Skip to content

Why security mindset for small-medium companies is critical to business success: talk with Cutec

A discussion with Mark Rowland, Co-Founder & Managing Director at Cutec, about how they solved client problems using NordLayer and what to expect for next cybersecurity’s major challenges and possibilities.

Cutec is a Managed Service Provider (MSP) and IT support company from England. Operating in the industry for 25 years, a 20-employee expert team supports a range of small and medium clients across the UK. Whether an organization has a staff of just a few or hundreds of people, Cutec’s role is to consult companies with technical focus and accuracy to fill in the vacancy of an internal IT person for the client.

The consultancy firm fills in the IT management and knowledge gap, which is a recurring issue for many businesses, especially smaller organizations Cutec gets to consult. However, conversing with different clients revealed another concern — there’s no cybersecurity mindset. Mark Rowland, a Co-founder and Managing Director at Cutec, shares his insight on how crucial security awareness is for business continuity. 

Business case: decentralizing single-site infrastructure

The client has been with Cutec for about 6 years — during this time, the company of 30 people expanded to an almost 300-employee organization. And as this financial services provider grew into a country-wide company, it started facing security challenges.

“As for a managed IT service provider, it is important to be there for your client when they need you. It’s our responsibility to support branches dotted around different parts of the UK — online presence becomes a necessity over physical.”

Click to tweet

Being contained in one place and managing 20 people is relatively easy. However, the client business model involved advisors spread all over the country. Combine it with rapid growth during a short time and data sensitivity due to the nature of financial services — the need to protect databases, CRM, and phone systems was critical.

The foundational elements for security were there: the client had two-factor authentication, password management, and fixed IP in place. It’s secure enough for 20 people sitting in one office, but not if numbers jump to hundred users in dozen cities — circumstances urged for an extra layer of security.

An increasing number of VPN connections to internal applications started causing connectivity issues and quickly bogged the network. This was the turning point for Cutec to find a better solution for a VPN route that would ensure security.

Close-up on the solution

One of the available options for the client was to get much more powerful broadband for the HQ office, install hardware firewalls, and achieve the wanted level of security for an outrageous expense bill.

Moreover, the solution would bind everything to one location. From a disaster management perspective, it’s not sustainable for business continuity — if the power is cut off, the internet goes down, and all employees get disconnected despite their location.

The alternative was getting a NordLayer subscription. Although it meant paying per user license, it offered what the company needed — a fixed IP address that provided much-needed flexibility and stability.

Choosing NordLayer allowed upgrading and downgrading the number of member accounts as the staff comes and leaves and, most importantly, eliminating the dependence on the HQ office — if the power got cut off, server design allowed carry-on working.

Sorting out the inconvenience of in-house security

Deployment and maintenance of the on-premise solution meant a lot of man-hours. It included a remote connection to a client’s PC and setting up their VPN connection. 

NordLayer, on the other hand, provided a simple solution. The MSP had to connect to the Partner Portal and add the user, so they could complete the setup themselves — click the welcome link to install the VPN.

“The solution setup was fantastic as we looked at a massive project and a big headache. Rolling out NordLayer VPN connection to 300 people was achieved in four days. And out of 300 members, we had only five people calling for help, but that’s because they were cautious, not because they didn’t know what to do.”

Click to tweet

It’s worth mentioning that the client has no one in-house with the knowledge and expertise on cybersecurity. In this case, Cutec is an advisor and a guide for organizations’ cybersecurity strategy, closely collaborating with a single point of contact on-premise, the Technology Director, to help steer the business away from cyber threats.

Expert insights: take on SMBs security

The client scope Cutec works with is usually small-medium sized businesses without internally dedicated IT staff. Better to say SMBs have little understanding of cybersecurity. There’s a persistent tendency for a slow but inevitable change in the business mindset:

  • A now-outdated perspective of ‘antivirus solves all our security problems’ was effective 10–20 years ago — today you have to think outside the box.

  • Small-medium enterprises tend to give on-premise servers and migrate to the cloud more often. Core IT support is going to change. It will be more about picking the right cloud solution for people driving the migration to the cloud. Over the next three years, people will drop on-premise stuff and go to the cloud completely, and we’ll be there to help them with that.

