Daily digest for Security Boulevard, on October 31, 2023

Gabi Stapel posted: "In the dimly lit corners of the internet, where shadows flicker and eerie silences prevail, there lurks entities of malevolent intent. They are not the stuff of old wives' tales or campfire ghost stories. We're talking about bad bots, the digital bo" Security Boulevard Why Bad Bots Are the Digital Demons of the Internet Gabi Stapel Oct 31 In the dimly lit corners of the internet, where shadows flicker and eerie silences prevail, there lurks entities of malevolent intent. They are not the stuff of old wives' tales or campfire ghost stories. We're talking about bad bots, the digital bogeymen of the digital age. These nefarious beings are lines of code that wreak […] The post Why Bad Bots Are the Digital Demons of the Internet appeared first on Blog. Read more of this post Comment Manage your email settings or unsubscribe. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/10/why-bad-bots-are-the-digital-demons-of-the-internet/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Vaidotas Sedys posted: "Interconnected digital technology advances at a rapid pace, and so do the tactics and strategies employed by malicious individuals, criminal groups and even nation-states. The World Economic Forum predicts global cybercrime will reach $10.5 trillion by 20" Security Boulevard Microsoft Data Leaks and the Importance of Open Source Intelligence Vaidotas Sedys Oct 31 Open source intelligence (OSINT) helps organizations find both unintentional data leaks and criminal data breaches. Read more of this post Manage your email settings or unsubscribe. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/10/microsoft-data-leaks-and-the-importance-of-open-source-intelligence/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Riley-Ann Parker posted: "The combined solution empowers security teams to identify behavioral anomalies, internal and external threats, and to prioritize responses with accurate security intelligence  BROOMFIELD, Colo., October 31, 2023–LogRhythm, the company helping securi" Security Boulevard LogRhythm Partners with D3 Security to Automate Threat Management and Incident Response Capabilities in Cloud-Native LogRhythm Axon SIEM Riley-Ann Parker Oct 31 The combined solution empowers security teams to identify behavioral anomalies, internal and external threats, and to prioritize responses with accurate security intelligence  BROOMFIELD, Colo., October 31, 2023–LogRhythm, the company helping security teams stop breaches by turning disconnected data and signals… The post LogRhythm Partners with D3 Security to Automate Threat Management and Incident Response Capabilities in Cloud-Native LogRhythm Axon SIEM appeared first on LogRhythm. Read more of this post Comment Manage your email settings or unsubscribe. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/10/logrhythm-partners-with-d3-security-to-automate-threat-management-and-incident-response-capabilities-in-cloud-native-logrhythm-axon-siem/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Adar Givoni, Director of Compliance, Scytale posted: " Many businesses prioritize compliance automation when formulating their strategic plans, and it's crucial to understand why. This strategy leverages technology to simplify the compliance processes, encompassing security and data requirements need" Security Boulevard Security Compliance for SaaS: Cutting Costs and Boosting Sales with Automation Adar Givoni, Director of Compliance, Scytale Oct 31 Managing compliance manually can be a burdensome and never-ending task. However, there is a simpler solution: Automated Security Compliance. The post Security Compliance for SaaS: Cutting Costs and Boosting Sales with Automation appeared first on Scytale. Read more of this post Comment Manage your email settings or unsubscribe. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/10/security-compliance-for-saas-cutting-costs-and-boosting-sales-with-automation/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Avast Blog posted: " If you asked this question a few years ago, many might have assumed that older generations would be the primary targets of online scams. It makes sense. Most of us view phishing and email scams as clumsy, low-effort routines designed to take adva" Security Boulevard Who's most at risk for scams, hacks, and identity theft? (It's not who you think) Avast Blog Oct 31 If you asked this question a few years ago, many might have assumed that older generations would be the primary targets of online scams. It makes sense. Most of us view phishing and email scams as clumsy, low-effort routines designed to take advantage of people who simply aren't as digitally savvy as the younger generation.   Read more of this post Comment Manage your email settings or unsubscribe. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/10/whos-most-at-risk-for-scams-hacks-and-identity-theft-its-not-who-you-think/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Shikha Dhingra posted: " Virtual programs are now an essential component of our daily lives. Web applications are now essential tools for both individuals and organizations. From online shopping to social media and banking, we depend on internet apps for convenience and accessib" Security Boulevard What makes Web Applications Vulnerable? Shikha Dhingra Oct 31 Virtual programs are now an essential component of our daily lives. Web applications are now essential tools for both individuals and organizations. From online shopping to social media and banking, we depend on internet apps for convenience and accessibility. However, the very capabilities that make internet packages so critical additionally make them at risk of […] The post What makes Web Applications Vulnerable? appeared first on Kratikal Blogs. Read more of this post Comment Manage your email settings or unsubscribe. