Why startups and small businessess are prime targets for cyberattacks?

Why startups and small businesses are prime targets for cyberattacks?

In today’s digital age, cybersecurity has become a paramount concern for businesses of all sizes. However, it’s alarming to note that startups and small businesses are increasingly becoming the primary targets for cyberattacks. According to a report by CyberPeace Foundation, a staggering 43% of cyberattacks are directed at these smaller enterprises. But why are startups and small businesses so vulnerable, and what can they do to protect themselves? Let’s delve into the reasons behind this growing trend. 

Why startups and small businessess are prime targets for cyberattacks

1. Limited Resources

One of the primary reasons startups and small businesses are targeted is their limited resources. Unlike large corporations, smaller businesses often lack the financial and human resources necessary to implement robust cybersecurity measures. They might not have dedicated IT departments or the budget to invest in advanced security solutions, making them easier prey for cybercriminals. 

2. Perception of Lower Security

Cybercriminals often perceive startups and small businesses as soft targets. The assumption is that these organizations may not prioritize cybersecurity as much as larger companies do. This perception, unfortunately, is often accurate. Many small businesses operate under the false belief that they are too small to be noticed by cybercriminals, which leads to complacency and inadequate security practices. 

3. Valuable Data

Despite their size, startups and small businesses hold valuable data. This includes customer information, payment details, and intellectual property. Cybercriminals know that stealing such data can be highly profitable. Additionally, these businesses often work with larger companies, and breaching their systems can serve as a stepping stone to access more significant targets. 

4. Inadequate Training and Awareness

Employees in small businesses and startups are often not adequately trained in cybersecurity best practices. Phishing attacks, for instance, rely heavily on human error. If employees are not aware of how to recognize and respond to suspicious emails, they are more likely to fall victim to these attacks. A lack of training and awareness can significantly increase the vulnerability of these organizations. 

5. Rapid Growth and Expansion

Startups, by nature, aim for rapid growth and expansion. In the rush to scale up operations, cybersecurity can sometimes take a back seat. New systems are integrated, and new employees are onboarded without proper security vetting and training, creating numerous vulnerabilities that cybercriminals can exploit. 

6. Third-Party Vulnerabilities

Many startups and small businesses rely on third-party vendors and services to manage various aspects of their operations. These third-party providers can introduce additional security risks. If these vendors are compromised, the startup or small business using their services can also be exposed to cyber threats. 

Why startups and small businessess are prime targets for cyberattacks - Mitigation startegies

Mitigation Strategies

While the threat landscape may seem daunting, there are several steps startups and small businesses can take to bolster their cybersecurity defences: 

1. Invest in Basic Security Measures:

Implementing firewalls, antivirus software, and encryption can provide a basic level of protection. While these measures are not foolproof, they can deter less sophisticated attacks. 

2. Employee Training:

Regularly training employees on cybersecurity best practices and how to recognize phishing attempts can reduce the risk of human error leading to a breach. 

3. Regular Updates and Patches:

Ensuring that all software and systems are regularly updated can close vulnerabilities that cybercriminals might exploit. 

4. Data Backup:

Regularly backing up data can ensure that a business can recover quickly in the event of a ransomware attack or data breach. 

5. Access Controls:

Limiting access to sensitive data to only those employees who need it for their work can reduce the risk of internal breaches. 

6. Incident Response Plan:

Having a plan in place to respond to a cyberattack can minimize damage and downtime. This should include steps for identifying the breach, containing the damage, eradicating the threat, and recovering operations. 

Why startups and small businessess are prime targets for cyberattacks - Compliance considerations.

Compliance Considerations

Understanding and adhering to compliance requirements is crucial for protecting your business and data. Here are some key considerations based on industry: 

1. Healthcare (HIPAA)

  • Health Insurance Portability and Accountability Act (HIPAA): Ensures the protection of patient health information. Compliance includes implementing physical, network, and process security measures. 
  • Steps to Compliance: Conduct regular risk assessments, train employees on HIPAA requirements, and ensure all patient data is encrypted. 

2. Finance (PCI DSS, GLBA)

  • Payment Card Industry Data Security Standard (PCI DSS): Protects cardholder data by requiring businesses to maintain a secure environment. 
  • Gramm-Leach-Bliley Act (GLBA): Protects consumers’ personal financial information held by financial institutions. 
  • Steps to Compliance: Regularly update security software, monitor and test networks, and establish information security policies. 

4. Retail (PCI DSS)

  • Payment Card Industry Data Security Standard (PCI DSS): Like finance, retail businesses must protect customer payment information. 
  • Steps to Compliance: Use strong access control measures, regularly monitor and test networks, and maintain an information security policy. 

4. Technology (GDPR, CCPA)

  • General Data Protection Regulation (GDPR): Protects personal data and privacy of individuals within the European Union (EU). 
  • California Consumer Privacy Act (CCPA): Provides California residents with the right to know what personal data is being collected and how it is used. 
  • Steps to Compliance: Obtain explicit consent for data collection, allow consumers to opt-out of data sharing, and provide access to collected data upon request. 

5. Education

  • Family Educational Rights and Privacy Act (FERPA): Protects the privacy of student education records. 
  • Steps to Compliance: Implement access controls, ensure data is encrypted, and provide training on FERPA requirements. 

Conclusion

Startups and small businesses are undeniably attractive targets for cybercriminals due to their limited resources, perceived lower security, and valuable data. However, by understanding the reasons behind these attacks and implementing basic cybersecurity measures, these organizations can significantly reduce their risk. In today’s interconnected world, prioritizing cybersecurity is not just an option; it’s a necessity for survival and growth. 

Take Action Now! Implement strong cybersecurity measures, train your employees, invest in essential security tools, and develop a robust incident response plan. Protect your business, customers, and future.  

Challenges in Cloud Security

Challenges in Cloud security

Cloud computing is one of the most widely adopted technologies, with around 39% of companies hosting over half of their workloads on cloud platforms. A 2023 Cloud security report by cybersecurity insiders predicts that within the next 12 to 18 months, about 58% of companies will run 50% of their workloads on cloud platforms. Given the importance of data stored in the cloud, security is a top priority for most companies. In this blog, we’ll explore the meaning of cloud computing, delve into cloud security, and address its challenges. 

What is cloud computing?

What is Cloud Computing?

