DLL Hijacking & PHP Malware

andreasc
-
0
DLL Hijacking & PHP Malware

[ad_1]

Researchers have discovered the workings of the MalSync malware known as the “DuckTail” or “SYS01”.

The analysis of the malware revealed the infection vectors, command line usage, malware capabilities, and other information.

The malware seems to have a targeted approach to stealing social media credentials and have capabilities of data extraction and detection evasion.

Moreover, the malware communicates with a command-and-control server for updating its configuration and receiving instructions.

MalSync Malware

According to Binary Defense’s reports, the index.php file handles device information collection, scheduled tasks, and data staging before exfiltration.

The analysis started with an alert raised due to suspicious PowerShell command line activity designed to add exclusions to Windows Defender.

Similar to other malware, this command was initiated by a svchost.exe process with elevated privileges.

Further analysis also revealed several executable files in the %AppData% directory. The list of files identified is as follows:

Though these files are used by legitimate installers and malware, the presence of these files in this specific directory raises suspicion.

Attack Chain

In addition, the file creation events in the malware showed a chain of executables which indicates a layered attack strategy.

The first part of the attack chain used an EXE file under the name “IMG_9597_One_Night_Stand_Li_Shaw – Gyeon_Jung_Hee_Studio – By_Gook_Changmin_Photographer.exe” that creates another EXE file “ts.exe”.

Following this, another two EXE files are created under the same name “cgcmpukluosgfec.exe”.

One of these files is a temporary file. After this, three other files are created such as rhc.exe, php.exe, and wdelua.exe alongside all the PHP libraries required for the attack chain.

The final part of the sequence is associated with the creation of a Scheduled search.

This search is used to communicate with the C2 server, download additional malware and create several other scheduled searches based on the C2’s response.

For luring users, the threat actor creates a file “WDSyncService.exe” which is capable of DLL search-order hijacking attack.

This DLL hijacking attack is performed by the use of WDSync.dll in the same directory that is loaded when the WDSyncService.exe is executed.

However, the original malware was found in the file named “updx-v2.5.23-setup.exe” which seems to be downloaded from an external source.

Further analysis of the malware executed through the MalSync’s IonCube PHP components had several other tactics such as identity theft, fraud and espionage activities.

Moreover, the index.php files consist of a large amount of PHP code that handles device information collection, task management, and data staging prior to exfiltration.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.



[ad_2]

Source link

Mintlify Confirms Data Breach Through Compromised GitHub Tokens

andreasc
-
0
Mintlify Confirms Data Breach Through Compromised GitHub Tokens

[ad_1]

Mintlify Confirms Data Breach Through Compromised GitHub Tokens

Mintlify data breach exposes GitHub tokens of 91 customers. The software documentation platform experienced a security vulnerability that compromised private code access. Mintlify has taken steps to address the issue and users are advised to change passwords and enable 2FA.

A security breach at a software documentation platform, Mintlify, has allowed unauthorized access to 91 GitHub tokens, raising concerns about the potential exposure of private repositories and the need for improved security measures to protect user data. 

For your information, Mintlify assists developers in creating software documentation by requesting access to customers’ GitHub repositories, including fintech, database, and AI startups.

On March 1st, an email raised security concerns about endpoints’ security, leading to unusual requests from an unrecognized device. Some of these requests targeted sensitive API endpoints. 

Mintlify blames the breach on a vulnerability in its systems, discovered by a bug bounty reporter, which allowed the attackers to gain access to private admin tokens, causing unauthorized entry into the system.

It is worth noting that private tokens on GitHub enable users to share account access with third-party apps such as Mintlify. If stolen, attackers could access source code levels as permitted.

Initial probing revealed that compromised GitHub tokens were used to access a customer’s repository, with no evidence suggesting other repositories were accessed.

The company took immediate action by revoking all GitHub token access, rotating admin access tokens, and implementing stringent security measures to mitigate further unauthorized access. 

Furthermore, the vulnerability that exposed admin access tokens was patched. The company is deprecating private tokens to prevent similar incidents and working with GitHub and customers to determine if any other tokens were used by the attacker.

