2022 彙整 - 頁39，共121

Scanning your external attack surface with runZero

While runZero is mostly used for asset inventory behind the firewall, you can also use its scanner to discover your external attack surface.

External scans are beneficial for a number of use cases, such as:

Getting visibility into external hosts and exposed services
Assessing infrastructure of corporate acquisition targets
Performing vendor security screening
Reconnaissance for penetration testing

Differences between runZero and EASMs

New users sometimes wonder about the differences between runZero and solutions for external attack surface management (EASM), such as Censys and ShodanHQ. Many of these solutions scan the whole world so you can query their host database. However, network owners can ask to exclude their IP ranges for all users (i.e., not all hosts show up in your search). Some vendors will have tools or services that discover all of your externally-facing assets.

By contrast, runZero:

Is primarily an internal asset inventory and network discovery tool, but also has the ability to discover public-facing hosts.
Collects data through a combination of active scanning and integrations.
Takes inputs in the form of ASNs, domains, IPs, and FQDNs (as well as public IPs discovered in internal scans).
Can integrate with Shodan & Censys to identify hosts and augment data.
Augments scans with other sources through integrations (e.g., cloud hosting providers, vulnerability scanners, and EDR platforms).
Offers a much richer data set per asset.

How to scan your public-facing hosts

If you don’t have access to runZero Enterprise Edition, you can sign up for a free 21-day trial to follow this walkthrough. The free Starter Edition doesn’t contain some of the features described in this blog post.

Step 1: Determining domains and ASNs to scan

The easiest way to get started with external scans is through:

Domains – There are several options for finding the domains associated with your organization. Best to check with the person who’s managing your domain registrations and renewals. Doing a reverse WhoIs lookup hasn’t been a good option for a couple of years now, but if you lack alternatives, use Whoxy to find all domains registered to the same company.
ASNs – If you don’t know the ASN for your company, you can use a lookup service, such as ASNLookup to identify the ASNs for your organization.

For this example, let’s scan the external attack surface of a real organization and its properties, but blur any identifying data to ensure that the organization doesn’t become a target as a result of this post.

Step 2: Adding Censys or Shodan integrations

You can also discover your external hosts via Shodan or Censys integration. The integration can pull in additional machines that may not be in your ASN or domain scope. To use the integration, go to Inventory > Assets in your navigation menu and select Censys search or Shodan search from the Connect dropdown menu. You’ll have to set up credentials with an API key to build the query.

In the Censys configuration, we query acme.org in our search. This will also find any hosts that use the string acme.org in the common name of a TLS certificate. You can run this import either once or on a schedule.

Alternatively, you can set the Censys search mode to All external assets, which will not discover new assets, but enrich the assets already captured in runZero with Censys data. However, for this use case, we’ll go with the former setting.

The import will pull any information about the matching hosts, including services and attributes, into your inventory. You should now see some assets with limited data being populated in your runZero inventory. You can view the details for one of the imported hosts and see the following information:

Step 4: Starting an external scan using hosted zones

In runZero, set up a new organization or project, then go to the inventory, click the Scan button and select Standard scan.

From the scan configuration page:

Choose US – New York as the Hosted zone (this is a runZero-hosted Explorer in the cloud).
Increase the scan rate from 1,000 to 5,000 (to accelerate the scan).
In the Discovery scope, enter the following data:
- public:all: This will scan all the public IPs that were pulled in via Shodan or Censys in the previous step. If you are scanning your internal network with runZero, this will also add all public IPs discovered by any other means into the scope.
- asn4:12345: Enter all ASNs in this format to target all IP addresses registered to this ASN. Note the digit 4 after ASN in the notation.
- domain:acme.org: Add all domains that you are targeting. runZero will add all subdomains connected to these domains.

Click Initialize scan. runZero now looks up both the IPs registered under the ASNs as well as all subdomains associated with the domains you are looking to scan and displays a sample for confirmation. Confirm your scan settings.

Once the scan task has completed, go view your populated inventory.

runZero hosted zones are deployed with Digital Ocean. If you prefer to host your own Explorer, we recommend Digital Ocean because AWS, Azure, and GCP all rate-limit or filter outbound scan traffic in a way that impacts the quality of scan results. The runZero hosted zones performed much better than running a scan from an ISP as well, regardless of whether a VPN was used or not.