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/10/what-makes-web-applications-vulnerable/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Victor Cheung posted: " " Security Boulevard Are Corporate VPNs Secure? Victor Cheung Oct 31 Corporate VPNs are designed to provide a secure and encrypted connection for remote users to access a company's internal network or resources over the internet. Although corporate VPNs have been around for decades, deploying corporate VPNs is still a common practice even till today. That's because it is still considered a secure way access to a company's internet network and resources. But in 2024, are corporate VPNs still secure? The answer is NO. That's because VPNs do not offer network security, cannot protect against social engineering attacks, lacks access authentication, and allows lateral movement once hackers gain entry, among other vulnerabilities listed here. In this article, you'll learn why corporate VPNs are not secure anymore and what the better option is when you want to secure corporate resources and remote access.  TABLE OF CONTENTS 7 Reasons Why Corporate VPNs are NOT Secure How to Secure Corporate Network and Remote Access Conclusion 7 Reasons Why Corporate VPNs are NOT Secure 1. Vulnerable to Social Engineering Attacks Just like in many aspects of cybersecurity, people are the weakest link when it comes to VPN security. VPNs primarily rely on things like unique usernames and single passwords for user authentication, and this authentication method is extremely vulnerable to social engineering attacks. In particular, users can fall victim to deceptive tactics, like phishing attempts delivered via company email, fraudulent websites that impersonate legitimate ones while requesting login details, malicious email attachments, or an attacker impersonating as an employee of the company, just like what happened in MGM's ransomware attack. 2. Lateral Movement Across the Network A corporate VPN is designed for use of all employees and third-party vendors. When they need to access company resources, their devices connect to a single IP address and VPN server. This setup ensures that the server is exclusively accessible to authorized business users. While this configuration is generally considered secure for business purposes, it also introduces potential vulnerabilities. Business VPNs provide users with comprehensive access to all the data within the network. Oftentimes, that includes vendors, where they have an all-or-nothing access. They either have unrestricted access to the network (typically at the outset of a project) or no access at all (when access is revoked after the project concludes). This, in turn, heightens the risk of sensitive information being unintentionally exposed to those who don't have authorized access to resources. Worse, if an attacker gains access to the network (via social engineering or other methods), the attacker can move laterally across the network to download, access, or encrypt all the resources he can find. 3. Not Tracking Network Activities A business VPN is designed for secure access to network, which is why they do not have the ability to track network activities or network security features. That means corporate VPNs offer limited or minimal detailed audit logs, which means you cannot effectively track and document the activities of each third-party vendor utilizing the VPN, thereby creating security, data leak, and compliance issues. Typically, corporate VPNs can log and record connection times and sometimes resources accessed, but that's the extent of it. The logs are usually stored in a separate file or folder and is not being monitored in real-time. Because of these limitations, detecting and responding to security incidents will be extremely challenging. 4. Does Not Protect Against Network Scans When a cyber-criminal successfully gains access to a network, the first thing he usually does is to scan the network so he can locate all resources connected to the network. VPNs are designed to secure communications, not network security, which is why VPNs are unable to stop and detect unauthorized port scanning or access attempts. 5. Vulnerable to Remote Code Execution (RCE) In recent years, it is known that cyber-criminals have the capability to remotely run code on both VPN clients and server software, thereby gaining control of systems holding sensitive corporate data. This kind of security flaw is categorized as Remote Code Execution (RCE) and enables malicious actors to access and manipulate a device, regardless of its physical location. In August 2021, the U.S. National Institute for Standards and Technology (NIST) issued a warning to the cybersecurity community that specific business VPN routers had been found to possess vulnerabilities that could allow attackers to execute code remotely, perform root-level commands, and trigger denial of service. Once in they can change configuration settings using RCE, they can move laterally across the network and connect deeper into their IT infrastructure. Here are the 6 known RCE vulnerabilities in enterprise VPN. 6. Does Not Protect Against the Negligent IT Professionals Again, people are the weakest link when it comes to VPN security. IT professionals usually have a heightened sense of security are less likely to fall victim against social engineering attacks than the general employee. However, most IT professionals have multiple responsibilities and are over-worked, which leads the following unintentional negligence that compromises the corporate VPN security: unpatched VPN software, not changing default credentials, and weak authentication setup. All of these are vulnerabilities that an attacker can exploit and gain unauthorized access to a corporate network and its resources. 