Cloud computing is on-demand availability of digital resources, especially data storage and computing power without any direct active management by the user. One of the main reasons why users use cloud is because of its convenience and reliability. 

What is cloud security?

What is Cloud Security?

As with any technology with vast amount of data, security is a paramount concern in the cloud. Cloud security encompasses a set of policies, controls, procedures, and technologies that work together to protect cloud–based systems, data, and infrastructure. It addresses both cyber threats and physical security, ensuring that data is safely stored and handled.  

Challenges in Cloud Security

Challenges in Cloud Security:

Despite having various benefits, it’s very important to understand the challenges of Cloud security as well. There are 5 major challenges, which compromises the integrity of cloud security:  

1. Data Breaches and Loss:  

The cloud’s very nature, being accessible from anywhere, makes it lucrative target for cybercriminals. Data breaches can lead to the loss of sensitive information, impacting businesses and individuals alike.  These data breaches can cause severe financial and reputational loss to the companies.  

2. Insufficient Identity, credential, and access Management:  

Weak credentials and poor access management can allow unauthorized access to sensitive data stored to cloud. This leads to data breaches which compromises their data and leads to major loss.  

3. Insecure Interfaces and APIs:  

Cloud services are accessed through interfaces and APIs. If they are insecure, they can be exploited to compromise the security of the cloud services. Which leads to data loss, DDoS attacks etc.  

4. Lack of Visibility and Control: 

In the cloud, data can reside in different locations worldwide. This lack of visibility and control over where data is stored and who is accessing it can complicate security efforts. This will increase the chances of vulnerability, ineffective incident response and risk management.  

5. Compliance Challenges:  

With varying regulations across regions, ensuring that cloud services comply with all relevant laws and standard can be a daunting task. If failed to comply, the companies will have to face legal consequences.  

Best Cloud Practices

Best Cloud Practices:

To mitigate these challenges, adopting best practices in cloud security is crucial:  

1. Implement strong access control: 

Use multi-factor authentication and least privilege access policies to minimize the risk of unauthorized access.  

2. Encrypt Data:  

Encrypt data both in transit and at rest to protect it from unauthorised access.  

3. Regularly monitor and audit cloud resources:  

Keep track of who is accessing your data and what they’re doing.  

4. Ensure Compliance with regulations:  

Stay informed about the latest regulations and ensure your cloud services are in compliance.  

5. Choose a reputable cloud service provider:  

It’s very crucial to choose a good reputable cloud service provider who has robust security measures in place.   

6. Regular security audits:  

Conduct regular security audits and assessments to identify potential vulnerabilities, gaps in security controls, and areas for improvement in cloud infrastructure and applications.  

Final Thoughts:

Cloud computing has undeniably transformed how we store, manage, and process data. However, its benefits come with a set of security challenges that need to be carefully managed. By understanding these challenges and implementing best practices, business and individuals can significantly mitigate the risks associated with cloud computing, making the most of this powerful technology while ensuring their data remains secure.  Explore how our expert solutions can help you maximize cloud benefits securely. Contact us to navigate cloud security with confidence.

CVE-2023-43336: Privilege Escalation Vulnerability in FreePBX

CVE-2023-43336: Privilege Escalation Vulnerability in FreePBX

FreePBX is a popular open-source web-based graphical user interface that manages Asterisk, a communication server. FreePBX allows users to configure and manage their communication systems easily. However, a security vulnerability was discovered in FreePBX version 16.0.26 that could potentially lead to privilege escalation, enabling unauthorized users to access sensitive information and compromise system integrity. 

About the CVE

CVE-2023-43336 is a high-level privilege escalation vulnerability identified in FreePBX version 16.0.26. It allows least privilege users to access information belonging to other users, violating access controls and potentially leading to authorized data disclosure and system compromise.  

What’s the cause of this vulnerability?

The cause of this vulnerability arose due to the improper access controls and untrusted input handling in the application’s codebase. 

Scenario

In August 2023, our team discovered the CVE-2023-43336 vulnerability in FreePBX version 16.0.26. They uncovered this vulnerability through careful analysis and testing which allowed them to apply series of steps to bypass controls and access sensitive data, such as call history, belonging to other users.    

What we found

Our team identified “Privilege Escalation” Vulnerability where the main motive of the attacker is to gain high-level unauthorized access within a security system.  The attacker typically starts with exploiting vulnerabilities to access a system that has limited privileges.  

Brief about what we found

Our team discovered the vulnerability by analysing the behaviour of the application. By logging in with a non-administrative user account with access to the “Call History” modules, they were able to trigger requests and observe the data exchange.  

Through a series of steps, including adding a specific widget to the dashboard and manipulating requests, our team successfully accessed call history data belonging to other users, circumventing the access restrictions implemented by the application.

We helped them mitigate the following risks

Privilege Escalation Vulnerability:

A Privilege Escalation vulnerability is a vulnerability that allows an attacker to gain higher levels of access or permissions within a system or application than they are authorized to have. This type of vulnerability typically arises due to inadequate access controls or flawed permission management within the software. Once exploited, privilege vulnerabilities can enable attackers to execute malicious actions, access sensitive data, and compromise the security of the system or application.

Business risks we prevented:

  1. Breaches of user privacy.
  2. Unauthorised access to sensitive information.
  3. Data theft.
  4. System integrity.
  5. Reputational damage.
  6. Financial loss.

Conclusion

The privilege escalation vulnerability discovered in FreePBX version 16.0.26 underscored the critical importance of robust security practices in software development. The timely identification and remediation of this vulnerability highlighted the importance of proactive security practices in mitigating risks to sensitive data and system integrity. This case highlighted the ongoing need for proactive security measures, including vulnerability assessments, timely patching, and user education, to defend against the evolving cybersecurity threats and ensure the resilience of communication infrastructure.

References:

https://en.wikipedia.org/wiki/FreePBX

https://medium.com/@janirudransh/security-disclosure-of-vulnerability-cve-2023-23336-4429d416f826

https://www.cynet.com/network-attacks/privilege-escalation/

Zimbra case-study thumbnail

Identifying a vulnerability in Zimbra software

Overview

CVE short for Common Vulnerabilities and Exposures is a globally recognized system managed by MITRE Corporation. It standardizes the identification and cataloging of software vulnerabilities, assigning unique reference numbers to each allowing easy tracking and reference across different platforms. This centralized database plays a crucial role in enhancing cybersecurity practices as it promotes information sharing, collaboration, and awareness of vulnerabilities, facilitating proactive remediation efforts and improving software security across industries.