Step 5: Digging into your inventory

Looking at this data set, there are quite a few hosts with EOL operating systems. You can use the following query to find these:

os_eol:<now

Some operating system vendors will enable you to purchase extended support services. To only view systems that are outside the extended support period, use the following query:

os_eol_extended:<now

Assets can often leak secondary IP addresses, often within the RFC 1918 range. These machines are potential pivot points into private network spaces. To find those quickly, use the query:

has_private:t

Best practices are to have as few services on a single host as possible, especially when they are public-facing, to avoid the risk of one vulnerable service compromising another one. Sorting the column with the number of services per host reveals one host with eight services. After opening the Asset Details page, we can see these in the Services section.

Each one of these services has an extensive list of attributes that provide more information.

Step 6: Finding problematic SSH services

Looking at the SSH service on port 22, we see that it supports the authentication method of both password and public key. Allowing a simple password authentication may indicate elevated risk to your infrastructure.

Clicking on the magnifying glass with the + sign next to the attribute name reveals that there are a total of 24 hosts that allow this kind of authentication.

Clicking on the attribute value or the count will display a list of hosts that match the query.

Back on the Asset Details page, clicking the magnifying glass next to the banner shows an overview of all the different SSH versions deployed in the infrastructure.

This works for all of the banner versions for other protocols as well. For example, you can very quickly and easily get a list of all of the Microsoft SQL Servers deployed in the environment, sorted by version number.

Going back to the Asset Details page, clicking the magnifying glass next to ssh.hostKey.md5 displays the frequency report for this attribute. It shows that several machines share the same SSH private key. This presents a security risk because if one of the hosts is compromised, it would also compromise other hosts sharing the same SSH private key. This typically happens when virtual machines are cloned without regenerating the SSH keys.

Step 7: Identifying databases exposed to the Internet

Generally, databases should be accessible only to the applications that require access. They should never be accessible on a public IP. The same host exposes MariaDB version 10.5.15 on port 3306, which has several associated security vulnerabilities.

Identify databases exposed to the Internet

Is runZero a vuln scanner?

runZero is an asset inventory and network discovery solution, not a vulnerability scanner, but its findings can sometimes point to security vulnerabilities.

Step 8: Looking at exposed services

Let’s move on to the Services Inventory now. A great way to find unusual services exposed on an external IP is to sort the ports by high numbers first.

In this environment, we’re seeing a Prometheus Node Exporter metrics server on port 9100, three IRC services, a mySQL/MariaDB service, NFS on port 2049, and RSYNC on three different machines. These may all provide options to an attacker. For example, insecurely configured Rsync servers are found during network penetration tests about a third of the time.

Step 9: Browsing web service screenshots

The Screenshots Inventory lists all screenshots taken from Web services. runZero uses the Google Chrome browser to render and screenshot any web pages. If you are using the cloud-hosted explorer as described above, you’re all set. If you are hosting your own explorer, please ensure that you have Chrome installed on the same machine to enable this feature.

Browsing through the screenshots is a great, visual way to inspect exposed websites. In our example, we’re seeing Jitsi Meet and GitLab sites, which may be OK to host externally as long as they’re updated and use strong authentication.

Step 10: Looking at software inventory

runZero can also infer installed software if it can be deduced either from a network scan or an integration. runZero’s Software Inventory provides a great way to get insight into software installed on hosts that are reachable over the Internet.

A view that may be even better in understanding your product exposure is the Most seen products report on the dashboard. To access the report, go to the Dashboard and look for the Most seen products card. After you find it, click View more.

The results for least seen products are actually more interesting than the most seen ones because these show the long tail of the software inventory. If a piece of software is only installed once in your environment, it is less likely to be well configured and patched.

Step 11: Create a report for your external assets

Now that you have discovered and analyzed all of your externally-facing assets, you can also generate a report for others to review. Go to Reports, find the External Assets Report, and launch it.

From the External Assets Report configuration screen, you can choose what you’d like to include in the results. Additionally, if you need to view it regularly, you can set up a schedule and email it to yourself (and any other runZero user who wants a copy). Initialize the report when you’ve finished configuring the settings. The generated report will display and show you the results. You can save the report as a PDF to easily share with others.

Step 12: Get alerted on changes to your external asset inventory

If you work in enterprise security, you probably want to know about any changes to your external asset inventory. In this case, you should set up a Censys or Shodan import and run the hosted scan on a schedule. Then, you can set up alerts to trigger post-scan, so you know everything that has changed in your environment.

In this example we’ll use email as the method of communication. To set up an alert, go to Alerts > Channels and click Create channel. Pick a name for your channel, select Email as Channel type and enter the email address you want to notify. Then click Save channel.

