami scanning engine. 

 When scanning a system, Tsunami executes a two-step process:

 Reconnaissance: In the first step, Tsunami detects open ports; then subsequently identifies protocols, services, and other software running on the target host using a set of fingerprinting plugins. To avoid reinventing the wheel, Tsunami leverages existing tools such as nmap for some of these tasks.

 Vulnerability verification: Based on the information gathered through reconnaissance, Tsunami selects all vulnerability verification plugins matching the identified services. To confirm that a vulnerability indeed exists Tsunami executes a fully working, benign exploit.

 Tsunami is released under the Apache 2.0 license. Tsunami is not an official Google product.

Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting
The 2020 Cloud Security Report sponsored by (ISC)². Based on a comprehensive survey of 650+ cyber security professionals, the report reveals:
  • The latest cloud security trends and challenges
  • how organizations are responding to security threats in the cloud
  • what tools and best practices cyber security leaders are considering in their move to the cloud


Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting
National Critical Information Infrastructure Protection Centre (NCIIPC) is an organisation of the Government of India created under Sec 70A of the Information Technology Act, 2000 (amended 2008), through a gazette notification on 16th Jan 2014 based in New Delhi, India. It is designated as the National Nodal Agency in respect of Critical Information Infrastructure Protection.

Protection of Critical Information Infrastructure entails a multi-stakeholder approach. NCIIPC engages with Industry, Academia and Independent Cyber Security Professionals in order to address current trends, threats and challenges. NCIIPC supports various avenues for engagement.

NCIIPC also runs Responsible Vulnerability Disclosure Program (RVDP)




NCIIPC hosts Vulnerability Disclosure Form at its website nciipc.gov.in. You may fill up the required fields in the Form and submit the same to: rvdp@nciipc.gov.in along with relevant documents, screenshots, urls etc. 

By reporting a vulnerability in Critical Sector, you become a part of NCIIPC extended family. NCIIPC duly acknowledges contribution appropriately. However, in case you wish to remain anonymous it would respect your privacy.

You can share any newly discovered vulnerability related to Critical Information Infrastructure on rvdp@nciipc.gov.in. 

 You may additionally call 24x7 Toll free number: 1800-11-4430
Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting
It is used to identify “interesting” features and metadata, like the use of cryptography, connecting to a remote entity, and the platforms it runs on.

Application Inspector differs from more typical static analysis tools in that it isn’t limited to detecting poor programming practices; rather, it surfaces interesting characteristics in the code that would otherwise be time-consuming or difficult to identify through manual introspection. It then simply reports what’s there, without judgement.

Application Inspector is a cross-platform, command-line tool that can produce output in multiple formats, including JSON and interactive HTML. 



Application Inspector is different from traditional static analysis tools in that it doesn't attempt to identify "good" or "bad" patterns; it simply reports what it finds against a set of over 400 rule patterns for feature detection including features that impact security such as the use of cryptography and more. This can be extremely helpful in reducing the time needed to determine what Open Source or other components do by examining the source directly rather than trusting to limited documentation or recommendations.

Application Inspector comes with hundreds of feature detection patterns covering many popular programming languages, with good support for the following types of characteristics:


  • Application frameworks (development, testing)
  • Cloud / Service APIs (Microsoft Azure, Amazon AWS, and Google Cloud Platform)
  • Cryptography (symmetric, asymmetric, hashing, and TLS)
  • Data types (sensitive, personally identifiable information)
  • Operating system functions (platform identification, file system, registry, and user accounts)
  • Security features (authentication and authorization)

Application Inspector can identify interesting features in source code, enabling you to better understand the software components that your applications use. Application Inspector is open source, cross-platform (.NET Core).

The tool supports scanning various programming languages including C, C++, C#, Java, JavaScript, HTML, Python, Objective-C, Go, Ruby, PowerShell and more and can scan projects with mixed language files. It also includes HTML, JSON and text output formats

Continue reading

The Secure Planet at 0
The Secure Planet, Cyber Security, Audit Compliance, Digital Forensics, Corporate training, CISSP, CISA, CISM, Information Security consulting
It is a distro intended to help you perform security assessment and penetration testing of Internet of Things (IoT) devices. 

It saves you a lot of time by providing a pre-configured environment with all the necessary tools loaded. The new version is based on Ubuntu 18.04 64-Bit - that also means that you'll receive updates for this version till April 2023.


Tools Included
  • Arduino
  • Baudrate
  • BDAddr
  • BetterCap
  • Binwalk
  • Create_AP
  • Cutter
  • DspectrumGUI
  • Dump1090
  • Firmadyne
  • Firmware Analysis Toolkit
  • Firmware Analysis Toolkit (FAT)
  • Firmware-Mod-Kit (FMK)
  • GHIDRA
  • GNURadio
  • GQRX
  • GR-GSM
  • GR-Paint
  • HackRF Tools
  • HackRF tools
  • Inspectrum
  • JADx
  • Kalibrate-RTL
  • KillerBee
  • LibMPSSE
  • Liquid-DSP
  • LTE-Cell-Scanner
  • NMAP
  • OOK-Decoder
  • Qiling
  • radare2
  • RFCat
  • RouterSploit
  • RTL-433
  • RTL-SDR tools
  • Scapy
  • Spectrum Painter
  • Ubertooth tools-
  • URH (Universal Radio Hacker)
Continue reading
Subscribe to: Posts (Atom)