7. Does Not Protect Against "Trusted" Access When thinking of security, most of us naturally think about protecting against outsiders. However, insider threats sometimes pose a more significant threat than external threats. Employees or contractors with legitimate access to the corporate VPN can misuse their privileges intentionally or unintentionally, posing a threat to the network's security. This is a result from VPNs all-or-nothing access and its inability to track network activities. How to Secure Corporate Network and Remote Access Using Mamori.io At Mamori.io, we understand the vulnerabilities of corporate VPNs. That is why we have created our solution to fill the security gaps of corporate networks and remote access. Listed below is a glimpse of what we can do: 1. Prevent Lateral Movements Problem: When an attacker has access to the corporate network, the attacker can move laterally across the network to find vulnerabilities and escalate privileges so they can reach their ultimate target. Solution: Microsegmentation – Mamori.io enables you to microsegment a network into smaller, isolated and secure zones with unique security controls over each zone's access. Not only does this prevent an attacker's lateral movement by reducing the attack surface, it also helps enable more granular security controls, improve regulatory compliance, and improve network performance.   2. Block Unauthorized Network Scans Problem: After gaining access to a corporate network, the first thing a cyber-criminal does is to scan the network to see what resources are connected to the network. Solution: Intrusion Detection - Any unsolicited attempts of a network scan will be detected and blocked. At the same time, the device making the unsolicited access will be locked, and the administrator and the device owner will be notified immediately of the unsolicited access. 3. 2FA on Every Resource Access Problem: Once someone has access to the network, he can begin downloading and interacting with all the resources on the network. Solution: 2FA on Every Resource Access: When we say 2FA everything, we mean it. Mamori.io can apply 2FA not only on network access, but also on access to specific resources, from those within an application to those in the database.  4. Identity and Role-based IP & Port Access Controls Problem: In corporate VPNs, users sometimes share passwords with co-workers for convenient access to resources. Not only is this a huge risk to security, these passwords are also typically easy to crack by cyber-criminals. Thus, employees might be sharing the same user password with an attacker without knowing. Solution: Identity & Role-Based IP & Port Access Controls – Mamori.io enables organizations to set access control policies based on a person's identity, role, IP address, and port. Not only will this eliminate the security risk of password sharing, it also creates multiple barriers to protect against cyber-criminals. Access Management – Mamori.io's access to resources is governed by least-privilege access policies, thereby blocking any unauthorized or unnecessary access to certain resources. 5. Protect Against Attacks from Within the "Trusted" Network Problem: An attacker can lay hidden within your network and download small amounts of data each day. The same can also be done by a disgruntled employee who is potentially going rogue. Solution: Access Management – Mamori.io's access to resources is governed by least-privilege access policies, thereby blocking any unauthorized or unnecessary access to certain resources. Intrusion Detection – Any unsolicited access to resource will be identified. At the same time, the device making the unsolicited access will be locked, and the administrator and the device owner will be notified immediately of the unsolicited access. Conclusion While VPNs have been used and are known for secure remote access, it is no longer safe anymore. They do not offer network security, cannot protect against social engineering attacks, lacks access authentication, and allows lateral movement once hackers gain entry. A better approach is to use Mamori.io. Not only can you secure your network using Zero Trust Network Access (ZTNA), intrusion detection, and microsegmentation, you can also apply 2FA to all access to your resources and apply more granular access controls. Mamori.io is an all-in-one solution that prevent ransomware by offering multiple layers of security – from the network, servers, all the way down to the database. The same system can also help organizations comply with privacy regulations, reduce cyber insurance premiums, and automate ISO 27001. For small businesses, Mamori.io has all the features to completely secure their data. For large businesses, Mamori.io covers security gaps, secures external vendor access, and provides access controls to the database. Schedule a demo with Mamori.io or request your free trial. If you're a small business with fewer than 20 users, you can use Mamori.io for free. Read more of this post Comment Manage your email settings or unsubscribe. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/10/are-corporate-vpns-secure/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Nicholas Tan posted: "Former Ivanti ANZ Vice President brings extensive cloud, technology, and regional sales expertise to help accelerate momentum for cybersecurity leader Sydney — 31 October 2023 – LogRhythm, the company helping security teams stop breaches by turning discon" Security Boulevard LogRhythm Names Matthew Lowe As ANZ Country Manager Nicholas Tan Oct 30 Former Ivanti ANZ Vice President brings extensive cloud, technology, and regional sales expertise to help accelerate momentum for cybersecurity leader Sydney — 31 October 2023 – LogRhythm, the company helping security teams stop breaches by turning disconnected data and signals… The post LogRhythm Names Matthew Lowe As ANZ Country Manager appeared first on LogRhythm. Read more of this post Comment Manage your email settings or unsubscribe. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/10/logrhythm-names-matthew-lowe-as-anz-country-manager/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

James Horseman posted: "Introduction This post is a follow up to https://www.horizon3.ai/cisco-ios-xe-cve-2023-20198-theory-crafting/. Previously, we explored the patch for CVE-2023-20273 and CVE-2023-20198 affecting Cisco IOS XE and identified some likely vectors an attacker mi" Security Boulevard Cisco IOS XE CVE-2023-20198: Deep Dive and POC James Horseman Oct 30 Introduction This post is a follow up to https://www.horizon3.ai/cisco-ios-xe-cve-2023-20198-theory-crafting/. Previously, we explored the patch for CVE-2023-20273 and CVE-2023-20198 affecting Cisco IOS XE and identified some likely vectors an attacker might […] The post Cisco IOS XE CVE-2023-20198: Deep Dive and POC appeared first on Horizon3.ai. Read more of this post Comment Manage your email settings or unsubscribe. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/10/cisco-ios-xe-cve-2023-20198-deep-dive-and-poc/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Kim Hill posted: "The post ReliaQuest Sponsors Youth Program to Teach Life Skills Through Golf appeared first on ReliaQuest. " Security Boulevard ReliaQuest Sponsors Youth Program to Teach Life Skills Through Golf Kim Hill Oct 30 The post ReliaQuest Sponsors Youth Program to Teach Life Skills Through Golf appeared first on ReliaQuest. Read more of this post Comment Manage your email settings or unsubscribe. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/?p=1993994

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Deepak Gupta - Tech Entrepreneur, Cybersecurity Author posted: "In today's digital landscape, where individuals interact with multiple systems and applications, managing user access has become increasingly complex. Federated Identity Management offers a solution to this challenge by simplifying the process of u" Security Boulevard Simplify User Access with Federated Identity Management Deepak Gupta - Tech Entrepreneur, Cybersecurity Author Oct 30 Discover the power of federated identity management for seamless SSO and enhanced user access. Improve security and streamline authentication Read more of this post Comment Manage your email settings or unsubscribe. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/10/simplify-user-access-with-federated-identity-management/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Ivan Novikov posted: "Diving into the Depths of Cloud Workload Defense Framework (CWDF) Mysteries Setting out to understand cloud security, one frequently encounters the term - Cloud Workload Defense Framework (CWDF). What exact role does CWDF play? Let's decode this riddle. " Security Boulevard What is a Cloud Workload Protection Platform ? (CWPP) Ivan Novikov Oct 30 Diving into the Depths of Cloud Workload Defense Framework (CWDF) Mysteries Setting out to understand cloud security, one frequently encounters the term - Cloud Workload Defense Framework (CWDF). What exact role does CWDF play? Let's decode this riddle. At its core, the Cloud Workload Defense Framework (CWDF) acts as a protective barrier, safeguarding cloud-oriented workloads [...] The post What is a Cloud Workload Protection Platform ? (CWPP) appeared first on Wallarm. Read more of this post Comment Manage your email settings or unsubscribe. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/10/what-is-a-cloud-workload-protection-platform-cwpp-2/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