Go Alerts > Rules, and click Create rule. Select new-assets-found and click Configure rule.

When the New rule configuration page appears, enter the following:

Name:
- A name for your rule.
Conditions:
- Enter 0 to the right of is greater than. This will trigger the rule if there are any changes to assets.
- In Limit to organization, select an organization if you have several in your account. You may choose a different organization (or site) for your external point of view rather than your internal assets.
Action:
- Choose the notification channel you just created.

You’ll now be notified after each import or scan if the assets have changed.

Use runZero for your internal asset inventory

runZero is primarily made for discovering your internal asset inventory. As you can see, it can also be useful for understanding your externally-facing assets.

As a next step, you should set up another organization and to scan your internal network to get a better understanding of your asset inventory. You can sign up for the free 21-day trial of runZero Enterprise Edition (no credit card required). If you are a private user or work for a company with less than 256 assets, you can use runZero Starter Edition for free.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

2022 runZero

CISA Urges Organizations to Prepare For Future Quantum Threats

As the world anticipates quantum computing, many believe it has potential benefits for every industry. Equally excited and awaiting its rollout is the hacker community who could use these powerful quantum computers to compromise the digital systems we use daily including online banking and email software

The US Cybersecurity and Infrastructure Security Agency (CISA) has already warned that organizations need to take action to protect network infrastructure for the transition to post-quantum cryptography.

Many governments believe that quantum computers can be used to break public-key encryption methods that countless networks use today. A fully-functioning and stable high-qubit quantum machine could potentially wreak havoc across the internet. It will lead to the vulnerability of secure networks and loss of public confidence in major institutions and businesses

The good news is that these governments are developing post-quantum encryption schemes. For instance, the US National Institute of Standards and Technology (NIST) has been running multi-year effort since 2016 calling upon cryptographers around the world to devise quantum-resistant encryption methods. It aims to standardize one or more quantum-resistant cryptographic schemes to foster a transition to seamless security for the general public.

What is Quantum Computing?

Quantum Computing focuses on the development of computer-based technology hinged on the principles of a quantum theory. Experts believe the present experimental quantum computers can render the conventional system obsolete. Its benefits include advanced research, higher-level simulation, and accelerated growth of artificial intelligence models.

Is Quantum Computing a Risk?

Despite these promising benefits, there are concerns about some negative implications which include ethical and security risks for businesses, quantum attacks from hostile nation-states, and exacerbating current issues like data harvesting.

CISA’s Stance on Quantum Threats

CISA asserts that critical infrastructure is more at risk largely due to the public-key cryptography that U.S. networks rely on to secure sensitive data.

CISA provides insight to all critical infrastructure owners to have a successful transition in their Post-Quantum Cryptography Roadmap. The roadmap stipulates the following measures:

Taking actionable steps like inventory assessments of current cryptography technologies.
Developing acquisition policies for post-quantum cryptography.
Training staff about the upcoming transition from conventional to quantum computers is necessary.
Increasing engagement with standards developments relating to necessary algorithms and dependent protocol changes.
Managing inventory assessments and the security of critical datasets for an extended time.
Organizations must identify systems where public key cryptography is used and mark these systems as quantum vulnerable.

Preparing Organizations for the Quantum Threat to Cryptography

Many believe the time to worry about quantum computers threats is in a decade — but it’s sooner than we think. The process of adopting new standards usually takes years so it is crucial to begin planning for quantum-resistant cryptography now.

Organizations need to make arrangements and budget for a transition plan. This should include upgrading IT systems and deploying standardized quantum-resistant cryptography. They also need to be aware of how vendors plan to upgrade software and hardware. The preparation process should include software upgrades, and system patch delivery to systems using cryptography. They should also ensure the security of these upgrades and authenticate the source.

Moreover, organizations need to take advantage of agencies promoting awareness of quantum computers’ impact on cryptography. These agencies also provide steps to prepare for the transition to quantum-resistant cryptography when it comes.

The agencies partner with others to evaluate the next generation of quantum-resistant cryptography. The aim is to replace current cryptographic applications.

The Challenges With the Quantum Resistance Ahead

New technologies come with new opportunities and new risks — and quantum computers are no exception.