About the CVE

CVE was listed in Zimbra Security advisories.

The CVE ID is CVE-2023-34193. The CVE was listed in Zimbra’s security advisories.

Scenario

Our team found a vulnerability in Zimbra software where we worked with a vendor to get the CVE listed.

What We Found

We discovered a high-level vulnerability called “Remote Code Execution (RCE)”. RCE vulnerability can provide an attacker with full access to control over a compromised device, making it one of the most dangerous and critical types of vulnerability.

Brief About What We Found

We found a Remote Code Execution vulnerability by logging in with an admin user. Navigated to Tools and Migration, and then Client Upload and Upload the JSP shell.

Navigateing the URL

Later on, we visited to the URL and observed the response with a list of all files. The remediation to this vulnerability is by implementing buffer overflow protection, Implementing WAF (Web Application Firewall), Monitoring your application, Input sanitization, and Access Control.

We Helped Them Mitigate the Following Risk

Remote code execution

Remote code Execution (RCE) is a cyber-attack that allows an attacker to remotely execute commands on a victim’s device. It often occurs via malicious malware downloads regardless of the device’s geographic location. The attacker scans for vulnerabilities, exploits them, gains access, and executes malicious code for various objectives, such as data theft, fund diversion, surveillance or service disruption.

Publications

Several websites published about this critical bug; the links are as follows:

https://cve.report/CVE-2023-34193.pdf

https://www.cvedetails.com/cve/CVE-2023-34193/

https://vulners.com/prion/PRION:CVE-2023-34193

Business Risks We Prevented

  • Initial Access
  • Information Disclosure
  • Information Theft
  • Crytomining
  • Ransomware
vulnerability

6 Red flags to look out for in vulnerability assessment

In the realm of cybersecurity, vulnerability assessment plays a pivotal role in fortifying digital defences. However, not all assessments are foolproof. In this blog, we’ll explore six critical red flags that if overlooked, can compromise the effectiveness of your vulnerability assessment. Whether you’re a cybersecurity professional or a vigilant individual, recognizing these warning signs is essential for staying ahead of potential threats in our interconnected digital landscape. Before we dive into the nuances of vulnerability assessment, let’s look at what the 6 red flags are. 

6 RED FLAGS!

While specific red flags in vulnerability assessments may vary based on the context and tools used, here are the six general warning signs to look out for: 

  1. Incomplete Coverage. 
  2. Outdated Software and tools. 
  3. False Positives/Negatives. 
  4. Lack of Involvement from a Third-Party Auditor. 
  5. Absence of threat Intelligence. 
  6. Inadequate Remediation Guidance. 

Let’s dive deep into what they are, why they matter, and how to respond to them. 

1. Incomplete Coverage:

  • Red Flag: The assessment does not comprehensively cover all aspects of your system, leaving potential vulnerabilities uncovered.  
  • Why it matters: Incomplete assessment may miss critical areas, providing a false sense of security.  
  • How to Respond: Have a right process in line for the assessment and expand the scope of your assessments to ensure comprehensive coverage. Regularly update and adapt assessment methodologies to encompass all critical areas.

2. Outdated Software and Tools:

  • Red Flag: The assessment tools or methodologies are outdated, lacking the capability to identify vulnerabilities in the latest software and systems.  
  • Why it matters: Cyber threats evolve rapidly, and using obsolete tools puts your organization at risk of overlooking current vulnerabilities.  
  • How to Respond: Invest in up-to-date cybersecurity tools and methodologies. Ensure that your team is trained on the latest technologies.  

3. False Positives/Negatives:

  • Red Flag: The assessment generates a significant number of false positives that identify a vulnerability that doesn’t exist or, worse, false negatives that fail to identify real vulnerabilities.  
  • Why it matters: False positives can lead to wasted resources addressing non-existent issues, while false negatives pose a severe risk by overlooking actual vulnerabilities.  
  • How to Respond: Fine-tune your assessment tools to reduce false positives and negatives. Regularly validate findings to confirm the accuracy of identified vulnerabilities.  

4. Lack of Involvement from a Third-Party Auditor:

  • Red Flag: The assessment is conducted solely by internal teams without the involvement of an external, third-party auditor.  
  • Why it matters: The internal team may unintentionally overlook blind spots or may be influenced by organizational dynamics. The absence of an external perspective can limit the thoroughness and objectivity of the assessment, potentially leading to undetected vulnerabilities.  
  • How to Respond: Consider engaging a third-party auditor with expertise in cybersecurity. Their external perspective can provide valuable insights, enhance objectivity, and ensure a more thorough evaluation of your security measures.  

5. Absence of Threat Intelligence:

  • Red Flag: The assessment doesn’t incorporate up-to-date threat intelligence, making it difficult to prioritize and address the most critical Vulnerabilities.  
  • Why it matters: Without understanding the current threat landscape, organizations may not allocate resources effectively to mitigate the most imminent risks. 
  • How to Respond: Integrate threat intelligence feeds into your assessment process. Stay informed about the latest cyber threats and adjust your security measures accordingly.  

6. Inadequate Remediation Guidance:

  • Red Flag: The assessment identifies vulnerabilities but lacks clear guidance on how to remediate or mitigate the risks.  
  • Why it matters: Without actionable steps for addressing vulnerabilities, organizations may struggle to implement effective solutions, leaving their systems exposed.  
  • How to Respond: Enhance your reporting process to include clear, actionable steps for remediation. Collaborate with relevant teams to ensure a coordinated response to identified vulnerabilities.  

The above red Flags serve as a guide to assess the effectiveness of your vulnerability assessment process. Regularly reviewing and refining your approach ensures a proactive and resilient cybersecurity posture.  

Final Thoughts

Safeguarding our digital spaces means actively looking out for vulnerabilities. Red flags, such as incomplete coverage or overlooking third-party audits, signal potential weaknesses that demand attention. Regular assessments, bringing in external expertise, and quick responses to issues are vital for robust defences. In a dynamic world of cyber threats, staying alert, acting swiftly, and continuously refining our cybersecurity strategies are essential to keep pace with evolving challenges.   

