Eric Lombrozo

How to use Sentinel (KQL) to discover Token Theft. Even though token theft is a small percentage of overall Sign-Ins, it is still IMPORTANT to know! https://lnkd.in/geBNYE_z

30

1 Comment

Episode 3026 Legit Security with Liav Caspi, CTO and Co-founder at BHUSA 2024. Why do you need an AI Command Center? GenAI use in software development is exploding and security struggling to keep up – both in terms of understanding where GenAI is in use, and and how to ensure its security. With the Legit AI security command center – security teams can proactively safeguard AI use across the software development lifecycle (SDLC) and prevent the accidental or intentional misuse of malicious and vulnerable machine learning (ML), GenAI, and large language models (LLMs) — all from a single pane of glass. https://lnkd.in/gENGdKUz #bhusa #bhusa2024 #cybersecurity #genai #aicommandcenter #LLM #ml #securityguytv #sdlc

8

Do you know your GitHub repo could be unknowingly exposing critical secrets? 2024 has already witnessed a surge in major token exposure incidents, affecting industry giants like Mercedes-Benz, The New York Times, and even the Python ecosystem. You ask, but how does it matter? These breaches compromise your entire development pipeline and introduce undetected malicious code. 1/ Exposed tokens often grant broader access than developers realize, magnifying potential damage. 2/ Tokens with unchecked rotation policies pose a .significant risk 3/ Threat actors leverage sophisticated scraping tools, and can find exposed tokens in a fraction of time. 4/ Exposed tokens in build artifacts can lead to devastating supply chain attacks, affecting countless downstream projects. Here’s what we can do to address - - Embed robust secret scanning directly into your CI/CD pipeline, catching exposures before they reach production.    - Implement mandatory code reviews with security-focused checklists, leveraging human expertise to catch what automated tools might miss.    - Establish and rigorously enforce token lifecycle policies, including automated rotation and instant revocation capabilities.    - Deploy Runtime Application Self-Protection (RASP) as an additional layer of defense, providing real-time protection against exploitation attempts.    - Implement thorough scanning of build artifacts, container images, and other deliverables to prevent inadvertent token leakage in your software supply chain. For an engaging read, check out this recent Unit 42 research (https://lnkd.in/dfkYWxic). Remember: Your security is only as strong as your weakest token. How confident are you in your strategy? PS: Evaluating your organization's token security posture? For a no-fluff chat on security, ping me (link under my profile).

7

Don't dismiss the Yubico security advisory, but don't panic either. My hot take, pending further analysis of the 88-page report, is that at present the problem is limited to ECC signing functions and doesn't provide a practical attack surface for keys that remain in your physical possession, use non-cached KDF for PINs, and aren't connected to untrusted hardware. 1. Read https://lnkd.in/eWi7kHam to learn more about what's wrong. 2. Stop here if you don't use the FIDO2, OpenPGP, or PIV functions of the card. If you *do* have an affected firmware version AND are using elliptic curves for signing, there are some mitigations you can take. 1. Run KDF setup if you haven't already, and then regenerate your PIN numbers for all affected protocols on vulnerable keys. *NB: I couldn't find this in the advisory, but it makes sense if you stop and think about it.* 2. Add a PIN to your FIDO2 authentication on affected firmware versions. 3. Disable the "touch cache" feature on the key to limit the potential window of exposure window on untrusted hardware. 4. Switch all ECDSA signing and attestation keys to use RSA instead of an elliptic curve algorithm if possible. This is generally the default for most impacted functions, but may have been changed by advanced users or by organizational policy. *NB: For OpenPGP, make sure you generate a revocation certificate for your signing key first before replacing the signature slot. This may impact other OpenPGP keys too if they were signed with the ECC key, so you might need to re-sign or regenerate your other keys as well.* 5. If you rely on FIDO2, supplement your FIDO2 authentication with an additional factor if possible. 6. Revoke and replace keys that must use ECC algorithms for signing keys, use FIDO2 without an additional factor, are likely to be exposed to untrusted hardware, or that can't be used with a device PIN. The only thing that really makes this vulnerability inconvenient is that the firmware of affected keys can't be replaced. I have seen no announcements about whether or not Yubico will be offering some kind of replacement program to affected customers, but users of RSA signature keys, the default Yubico attestation certificates, or the YubiOTP protocol do not appear to be impacted at this time.

4

2 Comments

🎉 Excited to share our latest article on ERC-7683: Demystifying Cross-Chain Intents for Seamless Swaps! Cross-chain complexities can be a pain for developers and users alike. Our new Medium article delves into how this groundbreaking standard that enhances cross-chain interactions by providing a unified framework for cross-chain actions. 👓 Dive into the benefits, security considerations, and best practices that ERC-7683 offers for a more robust and interoperable blockchain ecosystem. Check it out!

11

SF Login Verification And "MFA" are commonly mistaken for each other. (they're similar... but not the same)   Login Verification: • Typically a password + one-time code • Triggered during suspicious login attempts • Adds a single extra layer of security MFA (Multi-Factor Authentication): • Combines biometrics, app notifications, and codes • Requires at least 2+ ways to verify you • Meets Salesforce's latest security requirements The thing is...   A well-configured Login Verification can sometimes outperform a poorly implemented MFA in real-world scenarios.   Because let's be honest, adding "fancy tech" won't save you if your password is still "Salesforce123." 😄   What do you think?   P.S. Have you enabled MFA on your Salesforce account yet? If not, it's time to step up your security.