“The users have been notified, and we’re working with GitHub to identify whether the tokens were used to access private repositories,” the startup’s co-founder Hang Wang noted in the blog post.

The extent of the data breach remains unclear. Nevertheless, Mintlify has collaborated with third-party cybersecurity vendors to conduct a thorough investigation and implemented security measures. This includes improving API endpoint monitoring systems, establishing a robust security policy, launching a bounty program for ethical hackers, and re-auditing its 2024 SOC 2 certification. to prevent unauthorized access and ensure user security.

Mintlify advises users to change their password, enable two-factor authentication (2FA), monitor emails for suspicious activity, and review API key permissions. The incident underscores the need to improve cybersecurity for cryptocurrency exchanges, emphasizing the importance of strong passwords and 2FA.

  1. Malware as Dependabot Contributions Strikes GitHub Projects
  2. Massive Data Breach Exposes Info of 43 Million French Workers
  3. Hacker: I used GitHub 0day to hack US Federal contractor Acuity
  4. GitHub Reports Code-Signing Certificate Theft in Security Breach
  5. Scammers Exploit Crypto Hype with Token Factory, Stealing Millions



[ad_2]

Source link

Galaxy S25 CAD renders are being prepared as we speak

andreasc
-
0
Galaxy S25 CAD renders are being prepared as we speak

[ad_1]

It seems like Samsung is preparing the Galaxy S25 CAD renders as we speak. This information comes from a tipster, @kor_roe. Truth be said, that’s not our usual source of Samsung tips, but it’s easily possible he’s right.

The Galaxy S25 CAD renders are being prepared by the company, it seems

When it comes to smartphone designs, CAD-based renders are what we usually see first. That’s especially true when it comes to high-profile devices. @OnLeaks usually partners up with a publication and shares those renders with the world.

We’ve already seen the Pixel 9 and Pixel 9 Pro renders, for example, and the devices are not expected to launch until October. Considering that the Galaxy S25 series renders are being prepared, we may see those quite early too.

The Galaxy S25 series is not expected to arrive until January next year. Well, if Samsung intends to keep true to its release cycle. The Galaxy S24 CAD renders appeared in September last year almost 4 months ahead of launch.

It’s likely that @OnLeaks will show us the Galaxy S25 CAD renders first

Well, we have a feeling that the Galaxy S25 CAD-based renders could arrive even sooner than that. It remains to be seen, of course. Chances are they’ll once again come from @OnLeaks, though.

We do not have much info about the Galaxy S25 series thus far. An interesting rumor did surface quite recently, though. It claimed that (at least) the vanilla Galaxy S25 will feature a new design. In addition to that, it’s tipped to include a larger display too.

If that phone ends up changing things up in the design department, chances are that the other two will as well. The Galaxy S23 and Galaxy S23+ looked identical, aside from the size difference. The same goes for the Galaxy S24 and Galaxy S24+.

If we had to guess, we’d say that the same will happen with the Galaxy S25 series, but they both could have different designs. It remains to be seen.



[ad_2]

Source link

Samsung patents another rollable display, as the wait continues

andreasc
-
0
Samsung patents another rollable display, as the wait continues

[ad_1]

Samsung has secured a patent for yet another rollable display tech, as we’re waiting for first devices with rollable display to arrive. Foldable smartphones have been around for quite some time now, but phones with rollable displays, not exactly.

Samsung has patented yet another rollable display

We’ll talk more about that in a minute let’s first focus on this display. If you check out the images below, you’ll get to see some of the sketches included in the patent. This patent has been submitted with the United States Patent and Trademark Office (USPTO).

At the moment, we’re not sure for what it is, though. It could be for a smartphone, tablet, or TV. This is not the first rollable display patent Samsung submitted, not at all. Samsung also submitted a cylindrical roller design with the WIPO a while back, and it’s also worthing on a dual-folding display tech.

Samsung was the first company to release a foldable smartphone. That South Korean tech giant had a number of other firsts in the smartphone industry, and we wouldn’t be surprised if it delivered the first rollable smartphone.

