Search results for Busts Major

Threat actors from the Democratic People's Republic of Korea (DPRK) are increasingly targeting the cryptocurrency sector as a major revenue generation mechanism since at least 2017 to get around sanctions imposed against the country. "Even though movement in and out of and within the country is heavily restricted, and its general population is isolated from the rest of the world, the regime's

Hacks Threat

A new study that looked at the password requirements of the most popular websites came to a disappointing but not surprising conclusion.

password requirements surprising conclusion

One of Slovenia’s major power providers, HSE, has recently fallen victim to a significant cyberattack. The security and control system, along with the fire alarms, were breached by the criminal who caused significant damage. It has been reported that the attack was carried out by the Ransomware gang, which resulted in the encryption of files […] The post Slovenia's Biggest Power Provider has Suffered a Cyberattack appeared first on Cyber Security News.

Biggest Power major power Power Provider

The information technology systems of Ardent Health Services were targeted in a recent ransomware attack which has resulted in a major cybersecurity incident. As a result of this attack, the company has experienced significant disruption to its services and operations, causing inconvenience and potential harm to its clients and customers. Ardent Health Ransomware Attack Ardent […] The post Ardent Health Ransomware Attack: Multiple Hospitals Affected appeared first on Cyber Security News.

Health Ransomware

Founded in 2017 to support startups in their IT strategy, in France and abroad, SysWings has extended its activities to the cloud and managed services. The team is made up of heterogeneous profiles, mixing employees and consultants, scaled according to your projects.

The health IT security market is experiencing remarkable growth, driven by the pressing need for robust solutions that protect patient privacy, secure data integrity, and ensure the uninterrupted delivery of […] The post Safeguarding Healthcare: A Closer Look at the Major Trends in the Health IT Security Market appeared first on Cyber Defense Magazine.

