Source: securityboulevard.com – Author: Nathan Eddy Failure to properly configure authentication led to malicious actors exploiting the database backups of Airsoftc3.com, a popular Airsoft enthusiast community site, according to Cybernews researchers, who discovered the breach in December. The breach exposed sensitive user data, affecting approximately 75,000 individuals within the community involved with Airsoft, a team-based […]

La entrada Airsoft Data Breach Exposes Data of 75,000 Players – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Failure to configure authentication allowed malicious actors to exploit Airsoftc3.com's database, exposing the sensitive data of a vast number of the gaming site's users.

The post Airsoft Data Breach Exposes Data of 75,000 Players appeared first on Security Boulevard.

Password reset FAILURE: The U.S. Cybersecurity and Infrastructure Security Agency warns GitLab users of a 100-day-old, maximum severity vulnerability.

The post GitLab ‘Perfect 10’ Bug Gets a CISA Warning: PATCH NOW appeared first on Security Boulevard.

Insight #1

Here we go again: Verizon’s new Data Breach Investigations Report (DBIR) is out, and once again,  unauthorized uses of web application credentials and exploits of vulnerabilities in web applications are among the top three on the breach list. It’s the same, lame story every single year. At what point will the industry figure out that Application Security (AppSec) status quo methods — Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), web application firewall (WAFs), etc. — aren't working? Why not give something new — like Runtime Security — a chance?

The post Cybersecurity Insights with Contrast CISO David Lindner | 5/3/24 appeared first on Security Boulevard.

Drop Dropbox? The company apologized as user details were leaked from its “Dropbox Sign” product.

The post Dropbox Hacked: eSignature Service Breached appeared first on Security Boulevard.

Financial institutions are among the most regulated businesses in the world. That’s understandable given their role in a key critical infrastructure sector and rising threat levels across the industry. It’s why in the EU, the Digital Operational Resilience Act (DORA) will soon take effect, to improve baseline security efforts in the sector. Yet even as investment in cybersecurity increases, breaches continue to occur. The IMF warned recently that cyber-incidents over the past 20 years have cost the sector $12bn.

The post Tackling Data Security Challenges in Hybrid and Cloud Banking Environments appeared first on Security Boulevard.

Ransomware attacks are an expensive proposition for any company. For example, a report this week by cybersecurity firm Sophos found that while the percentage of companies that were victims of ransomware this year has dropped slightly, the recovery costs – which don’t include a ransom payment – have jumped to $2.73 million, a 50% increase..

The post Lawsuits After Ransomware on the Rise, Comparitech Says appeared first on Security Boulevard.

Data breaches are like uninvited guests at a party – they show up unexpectedly, take what they want, and leave a big mess behind. This April, the party crashers were particularly busy, leaving a trail of exposed information in their […]

The post Data Breaches in April 2024 – Infographic appeared first on WeSecureApp :: Simplifying Enterprise Security.

The post Data Breaches in April 2024 – Infographic appeared first on Security Boulevard.

What is PIPEDA, Canada’s Personal Information Protection and Electronic Documents Act? PIPEDA, or the Personal Information Protection and Electronic Documents Act, is Canada’s primary federal privacy law governing the collection, use, and disclosure of personal information by private-sector organizations. PIPEDA establishes ten fair information principles to guide organizations in their handling of personal data. What […]

The post PIPEDA Compliance with Accutive Data Discovery and Masking: Understanding and protecting your Canadian sensitive data first appeared on Accutive Security.

The post PIPEDA Compliance with Accutive Data Discovery and Masking: Understanding and protecting your Canadian sensitive data appeared first on Security Boulevard.

The country's largest wireless providers failed to get the consent of customers before selling the data to aggregators, the agency says.

The post FCC Fines Verizon, AT&T and T-Mobile for Sharing User Location Data appeared first on Security Boulevard.

Nice Cup of IoTea? The UK’s Product Security and Tele­comm­uni­cations Infra­struc­ture Act aims to improve the security of net-connected consumer gear.

The post Brits Ban Default Passwords — and More IoT Stupidity appeared first on Security Boulevard.

The goal is to enable cybersecurity and data science teams to work together and share their expertise.

The post Sysdig Extends CNAPP Reach to AI Workloads appeared first on Security Boulevard.

Pioneering DSPM deployment in high assurance environments sets new standard for comprehensive data protection Symmetry Systems,, the data+AI security company,...

The post Symmetry Systems Announces World’s First Air-Gapped Deployment of a DSPM Solution appeared first on Symmetry Systems.

The post Symmetry Systems Announces World’s First Air-Gapped Deployment of a DSPM Solution appeared first on Security Boulevard.