LG was expected to release the first rollable smartphone, but that didn’t happen

LG allegedly had a rollable smartphone ready to go, but the company left the smartphone-making industry right before that. OPPO showed us its rollable smartphone concept a couple of years ago, but it still didn’t release such a product.

It will be interesting to see who will be the first to cross the finish line. Having new form factors on the market is always exciting. They’d provide competition for both regular phones and foldable smartphones alike.

Foldable devices are actually excellent nowadays, so the competition would be fierce. Devices like the OnePlus Open and HONOR Magic V2 really managed to push the ante when it comes to foldable smartphone designs.

We’re still not sure when we’ll see the very first rollable smartphone, but a rumor from last year suggested it will happen in the second half of this year. It remains to be seen.

[ad_2]

Source link

A deep dive into thin markets

andreasc
-
0
A deep dive into thin markets

[ad_1]

In the intricate realm of oil trading, liquidity stands as a crucial determinant of market stability and trader success. The term ‘liquidity’ refers to the ease with which an asset can be bought or sold in the market without affecting its price. For oil traders, navigating thin markets—where liquidity is limited—presents a unique set of challenges. This article delves into the multifaceted nature of oil market liquidity, exploring its key components and the impact of various factors that contribute to thin markets.

Understanding Liquidity in Oil Markets

Liquidity Dynamics

Oil market liquidity is influenced by a myriad of factors. Market participants, comprising producers, consumers, speculators, and hedgers, play a pivotal role. The volume and frequency of trading activities, along with market depth reflected in bid-ask spreads, further define liquidity levels. Understanding these dynamics is essential for traders aiming to navigate the labyrinth of oil market liquidity.

The Impact of Geopolitical Factors on Oil Market Liquidity

OPEC Decisions and Ripple Effects

The Organization of the Petroleum Exporting Countries (OPEC) wields significant influence over oil prices. Decisions made by OPEC, such as production cuts or increases, can send shockwaves through the market, impacting liquidity. Traders must be attuned to these geopolitical dynamics to anticipate and adapt to market shifts.

Political Instability in Oil-Producing Regions

Regions with substantial oil reserves often face political instability. Conflicts, sanctions, or regime changes can disrupt production and transportation, creating uncertainties that erode market liquidity. Traders need to factor in geopolitical risks when navigating thin markets.

Global Economic and Trade Tensions

Oil markets are closely linked to global economic conditions and trade dynamics. Trade tensions, economic downturns, or recoveries can influence demand and supply, affecting liquidity. Successful navigation of thin markets requires vigilance regarding the broader economic and geopolitical landscape.

Technological Advancements and Liquidity in Oil Trading

Algorithmic and High-Frequency Trading

Technology has revolutionized oil trading through algorithmic and high-frequency trading. These systems enable rapid execution of trades and enhanced market participation, contributing to liquidity. Traders leveraging technology gain a competitive edge in navigating thin markets.

Electronic Trading Platforms

Electronic trading platforms have become integral to oil trading. These platforms connect a diverse range of market participants, fostering liquidity by increasing accessibility. The ease of electronic trading mitigates some challenges associated with thin markets, offering a streamlined and efficient trading experience.

Big Data Analytics

Big data analytics provide traders with valuable insights into market trends and potential price movements. By harnessing vast datasets, traders can make informed decisions, enhancing their ability to navigate thin markets. Analyzing market sentiment and historical data becomes crucial in managing risks associated with low liquidity.

Regulatory Changes and Their Influence on Oil Market Liquidity

Impact of Financial Regulations

Regulatory measures can significantly impact oil market liquidity. Financial regulations aimed at ensuring market integrity and preventing manipulation may impose constraints on traders. Understanding and adapting to these regulations is essential for navigating thin markets effectively.

Compliance Challenges

Complying with regulatory requirements poses challenges for market participants. Meeting reporting standards, adhering to position limits, and navigating compliance hurdles can affect trading strategies. Traders must stay informed about evolving regulatory landscapes to mitigate compliance-related risks.

Regulatory Responses to Market Manipulation

Regulators actively respond to instances of market manipulation to maintain fair and transparent markets. Enforcement actions and changes in regulatory frameworks can influence trader behavior and market dynamics, impacting liquidity in the process.