Major Trends patient privacy remarkable growth Safeguarding Healthcare

Malware Analysis of Remcos RAT: Exploitaion and Detection ExplainedExecutive SummarySHA256 hash:2e5c4d023167875977767da513d8889f1fc09fb18fdadfd95c66a6a890b5ca3fRemcos is a commercially available Remote Access Tool (RAT) marketed for legitimate use in surveillance and penetration testing. However, it has been leveraged in various unauthorized hacking initiatives. When deployed, Remcos establishes a backdoor, allowing comprehensive remote control over the affected system. The tool is a product of BreakingSecurity, a company specializing in cybersecurity solutions.Hackers are getting smarter by using tricks like hiding their code and adding fake code, which makes it harder for security experts to figure out how their attacks work. They're using things like image files and compression to disguise their activities.YARA signature rules are attached in Appendix A. Malware sample and hashes have been submitted to VirusTotal for further examination.High-Level Technical SummaryRemcos is an advanced remote access tool that breaks into computers using a series of hidden codes, starting with a malicious file which can be delivered from mail or dropper. It cleverly disguises its next steps within an image file, and then uses another DLL to make sure it stays on the computer even after it's restarted. Remcos can record keystrokes to steal passwords and other private information, which it logs into a file. It stays in contact with the hacker's server to send out this stolen information and to get new orders, allowing the hacker to keep a close watch and control over the infected computer.Malware CompositionThis composition of remcos consists of the following components:2e5c4d023167875977767da513d8889f1fc09fb18fdadfd95c66a6a890b5ca3fEmbedded_Remcos.exeIn a C# dropper, there's a sneaky way that malware developers are hiding bad code. They put this code inside the InitializeComponent() method. This method is normally used just for setting up how the app looks, like buttons and menus. But now, it's being used to hide something harmful. The tricky part is that this bad code looks just like regular setup code, so it's hard to spot. It's like hiding something bad inside something good, so people don't notice it.This makes it hard to find and fix the problem. It's a clever trick by hackers, and it shows how they can use parts of an app we usually trust to do sneaky things.It is extracting a byte array from a resource, possibly a file or other data embedded in the application and generating another byte array from a hard coded string.The code is setting up a user interface for a form and then performing an operation on a data resource (“SHP”) using a generated key.The _data before the encryption looks like this.The for loop processes the Data_ array in a complex way. It goes through each byte of Data_ and modifies it based on a calculation involving both Data_ and KeyGen.The calculation inside the loop involves bitwise XOR (^), addition, and modulo operations. It appears to be some form of data manipulation or encryption/decryption, where Data_ is being altered using the KeyGen byte array.First, a MethodBase object named methodBase is assigned the value kb. The MethodBase class in C# is part of the reflection namespace and is used to discover information about methods (like constructors and other methods) at runtime.Then, an array of objects named array is created and initialized with string values. This array includes this.VC, this.VR, and the literal string “Boilerplate”. VC and VR are private string fields of the class, initialized to “57775972” and “6C7978”, respectively. Therefore, the array contains these two strings along with “Boilerplate”.Finally, the Invoke method on methodBase is called, passing obj and array as arguments. This means the method represented by methodBase is being executed with obj as the target and the string array as the parameters.Before the inoke there was binary loaded successfully in modules.And if look closely it in kb.Fullname it is calling dr,hA.wP method in Ben dll.Ben DLLBy adding breakpoint after loading from module we catch the debugger.The code performs image processing, uses reflection to invoke a method, and dynamically loads an assembly from a byte array. This kind of operation is typical in applications that need to manipulate images, dynamically execute code, and potentially load plugins or modules at runtime.Sleep for 16secnew MemoryStream(array2): This creates a new MemoryStream object using array2 as its buffer. array2 is assumed to be a byte array (byte[]) that contains data compressed using the GZip algorithm. The MemoryStream is a stream based on a memory buffer, allowing for reading from and writing to memory.new GZipStream(…): This creates a new GZipStream object. The GZipStream class is used to compress