Andriod Application

Pentesting On An Android Application

Overview

Android Applications with no exception are prone to cyber threats and attacks. They are the most widely used applications worldwide and these cyber threats and attacks are a growing concern to both consumers and developers.  Malicious actors target these apps as a way to spread malware, steal personal information, and gain unauthorized access to users’ devices. From fake banking apps to social media scams, there is no shortage of ways hackers exploit Android app vulnerabilities. To combat this issue, developers must prioritize security measures during the app creation process by encrypting data, limiting third-party integrations, implementing strong authentication protocols, and conducting regular vulnerability assessments. We were asked to pen test an Android application by a client. In this case study, we’ll discuss the vulnerabilities found and ways used to detect them.

Scenario

We were asked to perform Android Penetration testing on their Android Application to detect possible vulnerabilities.

Major Android Application Risks

Major Android application risks that professionals need to be aware of include security vulnerabilities, data privacy concerns and malware infections.

  • Security vulnerabilities can allow attackers to exploit weaknesses within the application code or hardware to gain unauthorized access to sensitive information or system resources.
  • Data privacy concerns arise when an application accesses or collects user data without permission, or when it sends that data to third parties who may not be trustworthy.
  • Malware infections on Android devices can infiltrate applications, steal sensitive information, and take control of the device to carry out malicious actions without the user’s knowledge.

Professionals must carefully consider these potential risks when developing and deploying Android applications, implementing strong security measures like encryption, secure authentication protocols and frequent security testing throughout the development process.

It is also essential for professionals using Android applications in workplaces or on personal devices to remain vigilant about accessing insecure networks or downloading suspicious applications that could compromise their systems’ security and integrity.

What we found

We classified the risks we found into three categories I.e., Critical, High, Medium, and Low:

  • The Critical-level risks involve User credentials exposed in the web-socket response.
  • The High-level risks comprise Authorization Bypass Via IDOR- View sensitive information of other users and Application code is not obfuscated.
  • The Medium-level risks include Insecure local storage in shared preferences, Authorization Bypass via IDOR- View group Members of other groups, Unrestricted file upload, App log sensitive information, Session not expired, Insecure communication, and Insecure hash function (MD5 hash Used).
  • The Low-level risks contain Insecure Permissions and Unknown Permissions.

Brief about what we found

During our examination of the application, we discovered several Critical, High, Medium, and Low vulnerabilities.

Firstly, we found “Credentials exposed in WebSocket Response”. To find this vulnerability, we logged in with a valid username and sent a request to the URL to observe that the response had details like a hash password. 

When we logged in with a valid user such as User1, tapped on the “Profile Settings” feature and intercepted the request, it returned the hash password of User 1 on the response side. When the user ID of User1 was changed in the URL to another user ID known as User2, the name and password of User 2 were returned. That’s how we discovered the “Authorization Bypass Via IDOR- View Information of other user” vulnerability.

We’ve discovered that the application code was not obfuscated. This was uncovered by reversing the application, and we’ve discovered that the source code is in a readable and understandable form.

We spun the Android device, accessed the shell and navigated to the shared preference directory. When we opened a particular file, the file contained the “UserAuth” token. We’ve identified “Insecure Local Storage in Shared Preferences” through this.

We unmasked the “Authorization Bypass via IDOR- View Group Members of Other Group” vulnerability when we logged in as a valid user and tapped on to any existing group. When we tapped on a particular group to access group information, it came to light that the URL on the response side exposed the entire information of group members of the particular group. Later, we logged in with another User, clicked on another group, noted the ID of Channel 1 (channel id1) and logged out. We changed the value of the parameter from “channelid1” to “channelid2” and observed that the “channel name” and data are different on the response side.

We’ve also discovered “Unrestricted file upload”. Where the malicious user could upload an image. The attacker selected an image file and changed the extension of the file from “.jpeg” to “.exe”.  The attacker then sent a success message indicating that the file had been uploaded successfully and sent the URL to the victim. If the victim clicks on the URL, a file will be downloaded and their system might get compromised.

During the application assessment, we found that sensitive information could be logged. The “Authorization” token is not terminated after the logout feature.

We’ve also discovered that the app communicates with servers using “cleartext network traffic”, such as HTTP. And the traffic risks are being eavesdropped upon and tampered with by third parties. This can lead to information leakage and unauthorized content or exploits being injected into the app.

The hash function used in the application is old and insecure, allowing an attacker to conduct a hash collision attack without changing the hash. Additionally, the application uses the MD5 hashing algorithm for passwords.

Finally, we discovered that the app was insecure and gave unknown permissions.

We helped them mitigate the following risks

  1. User credentials exposed in the web-socket response:

Sensitive data is confidential information that must be kept safe and out of reach from all outsiders unless they have permission to access it. Access to sensitive data should be limited through sufficient data security and information security practices designed to prevent data leaks and data breaches.

Sensitive data is defined as any information that is protected against unwarranted disclosure. Protection of data may be required for legal or ethical reasons, for issues about personal privacy, or for proprietary considerations.

The risks of exposed user credentials are that threat actors can access additional hosts, install malware, steal data, and disable or modify security controls.

  1. Application Code is not obfuscated:

Unprotected Android apps increase the risk of exposing your businesses to IP theft, loss of revenue, or reputation damage. App providers must actively protect their apps against emerging threats with a strong layer of defence to safeguard critical code from attackers. Obfuscation is a series of code transformations that turn application code into a modified version that is hard to understand and reverse-engineer.

This way you ensure that your product’s intellectual property is protected against security threats, the discovery of app vulnerabilities and unauthorized access.

In the current scenario, the Android application was not obfuscated and hence revealed the source code of the application.

  1. Unrestricted File Upload:

Many web applications allow users to upload files that will either be stored or processed by the receiving web server.

It was possible to identify a form which allows files with arbitrary content and extension to be uploaded to the remote server and then stores the uploaded file to a guessable path in the server’s Webroot.

This could be used by a cyber-criminal to host content from the vulnerable server for phishing and Cross-Site Scripting attacks. In cases where the server is configured to execute scripts (PHP, Ruby, etc.) this vulnerability can be used to gain remote code execution on the server.

During the assessment of the application, it was discovered that any file can be uploaded while updating the “Display Picture”.

  1. App Log Sensitive Information:

The mobile platform provides capabilities for an app to output logging information and obtain log output. There are many legitimate reasons to create log files on a mobile device, such as keeping track of crashes, errors, and usage statistics.