Strategies for Navigating Thin Markets in Oil Trading

Risk Management Approaches

In thin markets, effective risk management is paramount. Diversification of trading instruments helps spread risk, reducing vulnerability to adverse price movements. Traders should employ hedging strategies to mitigate the impact of volatility, safeguarding their positions in the face of limited liquidity.

Importance of Market Intelligence

Staying ahead in thin markets requires a deep understanding of market intelligence. Traders need to analyze market data, track emerging trends, and assess geopolitical and economic factors. Proactive decision-making based on comprehensive market intelligence is key to navigating the challenges of low liquidity.

Case Studies: Navigating Thin Markets Successfully

Lessons Learned from Past Experiences

Examining historical instances where traders successfully navigated thin markets provides valuable insights. Case studies offer lessons on adaptability, strategic decision-making, and the resilience required to thrive in challenging market conditions.

Adaptive Strategies in Response to Market Conditions

Traders who have navigated thin markets effectively often employ adaptive strategies. Flexibility in adjusting trading approaches based on market conditions, combined with a proactive stance, is crucial. Case studies shed light on these strategies and their applicability in different scenarios.

Conclusion

Concluding our exploration of oil trading’s intricate dynamics, the intricate dance of navigating thin markets necessitates a comprehensive understanding of influential factors such as technological advancements, geopolitical considerations, regulatory landscapes, and effective risk management strategies. Successful traders in this demanding environment showcase not only technical prowess but also adaptability and resilience. As the oil trading industry undergoes continuous evolution, a proactive stance and unwavering vigilance become imperative for those aspiring to thrive in thin markets. Amidst this dynamic landscape, the Oil-Pro-Profit.com emerges as a compelling concept, encapsulating a transformative perspective that promises to reshape the contours of oil trading, urging market participants to embrace a holistic approach to these ever-evolving challenges.

[ad_2]

Source link

Amid the TikTok chaos: someone added a ByteDance analyst to a US intelligence group chat

andreasc
-
0
Amid the TikTok chaos: someone added a ByteDance analyst to a US intelligence group chat

[ad_1]

Someone made a big no-no last week, when a ByteDance researcher was mistakenly added to a group chat for American artificial intelligence safety experts.

Oh, the irony.

ByteDance, as you know, is TikTok’s parent company. TikTok is the topic of the day, since the Energy and Commerce Committee cast a unanimous 50-0 vote (highly unusual) in favor of the TikTok/ByteDance measure. Then, by a stunningly huge margin, the House passed the bill on to the Senate.

The goal is ByteDance to sell its interests in the viral short video app, or face a ban in the US. If everything goes to plan (if the bill passes and Joe Biden signs it), ByteDance will have a 165-day deadline to divest from TikTok. Should it not pass the control of TikTok to an American-based company, US app stores (like Apple’s, Google’s, and Samsung’s) would be prohibited from offering TikTok in the country.Now, there’s a hilarious turn of events, if you find such things funny – Reuters reports that an analyst from TikTok’s parent company ByteDance was added to a chat group of American AI safety specialists.

The ByteDance researcher was included in a Slack channel meant for dialogue among participants of NIST’s (National Institute of Standards and Technology) U.S. Artificial Intelligence Safety Institute Consortium, a source reported.

NIST clarified via email that this addition was made by a consortium member who thought the individual was volunteering. However, once it was discovered that the person worked for ByteDance, NIST quickly revoked their access due to a breach of the consortium’s ethics regarding false representation.

The individual, listed on LinkedIn as residing in California, hasn’t responded to inquiries, and ByteDance has remained silent on requests for comments.

The involvement of a ByteDance representative sparked concerns within the consortium, especially given TikTok’s contentious position in U.S. discussions about potential risks of Chinese surveillance and influence.

[ad_2]

Source link

Tor Unveils WebTunnel – Let Users Bypass Censorship

andreasc
-
0
Tor Unveils WebTunnel – Let Users Bypass Censorship

[ad_1]

Tor Project’s Anti-Censorship Team has made a groundbreaking announcement that promises to bolster the fight against internet censorship.