and decompress data in the GZip data format. In this case, it's constructed with the previously created MemoryStream and the CompressionMode.Decompress. This indicates that the GZipStream should be used for decompression, i.e., to decompress the data contained in array2.It's part of a process involving dynamic loading and reflection. It reads and possibly processes data from a MemoryStream, uses that data to load an assembly or access its contents, and then retrieves a specific type from that assembly.Rd is designed to dynamically load a .NET assembly from a byte array, denoted as u0020. It employs a nested, infinite loop structure with a switch statement for control flow. Initially, it attempts to load the assembly using Assembly.Load(u0020). The code's flow is influenced by the result of global::dr.hA.EV(), a method call whose purpose is unclear. If EV() returns a non-null value, the method exits the loop prematurely via a go to statement. The method's coding style, characterized by unconventional variable naming and complex looping, suggests a potential for obfuscation, possibly to conceal the actual functionality or make reverse-engineering more challenging.ReactionDiffusionAfter loading assembly we get a new binary in modules with the name of ReactionDiffusion.Then it disposes the “memorystream” which means the work of the memory stream is done here. Probably it will now move on to the next binary.After that it also dispose the gzip stream which was used to get the binary.Now let's track where it would go next in ReactionDiffusion. If we investigate the object where it is pointing its type show us the destination namespace and class.Since there were no method calls from previous binary. So, we created break point at constructor at it hit exact on it.There was nothing useful in ReactionDiffusion there, maybe it was all decoy code. Let's see what next the Ben binary does, in case 8 it gets bitmap from resources.RS MethodThe RS method in C# is designed to retrieve a Bitmap image from resources using reflection and obfuscated code patterns. It starts by declaring a ResourceManager to access embedded resources, using a dynamically constructed resource name from the first-string parameter, u0020. This parameter, along with a similarly named second parameter, is used in a nested, infinite loop structure with a switch statement. Bitmap is obtained by the method global::dr.hA.rY, which likely extracts the image from the resources. The control flow includes checks with global::dr.hA.EV() and global::dr.hA.m3(), whose purposes are unclear, but they seem to influence the flow and decision-making within the method. The use of obfuscated names (like u0020) and complex control flow suggests an intent to mask the code's functionality or purpose.Loading the assembly from byte arrayIt defines a private static method named Rd that takes a byte array u0020 as its parameter.It initializes an integer variable num with the value 1.Inside an infinite loop (for (;;)), the code performs the following actions: a. It declares a variable num2 and assigns it the value of num. b. It enters another loop (for (;;)). c. Within the inner loop, there is a switch statement with two cases:Case 1:It attempts to load an assembly using Assembly.Load(u0020), where u0020 represents the byte array passed as a parameter to the method.If the assembly is successfully loaded, it sets num2 to 0.It then checks whether global::dr.hA.EV() is not null. If it's not null, the code proceeds to the Block_1 label.If global::dr.hA.EV() is null, it effectively exits the loop and returns the loaded assembly.Default case:If none of the cases match, it returns the assembly variable, which would have been assigned earlier in the code. d. The Block_1 label is used to indicate the point where the code should continue if global::dr.hA.EV() is not null. It doesn't contain any specific code logic in the provided snippet.TyroneIt looks like another binary is coming. Another DLL loaded in modules with the name Tyrone.Invoking AJBqklj3Jn from tyorne { YcMqTyPiynJnoycycL.MhMHeAYqAZ6AJWSu3o}This is more obfuscated than previous binaries.Checking for the presence of a named mutex, which may be used by malware for synchronization or coordination purposes. “wnmJOXavioKPdkNYG”It tried to open but since if there is no mutex it goes to exception. If it exists it will end itself in second line.Creating MutexIt creates a new Mutex object with the name “wnmJOXavioKPdkNYG”. Mutexes are synchronization primitives used to control access to shared resources among multiple threads or processes.This was all to get path of appdata and then append it with “EiHjExP.exe”.