Log files can be stored locally when the app is offline and sent to the endpoint once the app is online. However, logging sensitive data may expose the data to attackers or malicious applications, and it might also violate user confidentiality.

We discovered the application logs, firebase token, meeting ID, user credentials, and User-id AuthKey in the application.

  1. Unknown Permissions:

Unknown permissions should not be part of the application. The attacker may leverage this permission to manipulate the file system in the device.

During the assessment of the application, it was discovered that unknown permissions were given which might be vulnerable and may lead to accessing of the application by other applications.

Business Risks We Prevented

  • Data Breach
  • Malware
  • Spoofing
  • Unauthorized access to data
  • Decline in App Downloads
  • Financial Loss
  • Decline in Reputation
Network Penetration Testing

Importance Of Network Penetration Testing

 

Network Penetration testing became a crucial element in ensuring the security of networks and systems in today’s digitalized world. It became essential for businesses and organizations to keep cyber threats away from them by performing regular network penetration testing to identify and discover possible vulnerabilities in their system before they turn into an open gate to malicious actors that would help them exploit the vulnerabilities. In this blog, we will take a deep dive into the importance of network penetration testing, a few of the benefits it provides, and types of network penetration tests and we will also discuss the best practices you can implement to conduct an effective test. Without further ado, let’s get into it.

WHAT IS NETWORK PENETRATION TESTING?

1

Network penetration testing is a method used to test the security of a computer system, network or web application. It involves simulating a real-world cyber-attack to identify vulnerabilities and exploit them in a controlled environment. The primary purpose of network penetration testing is to evaluate the effectiveness of an organization’s security controls and identify areas where improvements can be made.

WHY CONDUCT NETWORK PENETRATION TESTS?

2

According to IBM 2022 Cost of a Data Breach Report, “83% of organizations have had more than one breach”. This signifies the importance of Network Penetration testing. Network Penetration testing is essential for organizations to strengthen their security posture by identifying and addressing vulnerabilities before they can be exploited by attackers. By conducting regular network penetration testing, organizations can reduce the risk of data breaches, avoid financial losses, maintain compliance with industry regulations, and protect their reputation.

WHAT ARE THE BENEFITS OF NETWORK PENETRATION TESTING?

3

A lot of benefits are associated with network penetration testing. The most notable benefits are as follows:

1. Helps in identifying potential security threats

Network penetration testing helps organizations identify and address vulnerabilities by simulating real-world cyberattacks. One of the perks of conducting a network penetration test Is it will allow a security professional to identify the vulnerabilities, and weaknesses in their network infrastructure and their application before the attacker can exploit them. Identifying the vulnerabilities help organisations to implement a plan or take necessary steps to prevent future attacks.

2. Helps in Preventing Data Breaches and Losses

The average cost of a data breach is $ 4.35 million. The cost of recovery from data breaches is expensive. Network penetration test helps to prevent data breaches and the cost associated with them. The impact of a data breach on an organization is very daunting as it leads to financial losses, legal repercussions, and reputational damage. By conducting a test, organizations can prevent data breaches and protect sensitive data.

3. Helps in Compliance with Industry Standards and Regulations

Many industries and organizations are subject to standards and regulations that require regular network penetration testing to maintain compliance. Conducting these tests will let organizations ensure that they’re meeting regulatory requirements and avoid potential fines and legal repercussions.

LET’S UNDERSTAND DIFFERENT TYPES OF NETWORK PENETRATION TESTING

4

The types of Network penetration testing are White Box testing, Black Box Testing, and Grey Box Testing.

1. White Box Testing

White Box Testing is a method of testing where the tester has complete knowledge of the system being tested. This type of testing is typically used by internal security teams who have full access to the network infrastructure and applications being tested. White box testing allows testers to identify vulnerabilities that may not be visible to external attackers.

2. Black Box Testing

Black box testing is a method of testing where the tester has no prior knowledge of the system being tested. This type of testing is typically used by external security teams, such as third-party vendors, to test the security of a network or application. Black box testing simulates a real-world attack, where the attacker has no prior knowledge of the target system.

3. Grey Box Testing

Grey box testing is a method of testing that lies somewhere between white box testing and black box testing. In grey box testing, the tester has some knowledge of the system being tested but does not have complete access to it. This type of testing is often used to simulate an attack by a trusted insider who has limited access to the network or application. 

HERE ARE THE BEST PRACTICES YOU CAN IMPLEMENT TO CONDUCT AN EFFICIENT NETWORK PENETRATION TEST

5
1. Define Objectives

The first step is to define the objectives of the network penetration testing. You should identify what you want to achieve from the testing process, such as identifying vulnerabilities or testing the effectiveness of your security controls.

2. Identify Scope

It’s crucial to identify the scope of the testing, including the systems and networks that will be tested, and any other relevant details. This helps to ensure that the testing process is focused, efficient and effective in achieving the objectives.

3. Develop a Budget Plan

Developing a budget plan is crucial to ensure the success of your cybersecurity efforts. The price of the test completely depends on what kind of test you’re conducting (White box, black box, and grey box testing), the value of your assets, and if you’re going for In-house testing or an external service provider.

4. Choose a right Network Penetration Testing Provider

Choosing the right penetration testing provider depends on what objectives you’ve set. For example, if you’re looking for a Network security assessment, then look no further. Choosing the right network penetration testing provider is a crucial decision for any organization to secure its digital assets and it can be a challenging task. Here are some of the criteria you can consider when evaluating potential providers:

  • Evaluating Credentials and Experience.
  • Assessing Methodologies and tools used.
  • Review customer feedback and References.
5. Prioritize the outcome

It is very crucial to prioritize the outcome of your test. It would help you understand your network posture. Documenting results will help you in understanding the vulnerabilities and recommendations given for securing your systems and networks. It is also important to implement the recommendations made by the penetration testing team to ensure that your systems and networks are secure.

CONCLUSION

It takes 30 minutes to 10 days for a hacker to breach a network Perimeter. 63% of companies’ internal networks can be accessed in no more than two steps. The statics are terrifying and calls for a need to perform a network penetration test. Network penetration testing is done to strengthen the in-place network security. It helps organisations to understand their network better. By Conducting this test, the companies can establish strong security measures and reduce the risk of falling prey to data breaches, financial losses, and reputational damage.

Ransomware

How Has Ransomware Evolved Over Time?

Overall, there is 53% increase in Ransomware incidents reported in 2022 Year over Year.