On the World Day Against Cyber Censorship occasion, the team proudly introduced WebTunnel, a revolutionary new type of Tor bridge.

This innovative technology is now available in the stable version of the Tor Browser, marking a significant advancement in censorship circumvention technology developed and maintained by The Tor Project.

The Importance of Bridges in the Fight for Internet Freedom

Developing various types of bridges is crucial for enhancing Tor’s resilience against censorship efforts.

Document

Free Webinar : Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.:

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

AcuRisQ, that helps you to quantify risk accurately:

This is particularly pertinent as the world navigates through the 2024 global election megacycle, a period where the role of censorship circumvention technology becomes increasingly critical in safeguarding Internet Freedom.

For those who have ever contemplated becoming a Tor bridge operator to aid others in connecting to Tor, the introduction of WebTunnel presents an opportune moment to get involved.

Detailed requirements and instructions for running a WebTunnel bridge can be found on the Tor Community portal.

Understanding WebTunnel: The Technology Behind the Innovation

WebTunnel is a censorship-resistant pluggable transport designed to mimic encrypted web traffic (HTTPS), drawing inspiration from HTTP.

It operates by encapsulating the payload connection within a WebSocket-like HTTPS connection, making it appear to network observers as ordinary HTTPS (WebSocket) traffic.

This ingenious design allows WebTunnel to blend seamlessly with regular web traffic, enabling it to coexist with a website on the same network endpoint.

Consequently, when someone attempts to access the website at the shared network address, they will encounter the website’s content without indicating the hidden bridge (WebTunnel).

Comparing WebTunnel to Obfs4 Bridges

WebTunnel offers an effective alternative to obfs4 bridges for most Tor Browser users.

Unlike obfs4 and other fully encrypted traffic, which aim to be entirely distinct and unrecognizable, WebTunnel’s strategy of emulating well-known web traffic renders it more effective in environments with protocol-allower lists and a deny-by-default network policy.

In essence, WebTunnel traffic, by resembling HTTPS traffic—a permitted protocol—successfully bypasses censorship mechanisms that would otherwise reject unrecognized traffic.

How to Use a WebTunnel Bridge

Step 1: Acquiring a WebTunnel Bridge

Currently, WebTunnel bridges are exclusively distributed via the Tor Project Bridges website.

Plans include expanding distribution methods to include platforms like Telegram and Moat.

Users can obtain a WebTunnel bridge by visiting bridges, selecting “webtunnel” from the “Advanced Options” dropdown menu, solving a captcha, and copying the provided line.

Step 2: Setting Up Tor Browser

It is essential to note that WebTunnel bridges are incompatible with older versions of Tor Browser (12.5.x).

Users must download and install the latest version of Tor Browser for Desktop or Android.

After installation, users can add the bridge lines obtained in Step 1 through the Connection preferences window or by selecting the option to configure a bridge on Android devices.

Following these steps should enable a successful connection via WebTunnel.

The launch of WebTunnel by the Tor Project represents a significant leap forward in the ongoing battle against internet censorship.

As the global community continues to confront challenges to internet freedom, innovations like WebTunnel underscore the importance of continued vigilance and innovation in pursuing an open and accessible internet for all.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.



[ad_2]

Source link

Contribution of Chainlink to the advancement of smart contracts

andreasc
-
0
Contribution of Chainlink to the advancement of smart contracts

[ad_1]

In decentralized ecosystems, smart contracts stand as self-executing agreements, automating processes and reducing reliance on intermediaries for heightened efficiency. Beyond mere automation, these contracts foster trust and transparency in decentralized environments. Chainlink, positioned as a catalyst, refines smart contract functionality, addressing limitations and reshaping the landscape. This article explores how Chainlink’s impact unlocks unprecedented possibilities. Amid this evolution, individuals are encouraged to explore solutions like innovault.io aligning with decentralization principles in the digital financial landscape, ensuring a cost-effective and efficient approach to transactions.