“C:UsersusernameAppDataRoamingEiHjExP.exe”Check if not there Copy it.Change Directory PermissionIt adds access control entries to the directorySecurity object using the MhMHeAYqAZ6AJWSu3o.PR6qMi9p2U method. These entries seem to define permissions for specific file system rights (e.g., Read, ReadAndExecute, Delete, Write, etc.) with different access control types (e.g., Allow, Deny). The permissions are set for various inheritance flags and propagation flags, which determine how permissions are inherited by child objects.It removes “currentuser” security to change file and write permission.As you can see the permission are denied nowRemcos is doing this because it makes it safe from being changed or deleted from disc.Then it gets a base64 encoded text fetched from modules of this tyrone binary with this code.I decode this string from https://www.base64decode.org/ and it turns out that it is xml.There is code for decoding also in the remcos.Then this function is called to play with Microsoft Security. This function decodes the text which was fetched from module.It then creates a new process, assign a new stratinfo with it and give file name “powershell” which it gets from the module. In arguments of process, it gives @”Add-MpPreference -ExclusionPath “”C:UsersshaddyAppDataRoamingEiHjExP.exe”””Set process's window hidden.Windows ExclusionIt will be added to the exclusion but keep in mind that I was running it from admin, if not performing analysis from admin it will be able to add since so far there was not privilege escalation performed.Path.GetTempFileName(); it will return a string that represents a unique temporary file name. This file name is generated using a combination of a temporary directory path and a unique identifier, making it highly unlikely to clash with other temporary files in the system.It gets the identity of current user, exe path to update the xml. In the breakpoint it is updating the xml and saving it in text variable.The clean xml code.PersistenceAfter that it is writing all xml in tmp file.It then loads the command of scheduling task from modules and sets startupinfo of process. Process is executed with window style hidden, Filename “schtask.exe” and with following arguments.@”/Create /TN “”UpdatesEiHjExP”” /XML “”C:UsersshaddyAppDataLocalTemptmp66E3.tmp”””This command appears to be creating a new scheduled task with the name “UpdatesEiHjExP” and configuring it using an XML file located at “C:UsersshaddyAppDataLocalTemptmp66E3.tmp.”It is triggering the exe after every system restarts.Then it deletes the tmp file.After that it loads new assembly “xF7siMsac” from its resource manager.It is injecting this final binary and executing it. Let's see its injection inside process hacker.Another binary which is extracted and DE obfuscated from resources.Remcos / 5thstageAfter saving the binary from u0020 it looks exactly like client agent built from the original remcos agent from hxxps://breakingsecurity.net/remcos/. The logo is also the same, but its signature was not present in any online threat intelligence.https://www.virustotal.com/gui/search/f55fc4f4e1bcbe957d20750f56cd98869c717c18c14c8b6d42698557b254ad51This final stage was developed in c++ language. And before analysis when we perform strings filter there was something linking to remcos, this pattern comes almost in every remcos rat.Now let's start the debugger to look more into it. We can see some more identifications.It starts with calling GetAddrInfoW API which is pointing to rungmotors20.ddns.net:60247.GetAddrInfoW is a Windows API function that is used for network operations. It's part of the Windows Sockets (Winsock) API and is typically called to resolve network addresses or to perform name resolution, converting a hostname like a domain or a URL into an IP address that can be used to establish network connections.If running from admin privileges, it creates a directory [C:\ProgramData\remcos] using CreateDirectoryW API.CreateDirectoryW is a function in the Windows API that is used to create a new directory. The W at the end of CreateDirectoryW indicates that this function uses wide characters (Unicode), as opposed to CreateDirectoryA, which uses ANSI characters.After creating Directory, it creates file with name logs.dat using CretaeFileW api.There are privileges check also it is handling both cases smoothly. It is just paths which it used separately.While executed from admin it uses [ C:\ProgramData\remcos folder]. It creates thread and that thread in loop performs these steps.If executed from normal permission, it uses [C:\Users\username\Local\VirtualStore\ProgramData\remcos\logs.dat]It sets its mark on the system in registry. It sets exepath, licence and time for thread.Patching TLSAll traffic was encrypted so we must check what is being sent. There was TLS check which was on in our client rate.Since we cannot see what it is sending to server, because of TLS flag is on. It will send all the traffic encrypted. After patching this, we can analyze the traffic.After finding the check I was able to turn off the TLS and see all the traffic clearly. It was sending the device identification after every few seconds to server.This was sample data that rat was sending.