Building a large-scale quantum computer already has several challenges – fabrication, verification, and architecture. The technology derives its power from the ability to store a complex state in a single bit. Unfortunately, this also rather complicates the process of building, designing, and verifying. The verification issue is a cause of concern since it affects communication mechanisms, control circuitry for quantum operations, and more. Moreover, there’s no telling if it impacts the security of data within the technology itself.

Code breaking is another area of focus. An easy way to break codes in conventional computers is to try all possible keys. However, it is a much longer and difficult process. Quantum computing uses Grover’s algorithm to speed up this process. Another method called Shor’s algorithm is capable of breaking or weakening cryptographic algorithms within hours.

The potential for harm from quantum threats here becomes huge. Once encryption methods get broken, trust in data transmission becomes low. Cybercriminals will find it easy to create bogus certificates that call for the validity of a digital identity.

The technology’s effect would render communications as insecure as if encoding didn’t even exist. While there are a lot of worries about quantum computing, these fears remain hypothetical. Today’s quantum computing cannot break any commonly used encryption methods. However, concern for the vital security of our global network infrastructure and data drives the immense effort to counter a potential future of quantum threats.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

Why Is the Healthcare Industry the Most Likely To Pay Cybercriminals for Ransomware Attacks?

Times are looking more brutal than ever for one of the world’s most critical industries. Ransomware attacks are skyrocketing, and healthcare organizations are increasingly cut off from much-needed cybersecurity insurance.

But just how bad is the situation? A recent Sophos survey found that 66% of healthcare organizations were hit with a ransomware attack in 2021, up from 34% in 2020. Perhaps more alarming, healthcare organizations pay the ransom most often compared with other sectors (just over 60% compared with a cross-sector average of 46%. So, what’s going on here? Why is healthcare most likely to pay up in ransomware cyber-attacks?

Why Do Cybercriminals Target Healthcare Organizations?

Healthcare organizations are a lucrative target for cybercriminals because medical records are a treasure trove of sensitive information. The Health Insurance Portability and Accountability Act (HIPAA) classifies various patient information, including Social Security Numbers, contact information, credit card information, and more, as protected health information (PHI). And PHI is one of the most valuable types of data out there.

Beyond PHI’s higher selling price, healthcare organizations are more likely to be targeted with a ransomware cyber-attack because they’re more likely to pay the ransom. But why?

Holding Someone’s Life in the Balance

Here’s the bottom line. We all understand why paying the ransom is bad; it feeds the hackers and incentivizes them to continue hacking, making the problem worse for all. However, not paying the ransom isn’t so simple in reality.

In some industries, data provides a competitive advantage, but in healthcare, losing access to critical data and systems can put patients’ lives in danger. Or in other words, healthcare organizations aren’t blind to the ethical issues with paying ransoms, but getting their services back online quickly is often their top priority. When you consider that the average downtime a company experiences following a ransomware attack is 7-21 days, it’s not hard to see why healthcare companies cave to pressure.

Medical Devices Can Present an Easy Entry Point for Ransomware Attacks

The healthcare security landscape is made increasingly complex with medical devices and The Internet of Medical Things (IoMT). Medical devices like insulin pumps, wearable biosensors, smart thermometers, and other remote patient monitoring technology play an increasingly vital role in the industry. However, these new devices open up worrying new entry points for attackers.

As a relatively new industry, IoT still lacks strong security guidelines that help govern and secure other types of tech. At the same time, security is often not the primary concern in the development of new IoT and IoMT devices. Why? Because manufacturers want to maximize functionality while working with limited compute and hardware, which leaves minimal space for robust security and data protection measures.

More often than not, these devices don’t store patient data. However, attackers can leverage these devices to gain access to other network resources, like a server that does hold sensitive data. Once attackers gain access to the network, they can exfiltrate data or, increasingly, install costly ransomware.

Beyond IoMT, other complexities of the healthcare IT environment can leave healthcare companies vulnerable to cyber-attacks. For example, the need for efficient and widespread access to critical patient data across systems means two-factor authentication and zero trust defenses aren’t always feasible.

An Increase in Ransomware Attacks is Making it Harder to Get Cybersecurity Insurance

Ransomware attacks are on the rise, healthcare IT environments are more complex than ever, and the cybersecurity skills gap puts in-house cybersecurity teams under immense pressure. With this dire picture in mind, healthcare organizations increasingly turn to cyber insurance to protect their vital assets and minimize cyber-attack damage. But there’s a problem – obtaining coverage is becoming more challenging.

The Sophos report found that 51% of respondents said the level of cybersecurity needed to qualify for cyber coverage is now higher than in the past. At the same time, cyber insurance is becoming increasingly expensive.