  • Cloud-edge solutions like NordLayer are going to get more popular over time. Teams work from coffee shops and McDonald’s — they connect to public Wi-Fi and hot spots and must protect their traffic with tools that work well.

A future notion on SMBs from sensitive industries

The cybersecurity landscape changed— now it’s about protecting yourself online. At our company, we notice clients are transitioning to online cloud services. The number of adopted vendors and service providers can be three, five, or a dozen online solutions and tools.

Previously, having a server in the office under lock and key with a firewall allowed us to assume that that was enough to keep the company secure. However, small businesses struggle to comprehend the gravity of cybersecurity.

“Using Office365, therefore, thinking my data is secure is a mistaken approach. Company data might be secure in the Microsoft Data Center, but is it safe where you are accessing it from?”

Click to tweet

After Covid, once people started connecting from their home PCs and smartphones, companies without proper security measures risked having their business data on employees’ personal devices.

Larger enterprises and governmental institutions already have an awareness – sometimes forced by insurance companies and bank regulations – of owning some security accreditations to filter down the risks. Meanwhile, small-medium enterprises don’t have this perception, and MSPs like Cutec help them drive in the right direction.

Our biggest challenge is overcoming the big issue of clients thinking that security is finite. Threats are layered and complex — getting an antivirus or a firewall might solve only a small part of the potential risks and gaps for threat actors to exploit. Instead, business owners and their teams must keep up-to-date with a cybersecurity mindset to guarantee business continuity.

Pro cybersecurity tips

Education on cybersecurity is increasing, and it is becoming a common topic of conversation. More and more employees and decision-makers now acknowledge a serious lack of digital security knowledge. To make the learning process easier, it’s better to ask questions and have some starting points. Here’re some pro tips you can begin with:

Explore cybersecurity to broaden your knowledge about threats and solutions for managing them. NordLayer offers layered-by-design network access solutions for all kinds of businesses and their team setups to rise to the challenges of a modern company. And at NordLayer, we care about guidance. Thus, explore our Cybersecurity Learning Center and Decision Maker’s Kit for in-depth support for building your own cybersecurity strategy.

Want to join forces to build a more resilient and aware cybersecurity landscape for businesses and organizations? NordLayer invites Managed Service Providers to seize the opportunity to join our Partner Program — reach out to learn more about it.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

ESET Research: Chinese-speaking Evasive Panda group spreads malware via updates of legitimate apps and targets NGO in China

  • Users in mainland China at an international NGO were targeted with malware delivered through updates for software developed by Chinese companies.
  • With high confidence, we attribute this activity to the Chinese-speaking Evasive Panda APT group.
  • The backdoor MgBot is used for cyberespionage.

BRATISLAVA, MONTREAL — April 26, 2023 — ESET researchers have discovered a campaign conducted by the APT group known as Evasive Panda, in which update channels of legitimate Chinese applications were hijacked to also deliver the installer for the MgBot malware, Evasive Panda’s flagship cyberespionage backdoor. Chinese users were the focus of this malicious activity, which ESET telemetry shows started in 2020. The targeted users were located in the Gansu, Guangdong, and Jiangsu provinces. The majority of the Chinese victims are members of an international non-governmental organizations (NGO).

In January 2022, ESET Research discovered that while performing updates, a legitimate Chinese application had received an installer for the Evasive Panda MgBot backdoor and that the same malicious actions had already taken place as far back as 2020 with several other legitimate applications developed by Chinese companies.

“Evasive Panda uses a custom backdoor known as MgBot that has seen little evolution since its discovery in 2014. To the best of our knowledge, the backdoor has not been used by any other group. Therefore, we attribute this activity to Evasive Panda with high confidence,” says ESET researcher Facundo Muñoz, who discovered this latest campaign. “During our investigation, we discovered that when performing automated updates, several legitimate application software components also downloaded MgBot backdoor installers from legitimate URLs and IP addresses,” explains Muñoz.

When ESET researchers analyzed the likelihood of several methods that could explain how the attackers managed to deliver malware through legitimate updates, two scenarios stood out: supply-chain compromises, and adversary-in-the-middle (AitM) attacks.