Understanding the Limitations of Smart Contracts

Oracles and External Data Dependency

Smart contracts, while powerful, face challenges when dealing with real-world data. Chainlink recognized the need to bridge this gap by introducing decentralized oracles, ensuring secure and reliable external data input.

Security Concerns and Vulnerabilities

The execution of smart contracts is not without risks. Chainlink actively addresses security concerns by providing a robust framework that minimizes vulnerabilities and safeguards against malicious attacks.

Real-world Applicability Challenges

Chainlink tackles the practicality issues faced by smart contracts. Through its technology, smart contracts become more adaptable to real-world scenarios, opening avenues for broader applications.

Chainlink’s Decentralized Oracle Technology

Introduction to Chainlink Oracles

Chainlink’s oracles act as decentralized information sources, providing smart contracts with accurate and tamper-proof data. This decentralized approach enhances reliability and reduces dependence on centralized sources.

Decentralized Data Sourcing and Verification

The decentralized nature of Chainlink’s oracles ensures that data is sourced from multiple, independent nodes. This not only enhances reliability but also establishes a consensus mechanism for data verification.

Interoperability with Various Blockchain Networks

Chainlink’s versatility shines through its ability to seamlessly integrate with different blockchain networks. This interoperability expands the reach of smart contracts, fostering a more interconnected and collaborative decentralized ecosystem.

Enhancing Security in Smart Contracts

Mitigating Risks Through Decentralized Oracle Networks

Chainlink’s decentralized oracle networks significantly reduce the single points of failure in smart contract execution. This mitigation strategy enhances the overall security of decentralized applications.

Chainlink’s Approach to Preventing Manipulation and Attacks

Chainlink employs cryptographic techniques and consensus mechanisms to thwart manipulation attempts. This proactive approach ensures the integrity of the data feeding into smart contracts, safeguarding against potential attacks.

Ensuring Trustworthiness in Smart Contract Execution

By fostering a trustless environment, Chainlink’s technology ensures that smart contracts execute as intended, reducing the need for implicit trust in centralized authorities. This reliability is crucial for the widespread adoption of decentralized applications.

Expanding Smart Contract Use Cases

Enabling Complex and Dynamic Contracts

Chainlink’s contribution extends beyond basic transactions. It enables the creation of complex and dynamic smart contracts, capable of executing intricate tasks with real-world relevance.

Facilitating Cross-Platform Integration

The seamless integration of Chainlink with various blockchain networks breaks down silos, allowing smart contracts to interact across platforms. This cross-platform functionality enhances the versatility and utility of smart contracts.

Real-world Applications and Industry Adoption

The practical applications of Chainlink’s technology are witnessed across industries. From supply chain management to healthcare, smart contracts powered by Chainlink find application in solving real-world challenges.

Chainlink’s Impact on DeFi and Beyond

Revolutionizing Decentralized Finance (DeFi)

Chainlink plays a pivotal role in the DeFi space, providing the decentralized infrastructure needed for secure and reliable financial transactions. This facilitates the growth and evolution of decentralized finance ecosystems.

Enabling New Possibilities in Decentralized Applications (DApps)

Decentralized applications powered by Chainlink extend beyond basic functionalities. The technology opens new possibilities for DApps, allowing for more sophisticated and feature-rich decentralized applications.

Integration with NFTs and the Creative Economy

The integration of Chainlink with non-fungible tokens (NFTs) enhances the authenticity and uniqueness of digital assets. This, in turn, fuels the creative economy by providing a secure and decentralized marketplace for digital content.

Future Trends and Developments

Chainlink’s Ongoing Research and Development

The evolution of Chainlink is a continuous process. Ongoing research and development initiatives ensure that the technology remains at the forefront of addressing emerging challenges and opportunities.

Potential Integrations and Collaborations

The future holds promising collaborations and integrations as Chainlink expands its ecosystem. Collaborative efforts with other projects and technologies are anticipated to further enhance the capabilities of smart contracts.

The Evolutionary Path of Smart Contracts with Chainlink

As Chainlink continues to evolve, the path of smart contracts undergoes a transformation. The technology paves the way for a more sophisticated, secure, and widely adopted decentralized future.

