Category: vulnerabilities

What is Unpatched softwares or systems & How To Defend Against It

What is Unpatched softwares or systems?

Sometime companies use the old versions of the softwares that have multiple exploits that are already written and are easily available on the web (usually they use that vulnerable version of the softwares because updating it might cause problems with the other softwares depending on it in the environment).

How to defend against the Unpatched softwares or systems?

  • Implement a patch management process.
  • Remove unnecessary features and dependencies.
  • Continuously monitor sources like CVEs for vulnerabilities in the systems.
  • Subscribe to email alerts for security vulnerabilities related to components you use.
  • Just use secured links to get products through official sources. To reduce the risk of a changed, malicious element being included, prefer signed packages.
  • Monitor for libraries and components that are unmaintained.
  • For the lifetime of the application, the company must insure that there is an ongoing process for monitoring, triaging, and implementing updates or configuration changes.

 

What is Cookie Stealing & How To defend against It

What is Cookie Stealing?

Cookies are small bits of data on how you respond and interact with a website. Cookie Stealing is exploitation of a valid computer session to gain unauthorized access to the Web Server.

The most common ways to compromise a session token are:

  • Predictable session token.
  • Session Sniffing.
  • Client-side attacks.
  • Man-in-the-middle attack.

How to defend against Cookie Stealing?

  • Use SSL certificate (HTTPS protocol).
  • keep your web-app up to date.
  • Use strong usernames and passwords.
  • Use MFA.
  • Block PHP execution.
  • Use Anti-Virus.
  • Do not click on suspicious links.
  • Avoid storing sensitive data.
  • don’t use predictable cookies.

 

What Is A Phishing Attack & How To Defend Against It

What is Phishing?

Phishing is when a attacker convinces you to be someone that they are not and ask for you personal information. They can more easily infect you with malware or steal your credit card details by impersonating someone you trust.

Example Scenario:

You receive an email from the bank containing a bank URL to goto
You click on the URL and the page opens
You sign in the bank account
The page loads again and you go to a random page related to the bank

In the back end when you sign in the creds are forwarded to the attacker in clear text and then the attacker redirects you to the actual bank website.

How to defend against the Broken Access Control?

  • Staff training.
  • Never trust anyone and do verify before giving out any data.
  • Dont visit random links.
  • Dont open unknown attachments.
  • Implement technologies that scans the attachments or checks the links (such as safe links and safe attachments in MS Azure).
  • Report to relevant person if you have clicked on the suspicious link so that the security team can verify and then proceed with their troubleshooting if necessary.
  • Use MFA.

 

What is Insufficient Logging & Monitoring & How To Improve It

What is Insufficient Logging & Monitoring?

Logging is essential because it enables the attacker’s actions to be tracked in the event of an incident. Their risk and effect can be calculated once their activities are traced. There would be no way to say what activities an intruder took if they gained access to specific web applications without logging. Since these logs contain confidential data, it is important to make sure that they are stored safely and that several copies of these logs are kept in separate locations. Even though logging is essential but it is helpful after a breach not before, or while a breach. to defend our self in the first place we need to ensure that we have Monitoring and Detection systems in place to catch and alert the teams (if needed or else the play books can be automated) when the suspicious activity is detected.

The information should be stored in the logs:

  • Time stamps.
  • User accounts.
  • API endpoints/page locations.
  • IP addresses.
  • Requests made.
  • Responses sent.

Common examples of suspicious activity includes:

  • Multiple unauthorized attempts for a particular action.
  • Requests from anomalous IP addresses or locations.
  • Use of automated tools.
  • Common payloads attempts.

How to Improve Logging & Monitoring?

  • Ensure all login, access control failures, and server-side input validation failures can be logged.
  • Ensure that logs are generated in a format that can be easily consumed by a centralized log management solutions.
  • Ensure high-value transactions have an audit trail with integrity controls to prevent tampering or deletion, (such as append-only database tables).
  • Establish effective monitoring, detecting and alerting mechanism.
  • Establish or adopt an incident response and recovery plan.
Examining the logs after a pen-test is one technique for deciding whether you have enough monitoring. The actions of the testers should be clearly documented in order to determine the extent of any harm they may have caused.

 

What is Man-In-The-Middle (MITM) Attack & How To defend against It

What is MITM?

A MITM attack is when an attacker intercepts communications between two parties either to secretly go through or modify data going from one end to another. Attackers might use MITM attacks to steal login credentials or personal information.