bacohido posted: "Author Q&A: Here's why the good guys must continually test the limitations of 'EDR'By Byron V. AcohidoA new tier of overlapping, interoperable, highly automated security platforms must, over the next decade, replace the legacy, on-premise systems that" Security Boulevard Author Q&A: Here's why the good guys must continually test the limitations of 'EDR' bacohido Oct 30 A new tier of overlapping, interoperable, highly automated security platforms must, over the next decade, replace the legacy, on-premise systems that enterprises spent multiple kings' fortunes building up over the past 25 years. Related: How 'XDR' defeats silos Now along … (more…) Read more of this post Comment Manage your email settings or unsubscribe. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/10/author-qa-heres-why-the-good-guys-must-continually-test-the-limitations-of-edr/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Marc Handelman posted: "Many thanks to DEF CON 31 for publishing their terrific DefCon Conference 31 presenters content. Originating from the conference events at Caesars Forum, Flamingo, Harrah's and Linq in Las Vegas, Nevada; via the organizations YouTube channel. Permalink" Security Boulevard DEF CON 31 Policy – Panel: Demystifing Hacking For Government Officials Marc Handelman Oct 30 Many thanks to DEF CON 31 for publishing their terrific DefCon Conference 31 presenters content. Originating from the conference events at Caesars Forum, Flamingo, Harrah's and Linq in Las Vegas, Nevada; via the organizations YouTube channel. Permalink Read more of this post Comment Manage your email settings or unsubscribe. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/10/def-con-31-policy-panel-demystifing-hacking-for-government-officials/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Raj Patel posted: "In this post, we will talk about an interesting lateral movement technique called ActivateMicrosoftApp() method within the distributed component object model (DCOM) Excel application. This technique is built upon Matt Nelson's initial research on "Lateral" Security Boulevard Lateral Movement: Abuse the Power of DCOM Excel Application Raj Patel Oct 30 In this post, we will talk about an interesting lateral movement technique called ActivateMicrosoftApp() method within the distributed component object model (DCOM) Excel application. This technique is built upon Matt Nelson's initial research on "Lateral Movement using Excel.Application and DCOM". What is DCOM? DCOM is a Microsoft solution that allows software components to communicate remotely. Its predecessor, component object model (COM), lacked distributed computing functionality, so Microsoft introduced DCOM to serve the need of software components to communicate across the network. Basically, DCOM allows a client application to remotely instantiate a COM server object on another machine and utilize its methods. It operates on top of the remote procedure call (RPC) transport protocol based on TCP/IP for its network communications; specifically, it uses the ncacn_ip_tcp protocol sequence, where: ncacn stands for "Connection-Oriented Network Computing Architecture." ip_tcp specifies the use of TCP/IP. In practical terms, when you see this protocol sequence, it indicates that RPC is using TCP/IP for network communications in a connection-oriented manner. How does COM work? COM objects must be configured properly on both client and server. The Windows Registry stores the DCOM configuration data in three identifiers: CLSID — The class identifier (CLSID) is a global unique identifier (GUID) which represents a unique ID for any application components in Windows; an example of CLSID is "{00020812–0000–0000-C000–000000000046}" ProgID — The program identifier (ProgID) is an optional identifier registry entry which is linked to CLSID; unlike CLSID, ProgID is not a complex GUID format but a human readable format like "Excel.Application" APPID — The application identifier (AppID) identifies all the classes that are part of the same executable and the permissions required to access it; it will most likely throw an error if the correct AppID is not used The basic flow of communication is like this: Figure 01 — DCOM flow over the network To create an object on the remote computer, the client provides a request with the CLSID, PROGID or APPID The remote machine performs a validation to determine whether it has permission to create an object (i.e., requires administrator privileges) If the remote machine has the correct permissions, it will use DCOMLaunch.exe or DLLHOST.exe and start the instance After successful communication, the client will have access to all the functions and methods on the remote computer This was a quick overview of DCOM to learn more read here. DCOM Exploitation Using Excel's ActivateMicrosoftApp() Method Before we begin, there are some prerequisites for this attack: Requires local admin privilege on the target Requires Microsoft Excel installed on the target Ability to remotely write a file in the system PATH Tested on Windows 10 and 11 Tested on 64-bit installation of Office 365 While enumerating different methods of Excel objects, we discovered the ActivateMicrosoftApp() method could be used to get shell access because Microsoft still supports activation of some end of life (EOL) software such as FoxPro, Schedule Plus, and Office Project. It is unlikely that any of these legacy applications will be installed on modern environments, but we could abuse this vulnerability for lateral movement and persistence techniques. Figure 02 — Excel's DCOM methods According to Microsoft's documentation, the ActivateMicrosoftApp() method activates a Microsoft application. If this application is already running, this method activates the running application. If the application is not running, this method starts a new instance of the application as the launching user or the currently logged on user based on how DCOM was configured. The ActivateMicrosoftApp() method takes one parameter which specifies the Microsoft application to activate. Figure 03 — ActivateMicrosoftApp() method