Smishing is hard to stamp out. Worse, bogus domains surpass the legitimate one during the holiday season, when more people expect packages.

The post USPS Phishing Scams Generate Almost as Much Traffic as the Real Site appeared first on Security Boulevard.

MDM Hindered: Android phones are still OK; this is Samsung’s home, after all.

The post South Korean iPhone Ban: MDM DMZ PDQ appeared first on Security Boulevard.

In episode 327 Tom, Scott, and Kevin discuss the findings from Mandiant’s M-Trends 2024 report, highlighting a significant rise in traditional vulnerability exploitation by attackers while observing a decline in phishing. Despite phishing’s decreased prevalence, it remains the second most popular method for gaining initial network access. Discussions include the impact of high-profile vulnerabilities and […]

The post Privacy Challenges in Relationships, Phishing Down but Vulnerabilities Up? appeared first on Shared Security Podcast.

The post Privacy Challenges in Relationships, Phishing Down but Vulnerabilities Up? appeared first on Security Boulevard.

💾

In August of last year, @tifkin_, @0xdab0, and I released Nemesis, our offensive data enrichment platform. After lots of feedback, operational testing, hundreds of commits, and another solid dev cycle, we’re proud to finally announce Nemesis’ 1.0.0 release. This post will detail several of the major changes we’re excited about, from host modeling, to a streamlined installation process, dashboard improvements, and more!

Host Modeling

Since the beginning of development, one of our visions for Nemesis has been for it to provide guidance to operators agnostic of their C2 tooling. If we want Nemesis to be able to perform analysis like PowerUp’s privilege escalation, we have to build a proper offline data model to handle the analysis we want. Part of this involves the very specific problem of host “uniqueness” when you have data coming in from a number of different C2 sources.

This, however, ended up being a more challenging task than we anticipated. We will be releasing a detailed post diving into all of the nuances of this problem in the next few weeks, but we wanted to at least highlight the problem as we viewed it. We also have a specific temporal issue that we’ll touch on briefly as well.

The host uniqueness problem is a consequence of the variety of ways host data can be ingested into Nemesis. In order to perform host-based analysis, we have to collapse data from potentially multiple ingested sources into a single host abstraction so we don’t miss any details. I.e., consider the situation of having multiple C2 agent types on the same host. C2 agents can report a host’s short name(e.g., NetBIOS name), fully qualified name, or IP addresses. We might be performing an action against a remote host from a C2 agent, i.e., downloading a file from a host that doesn’t have an agent on it, but the connection is being routed through an existing agent. And finally, we might have manual data we’re uploading through the Nemesis interface in case there isn’t an existing connector.

With all of these options, the way to elegantly (well, at least as elegantly as possible) combine data from multiple ingestion sources in a way that we can break sections back apart if there is a mapping mistake was…tricky. We also ran across a “temporal problem” for specific types of data like file or process listings where these data are ephemeral and can be influenced by operator events. For example, if you took a file listing but then uploaded or deleted a file on the host, the ground truth (as far as you know) for the filesystem state has to be built from multiple pieces. This data may also be ingested out of order (e.g., ingesting long-term collection output from a tool running on another host). Luckily, we believe we have a solution for this too!

If you’re as interested in this type of problem as we are (Bueller? Bueller?) keep an eye out for our upcoming modeling deep dive post.

HELM Charts!

One of the most common pieces of negative, yet legitimate, feedback we received about Nemesis was the complexity of its installation. Previously, setting up Nemesis required a number of prerequisites like Docker, Helm, and Kubernetes via Minikube. In response to this feedback, we’ve now adopted k3s, which can be installed with one command and doesn’t depend on Docker. Our updated quickstart guide outlines the full installation process in just five steps, making it quicker to get up and running.

We’ve significantly improved the deployment process of Nemesis with the transition from Skaffold to Helm. Max worked hard on creating three new Helm charts: quickstart, nemesis, and monitoring. The quickstart chart is designed to configure all the secrets and dependencies necessary for Nemesis, providing an easy setup for most users. Advanced users, who might want to manually manage these settings or integrate with a Kubernetes secrets manager will want to replicate the functionality of the quickstart chart themselves. The nemesis chart sets up all the required Nemesis services like before. The monitoring chart is an optional installation that deploys monitoring services like Fluentd, Grafana, and Prometheus for those who want more insight into logging and performance. Additionally, this change has allowed us to eliminate the need for the janky nemesis-cli.py script!