“Given the targeted nature of the attacks, we speculate that attackers would have needed to compromise the QQ update servers to introduce a mechanism to identify the targeted users in order to deliver the malware, and filtering out non-targeted users and delivering them legitimate updates. This is because we registered cases where legitimate updates were downloaded through the same abused protocols,” says Muñoz. “On the other hand, AitM approaches to interception would be possible if the attackers were able to compromise vulnerable devices such as routers or gateways and the attackers could have gained access to ISP infrastructure”.

MgBot’s modular architecture allows it to extend its functionality by receiving and deploying modules on the compromised machine. The functionalities of the backdoor include recording keystrokes; stealing files, credentials, and content from the Tencent messaging apps QQ and WeChat; and capturing both audio streams and text copied to the clipboard.

Evasive Panda (also known as BRONZE HIGHLAND and Daggerfly) is a Chinese-speaking APT group, active since at least 2012. ESET Research has observed the group conducting cyberespionage against individuals in mainland China, Hong Kong, Macao, and Nigeria. One victim of this campaign was verified to be located in Nigeria and was compromised through the Chinese software Mail Master by NetEase.

For more technical information about the latest Evasive Panda campaign, check out the blogpost “Evasive Panda APT group delivers malware via updates for popular Chinese software” on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

Map of China showing where users were targeted

 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

CVE-2022-45875: Apache DolphinScheduler vulnerable to Improper Input Validation leads to RCE

Introduction

Improper Input Validation leads to command injection/RCE in Apache DolphinScheduler has been found and registered as #CVE-2022-45875

The affected version 3.0.1 and prior versions; version 3.1.0 and prior versions.

What is Apache DolphinScheduler

Apache DolphinScheduler is a modern data workflow orchestration platform with a powerful user interface, dedicated to solving complex task dependencies in the data pipeline and providing various types of jobs available out of the box.

Build the lab

I’m using docker on Ubuntu server 20.04

Install docker

  • apt update

  • apt install docker && docker-compose

Setup DolphinScheduler

  • DOLPHINSCHEDULER_VERSION=3.0.0

  • docker run --name dolphinscheduler-standalone-server -p 12345:12345 -p 25333:25333 -d apache/dolphinscheduler-standalone-server:"${DOLPHINSCHEDULER_VERSION}"

Verify the container is running:

  • docker ps -a

Now open the following link in your browser:

Reproduce the vulnerability

As we can understand from the advisor and from the static analysis and the patch diffing, the vulnerability existed in the Alert script plugin which is an alert that happens based on specific settings. The alert has multiple types, one of the types is “script” where you are telling the software to run the following alert (which will run the script) if those settings happened.

Create a bash script

  • First, we need to create a bash script that we will use for the alarm

  • Access the docker container

sudo docker exec -it <container_id> bash

  • Go to /tmp

cd /tmp

  • Create the bash script, I’m making the script to create a file just as a way to check if the alarm got triggered or not.

echo "touch /tmp/alarm001finished" > alarm001.sh

  • Change the permissions of the script so Apache DolphineScheduler can access it.

    chmod 777 alarm001.sh

Create a tenant

  • Assign the Tenant to the admin user

Create the alarm

  • '; echo "This is a shell injection attack" > /tmp/injection.txt; #

Create the project

  • Under project we can run the process we want that eventually it will trigger the alarm which it’s vulnerable to command injection.

Create workflow definition

  • Click on the project name “proj_001”

  • Go to workflow definition

  • Drag and Drop shell

  • Once you drop it, it will open this

  • In the script you can write whatever you like, it’s what the shell process will do.

  • Now confirm

  • After the confirm, it will look like this, click save

  • It will ask you for Workflow basic information

  • After you click confirm, it will take you to this

  • Click that button to make this workflow online

  • You can notice the color changed.

  • Click on the start button

  • The notification strategy can be all or success which means when or based on what the alarm will be triggered.

  • Click confirm, it will take you to the Workflow instance

Check docker

  • ls

  • You can see “alarm001finished” and this is the file created by alarm001.sh script

  • Also, you can see injection.txt, this is the file created by the command injection.

Static Analysis

Let’s analyze the source code of the alarm script plugin.