62

I have a new blog post in which I compare and contrast how privacy laws are proposed and implemented in California and at the Federal level. This is very analogous to software development: in California, it is open and agile, while at the Federal level, it is closed and waterfall. https://lnkd.in/gW387JRZ

34

1 Comment

The EXPMON Public has reported several Foxit Reader crashes when processing a public PDF sample set. https://lnkd.in/gidnAhMU https://lnkd.in/gCeijxFz https://lnkd.in/grJTxu7b I've manually analyzed them and confirmed they're not zero-day attacks, they're not FPs either. They're even not new Foxit Reader vulns/bugs, as far as I've seen. The crashes could be reproduced in the specific tested Foxit Reader version 2023.2.0.21408 (so not FPs), but not in the latest version. So I'd guess it's a vuln/bug in Foxit Reader just got patched in the last several months. Yeah, sometimes, @EXPMON_ could be used to discover software vulnerabilities (for free), too. You never know what you'd encounter when processing real-world samples! :)

9

1 Comment

Worth reading: What the Fork? Finding and Analyzing Malware in GitHub Forks. Authors: Alan Cao, Brendan Dolan-Gavitt Abstract—On GitHub, open-source developers use the fork feature to create server-side clones and implement code changes separately before creating pull requests. However, such fork repositories can be abused to store and distribute malware, particularly malware that stealthily mines cryptocurrencies. In this paper, we present an analysis of this emerging attack vector and a system for catching malware in GitHub fork repositories with minimal human effort called Fork Integrity Analysis

7

Articles like these are why I use Brian Krebs articles in my workshops. If you want to learn how follow investigative thread to track down miscreants, see if you can copy one of Brian’s step by step investigative paths. https://lnkd.in/gbZDiH6Z

8

1 Comment

Doxing the identity of an initial access broker using Hudson Rock's Infostealers AI investigation module. We've established in the past that just like regular users get infected by Infostealers, so do hackers. In this video, Leonid Rozenberg demonstrates how Hudson Rock's AI can analyze all files retrieved from the computer of an initial access hacker and identify the name, phone number, and online behavior of the hacker. This kind of intelligence is critical in identifying the identities of threat actors, extremists, pedophiles, and other types of criminals. Talk to us to learn more - https://lnkd.in/dKaEznQT

56

4 Comments

What is an agent? Harrison Chase answers this question in his blog at LangChain: "An agent is a system that uses an LLM to decide the control flow of an application." Here are the main points about agents and the "agentic" concept from Harrison Chase's blog: ▪️ More about the definition of an agent: Agents are often perceived as advanced, autonomous, and human-like, but even simple systems using LLMs for routing fit the technical definition. However, the concept of an agent can be hard to define precisely. ▪️ Agentic spectrum: Chase likes Andrew Ng's opinion about agents. Andrew Ng proposes viewing agent capabilities as a spectrum, similar to levels of autonomy in vehicles. ▪️ What's to be "agentic" for a system? A system's agentic behavior increases as an LLM takes more control over its actions. Levels of agentic behavior of LLM systems: - Simple routing tasks (Router) - Multiple routing steps (between Router and State Machine) - Looping processes (State Machine) - Tool building and memory usage (Autonomous Agent) ▪️ Importance of "agentic" concept: Understanding how "agentic" a system is can guide development, operation, interaction, evaluation, and monitoring. More agentic systems benefit from robust orchestration frameworks and specialized tools. ▪️ Highly agentic systems requirements: - Highly agentic systems are harder to run, needing background jobs and durable execution for error handling. - More agentic systems need real-time monitoring and the ability to adjust the agent’s state or instructions. - These systems need strong frameworks to evaluate multiple stages and final outputs. ▪️ Tooling and infrastructure: New, more agentic LLM applications require new tools and infrastructure. LangChainAI developed LangGraph for agent orchestration and LangSmith for testing and observability for LLM apps to support these needs. Harrison Chase's blog: https://lnkd.in/eWqVajME

7

CyberSec Alert: Malware Campaign Uses Ethereum Smart Contracts to Control npm Typosquat Packages New npm malware campaign uses Ethereum smart contracts for resilient C2, impacting 287 packages 🚨 Hundreds of typosquatted versions targeting npm developers are attempting to deliver cross-platform #malware by employing Ethereum smart contracts for command-and-control (C2) communications. Read: https://lnkd.in/gRyfDYah #cybersecurity #infosec #artificialintelligence #machinelearning #cybersecurity #technology #innovation #AI #datasecurity #digitaltransformation #dataanalytics #technews

7

2 Comments

Crypto scams seems to be a growing trend over exposed resources, from fakes sales to crypto mining over hacked workloads. "LEGO's website hacked to push cryptocurrency scam" Do you have proper controls in place ? Active detection and response ? Configuration hardening (following CIS - center for internet security recommendations with system hardening, AND, reviewing the OWASP best practices ? ) connected=hacked Sometimes it's also about having pentesting, which goal is to validate how effective are you controls against attacks, and allowing you to enhance these. #cybersecurity https://lnkd.in/ekNMQqWX

14

Software supply chain security is much wider in scope than what I imagined last year. It can't be solved by building scanners or SBOM tools alone. It requires standards, tooling, industry & community participation to build the infrastructure required for "verifiable trust" between producers and consumers of software across trust boundaries (e.g. OSS project & consumer of it) Now that the hype of software supply chain security has faded in favour of "you know what", I am looking to connect and brainstorm ideas with folks who are still working on this space. Drop in a comment or DM if you want to chat. I am curious on your thoughts on how does a solution look like.

44

4 Comments