Types Of MITM Attacks:

  • Rogue Access Point.
  • ARP Spoofing.
  • DNS Spoofing.
  • Multicast DNS Spoofing.

Common MITM Techniques:

  • Packet Sniffing.
  • Packet Injection.
  • Cookie Stealing.
  • SSL Stripping.

How to defend against MITM?

  • Use strong encryption.
  • Strong router login creds.
  • Use VPNs.
  • Force HTTPS protocol over HTTP.
  • Public Key Pair Based Authentication.

 

What is a Remote Access Trojan (RAT) & How To defend against It

What is RAT?

A RAT is a form of malware that lets attackers track and control your machine remotely.

How to defend against RAT?

  • Use anti virus.
  • Download softwares using safe and official links over a secure protocol. Prefer to download a signed image of the software to make sure there is no changes made in the software while in transit.
  • Dont open unknown email attachments & links.
  • Keep your browser and operating system up-to-date with security patches.

 

What is Insider Threat & How To defend against It

What is Insider Threat?

Employees, former employees, contractors, or business associates who have legitimate access to your systems and data but can use that access to kill or steal your data or systems are known as insider threats. Insiders may turn malicious for a variety of reasons, such as revenge, manipulation, ideology, ego, or monetary benefit via intellectual property theft.

How do I prevent a Insider Threat?

There are a variety of ways to defend yourself from malicious insiders, depending on the organization, systems, culture, environment, and how well this information is communicated and understood by employees.

 Technical Controls:

  • Control removable storage
  • Control outbound emails and files
  • Backups
  • Require strong passwords and multi-factor authentication
  • Recycle your old hardware and documentation properly (Remove all data before recycling)

 Access Controls:

  • Implement concept of least-privileged access
  • Use unique logons
  • Deactivate unnecessary access
  • Implement Auditing and logging
  • Establish physical security in the work environment
  • Enforce separation of duties

 Business Processes:

  • Do a comprehensive background check before hiring any IT admins because they have powerfull administrative access
  • Staff training
  • Improve work culture
  • Enable surveillance

What is a Ransomware & How to Defend Against It

What is a Ransomware?

Ransomware is a form of malware that encrypts a victim’s data. The attacker then asks for ransom. Once the ransom is paid the the user access to data is restored..

How to defend against Ransomware?

  • Keep your operating system patched and up-to-date.
  • If you don’t know what you’re doing, don’t install software or grant it administrative rights.
  • Use antivirus software.
  • Back up your files, regularly and automatically. Even though this will not prevent you from an attack, it will significantly reduce the harm it does.

What is Cross-Site Scripting (XSS) & How to Defend Against It

What is XSS?

XSS is a type of injection which if successful, allows an attacker to run scripts on the victim’s machine. A web-app is vulnerable, if it uses unsanitized user input.

There are three main XSS types:

  • Stored XSS: This is the most dangerous type of XSS. This is where a malicious string originates from the website’s database.
  • Reflected XSS: This payload is part of the victims request to the website. The website includes this payload in response back to the user.
  • DOM-Based XSS: DOM (Document Object Model) is a programming interface for HTML and XML documents. It represents the page so that programs can change the document structure, style and content.

How to defend against the Broken Access Control?

Using frameworks that automatically escape XSS by design.
Escape mistrusted HTTP request data.
Apply context-sensitive encoding when modifying the browser document on the client side.
Enable a CSP (Content Security Policy).

 

What is Security Misconfiguration & How to Defend Against It

What Security Misconfiguration is?

Security misconfigurations are when security could have been configured properly but was not, and can happen at any level of an application stack. Automated scanners are useful for detecting the misconfigurations.Often this Vulnerability give attackers unauthorized access to system data, sometimes can end up in a complete system compromise.

Security misconfigurations often include:

  • Poorly configured permissions.
  • Having unnecessary features enabled.
  • Out of date web applications
  • Insufficient firewall protection
  • Default configurations (default accounts and default passwords).
  • Overly detailed error messages.
  • Unencrypted files

How to defend against the Security Misconfigurations?

  • Remove any unnecessary features.
  • Regularly patch your systems and use up to date softwares.
  • Use strong and complex passwords
  • Use strong ACL (Access Control List) and other permissions.
  • Design the error messages (such as the error 404 page).
  • Use strong encryption protocols
  • Verify the effectiveness of the configurations and settings in all environments.