  • Download the source code from here

https://github.com/apache/dolphinscheduler/archive/refs/tags/3.0.0.zip

  • Go to dolphinscheduler-3.0.0\dolphinscheduler-alert\dolphinscheduler-alert-plugins\dolphinscheduler-alert-script\src\main\java\org\apache\dolphinscheduler\plugin\alert\script\ScriptSender.java

  • The class starts with defining some variables

  • This method will get the value of those parameters from ScriptParamsConstants.java

  • Here it will do six things

1. validate script path in case of injections

2. Check if the file existed in the first place

3. Check that the script is a file

4. We have an array called cmd here where the execution of the script happens and the injection as well.

5. We have an if statement checks if there is no error, it will set the alert status to true and the alert message.

6. Finally, if there is any error we the alarm message with the exit code, and the error will be logged as well.

We are interested in point number 4.

String[] cmd = {"/bin/sh", "-c", scriptPath + ALERT_TITLE_OPTION + "'" + title + "'" + ALERT_CONTENT_OPTION + "'" + content + "'" + ALERT_USER_PARAMS_OPTION + "'" + userParams + "'"};
        int exitCode = ProcessUtils.executeScript(cmd);

The injection happens because this constructs a shell command by concatenating the scriptPath, title, content, and userParams strings without validating or sanitizing them.

For more understanding let’s see how the cmd variable value will look like in case of valid data input.

  • scriptPath = alarm001.sh

  • ALERT_TITLE_OPTION = -t

  • ALERT_CONTENT_OPTION = -c

  • ALERT_USER_PARAMS_OPTION = -p

The final result:

/bin/sh -c /path/to/alarm001.sh -t 'title' -c 'content' -p 'paramtest'

The developers assume that the input will be between ' ' therefore anything between single quotes ' ' can’t be escaped or injected.

BUT if the attacker has the ability to close the single quotes ' ' first, after that inject a command, it will be treated as a separate command by the /bin/sh

So, with our payload, the final result will look like this:

/bin/sh -c /path/to/script.sh -t 'title' -c 'content' -p ''; echo "This is a shell injection attack" > /tmp/injection.txt; #'

How to test this?

Go to your terminal (you can test inside the docker container itself) and try this command

/bin/sh -c /path/to/script.sh -t 'title' -c 'content' -p '; echo "This is a shell injection attack" > /tmp/injection.txt; #'

Nothing will happen, the injection.txt file won’t be created.

Now try it like this

/bin/sh -c /path/to/script.sh -t 'title' -c 'content' -p ''; echo "This is a shell injection attack" > /tmp/injection.txt; #'

You will find that the injection.txt is created.

Patch Diffing

You can check the changes on the vulnerable endpoint ScriptSender.java from here:

https://github.com/apache/dolphinscheduler/commit/1b7000281e28a44d4de3ed60c3c872582e3d7cb3

  • They added space in the comments

  • Removed the cmd array from here

  • Here they added three if statements, basically those statements check if the parameter value contains a single quote '


    if it is, the alarm won’t be executed therefore we will not move to line 102 and execute the command constructed in the cmd array variable.

    also, the code will log the error and set the message to “shell script illegal user params” and the userParams value.

Is there a bypass for this?

I don’t think so, I tried. every time you try to inject anything without escaping the single quotes ' ' it will be treated as a string as we saw before in the Static analysis.

Mitigation

Users should upgrade to version 3.0.2 or 3.1.1.

Final Thoughts

There is not much to say about this. Command injection is always my favorite vulnerability, this is really easy to reproduce and exploit.

The issue is solutions like this are not always public therefore you will find more use for it when you find such a solution inside the network company during internal pentesting for example.

Also, another restriction here is that you will need to create a malicious alarm, and to do that you need permissions, after that almost any user can exploit this.

I will show you later how to get RCE and gain access, so stay tuned and join vsociety 😏.

Resources:

#Apache #DolphinScheduler

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.

Complete Guide to SafeDNS AppBlocker for Granular Web Filtering Control

SafeDNS AppBlocker is a web filtering tool that enables precise control over your filtering settings, making it an excellent option to consider. SafeDNS AppBlocker has a list of 100+ apps divided into 14 groups for easier management, making it easier to block specific apps or ecosystems.

With SafeDNS AppBlocker, you can block individual apps or entire ecosystems or groups of apps/ecosystems. This gives you complete control over what apps are accessible, ensuring that you and your users are protected from harmful content and potential security threats.

AppBlocker VS. Categories

AppBlocker settings have a higher priority than Category settings in SafeDNS, which means that if an app is blocked by AppBlocker, that setting will override any Category settings that apply to the same app.