               -CERTIN(India Ransomware reports)

Ransomware has become one of the most significant cybersecurity threats facing individuals, businesses, and organizations around the world. It is a type of malware that encrypts data and demands payment in exchange for a decryption key. While ransomware attacks have been around for decades, they have evolved significantly over time, becoming more sophisticated and prevalent. In this article, we will explore the history and evolution of ransomware, from its humble beginnings to the modern era, and examine the impact it has on individuals and organizations. We will also discuss strategies for preventing and responding to ransomware attacks and look at what the future may hold for this dangerous threat.

Introduction To Ransomware

Ransomware has become a popular tool for cybercriminals seeking financial gain, as victims often feel compelled to pay a ransom in order to regain access to their data.

2 (1)

What is Ransomware?

Ransomware is a type of malware that takes control of a victim’s computer system and demands payment in exchange for releasing the data. It can be delivered through malicious email attachments, infected software downloads, or compromised websites. There are two main types of Ransomware: locker ransomware, which locks the user out of their system or certain files; and crypto-ransomware, which encrypts the victim’s files.

How Ransomware Works

Once the ransomware has infected the victim’s system, it will typically display a message demanding payment in exchange for restoring access to the encrypted files. This message will often include a countdown timer, adding a sense of urgency to the situation. Payment is typically demanded in Bitcoin or other cryptocurrencies, making it difficult to trace the identity of the cybercriminals.

Early Forms of Ransomware

3

The First Recorded Ransomware Attack

Message Displayed After Activation of AIDS (Source: Wikipedia)

The first recorded instance of ransomware was the “AIDS Trojan” in 1989, which was distributed via floppy disks and targeted AIDS researchers. The malicious code targeted filenames instead of the contents of the files as we know today causing major disruptions and downtime. This proves that even simple encryption can have disastrous consequences.

Example of Early Ransomware

Other early forms of ransomware examples included the “Gpcode” ransomware in 2004, which used weak RSA encryption that was subsequently cracked by security researchers. And “Archiveus” trojan encrypted the entire files in the “My Documents” folder.

Both of these early examples utilized simple encryption methods and were relatively easy to decrypt without paying a ransom. However, they laid the groundwork for more sophisticated attacks that we see today. The evolution of ransomware has made it increasingly complex, using advanced encryption algorithms and bypassing traditional security measures to extort money from victims by exploiting their data as leverage to achieve financial gain.

Evolution Of Ransomware Tactics

2005-2009: Early Ransomware Tactics

4

Early ransomware attacks were relatively simple, displaying a message that would prevent the user from accessing their system until a ransom was paid. These attacks were often easy to circumvent, and victims could restore their systems by removing the infected files or using anti-malware software.

2009-2016: Encryption-based Ransomware Tactics

5

Encryption-based ransomware is the most common type of ransomware seen today. It uses advanced encryption algorithms to lock files on a system, making them inaccessible to the user. This type of ransomware has become increasingly sophisticated, with some variants even encrypting the filenames themselves. In recent times, Ransomware builders are focusing on speed and performance. Instead of encrypting the whole file, a portion of a file is being targeted for encryption to save time. Multithreading is getting leveraged for faster encryption. A few notable attacks include “Vundo”, and “WinLock”.

2016-2018: Ransomware-as-a-Service (RaaS)

6

Ransomware-as-a-Service (RaaS) is a model in which cybercriminals create and distribute ransomware to other criminals, who then use it to target victims. The original creators of the ransomware typically take a percentage of the profits earned by the secondary criminals. The emergence of RaaS has made it easier than ever for cybercriminals to launch ransomware attacks, leading to a proliferation of providers offering these services on the dark web. Some of the most notorious RaaS providers include “Hive” and “Darkside”. As ransomware continues to evolve, it remains a potent threat to individuals and businesses alike.

2019-2022: Double Extortion

8

Double extortion is a tactic some ransomware groups use to increase the pressure on their victims to pay the ransom. In addition to encrypting files, they also exfiltrate sensitive data and threaten to publish it unless the ransom is paid. This tactic has become increasingly popular in recent years, with several high-profile attacks leveraging this technique.

Today’s Ransomware Landscape:

9 (1)

Common Ransomware Delivery Methods

In today’s landscape, common ransomware delivery methods include phishing emails, malvertising, and exploit kits. Phishing emails trick victims into clicking on a malicious link or attachment to an email, while malvertising involves planting malicious code in online advertisements. Exploit kits take advantage of software vulnerabilities to infect the victim’s device without their knowledge.

Ransomware Targeted Industries and Sectors

Ransomware is now a global problem affecting individuals, businesses, and even government entities. Any organization that relies on computers to carry out its operations is at risk of a ransomware attack. However, some sectors, such as healthcare, finance, and education, are particularly vulnerable due to the sensitive nature of their data.

Impact of Ransomware on Business and Individuals

The impact of ransomware can be devastating for both businesses and individuals alike.

The Financial Cost of Ransomware

12

A report Published by IBM states that “The average cost of a ransomware attack, not including the cost of the ransom is $4.54 million“. However, The financial cost of ransomware extends beyond the ransom payment. It can include lost revenue due to system downtime, data recovery costs, legal fees, and damage to the organization’s reputation. In some cases, victims may choose to pay the ransom to avoid these costs altogether.

Psychological Effects of Ransomware

14

Ransomware can also have psychological effects on victims. The fear and uncertainty caused by the attack can lead to stress, anxiety, and even depression. Individuals feel violated, and businesses experience a loss of trust from their customers and employees.

Strategies for Preventing and Responding to Ransomware Attacks

Business Plan-bro (1)

Prevention and response are the keys to minimizing the impact of ransomware attacks.

Preventing Ransomware Attacks

Preventing ransomware attacks involves implementing security best practices such as penetration testing, regularly backing up data, keeping software up-to-date, using antivirus software, and training employees to identify and avoid phishing emails.

Responding to a Ransomware Attack

If a ransomware attack does occur, the organization should first isolate the infected devices, shut down the network if necessary, and contact law enforcement. They should also assess their backup data and determine if paying the ransom is the best course of action.

Future Of Ransomware: Predictions and Trends

16

As technology continues to evolve, so too does ransomware. Understanding future trends and potential threats is essential for organizations to stay ahead of the curve.