Additionally, we have builds of Nemesis Docker images pushed to Dockerhub, meaning users no longer have to go through the build process. The entire setup process is described here in the documentation, but involves setting up the prerequisites, running the Nemesis quickstart chart to configure a handful of secrets/configs, and running the Nemesis Helm chart from a local clone or the remote repo. Here’s how the actual core Nemesis deployment looks like from running the local Helm chart:

Another nice side effect of this is that Max was able to get self-signed TLS working, so communication to the Nemesis endpoint is now all over HTTPS. Additionally, the monitoring infrastructure is now optional, which can help save on resources. Big thanks to @M_alphaaa for helping us out with some Helm issues!

And finally, for those who really like Minikube or Docker Desktop, we do have documentation for setting up Nemesis using the new installation procedure. Note that we will only be officially supporting k3s going forward (it’s way easier, we promise!).

Text Search Modifications

The “Summoning RAGnarok With Your Nemesis” post we released in March has complete details on these modifications, but TL;DR we completely redid how text search works under the hood for Nemesis.

In the Document Search page, there are now two tabs. The first, “Full Document Search”, searches for text phrases over the entire text extracted from any compatible document, à la Google:

The main difference here is that we now have search filters that let you include or exclude specific paths, name patterns, or file extensions:

We also collapsed the old “Source Code Search” tab into “Full Document Search”. In order to search indexed source instead of extracted document text, select source_code as the index in the expanded search filter section:

The “Text Snippet Search” tab now replaces the old “Semantic Search” tab and has received a complete overhaul. This tab searches over snippets of text extracted from compatible documents, where each snippet/chunk is ~400–500 words. If you want to know more about why this chunking was used, check out the “Summoning RAGnarok With Your Nemesis” post!

When you type a term or question into this search, the query is passed to the new https://<NEMESIS>/nlp/ endpoint, specifically the /nlp/hybrid_search route. Nemesis calculates the embedding vector for the query and searches the closest vector/text pairs, as well as performing a more classic BM25 “fuzzy” search of the text and the indexed document title. These results are fused together through Reciprocal Rank Fusion and returned reordered to the user:

Note: deselecting “Use Hybrid Vector Search” will remove the embedding vector approach and use just the BM25 “fuzzy” search. “Snippet Search” also has the same include/exclude filters that the “Full Document Search” tab has.

If you want to use a local LLM to chat over text extracted from Nemesis documents, check out RAGnarok!

Hasura API

Nemesis has a very rich backend data model that’s presented in two ways: a semi-structured and easily searchable form in Elasticsearch, and a highly structured form in PostgreSQL. While Kibana/Elastic have been accessible in Nemesis since the beginning, one piece of feedback we commonly heard was there was no way to easily access the structured data. We have had pgAdmin present for basic troubleshooting but nothing programmatically accessible.

Hasura fixes that! Hasura lets us easily construct GraphQL and REST APIs on top of our existing PostgreSQL database. Once it’s deployed, we get an awesome interface where we can play around with query and subscription construction:

This also means we can do some basic scripting to process existing data or new data as it comes in. We have some improved documentation (another 1.0.0 “feature”!) which includes information about scripting with Hasura here:

Dashboard Changes

As the Nemesis /dashboard/ route is the main way operators interact with Nemesis, it’s one of the pieces we received the most feedback on. There are nearly too many quality-of-life changes to count, but we’ll highlight a few of them here:

The File Viewer page was broken out which displays syntax-highlighted text, or raw hex of a binary file. This page is accessible via the i icon on the main files page:

The File Upload was broken out into its own page with values saved in cookies for persistence between runs:

We finally exposed the Custom Cracklist endpoint in the interface. This service keeps a unique list of non-dictionary words extracted from documents and lets you download the X most common:

If there are any Yara rule matches against a downloaded file, the match is displayed in a new sub-tab along with the matching rule text. The appropriate icon on the Files page will link you directly to these results now as well:

The NoseyParker tab was revamped and hyperlinked from the displayed tag bubbles as well:

Countless Miscellaneous Changes

There were, of course, countless other bug fixes and tweaks as well. We’ll run through a grabbag of them here:

• Added additional documentation, including (finally) a usage guide to get people started.
• Streamlined NLP indexing to prevent choking and exposed a /nlp/ route for search.
• Removed the Tensorflow model hosting and DeepPass as the model just wasn’t accurate enough to be useful.
• Streamlined hash cracking and added in deduplication so hashes aren’t cracked twice.
• Added a `monitor` command to submit_to_nemesis.sh for continual file submission.
• Any compatible file is now handled by Apache Tika instead of a subset.
• Detection of already processed files and suppression of alerts.
• Automatic expunging of expired data via the `data_expunge` task.
• Added Jupyter notebooks back into the stack.
• Processing for Chromium JSON cookie dumps.
• Countless other bug fixes and small usability changes.

