Knowledge platform

With independent articles, interviews and videos by professionals, for professionals.

Scaling Application Security: The issues that Appsec teams face

This post concerns application security teams, so it’s written assuming you are part of one. However, I believe it could help you understand application security a bit more even if you are not.

If you are part of an application security team, you probably struggle with the amount of work on your shoulders every day. Let’s say you have a small team of 5 people to test all web applications produced by a group of 200 developers, and you still need to provide guidance on how to fix some vulnerabilities. You try to offload some work by handing developers with security testing tools, but the learning curve is long - causing frustration. Basically, you have a scaling issue!

Multidisciplinary Aspects of Blockchain

Multidisciplinary Aspects of Blockchain is a different book on a fundamental digital technology under development and published in Dutch (hardcopy) and English (eBook) as part of a series of the Royal Dutch Society for Computer and Information Professionals. Blockchain, which reportedly changes society as the ultimate disruptor and most important invention after the introduction of the World Wide Web of Internet. Blockchain is a collective term for digital databases, which are distributed, mathematically-protected and chronological in nature.

How you can contribute to the knowledge platform

Crime, ransomware and defence

“I rob banks because that is where the money is”, is a famous quote attributed to (in)famous bank robber Willie Sutton[1]. It is also known as Sutton’s Law. Suttons law still holds true for many things, including modern (cyber)crime. If you want to earn money from your crimes, focus on what people value most.

Ransomware is an example of just this. Criminals target what is most valuable to organisations and individuals, their data or memories.

Fighting security risks beyond the bug

Data leaks have become an all-too-common societal problem. Still, 99% of the problems do not involve scary zero-day bugs. So why is security still hard? We need to accept that technology isn’t going to save us. Rather, thinking it can, got us in this situation in the first place. We need a new way of teaching and implementing security across our organizations. I am introducing the AVA=Risk Security Model to help us get there.

A confusing mix of digital incident notification laws

We note divergent digital law trends of statutory nature – many of which have been going on for some time, starting-out two or even three decades ago. Just to give an idea in an at random sequence: modernizing and extending intellectual property laws, updating penal legislation with new crimes like hacking and computer sabotage, amending the Criminal Procedure Code with extensive powers for the police and public prosecution, strengthening the legal position of the online consumer, introducing and tightening data privacy laws, adjusting evidence laws, and implementing security regulations.

DeTT&CT: Mapping your Blue Team to MITRE ATT&CK™

A month ago we, Ruben and Marcus, released the first version of DeTT&CT. It was created at the Cyber Defence Centre of Rabobank, and built atop of MITRE ATT&CK. DeTT&CT stands for: DEtect Tactics, Techniques & Combat Threats. Today we released version 1.1, which contains multiple improvements: changelog. Most changes are related to additional functionality to allow more detailed administration of your visibility and detection.

By creating DeTT&CT we aim to assist blue teams using ATT&CK to score and compare data log source quality, visibility coverage, detection coverage and threat actor behaviours. All of which can help, in different ways, to get more resilient against attacks targeting your organisation.

In this blog we start off with an introduction on ATT&CK and continue with how DeTT&CT can be used within your organisation. Detailed information about DeTT&CT and how it can be used, is documented on the GitHub Wiki pages. Therefore, the explanation we give in this blog will be high-level.

IT testlabs for everybody!

Not too long ago I was in a SANS course, about the Critical Security Controls. More than once our teacher Russell nudged us, suggesting that “you could be applying these to your home network as well!” which brought us to the subject of testlabs. “What would make a good testlab for us?” was something asked along the way.

To sum things up: it really doesn't have to be glamorous! As long as your lab helps you experiment and learn, it's a good lab for your! So here's a few quick reminders for IT folks who would like to get their feet wet in setting up their own labs.

Two Factor Authentication Cross Site Request Forgery (CSRF) vulnerability (CVE-2018-20231)

At BitnessWise we recently did a review of a few Two Factor Authentication (2FA) plugins for WordPress. First we selected some candidates based on usability and free-version features and after that performed a technical review of the plugin. This revealed a vulnerability we’d like to discuss in this post for future reference and to better understand the issue.

How you can contribute to the knowledge platform

Abusing Exchange: One API call away from Domain Admin

In most organisations using Active Directory and Exchange, Exchange servers have such high privileges that being an Administrator on an Exchange server is enough to escalate to Domain Admin. Recently I came across a blog from the ZDI, in which they detail a way to let Exchange authenticate to attackers using NTLM over HTTP. This can be combined with an NTLM relay attack to escalate from any user with a mailbox to Domain Admin in probably 90% of the organisations I’ve seen that use Exchange. This attack is possible by default and while no patches are available at the point of writing, there are mitigations that can be applied to prevent this privilege escalation. This blog details the attack, some of the more technical details and mitigations, as well as releasing a proof-of-concept tool for this attack which I’ve dubbed “PrivExchange”.

Click me if you can, Office social engineering with embedded objects

Introduction

Microsoft Office documents provide attackers with a variety of ways to trick victims into running arbitrary code. Of course an attacker could try to exploit an Office vulnerability, but it is more common to send victims Office documents containing malicious macros, or documents containing embedded (Packager) executable files. 

To make these attacks harder, Microsoft has been adding security measures to Office that are aimed at protecting victims from running malicious code. A well-known measure is to open documents in Protected View when they are downloaded from the internet. Office 2016 and Office 365 contain additional security measures like a GPO to disable macros altogether when a document is downloaded from the internet. And the Packer file extension blacklist that blocks running of blacklisted file types. 
 

TaHiTI - Threat Hunting Methodology

During several months we worked together with a number of Dutch financial institutions to create the threat hunting methodology called TaHiTI. Which stands for Targeted Hunting integrating Threat Intelligence. You can obtain it from here: https://www.betaalvereniging.nl/en/safety/tahiti.

The goal of this collaboration was to reach a joint understanding of what threat hunting is and to come up with a common approach how to carry out threat hunting. As the name implies, threat intelligence has an important role within this methodology. It is used as a source for creating hunting hypotheses and during the hunting investigation to further contextualize and enrich the hunt.

The Legal Look: The Overlooked Categories of Cyber Threats

When money is not an issue companies tend to look at legal standards differently. Today, also digital entrepreneurs seem to go their own way more than ever before. Take Uber. Since its establishment in 2009, all kinds of legal conflicts of weight have occurred in various jurisdictions. From large-scale privacy violations and alleged misuse of trade secrets to claims based on structural sexual harassment and misleading a supervisory body. Exemplary, however, are the legal battles relating to its UberPOP ride-share service, executed by ordinary people who love to moonlight. This business model fundamentally clashes with the licensed passenger transport regulation that many countries have in place. You could have counted that on your fingers in advance. 

Cyber security in 2018 and 2019: Looking back and moving forward

A closer connection to the real world

From a risk perspective 2018 was an interesting year. But what will 2019 bring? In this blog series we look back but more so: we move forward. How can blockchain technology, cyber security, risk sensing and privacy help you gain a competitive advantage in the years to come? Episode 1 is about cyber security: the connection between digital and physical worlds.

On scarcity and the blockchain

In an otherwise perfect interview on the importance of social innovation (that I wholly agree with and that I encourage everybody to read) Jaromil said something interesting about the use of blockchain to create scarcity in the digital realm.

With the blockchain the situation is paradoxically creating scarcity, because if I give you something I will not have it anymore, and I can’t spend it anymore. The blockchain creates for the first time a condition in which it will be possible to create a unique asset in the digital dimension.

How you can contribute to the knowledge platform