$ KRemoteHost||DESKTOP-002IHON/shaddy||US||Windows 10 Enterprise (64 bit)||||8588939264||4.9.2 Pro||C:ProgramDataremcoslogs.dat||C:UsersshaddyDesktop5thstage.exe||||5thstage.exe — PID: 3308 — Module: 5thstage.exe — Thread: Main Thread 6232 — x32dbg [Elevated]||1||47||48556593||1||rungmotors20.ddns.net||Rmc-ZT6SIL||0||C:UsersshaddyDesktop5thstage.exe||12th Gen Intel(R) Core(TM) i7–12700KF||Exe||||Clipboard and Process recordingInside the thread it was performing three major activities because the one who built it, he/she only want to record clipboards, records keylogging and setting some registries. It records all the clipboards data inside the same logs.dat file. Only it appends [Text copied to clipboard] at initial and [End of clipboard] at end.It also keeps recording the process which spawns, its architecture, its user access and all the keystrokes also.Rules & IOCsYara Rulesrule remcos_pro_4_9_2{meta:author = “Osama Ellahi”description = “Remcos RAT 4.9.2 pro version from breakpoint”strings:$string_match1 = “© by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED” ascii fullword$string_match2 = “tRemcos v” ascii fullword$string_match3 = “BreakingSecurity.net” ascii fullword$string_match4 = “4.9.2 Pro” ascii fullword$string_match6 = “[Text pasted from clipboard]” ascii fullword$string_match7 = “[End of clipboard]” ascii fullword$string_match8 = “[End of clipboard]” ascii fullword$string_match9 = “[Text copied to clipboard]” ascii fullword$string_match11 = “Offline Keylogger Started” ascii fullword$string_match12 = “Offline Keylogger Stopped” ascii fullword$string_match13 = “Online Keylogger Started” ascii fullword$string_match14 = “Online Keylogger Stopped” ascii fullword$string_match15 = “Remcos restarted by watchdog!” ascii fullword$string_match16 = “Watchdog module activated” ascii fullword$string_match17 = “Watchdog launch failed!” ascii fullword$string_match18 = “[Chrome StoredLogins not found]” ascii fullword$string_match19 = “[Chrome StoredLogins found, cleared!]” ascii fullword$string_match20 = “[Chrome Cookies not found]” ascii fullword$string_match21 = “[Chrome Cookies found, cleared!]” ascii fullword$string_match22 = “[Firefox StoredLogins not found]” ascii fullword$string_match23 = “[Firefox Cookies not found]” ascii fullword$string_match24 = “[Firefox cookies found, cleared!]” ascii fullword$string_match25 = “[Firefox StoredLogins Cleared!]” ascii fullword$string_match26 = [IE cookies not found] ascii fullword$string_match27 = [IE cookies cleared!] ascii fullword$string_match28 = [Cleared browsers logins and cookies.] ascii fullword$string_paths1 = “\AppData\Local\Google\Chrome\User Data\Default\Cookies” ascii fullword$string_paths2 = “\AppData\Roaming\Mozilla\Firefox\Profiles\” ascii fullword$string_paths3 = “Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders” ascii fullword$string_paths4 = “Software\Microsoft\Windows\CurrentVersion\Run\” ascii fullword$string_paths5 = = “\AppData\Local\Google\Chrome\User Data\Default\Login Data” ascii fullword$string_paths6 = “Software\Microsoft\EventSounds\Sounds” ascii fullword$string_paths7 = “System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm” ascii fullword$string_commands1 = “CreateObject(”WScript.Shell”).Run ”cmd /c ””” ascii fullword$string_commands2 = “CreateObject(”Scripting.FileSystemObject”).DeleteFile(Wscript.ScriptFullName)” ascii fullword$string_commands3 = “\AppData\Local\Google\Chrome\User Data\Default\Login Data” ascii fullword$string_commands4 = “/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f” ascii$string_url1 = “http://geoplugin.net/json.gp" ascii fullword$string_url2 = “rungmotors20.ddns.net” ascii fullwordcondition:uint16(0) == 0x5a4d and filesize < 600KB and filesize >200KBand(any of ($string_url*)or3 of ($string_paths*)or5 of ($string_match*))}Callback URLsURL: rungmotors20.ddns.net Port: 60247URL: hxxp://geoplugin.net/json.gp Port: 443IOC1stSHA256 —2e5c4d023167875977767da513d8889f1fc09fb18fdadfd95c66a6a890b5ca3f2ndMD5 —3125f77575829f3b710f5a15912dec20 *stage2.dllSHA256 —1cc58fba1d1b4c7e0b9d752ea7f03fa3c312ae2fc53796d5b3acea98e6ea3c0e *stage2.dll3rdSHA256 —d01f3dea3851602ba5a0586c60430d286adf6fcc7e17aab080601a66630606e5 *stage3.dllMD5 —579197d4f760148a9482d1ebde113259 *stage3.dll4thSHA256 —c5928572e371b0a5d3109d0a7431ca9e064216beb858f04dc8d0140ccaf44b84 *Tyrone.dllMD5 —dd76e11ff9b96efdcf3cd377126c8d96 *Tyrone.dll5thSHA256 —f55fc4f4e1bcbe957d20750f56cd98869c717c18c14c8b6d42698557b254ad51 *5thstage.malMD5 —dc05d4f2864dfafa9b91e8e0d79840e3 *5thstage.malReferenceshttps://www.joesandbox.com/analysis/1339230/0/htmlhttps://www.jaiminton.com/reverse-engineering/remcos#part-2-decompiling-binaryUnfolding Remcos RAT- 4.9.2 Pro was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