The Increasing Sophistication of Ransomware

Ransomware is becoming more sophisticated, with some variants now capable of evading detection and spreading laterally across networks. This makes it challenging for organizations to detect, prevent, and respond to ransomware attacks.

New and Emerging Ransomware Threats

Emerging ransomware threats include targeting industrial control systems (ICS), as well as the use of artificial intelligence (AI) and machine learning (ML) to enhance ransomware capabilities. As such threats continue to emerge, organizations must remain vigilant and proactive in protecting their critical data and assets.

Conclusion

Ransomware has undergone significant changes throughout its history, from early forms that were relatively simple to today’s sophisticated attacks. While the threat of ransomware is likely to continue to evolve and persist, there are steps that individuals and organizations can take to reduce the risk of falling victim to an attack. By staying vigilant, implementing best practices for cybersecurity, and preparing for the worst-case scenario, it is possible to mitigate the impact of ransomware and other types of malware.

PENTESTING FOR A FINTECH COMPANY

Pentesting For A FinTech Company

Overview

There’s no denying the fact that cyber threats pose a significant risk to the financial industry. With the increasing use of digital platforms and advanced technologies, cybercriminals have found new ways to exploit vulnerabilities in established systems, leading to data breaches and network intrusions. Threat actors may attempt to infiltrate an LEI company’s networks to steal sensitive information, disrupt operations for personal gain, or simply for malicious intent. We were asked to pentest a client’s website and found vulnerabilities. In this case study, we will discuss the vulnerabilities detected and the approaches used to identify them.

Scenario

We were asked to perform web penetration testing on their .NET web application to detect possible vulnerabilities.

Major LEI-service-based website risks

  • Major risks associated with LEI-service-based web applications include data breaches, cyber-attacks, and system failures.
  • These risks can arise due to different factors such as inadequate security measures, vulnerability in the application code or third-party software, and lack of resources for maintaining the platform.
  • Hackers can exploit these vulnerabilities to access sensitive information related to the organization’s finances, customer data, or other critical assets.
  • Furthermore, system failures can lead to operational disruptions that can cause significant financial losses or compliance violations.

To mitigate these risks, it is crucial to implement robust security controls such as regular vulnerability assessments, continuous monitoring of network activity, multi-factor authentication protocols for accessing sensitive information and secure program coding practices.

Additionally, businesses should have comprehensive disaster recovery plans and monitor the availability of the systems with failover mechanisms in place.

What we found

We classified the risks we found into three categories I.e., Critical, High, Medium, and Low:

  • The Critical-level risks involve Blind SQL injection.
  • The High-level risks comprise Price Manipulation, Firebase Misconfiguration.
  • The Medium-level risks include Weak Password Policy, Denial of Service, User Registration Via Automation, Server Version Disclosure Vulnerability, and No Email Verification During the Registration Process.
  • The Low-level risks contain Username Enumeration, Outdated JavaScript Library, Allowed HTTP methods (OPTIONS Method), and Missing ‘X-Frame-Options’ header.

Brief about what we found

During our investigation, we uncovered several critical vulnerabilities in the application. Firstly, we discovered Blind SQL injection. To test for SQL injection, we intercepted the Upload Reference Documents request and inserted a quote (‘) at the end of the file name. However, this resulted in an error. To confirm the vulnerability, we injected a time-based SQL injection payload that caused the application to sleep for a specific time as defined in the payload. Since the SQL injection was Blind, we created a script tailored to the company to exploit the vulnerability. We then developed an exploit to automate the data exfiltration process, which allowed us to fetch the database name.

In the payment processing section of the web application, we intercepted the “Pay now” request and were able to manipulate the price. After conducting initial reconnaissance, we discovered that the API keys were exposed in the URL. By researching the Google APIs, we found that we could gain complete access to the database, allowing us to READ, WRITE, UPDATE, and DELETE every element. We created a new collection called “Hacked” and retrieved its contents. Additionally, we discovered that weak passwords could be used to register into the portal, which we successfully exploited.

We flooded the admin’s mailbox with redundant emails by automating the Send Email Functionality request. By intercepting the Sign-up request to register in the portal, we repeated the request with multiple sets of payloads containing unique email addresses, allowing us to register multiple users into the application. We also discovered that the server’s version was disclosed in the application response. Upon registering into the application, the user was automatically directed to the dashboard without receiving any email verification links.

We discovered that the attacker can easily enumerate users by exploiting error messages generated by the application. Additionally, we found that the application is utilizing an outdated JavaScript library that is known to have vulnerabilities such as command injection and denial of service attacks.

Furthermore, we identified that the application’s “OPTIONS” method is enabled, and the x-frame options are missing from the application response. This oversight could potentially allow an attacker to gain unauthorized access to sensitive information.

Moreover, the application’s verbose error messages provide attackers with valuable insights into the application’s backend, making it easier for them to construct malicious payloads to exploit the application.

It is imperative that these vulnerabilities are addressed immediately to prevent any potential attacks. We recommended that the application’s JavaScript library is updated, and the x-frame OPTIONS are implemented to enhance the application’s security. Additionally, the application’s error messages should be reviewed and modified to prevent attackers from gaining access to sensitive information.

Overall, our team identified and exploited several vulnerabilities in the web application, highlighting the importance of thorough security testing and implementation.

We helped them to mitigate the following risks.

1. Blind SQL Injection:

Blind SQL injection is an attack technique commonly used by hackers to exploit web applications. It involves injecting malicious code into a vulnerable web application to bypass the security controls and gain unauthorized access to sensitive data or resources.

Blind SQL injection is considered more challenging than classic SQL injection because it generates no visible error messages or responses from the targeted application. Attackers use various techniques, including conditional statements and time delays, to extract data from the database without triggering any alarms.

The consequences of a successful blind SQL injection are severe as it can result in the loss of proprietary information, financial losses, and reputational damage for affected organizations.

The injection was detected as it was possible to inject specific SQL queries, which, if vulnerable, result in different responses for each injection. This is known as a blind SQL injection vulnerability.

To prevent blind SQL injection attacks, developers must implement adequate security measures such as input validation and sanitization, error handling mechanisms, and secure coding practices.

2. Price Manipulation:

Price manipulation attacks are most common on custom shopping cart platforms or smaller shopping cart platforms. Larger and more popular off-the-shelf programs don’t have this vulnerability. However, because the vulnerability isn’t on the server level and is relatively unknown outside of eCommerce, many programmers just don’t know to look out for it.