Ransomware attacks are a significant cause of changes we’ve seen in the cyber insurance market in recent years. Ransomware is now the largest driver of cyber insurance claims, and with attacks increasing, ransom payouts have soared. As a result, many cyber insurance providers have found themselves unable to keep up and have left the industry altogether. The ones that remain are changing their limits, coverage, and pricing to manage the increased risk.

This has led to a seller’s market, where the dwindling number of providers hold all the power. They can charge what they want and be selective about who gets coverage. And unfortunately, many healthcare organizations aren’t meeting the selection criteria.

Equally concerning is threat actors’ monitoring of cyber insurance companies’ relationships. According to Reuters, some ransomware attack check whether potential victims have policies that make them more likely to pay the ransom.

However, the competitiveness of the cyber insurance market does seem to be having some positive effects. For example, over 95% of healthcare respondents said they have made improvements to their cyber defenses to boost their cyber insurance prospects. For example, nearly half of the covered respondents implemented new security processes and increased staff training.

Despite the concerns surrounding cyber insurance, it’s crucial that healthcare organizations understand that cyber insurance isn’t a band-aid for weak cybersecurity. Instead, healthcare organizations need to deploy robust cybersecurity defenses that grant a speedy recovery from a cyber-attack, as well as backups and endpoint detection and response solutions.

Wrapping Up

The healthcare industry has had a tough few years with COVID-19, rising staff shortages, increased demand for telehealth, and a constant onslaught of ransomware attacks. If the healthcare industry wants to lose its number one spot as the industry most likely to pay ransoms, it needs to take a more rigorous approach to cybersecurity. The cybercriminals will stop trying (or trying in colossal numbers) when the work becomes too hard and the reward too low. As it stands, healthcare is the low-hanging fruit for cybercriminals in 2022.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

Portnox 2022 Network

How to Choose a PAM Solution?

PAM was voted the #1 cybersecurity project by Gartner for two years in a row.

This is because it is a strategic measure to choose a PAM solution as a tool to promote cybersecurity in organizations, which allows one to control privileged access for users, accounts, processes, and systems in an IT environment.

In practice, PAM involves a number of capabilities, with the main goal of ensuring the application of the principle of least privilege, according to which each user must have only the necessary access to perform their activities.

In the next topics, we will show you what you should do to choose a PAM solution that is ideal for your business. Keep reading our article.

Follow Technology Events

Following technology events is a way to stay on top of key trends related to information security and know what are the best PAM solution providers.

Between August 22 and 24, Gartner Identity & Access Management will be held in Las Vegas, with experts sharing information on PAM and many other things.

In addition, other enlightening events are planned for 2022 and 2023, including RSAC 2022, Defcon, Red Hat, and the European Identity and Cloud Conference.

Check What the Market Reports Have to Say

Another way to know which PAM suppliers are reliable and offer an efficient solution is through market reports, which bring up-to-date data to buyers.

In this sense, Gartner shares relevant information about the main PAM solutions available, as well as KuppingerCole Analysts, Forrester, Quadrant Solutions, and ISG, among others.

Talk to Resellers

PAM resellers are also often trusted sources and recommend the best tools for their customers. Considering that resellers also deal with several customers and can understand better than most the real pains of companies of different sizes and verticals, it is worth questioning them about how to choose a PAM solution that best suits your needs.

Search on Websites

Some websites may provide interesting information about the PAM solutions available on the market. You can, for example, check reviews on Google or search for posts on information security pages, such as The Hacker News and HelpNetSecurity.

Join Cyber Groups

Finally, it is possible to learn from the experience of others who have hired these solutions. Just join cyber groups on LinkedIn, MeetUp, WhatsApp, Slack, or IRC and ask which PAM solutions have brought the most benefits to users.

Conclusion

In this article, we have shown you the importance of PAM and what you should do to choose a PAM solution that is ideal for your company. Did you like our content? Then share it with someone.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.

Segura 2022

OWASP Top 10 – Cryptographic failures

OWASP stands for Open Web Application Security Project. It is a non-profit organization whose mission is to improve software security. It is based on an “open community model,” thus, anyone can participate.

The OWASP community is well-known; I also refer to them in some of the articles I wrote.

OWASP started to publish a top 10 list of vulnerabilities way back in 2003. Since then, the list is updated every two or three years. The latest list was published in 2021. At the end of this article, I will provide a list of important pages on OWASP’s site.