ascii fullword Detection Explained Explained Executive

Photo by Beth Jnr on UnsplashIn both the offensive and defensive penetration testing , grabbing a banner is the first and, it seems, the most crucial step. This post will introduce you to the concept of “Banner Grabbing” and explain how various web interfaces and command-line tools may be used to capture a webserver's banner along with its active services.Introduction“Banner Grabbing” is often termed as “Service Fingerprinting”.Banner refers to a text message received from the host, usually, it includes information about the open ports and services with their version numbers.Why Banner Grabbing?Banner Grabbing allows an attacker to discover network hosts and running services with their versions on the open ports and moreover operating systems so that he can exploit the remote host server.Banner Disclosure is the most common vulnerability with a “CWE-200 i.e. Exposure of Sensitive Information to an Unauthorized Actor” and a “CVSS Score of 5.0 with the Risk factor as Medium.”In order to clear the vision, we'll consider an attack scenario:As we all know that Microsoft Windows 7 are exploitable by Eternal Blue (CVE-2017–0143) directly with SMBv1 service. In order to enumerate this server, the attacker needs to grabs a service banner which displays whether the SMB service with a vulnerable version is running over it or not. If running, he/she can easily exploit the Microsoft server directly with the Eternal Blue attack.Types of Banner GrabbingActive Banner grabbing –In this, the attacker craft or modify his/her own packets and send them to the remote host server and analyses the response data in order to get the operating system information and the services running with their versions.Passive Banner grabbing –Here the attacker collecting data about our target using publically available information i.e. by analyzing the server either with the help of “Error Messages” or by “Sniffing up the Network Traffic”.Up till now, you might have gained a lot of information about what is Banner Grabbing and why it is used?Let's continue this journey by exploring the most aggressive and direct methods of grabbing a service banner.Banner grabbing using Kali LinuxWhatweb“WhatWeb” recognizes websites, which helps us to grab the web-applications banner by disclosing the server information with its version, the IP address, the webpage Title and running operating system.Type the following command in order to capture the essentials.whatweb <website URL>whatweb http://192.168.0.11cURLThe cURL command includes the functionality for retrieving the banner details from HTTP servers. Just execute the following command, and discover what we grab:curl –s –I 192.168.0.11However to fetch a clean result, we are using the -s flag to prevent the progress of the error messages from being displayed, and the -I flag to simply print out the header information of all requested pages.WgetWe will be using the wget command to capture the HTTP banner of the remote server.wget –q –S 192.168.0.11The –q flag will cover-up the progress of our output, while the -S flag will print out the header information of all requested pages.TelnetWe will be using the Telnet protocol in order to interact with services to grab their banners.Type following command to grab the FTP banner of the remote server.telnet 192.168.0.11 21As a result, it will dumb “220 (vsFTPd 3.0.3)”NetcatNetcat is a network utility that will again help us to grab the FTP banner of the remote host server.nc 192.168.0.11 21From the above image, you can check that it dumbs up “220 (vsFTPd 3.0.3)”NiktoNikto is an open-source web-application scanner, which we'll be using to grab a banner of a website running on an Ubuntu server.Type the following command in order to capture the installed web server — its version, the configuration index files, the HTTP server options and a list of other useful details.nikto –h http://192.168.0.11The –h flag is used to specify the host.NmapWe'll use Nmap as a simple banner grabber which connects to an open TCP port and prints out anything sent by the listening service within a couple of secondsType following command which will grab banner for the SSH service running on port 22 in the remote host.nmap -sV –p22 192.168.0.11The -sV flag prints out the version of the running service.From the above screenshot, you can read the SSH service and its version, fetched by NMAP as “OpenSSH 7.6p1 Ubuntu 4ubuntu0.3”DmitryDmitry (Deepmagic Information Gathering Tool) has the ability to gather as much information as possible about a host. Base functionality is able to gather possible subdomains, email addresses, uptime information, tcp port scan, whois lookups, and many more.The –pb flag is used to grab the banner for all the open-ports of the remote host.Fire the following command to grab the banners of the running services.dmitry –pb 192.168.0.11Banner Grabbing over BurpsuiteWhile performing an attack or a penetration test, we all use burp suite somewhere or the other, but does it help us to identify the target's web server?Yes, we can simply grab the server's information through the response generated by the repeater.From the below screenshot you can see that I've sent the interpreted request into the repeater. As soon as I hit the send button, the response will be executed and on the right-hand side you will get the captured server details as Apache/2.4.29 (Ubuntu)Banner Grabbing using NetcraftNetcraft is one of the most operatable information gathering web-interface which help us to check the technologies and the infrastructure of the web-applications.So I'll be using a demo website over Netcraft in order to grab some service banners and capture all the possible information.From the above image, you can see that I have grabbed the Hosting History of testphp.vulnweb.com, which shows up the IP addresses, the operating systems and the webservers along with their last seen.Banner Grabbing through Browser ExtensionsSometimes it's a bit time consuming while grabbing banners of multiple web applications. Thus in order to make our work faster, we will be setting up some browser extensions that will help us to capture the server information with their version numbers, the running operating systems and the other frameworks that drive up the web applications.WappalyzerWappalyzer is a free browser extension available for both Mozilla Firefox and Google Chrome. It helps us to check the technologies of the web-application, majorly the server with its version and the framework running on it. You can add this extension in your browser from here.From the above image you can see that, we have easily captured “Apache 2.2.0” as the server, “PHP 5.3.10” as the programming language and “Ubuntu and Fedora” as the running operating systems.HTTP Header LiveThis extension gives us the power to capture the ongoing HTTP Requests before they are sent to the server.Therefore we are going to garb some server banners through this HTTP Header extension. You can add it in your browser from here.From the below image you can see that, as soon as I capture the HTTP request, I was presented with the target's information containing the server and the operating system banners i.e. Apache/2.4.29 (Ubuntu)Banner Grabbing using ID ServeID Server is a free and a general-purpose Internet server identification utility which helps us to grab the banner of a remote host. You can download the tool from here.Just enter the target's website URL and hit the “Query This Server” button. And there it goes, it dumps everything it could, including the IP addresses, open ports, cookie and the server informationFeel free to Subscribe for more content 🔔, clap 👏🏻 and share the article With anyone you'd like.What is Banner Grabbing??Several Approaches for Banner Grabs. was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Banner Banner Grabbing Banner Grabs Grabbing