Shopping carts will often pass on price data in HTTP headers or through cookies. For example, the header might say something like “price=59&ordered=555319&custname=jamesbenyon”. The first variable being passed along is price.

In the application, we were able to still change the price and renew the subscription.

3. Firebase Misconfiguration:

Firebase Misconfiguration is a Vulnerability that can provide direct access to the application via Google APIs. This does not require any type of sign-up functionality to let users register in the application but it is possible to generate a new user and login into the application to access its internal functionality. Firebase applications cannot prevent new users to sign-up unless the application owner disables the whole authentication service.

In the existing scenario, we were able to take over the entire database where we were able to READ, WRITE, UPDATE, and DELETE anything and everything. The fun Fact is, this was possible without having prior credentials or any dummy logins to carry out this attack.

4. Denial of Service:

Denial of Service Vulnerability allows an attacker to send a large number of requests when the APIs don’t have the rate limiting implemented thereby slowing down the server.

Using this vulnerability, the attacker can consume the organization’s and users’ limited resources, which may lead to a denial-of-service scenario. This can also lead to monetary loss.

In the application, due to the absence of the rate-limiting, the attacker can flood the admin’s mailbox with redundant mail using the “Contact us” functionality. 

5. Missing ‘X-Frame-Options’ header:

The “Missing ‘X-Frame-Options’ header” vulnerability is an issue that arises when a website does not include the X-Frame-Options header in its HTTP response. This header informs the web browser whether or not it should display the website within an iframe.

Business Risk we prevented

  • Data breach.
  • Price Manipulation.
  • Unauthorized alteration of data.
  • Weak Data security.
  • Exposure of sensitive user information.
  • Lack of trust.
  • Financial loss.
  • Decline in Reputation.
Magento case-study thumbnail

Pentesting On A Magento-Based e-Commerce Application

Overview

Penetration testing is a crucial security measure for all e-commerce websites, particularly those developed on the Magento platform. In this case study, we will delve into the process of conducting a pen test on a Magento-based e-commerce website to detect and resolve any potential vulnerabilities. We will discuss the various tools and techniques used during the testing process, as well as the outcomes of the test, and highlight the business risks that we were able to mitigate.

Scenario

To ascertain whether their web application harboured any security flaws or vulnerabilities, we were tasked with conducting a web application penetration test on their Magento-based web application.

Major Magento-based e-commerce website risk

Major e-commerce websites based on Magento are exposed to numerous risks associated with potential cyber-attacks. One of the primary issues is that many Magento sites can be unpatched and susceptible to vulnerabilities, resulting in hackers taking control of systems and stealing customer data. Additionally, weak administrator passwords or easy-to-guess ones give malicious actors an entry point; thus, businesses should ensure that strong passphrases are used. Another major risk is poor website performance due to extensive traffic or malicious bot activity, as this can easily affect the user experience, result in lost sales, and tarnish a company’s reputation with customers. To mitigate these risks, it is paramount for companies utilizing Magento to ensure their systems are secure and properly maintained. Furthermore, best practices should be implemented such as two-factor authentication which strengthens security against threats while also providing IT professionals with the agency they need in safeguarding customer data.

Attack Narrative

Gathering information was the first step in the process. Both passive and active methods were employed to collect data. Afterwards, a comprehensive understanding of the directory structure and mapping of the application was acquired. Additionally, related external sites were identified, HTTP headers were inspected, and information was collected through errors and error pages. The source code was also examined and the documentation was reviewed during this phase. With the information gathered, analysis of the application and its dependencies began, exploring any application vulnerabilities and verifying the security controls in place. Once all the information was gathered and mapped, test cases were prepared according to the flow of the target application. Tools such as Burp Suite Professional, DirSearch, and Nikto were used to identify and exploit vulnerabilities. The suggested test cases were implemented and the report was created.

What we found

We classified the risks we found into three categories I.e., High, Medium, and Low:

  • The High-level risks comprise Insecure Direct Object References (IDOR) on Abandoned Carts, Insecure Direct Object References (IDOR) on Product Catalogue Delete, and Privilege Escalation Vulnerability in Email Log Delete.
  • The Medium-level risks include Privilege Escalation Vulnerability in Product Transfer Catalogue, Privilege Escalation Vulnerability in Manage Order, Privilege Escalation Vulnerability on Abandoned Carts Log Download, Privilege Escalation Vulnerability using Abandoned Cart, and Privilege Escalation Vulnerability on Staff and Admin Configuration.
  • The Low-level risks contain HTTP Strict Transport Header Missing.

Brief about what we found

First, we logged in as both administrators and customer viewers in their respective browsers. We discovered an abandoned cart module when going to the “Sales” tab on the administrator side, which cannot be found on the customer viewer side. When clicking on the “View” option in the “Action” section of the table, all the details regarding the abandoned carts are displayed. We then copied the URL and pasted it on the customer viewer side, finding that the customer user could access the details without permission (Insecure Direct Object References (IDOR) on Abandoned Carts). We also discovered that the customer could delete a product from the catalogue (IDOR on Product Catalogue Delete) by conducting a similar process.

We helped them to mitigate the following risks.

Insecure Direct Object References (IDOR) on Abandoned Carts:

The OWASP guide gives the following description for Insecure Direct Object Reference:

Applications frequently use the actual name or key of an object when generating web pages. Applications do not always verify the user is authorized for the target object. This results in an insecure direct object reference flaw. Testers can easily manipulate parameter values to detect such flaws and code analysis quickly shows whether authorization is properly verified.

Privilege Escalation Vulnerability in Email Log Delete:

Privilege escalation vulnerabilities allow attackers to impersonate other users, or gain permissions they should not have. These vulnerabilities occur when code makes access decisions on the back of untrusted inputs.

HTTP Strict Transport Header Missing:

HTTP Strict Transport Security (also named HSTS) is an opt-in security enhancement that is specified by a web application through the use of a special response header. Once a supported browser receives this header that browser will prevent any communications from being sent over HTTP to the specified domain and will instead send all communications over HTTPS. It also prevents HTTPS click-through prompts on browsers.


Business Risk we prevented

  • Data Exposure.
  • Unauthorized alteration of data.
  • Price Manipulation.
  • A decline in customer acquisition and retention.
  • Loss of reputation.
  • Financial loss.