Conclusion

In conclusion, Chainlink’s undeniable impact on smart contracts is reflected in its concerted efforts to address key limitations and enhance security, paving the way for a new era of decentralized applications. As we reflect on the journey so far, it becomes evident that the story of Chainlink doesn’t conclude here. The anticipated developments and advancements in the decentralized ecosystem, driven by Chainlink’s innovations, foreshadow a future where smart contracts will play an even more integral role across various industries. Chainlink, far beyond being a mere technology provider, emerges as a catalyst in shaping the future of blockchain technology. Its influence extends to steering the blockchain landscape towards increased decentralization, heightened security, and a broader real-world applicability that goes beyond the conventional boundaries of technology provision.

[ad_2]

Source link

Hackers Attacking Critical US Water Systems, White House Warns

andreasc
-
0
Hackers Attacking Critical US Water Systems, White House Warns

[ad_1]

In a stark warning issued by the White House, it has been revealed that cyberattacks are increasingly targeting water and wastewater systems across the United States.

These critical infrastructures are essential for providing clean and safe drinking water to communities, yet they are now at the forefront of a silent cyber war.

Cyber Threats from Iran and China

The letter from the White House, dated March 18, 2024, outlines two significant cyber threats that have been compromising the nation’s water systems.

Document

Free Webinar : Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.:

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

AcuRisQ, that helps you to quantify risk accurately:

The first threat comes from actors affiliated with the Iranian Government’s Islamic Revolutionary Guard Corps (IRGC), who have been exploiting weaknesses in operational technology.

Specifically, they have targeted water facilities that failed to change default manufacturer passwords.

The White House refers to the Cybersecurity and Infrastructure Security Agency’s (CISA) advisory for more details on these attacks.

The second threat is the People’s Republic of China (PRC) state-sponsored cyber group, Volt Typhoon.

This group has been infiltrating information technology systems of multiple critical infrastructures, including those of drinking water.

Unlike typical cyber espionage, Volt Typhoon’s activities suggest a pre-positioning strategy to disrupt essential operations in the event of geopolitical tensions or military conflicts.

The Vulnerability of Water Systems

The letter emphasizes the attractiveness of drinking water and wastewater systems as cyberattack targets.

Despite being a lifeline critical infrastructure sector, these systems often lack the necessary resources and technical capacity to implement robust cybersecurity measures.

The U.S. Environmental Protection Agency (EPA), as the lead Federal agency under Presidential Policy Directive 21, is tasked with ensuring the resilience of the nation’s water sector to all threats and hazards.

The White House is seeking the support of state governments to ensure that water systems within their jurisdictions conduct comprehensive assessments of their cybersecurity practices.

The goal is to identify vulnerabilities, implement controls to mitigate risks and develop robust incident response plans.

The letter points out that even basic cybersecurity precautions, such as changing default passwords and updating software, can significantly reduce the risk of a cyberattack.

Resources and Assistance

The EPA and CISA offer guidance, tools, training, resources, and technical assistance to help water systems enhance their cybersecurity.

Additionally, private sector associations like the American Water Works Association, the National Rural Water Association, and the Water Information Sharing and Analysis Center provide support.

State Homeland Security advisors are also highlighted as valuable resources connected to Federal cybersecurity efforts.

Upcoming Convening and Task Force

The White House plans to invite state Environmental, Health, and Homeland Security Secretaries to a meeting to discuss improvements needed to protect the water sector from cyber threats.

This convening will address current Federal and state efforts, identify priority gaps, and emphasize the urgency of immediate action.

Furthermore, the EPA will establish a Water Sector Cybersecurity Task Force in collaboration with the Water Sector and Water Government Coordinating Councils.

This task force will focus on identifying critical vulnerabilities, challenges in adopting best practices, and strategies to reduce the risk of cyberattacks on water systems nationwide.

The White House and EPA hope that the initiatives outlined in the letter and future collaborative efforts will fortify water systems against cyber threats.

The administration appreciates the gravity of the situation and calls for a concerted effort to safeguard mission-critical water utility operations.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.



[ad_2]

Source link

1...317318319...1,492Page 318 of 1,492