A cyberattack on CTS, a leading managed service provider (MSP) for law firms and other organizations in the UK legal sector, is behind a major outage impacting numerous law firms and home buyers in the country since Wednesday. [...]

CTS impacts MSP provider CTS

Today, CISA ordered U.S. federal agencies to secure their systems against an actively exploited vulnerability that lets attackers gain root privileges on many major Linux distributions. [...]

patch Looney

By Deeba Ahmed The initiative was carried out under the banner of Operation MOZAIK 2023. This is a post from HackRead.com Read the original post: Europol Busts Major Online CSAM Racket in Western Balkans

Busts Major CSAM Racket Major Online Online CSAM Operation MOZAIK

Clean up of over permissioned IAM accounts on GCP infra in an automated way CureIAM is an easy-to-use, reliable, and performant engine for Least Privilege Principle Enforcement on GCP cloud infra. It enables DevOps and Security team to quickly clean up accounts in GCP infra that have granted permissions of more than what are required. CureIAM fetches the recommendations and insights from GCP IAM recommender, scores them and enforce those recommendations automatically on daily basic. It takes care of scheduling and all other aspects of running these enforcement jobs at scale. It is built on top of GCP IAM recommender APIs and Cloudmarker framework. Key features Discover what makes CureIAM scalable and production grade. Config driven : The entire workflow of CureIAM is config driven. Skip to Config section to know more about it. Scalable : Its is designed to scale because of its plugin driven, multiprocess and multi-threaded approach. Handles Scheduling: Scheduling part is embedded in CureIAM code itself, configure the time, and CureIAM will run daily at that time note. Plugin driven: CureIAM codebase is completely plugin oriented, which means, one can plug and play the existing plugins or create new to add more functionality to it. Track actionable insights: Every action that CureIAM takes, is recorded for audit purpose, It can do that in file store and in elasticsearch store. If you want you can build other store plugins to push that to other stores for tracking purposes. Scoring and Enforcement: Every recommendation that is fetch by CureIAM is scored against various parameters, after that couple of scores like safe_to_apply_score, risk_score, over_privilege_score. Each score serves a different purpose. For safe_to_apply_score identifies the capability to apply recommendation on automated basis, based on the threshold set in CureIAM.yaml config file. Usage Since CureIAM is built with python, you can run it locally with these commands. Before running make sure to have a configuration file ready in either of /etc/CureIAM.yaml, ~/.CureIAM.yaml, ~/CureIAM.yaml, or CureIAM.yaml and there is Service account JSON file present in current directory with name preferably cureiamSA.json. This SA private key can be named anything, but for docker image build, it is preferred to use this name. Make you to reference this file in config for GCP cloud. # Install necessary dependencies$ pip install -r requirements.txt# Run CureIAM now$ python -m CureIAM -n# Run CureIAM process as schedular$ python -m CureIAM# Check CureIAM help$ python -m CureIAM --help CureIAM can be also run inside a docker environment, this is completely optional and can be used for CI/CD with K8s cluster deployment. # Build docker image from dockerfile$ docker build -t cureiam . # Run the image, as schedular$ docker run -d cureiam # Run the image now$ docker run -f cureiam -m cureiam -n Config CureIAM.yaml configuration file is the heart of CureIAM engine. Everything that engine does it does it based on the pipeline configured in this config file. Let's break this down in different sections to make this config look simpler. Let's configure first section, which is logging configuration and scheduler configuration. logger: version: 1 disable_existing_loggers: false formatters: verysimple: format: >- [%(process)s] %(name)s:%(lineno)d - %(message)s datefmt: "%Y-%m-%d %H:%M:%S" handlers: rich_console: class: rich.logging.RichHandler formatter: verysimple file: class: logging.handlers.TimedRotatingFileHandler formatter: simple filename: /tmp/CureIAM.log when: midnight encoding: utf8 backupCount: 5 loggers: adal-python: level: INFO root: level: INFO handlers: - rich_console - file schedule: "16:00" This subsection of config uses, Rich logging module and schedules CureIAM to run daily at 16:00. Next section is configure different modules, which we MIGHT use in pipeline. This falls under plugins section in CureIAM.yaml. You can think of this section as declaration for different plugins. plugins: gcpCloud: plugin: CureIAM.plugins.gcp.gcpcloud.GCPCloudIAMRecommendations params: key_file_path: cureiamSA.json filestore: plugin: CureIAM.plugins.files.filestore.FileStore gcpIamProcessor: plugin: CureIAM.plugins.gcp.gcpcloudiam.GCPIAMRecommendationProcessor params: mode_scan: true mode_enforce: true enforcer: key_file_path: cureiamSA.json allowlist_projects: - alpha blocklist_projects: - beta blocklist_accounts: - foo@bar.com allowlist_account_types: - user - group - serviceAccount blocklist_account_types: - None min_safe_to_apply_score_user: 0 min_safe_to_apply_scor e_group: 0 min_safe_to_apply_score_SA: 50 esstore: plugin: CureIAM.plugins.elastic.esstore.EsStore params: # Change http to https later if your elastic are using https scheme: http host: es-host.com port: 9200 index: cureiam-stg username: security password: securepassword Each of these plugins declaration has to be of this form: plugins: <plugin-name>: plugin: <class-name-as-python-path> params: param1: val1 param2: val2 For example, for plugins CureIAM.stores.esstore.EsStore which is this file and class EsStore. All the params which are defined in yaml has to match the declaration in __init__() function of the same plugin class. Once plugins are defined , next step is to define how to define pipeline for auditing. And it goes like this: audits: IAMAudit: clouds: - gcpCloud processors: - gcpIamProcessor stores: - filestore - esstore Multiple Audits can be created out of this. The one created here is named IAMAudit with three plugins in use, gcpCloud, gcpIamProcessor, filestores and esstore. Note these are the same plugin names defined in Step 2. Again this is like defining the pipeline, not actually running it. It will be considered for running with definition in next step. Tell CureIAM to run the Audits defined in previous step. run: - IAMAudits And this makes the entire configuration for CureIAM, you can find the full sample here, this config driven pipeline concept is inherited from Cloudmarker framework. Dashboard The JSON which is indexed in elasticsearch using Elasticsearch store plugin, can be used to generate dashboard in Kibana. Contribute [Please do!] We are looking for any kind of contribution to improve CureIAM's core funtionality and documentation. When in doubt, make a PR! Credits Gojek Product Security Team Demo <> ============= NEW UPDATES May 2023 0.2.0 Refactoring Breaking down the large code into multiple small function Moving all plugins into plugins folder: Esstore, files, Cloud and GCP. Adding fixes into zero divide issues Migration to new major version of elastic Change configuration in CureIAM.yaml file Tested in python version 3.9.X Library Updates Adding the version in library to avoid any back compatibility issues. Elastic==8.7.0 # previously 7.17.9 elasticsearch==8.7.0 google-api-python-client==2.86.0 PyYAML==6.0 schedule==1.2.0 rich==13.3.5 Docker Files Adding Docker Compose for local Elastic and Kibana in elastic Adding .env-ex change .env-ex to .env to before running the docker Running docker compose: docker-compose -f docker_compose_es.yaml up Features Adding the capability to run scan without applying the recommendation. By default, if mode_scan is false, mode_enforce won't be running. mode_scan: true mode_enforce: false Turn off the email function temporarily. Download CureIAM

CureIAM GCP IAM GCP Infra Principle Enforcement