Wrapup

We’ve put a lot of blood, sweat, and tears (mostly at k8s) into Nemesis, and we’re incredibly excited for this official 1.0.0 release! With the quality of life changes and ease of installation with Helm, we’re looking forward to more people getting to play with Nemesis hands on.

If you play around with Nemesis, let us know what works and what doesn’t! Come join us in the #nemesis-chat channel of the BloodHound Slack! We (the main Nemesis devs- @tifkin_, @harmj0y, and @Max Harley) are all active in that channel.

---

Nemesis 1.0.0 was originally published in Posts By SpecterOps Team Members on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post Nemesis 1.0.0 appeared first on Security Boulevard.

North American software developers have reasonable confidence that generative AI can be a tool to improve the security of the software they're building. In other regions? Not so much.

The post North American Developers Optimistic About Generative AI and Code Security appeared first on Security Boulevard.

The warning underscores the importance of a collaborative approach to AI security involving stakeholders across different domains, including data science and infrastructure.

The post AI Adoption Prompts Security Advisory from NSA appeared first on Security Boulevard.

The shift to cloud computing has enhanced the resilience and security of most organizations. In this era of unparalleled agility and scalability, data-centric security can offer transformational opportunities for Chief Information Security Officers (CISOs) to improve data protection, compliance, and operational efficiencies, thereby strengthening customer trust. Despite this, a layered defense model is still necessary […]

The post The CISO’s Top Priority: Elevating Data-Centric Security appeared first on Blog.

The post The CISO’s Top Priority: Elevating Data-Centric Security appeared first on Security Boulevard.

Although artificial intelligence (AI) has been with us for some time, the technology seems to be everywhere these days, as vendors and end users get more vocal about its benefits. They’re right to be enthused. McKinsey estimates that AI could unlock trillions of dollars’ worth of value globally across functions in 19 sectors. In some areas, it’s no longer about even carving out competitive differentiation, but merely delivering what is expected by customers and employees.

The post It’s All About Data: How to Drive Secure Use of AI appeared first on Security Boulevard.

Learn how to elevate your CX strategies with CIAM and data-driven insights. From seamless digital experiences to proactive customer engagement, discover the key to driving growth and loyalty in a competitive market.

The post Transforming Customer Experience: Enhancing CX through CIAM and Insights appeared first on Security Boulevard.

What is the CCPA, the California Consumer Privacy Act? CCPA, or the California Consumer Privacy Act, is a law in California data privacy law that came into effect in early 2020. The CCPA grants California residents several key rights about how businesses collect, use and share their personal information.  The CCPA contains 4 key protections […]

The post CCPA Compliance with Accutive Data Discovery and Masking: Understanding and protecting your sensitive data first appeared on Accutive Security.

The post CCPA Compliance with Accutive Data Discovery and Masking: Understanding and protecting your sensitive data appeared first on Security Boulevard.

A threat group that’s been around since last year and was first identified earlier this month is using three high-profile information stealers in a wide-ranging campaign to harvest credentials, financial information, and cryptocurrency wallets from targets around the world who were downloading the malware that masqueraded as movie files. Researchers with Cisco’s Talos threat intelligence..

The post CoralRaider Group Delivers Three Infostealers via CDN Cache appeared first on Security Boulevard.

The new directive prohibits data disclosure when law enforcement agencies want to investigate people, healthcare providers, or others seeking reproductive care that is lawful where the care is given.

The post HHS Strengthens Privacy of Reproductive Health Care Data appeared first on Security Boulevard.

The health insurance giant also admitted that it paid a ransom to the threat group as its CEO prepares to testify before Congress May 1.

The post UnitedHealth: Ransomware Attackers Stole Huge Amount of Data appeared first on Security Boulevard.

Source: securityboulevard.com – Author: Jeffrey Burt The takedown this week of a massive phishing-as-a-service (PhaaS) operation spanned law enforcement agencies from both sides of the Atlantic and is the latest example of an increasingly aggressive approach by authorities to disrupt the operations of high-profile cybercriminal gangs. Agencies from 19 countries participated in the operation against […]

La entrada LabHost Phishing Platform is Latest Target of International Law Agencies – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Source: securityboulevard.com – Author: Brian Robertson The newest version of the European Union Network and Information Systems directive, or NIS2, came into force in January 2023. Member States have until October 2024 to transpose it into their national law. One of the most critical changes with NIS2 is the schedule for reporting a cybersecurity breach.  […]

La entrada Taking Time to Understand NIS2 Reporting Requirements – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Data security company Cyera’s latest $300 million funding round brings the total raised by the firm to $460 million, at unicorn valuation.

The post Data Security Firm Cyera Raises $300 Million at $1.4 Billion Valuation appeared first on SecurityWeek.