parameters When this method is invoked, it scans the system PATH to run the associated binary. For instance, if we provide the value "5," which corresponds to Microsoft's FoxPro application, the ActivateMicrosoftApp() method will seek the FOXPROW.exe binary within the system PATH. Figure 04 — Error thrown if executable not found However, if the application is not present on the system ActivateMicrosoftApp() will throw an error that it "Cannot run 'FOXPROW.exe'. The program or one of its components is damaged or missing." After some research, we utilized Process Monitor to further investigate underlying operations. Figure 05 — Attempt to find the FOXPROW.exe in system PATH The Excel.exe process attempted to locate the FOXPROW.exe binary file within the system PATH; however, since the application is not installed, it returned an error instead. In order to abuse this, we have to identify write permissions within the system PATH. The location where users most commonly have write permission to the PATH is: C:\users\*\AppData\Local\Microsoft\WindowsApps\ The FoxPro application is no longer supported since January 2010, and it is unlikely to exist on any modern environment. So, if we manage to upload a malicious binary with the name "FOXPROW.exe" and place it in the above folder, then our malicious binary will execute and provide us access to the target machine. copy c:\windows\system32\calc.exe '\\192.168.49.160\c$\users\user\AppData\local\Microsoft\WindowsApps\foxprow.exe' $com = [System.Activator]::CreateInstance([type]::GetTypeFromProgID("Excel.Application","192.168.49.160")) $com.ActivateMicrosoftApp("5") https://medium.com/media/c2e8f7969e37ae4365674528e4a9a8bb/href In certain situations, you may receive the below error due to the absence of Excel on the machine initiating the attack. The GetTypeFromProgIDmethod looks for an associated CLSID in the registry of the local computer and if it is not able to map the ProgID to CLSID, the following error will occur: Figure 06 — Error thrown if ProgID could not map to CLSID Alternatively, we could use CLSID instead of ProgID to identify the Excel COM class object. Please note that CLSID can differ between various versions of Excel. $com = [System.Activator]::CreateInstance([type]::GetTypeFromCLSID("00020812-0000-0000-C000-000000000046","192.168.49.160")) $com.application.ActivateMicrosoftApp("5") This technique is not limited to Microsoft FoxPro (FOXPROW.exe corresponds to xlMicrosoftFoxPro or 5) but other legacy applications such as Microsoft Schedule Plus (SCHDPLUS.exe corresponds to xlMicrosoftSchedulePlus or 7) and Project (WINPROJ.exe corresponds to xlMicrosoftProject or 6) could be abused as well. This technique is not limited to Microsoft FoxPro (FOXPROW.exe corresponds to xlMicrosoftFoxPro or 5), but other legacy applications such as Microsoft Schedule Plus (SCHDPLUS.exe corresponds to xlMicrosoftSchedulePlus or 7) and Project (WINPROJ.exe corresponds to xlMicrosoftProject or 6) can be abused as well. To automate this attack, check out SharpExShell. Persistence This technique could be used for persistence once we have established a foothold on a machine that has Microsoft Office installed. First, develop a PowerShell script that initializes an instance of the Excel.Application object via DCOM and invokes the ActivateMicrosoftApp() method on the localhost. Then, create a scheduled task configured to run at specific intervals, which will execute the PowerShell script we created. Ultimately, ensure that FOXPROW.exe is placed within the system PATH and wait for the scheduled task to execute. PS C:\Users\User\Desktop> cat .\ExcelPersistence.ps1 $com = [System.Activator]::CreateInstance([type]::GetTypeFromProgID("Excel.Application","localhost")) $com.ActivateMicrosoftApp("5") PS C:\Users\User\Desktop> copy C:\windows\system32\calc.exe C:\Users\user\AppData\Local\Microsoft\WindowsApps\foxprow.exe PS C:\Users\User\Desktop> schtasks /create /tn ExcelPersistence /tr "c:\windows\syswow64\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden -NoLogo -NonInteractive -ep bypass -nop -c 'C:\users\user\desktop\ExcelPersistence.ps1'" /sc onidle /i 5 PS C:\Users\User\Desktop> schtasks.exe /run /tn ExcelPersistence Figure 07 — Create Persistence via ActivateMicrosoftApp() method Post Exploitation Once we have compromised Domain Admin within a network, this technique grants us the ability to establish a reverse shell on any workstation where Microsoft Office is installed in a non-traditional way. Since administrators have write privileges to the C:\Program Files\Microsoft Office\Office16 directory, we can upload our malicious file there or in any other folder within the system PATH. Note: The initial location where the ActivateMicrosoftApp() method searches for FOXPROW.exe is within the C:\Program Files\Microsoft Office\root\Office16 folder. Impact This technique can have a significant impact since it allows attackers to execute malicious executable on any machine that has Microsoft Office installed, given administrative rights to that machine. It could be abused by attackers in a ransomware scenario. The malicious actor has the capability to upload malware, place it within the PATH, and then run the malware by executing the ActivateMicrosoftApp() method. Detection In general, DCOM security is a bit challenging because there are many applications that support DCOM models for re-usability and each application requires its own security