By OWASP definition: The OWASP Top 10 is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to web applications.

And, of course, as you can guess, this list is created by the community of developers specializing in security risks.

OWASP Top ten 2021 vulnerabilities:

Broken access control
Cryptographic failures
Injections
Insecure design
Security misconfigurations
Vulnerable and outdated components
Identification and authentication failures
Software and data integrity failures
Security Logging and monitoring failures
Server-Side Request Forgery (SSRF)

I will not focus on historical differences within the OWASP top 10. However, I wanted to mention that the difference between new versions of the list is mainly in categorization (often in adding new categories as new malicious attacks emerge), renaming, changing scopes, etc.

In my previous articles, I already covered some of the vulnerabilities from the OWASP list. In this article, I am going to focus more on Sensitive Data Exposure which is now known as Cryptographic failures. Now the focus of this category is cryptography failures that lead to sensitive data exposure.

Sensitive Data Exposure

When web applications accidentally expose sensitive information that should not be public, that vulnerability is called “Sensitive Data Exposure.” By sensitive data, I mean the data which should be protected by the GDPR. This includes personal data such as name, date of birth, credit card numbers, and even usernames and passwords. Unfortunately, if the website’s security is poor, sometimes, data can be found on the web server. But often, it is a case where attackers would perform the “man in the middle – MiTM” technique to try to hijack sensitive data.

This attack happens when the attacker places themself between the user and the web application. They would make a fake site, so the user thinks they went to their desired site but were redirected to the attacker’s fake site. Or for example, the attacker intercepts messages between the user and the server and gains control of that conversation. Basically, they control the flow of the request and the responses.

Exposing flat-file database

The database is often used to store all kinds of data, including sensitive data.

For this example, we will consider a small web application whose database is saved is saved as a single file on the disk of a computer (server).

The most common database engine used for this database type is SQLite.

In this case, the attacker would need to navigate and find the location of the database and then download it. They would then have access to the data in the database and could query it to get the results. Of course, it will probably not be easy if the data is encrypted, but the attack becomes a lot easier if the attacker downloads the database and has the file saved locally.

In one of my articles, I described one technique-Path Traversal, which attackers are using to navigate to a certain file. Check it out! I will not describe how to find the file and download it; if you read the mentioned article, you will have an idea about how it is done.

So, we are on the step when we download the database, and now, we want to check out the results in it.

As I mentioned, in this example SQLite queries are used. You can check out select and distinct syntax with SQLite here.

For example, if you are using Kali, sqlite3 is installed by default, so you can just refer to the man pages.

To access the database, you would issue a command like this:

sqlite3 targetDB

to see the list of tables:

.tables

To check out table info for the table:

PRAGMA table_info(users)

More info about pragma statements on this site.

Check out all user’s info:

SELECT * FROM users

Then, if the passwords are stored in this database, they would probably be hashed, and the next step would be to use some tool to crack the hash, for example, John the Ripper, Hashcat, or some other password-cracking tool.

When the attacker gets to the password, it is the beginning of the game for them! And the end of the game for the user.

Prevention steps Sensitive Data Exposure

When deciding on the storage type, it is very important to remember that you shouldn’t store sensitive data that is not required (store the least amount of data). If you need to store it, first figure out the safest location to store it and how to prevent the leakage of sensitive data.

When you store the data, you must encrypt it! I found this site you can check out if you are working with ASP .NET CORE and want to see how to encrypt/decrypt data using the interface IDataProtector!

Before you store the data, it should be safe at all times, especially in transit! For safe transit, use TLS, which would enable secure communication. If you are using ASP .NET check out how to enable TLS on this blog.

As I mentioned before, attackers often use the “man in the middle” technique; because of that, you might want to consider setting up something like HSTS(HTTP Strict Transport Security). If you are familiar with and want to use Angular to implement HSTS, there is a brief explanation on their official site.

While I mentioned ASP .NET and HSTS, if the application is in production you can modify startup class(or Program.cs if it is .NET 6)to use UseHttpsRedirection(HTTPS Redirection Middleware) and a also UseHsts(HSTS Middleware). If you want to use the mentioned Middleware, check out the official site!

Conclusion

I wanted to show you how many vulnerabilities from OWASP’s Top 10 list we covered through the previous articles and how many are left to be covered.

In the end, secure code is the cheapest code!

OWASP pages related to the topic:

Cover photo by Brett Jordan

#owasp #cryptographic-failures #top10

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.

vRx 2022