For instance, let’s say you have allowed access to social media apps by Categories settings, but you have also blocked access to Instagram by AppBlocker. In this scenario, Instagram will be blocked, even though it belongs to a category that is allowed.

It’s crucial to note that AppBlocker works one way only. If an app is blocked by Category settings, AppBlocker won’t allow access to that app. In such cases, it’s better to use the Allowlists to explicitly allow access to specific apps, regardless of their category.

AppBlocker VS. Allow/Denylists

AppBlocker functionality works alongside the Allow/Denylists to provide granular control over app and website access. While AppBlocker offers a more flexible approach to web filtering by allowing you to block individual apps or entire ecosystems/groups of apps, the Allow/Denylists enable you to explicitly allow or block specific websites or apps, irrespective of their category.

One crucial thing to note is that the Allow/Denylists have a higher priority than AppBlocker settings. This means that if a group of apps is blocked by AppBlocker, but an app from this group is in the Allowlist, the user will have access to the app because the Allowlist settings take precedence.

Whether you want to block social media apps during work hours, prevent access to gambling or adult content, or simply manage app usage, SafeDNS AppBlocker is the perfect solution. Its easy-to-use interface and customizable features make web filtering a breeze, helping you stay safe and secure online.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SafeDNS
SafeDNS breathes to make the internet safer for people all over the world with solutions ranging from AI & ML-powered web filtering, cybersecurity to threat intelligence. Moreover, we strive to create the next generation of safer and more affordable web filtering products. Endlessly working to improve our users’ online protection, SafeDNS has also launched an innovative system powered by continuous machine learning and user behavior analytics to detect botnets and malicious websites.

Everything You Need to Know About SafeDNS Categories

One of the key features of SafeDNS is its ability to categorize websites into different categories based on their content and purpose. In this blog post, we’ll take a closer look at SafeDNS Categories and explore how they work, both alone and in combination with other SafeDNS features.

So, how exactly do SafeDNS Categories work? Basically, when you try to access a website, SafeDNS checks its URL against its database of categorized websites. If the website falls into a blocked category, access is denied. If it’s in an allowed category, access is granted. Simple, right? SafeDNS Categories are super handy, especially when it comes to controlling internet access in a safe and secure way.

SafeDNS Categories and the Allow/Denylist:

Another great feature of SafeDNS is the Allow/Denylist. This is a list of websites that are either explicitly allowed or blocked, regardless of their category. SafeDNS Categories and the  Allow/Denylist work together to provide granular control over website access. SafeDNS Categories do not override the Allow/Denylist.

How the Allowlist Only Feature Works:

The Allowlist only feature is a setting in SafeDNS that allows you to block all websites except for those that are explicitly listed on the Allowlist. This is perfect for organizations that want to restrict website access to only a select few sites. You can be sure that your employees or students are only accessing the websites that you’ve deemed appropriate.

How Force Safe Search and Force Restricted Mode for Youtube Work:

SafeDNS offers a Safe Search feature that filters out any explicit content from search results on popular search engines such as Google, Bing, and Yandex. This ensures that your employees or students are not exposed to inappropriate content while browsing the web. In addition, SafeDNS offers a Restricted Mode feature for YouTube, which filters out any age-inappropriate videos on the platform. With these powerful features, you can ensure a safe and secure browsing experience for your users, and have peace of mind knowing that your organization’s web filtering policies are being enforced.

SafeDNS Categories are a powerful tool for controlling internet access and enforcing company policies. With SafeDNS Categories, the  Allow/Denylist, Allowlist only setting, Safe Search, and Restricted Mode for Youtube, you can customize your web filtering settings to meet your organization’s specific needs. SafeDNS is a great way to ensure a safe and secure internet environment for your employees or students.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SafeDNS
SafeDNS breathes to make the internet safer for people all over the world with solutions ranging from AI & ML-powered web filtering, cybersecurity to threat intelligence. Moreover, we strive to create the next generation of safer and more affordable web filtering products. Endlessly working to improve our users’ online protection, SafeDNS has also launched an innovative system powered by continuous machine learning and user behavior analytics to detect botnets and malicious websites.

×

Hello!

Click one of our contacts below to chat on WhatsApp

×