configuration. DCOM also maintains its own set of access control lists (ACLs) which define the users or groups that have access to a component of a certain class. Additionally, DCOM utilizes Windows authentication mechanisms like NTLM or Kerberos. Each application component has its own permissions (e.g., users that are allowed to launch and activate the COM server, users that have access permission, users that have component configuration permission, etc.). The biggest complication is that a user might be blocked from accessing Microsoft Excel COM class objects but has privileges to access Microsoft Word COM class objects. This can complicate DCOM security within an enterprise environment, but there are few actions we could take to detect and mitigate this attack. To detect this attack, defenders can look for a child process spawning off of Excel.exe. If the following processes are spawned as a child process of Excel.exe, then you should investigate further: FOXPROW.exe SCHDPLUS.exe WINPROJ.exe Figure 08 — Excel.exe spawned FOXPROW.exe as its child process Another detection method involves monitoring for network anomalies. For instance, if RPC communication between two machines is unusual within your environment, you might want to investigate it further. To learn more about security of DCOM read here. Mitigation To mitigate this attack, consider configuring the user identity located under Component Services > Computers > My Computer > DCOM Config > Microsoft Excel Application > Properties. There are three options available: The interactive user — runs Excel as the currently logged on user's security context The launching user — runs Excel under the security context of the user launching it This user — runs Excel under a specific user's security context Configure the "This user" option to a user with minimal privilege. Since attackers will now have to jump another hop to escalate privileges, this dramatically reduces the potential impact. Figure 09 — Configure This user to minimize the attack impact Lastly, the concept of least privilege should be applied to limit the number of local administrators with access to workstations and servers, thus decreasing the chance of an attacker successfully being able to upload malware. To learn more about mitigation read here. Credits Big thanks to Duane Michael, Jared Atkinson, Matt Nelson and others who have helped review the blog post. Please reach out on X for your thoughts. I am curious to know other creative ways this technique could be abused. Thank you for reading! Lateral Movement: Abuse the Power of DCOM Excel Application was originally published in Posts By SpecterOps Team Members on Medium, where people are continuing the conversation by highlighting and responding to this story. Read more of this post Comment Manage your email settings or unsubscribe. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/10/lateral-movement-abuse-the-power-of-dcom-excel-application/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Jeffrey Burt posted: "As Israel's military escalates its ground and air attacks in Gaza, the parallel cyberwar that spun up so quickly following the October 7 surprise raids by Hama terrorists appears to be changing and spreading to other countries. A report this month by c" Security Boulevard Pro-Palestinian Threat Groups Expand Cyberwar Beyond Israel Jeffrey Burt Oct 30 As Israel's military escalates its ground and air attacks in Gaza, the parallel cyberwar that spun up so quickly following the October 7 surprise raids by Hama terrorists appears to be changing and spreading to other countries. A report this month by cybersecurity firm SecurityScorecard found that while lower-level and less-skilled bad […] Read more of this post Manage your email settings or unsubscribe. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/10/pro-palestinian-threat-groups-expand-cyberwar-beyond-israel/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

amy posted: "Ransomware is on the rise again in 2023. Learn about the most common ransomware attack vectors and how to avoid the dangers they represent. The post Common Ransomware Attack Vectors and How to Avoid Them appeared first on ID Agent. " Security Boulevard Common Ransomware Attack Vectors and How to Avoid Them amy Oct 30 Ransomware is on the rise again in 2023. Learn about the most common ransomware attack vectors and how to avoid the dangers they represent. The post Common Ransomware Attack Vectors and How to Avoid Them appeared first on ID Agent. Read more of this post Comment Manage your email settings or unsubscribe. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/?p=1994014

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Flare posted: " The need for effective cyber threat analysis – a critical process that involves identifying, investigating, and evaluating potential threats to maintain the integrity of our digital environments, is integral to cybersecurity. For businesses harnessin" Security Boulevard Cyber Threat Analysis: A Quick Guide Flare Oct 30 The need for effective cyber threat analysis – a critical process that involves identifying, investigating, and evaluating potential threats to maintain the integrity of our digital environments, is integral to cybersecurity. For businesses harnessing the power of Software as a Service (SaaS) platforms, particularly those in the field of cyber threat intelligence, comprehending and implementing […] The post Cyber Threat Analysis: A Quick Guide appeared first on Flare | Cyber Threat Intel | Digital Risk Protection. Read more of this post Comment Manage your email settings or unsubscribe. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/10/cyber-threat-analysis-a-quick-guide/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Michael Toback posted: " Introduction: Why You Should Worry About APT Attacks In today's digital landscape, Advanced Persistent Threats (APTs) are not just buzzwords but real, looming dangers. These highly sophisticated, long-term cyber-attacks aimed at stealing, sp" Security Boulevard Defend Against APT Attacks: Proven Strategies You Can't Ignore Michael Toback Oct 30 Introduction: Why You Should Worry About APT Attacks In today's digital landscape, Advanced Persistent Threats (APTs) are not just buzzwords but real, looming dangers. These highly sophisticated, long-term cyber-attacks aimed at stealing, spying, or sabotaging organizations are becoming increasingly relevant. Learning how to defend against APT attacks is no longer optional; it's a necessity for … Defend Against APT Attacks: Proven Strategies You Can't Ignore Read More » The post Defend Against APT Attacks: Proven Strategies You Can't Ignore appeared first on Endpoint Security. Read more of this post Comment Manage your email settings or unsubscribe. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/10/defend-against-apt-attacks-proven-strategies-you-cant-ignore/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Marc Handelman posted: " " Security Boulevard Randall Munroe's XKCD 'Dendrochronology' Marc Handelman Oct 30 via the comic artistry and dry wit of Randall Munroe, creator of XKCD! Permalink Read more of this post Comment Manage your email settings or unsubscribe. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/10/randall-munroes-xkcd-dendrochronology/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Chris Garland posted: " The rapid rise of hardware- and firmware-related attacks and supply chain threats has been one of the most significant changes in cybersecurity in recent years. Unlike the small incremental changes that typically define the evolution of threats (e.g. new" Security Boulevard Applying ATT&CK Methodology to Hardware and Firmware Chris Garland Oct 30 The rapid rise of hardware- and firmware-related attacks and supply chain threats has been one of the most significant changes in cybersecurity in recent years. Unlike the small incremental changes that typically define the evolution of threats (e.g. new malware variant, new ransomware operator, etc.), this new wave of attacks has introduced profound and fundamental […] The post Applying ATT&CK Methodology to Hardware and Firmware appeared first on Eclypsium | Supply Chain Security for the Modern Enterprise. Read more of this post Comment Manage your email settings or unsubscribe. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/10/applying-attck-methodology-to-hardware-and-firmware/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Satya Moutairou posted: "What is the HITRUST Certification? In 2007, a group of healthcare organizations, technology companies, and government agencies—including the American Hospital Association, Blue Cross Blue Shield Association, the Centers for Medicare & Medicaid Service" Security Boulevard How to Get HITRUST Certified—and Why Satya Moutairou Oct 30 What is the HITRUST Certification? In 2007, a group of healthcare organizations, technology companies, and government agencies—including the American Hospital Association, Blue Cross Blue Shield Association, the Centers for Medicare & Medicaid Services (CMS), McKesson Corporation, and Microsoft—got together to create a unified approach to information security and privacy. Image source: https://hitrustalliance.net/the-hitrust-approach/ The result was […] The post How to Get HITRUST Certified—and Why first appeared on TrustCloud. Read more of this post Comment Manage your email settings or unsubscribe. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/10/how-to-get-hitrust-certified-and-why/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110

Flare posted: " At its core, cyber threat exposure management (CTEM) is the culmination of traditional vulnerability management, threat intelligence, and attack surface management. In the past, organizations focused on identifying and patching software vulnerabiliti" Security Boulevard Cyber Threat Exposure: Detection & Prevention Guide Flare Oct 30 At its core, cyber threat exposure management (CTEM) is the culmination of traditional vulnerability management, threat intelligence, and attack surface management. In the past, organizations focused on identifying and patching software vulnerabilities, often with a reactive approach. CTEM is focused on proactively identifying all types of high-risk exposure that could leave your organization at risk, […] The post Cyber Threat Exposure: Detection & Prevention Guide appeared first on Flare | Cyber Threat Intel | Digital Risk Protection. Read more of this post Comment Manage your email settings or unsubscribe. Trouble clicking? Copy and paste this URL into your browser: https://securityboulevard.com/2023/10/cyber-threat-exposure-detection-prevention-guide/

Get the Jetpack app to use Reader anywhere, anytime Follow your favorite sites, save posts to read later, and get real-time notifications for likes and comments. Automattic, Inc. - 60 29th St. #343, San Francisco, CA 94110