Security vendors are in the business of selling security they don't have to care about securing their own environment (Remember RSA, Symantec)

- British security outfit Keepnet Labs exposed a massive database (without any password protection) on the internet, containing more than five billion records.

https://www.grahamcluley.com/security-firm-five-billion-records-exposed-unsecured-database/

Can this be true? - CIA's password for its top-secret hacking tools? 123ABCdef. The passwords were shared

 The passwords were shared by the entire team and posted on the group’s intranet. IRC chats published during the trial even revealed team members talking about how terrible their infosec practices were, and joked that CIA internal security would go nuts if they knew.


https://www.theregister.co.uk/2020/03/05/cia_leak_trial/

Hostinger STUNG by Hackers - August 23rd breach has put the records of up to 14 million Hostinger users at risk.

Hostinger does not currently offer its customer two-factor authentication as an additional layer of security

Data exposed in the security breach includes clients’ usernames, email addresses, hashed passwords, first names, and IP addresses.

https://www.grahamcluley.com/hostinger-resets-passwords-following-security-breach/

Capital One needed a Skilled engineer for 100M hack, Honda only needed a dumb admin to expose 134M rows of sensitive data

 The data was on an unsecured Elasticsearch database that was freely accessible to anyone who came across it, and contained in-depth information about the company’s security systems and network.

This includes technical details of each individual computer, including IP addresses, operating systems, unique network identifiers and security solutions and patches.


As a result, the data would provide any malicious actors with an exhaustive map of the company’s systems, including all the soft spots that would provide easy access to the network. Any skilled – or even relatively unskilled – hacker could use this information to perform a successful and potentially devastating cyberattack on Honda, such as highly targeted attacks on high value employees

https://www.verdict.co.uk/honda-database-exposure/

Capital One, 100M customer info stolen - All it took was a misconfigured firewall and an experienced software engineer.

Misconfiguration is something that  in any security system/application because Vulnerabilities are easier to find compared to misconfiguration.

Approximately 100 million of the affected customers are in the US, with the remaining six million in Canada

The Capital One breach was discovered on 19 July 2019. The hack took place on 22 and 23 March.

On Monday, the FBI arrested the person allegedly responsible: Paige Thompson, a 33-year-old former systems engineer

https://www.verdict.co.uk/capital-one-breach/

[Risk Assessment Failure] Comcast did not protect its mobile accounts with a unique PIN. It used "0000" and the consequence was - Someone was able to hijack his phone number, port it to a new account on another network and commit identity fraud. The fraudster loaded Samsung Pay onto the new phone with his credit card—and went to the Apple Store in Atlanta and bought a computer.

To port a phone line from Comcast to another wireless carrier, a customer needs to know his or her Comcast mobile account number. Carriers generally use PINs to verify that a customer seeking to port a number actually owns the number. But Comcast reportedly set the PIN to 0000 for all its customers, and there was apparently no way for customers to change it. That means that an attacker who acquired a victim's Comcast account number could easily port the victim's phone number to another carrie


https://arstechnica.com/information-technology/2019/03/a-comcast-security-flub-helped-attackers-steal-mobile-phone-numbers/

"Security Culture" can help you to avoid embarrassment. Example - A patient who Googled their name was able view their medical file.

 (Because,) someone misconfigured a website server belonging to University of Washington and it was searchable on the internet from December 4-26 containing the data on 974,000 patients.


UW did not discover the problem,the patient reported this finding to them.


https://www.scmagazine.com/home/security-news/data-breach/misconfigured-database-exposes-974000-university-of-washington-medicine-patients/

CLOUD adoption is a good decision provided we bake in security (else, get ready for data loss/breach) - By default, pods in a Kubernetes cluster can receive traffic from any source – a setting 46% of businesses leave in place, exposing pods to network attacks. Further, 15% don't use identity and access management roles for access to Kubernetes clusters.

25% of organizations use popular managed container services such as Amazon Elastic Container Service for Kubernetes and Azure Kubernetes Service.

Common misconception - There's a lack of belief they're necessarily going to be targeted or an unwillingness to make an investment.
The motivation to secure arrives after an incident.

Other Stats:
27%  allow root user activities.
Over 40% of API access keys have not been rotated in a 90-day period.


https://www.darkreading.com/perimeter/49--of-cloud-databases-left-unencrypted/d/d-id/1333462

Do you own a Sennheiser's HeadSet - Here is an interesting story (like the Adware Scandal that made Lenova pay $7.3m for installing adware in 750,000 laptops) - Sennheiser Headset Software Could Allow Man-in-the-Middle SSL Attacks.

When users have been installing Sennheiser's HeadSetup software, little did they know that the software was also installing a root certificate into the Trusted Root CA Certificate store.  To make matters worse, the software was also installing an encrypted version of the certificate's private key that was not as secure as the developers may have thought.

While these certificate files are deleted when a user uninstalls the HeadSetup software, the trusted root certificate was not removed. This would allow an attacker who had the right private key to continue to perform attacks even when the software was no longer installed on the computer

Microsoft has also released the security advisory ADV180029, titled "Inadvertently Disclosed Digital Certificates Could Allow Spoofing", that explains that Microsoft has released an updated Certificate Trust List that removes trust for these certificates.

https://www.bleepingcomputer.com/news/security/sennheiser-headset-software-could-allow-man-in-the-middle-ssl-attacks/

First we hear "Poorly Secured", which we IGNORE then, we hear "Data Breach" then, we are surprised. As long as we suffer from SIS ("Security Ignorance syndrome"), we will continue to have Data Leakage (FYI, no hacking skills needed)

Leaky database, owned by communications firm Vovox which lacked password protection, contained tens of millions of SMS messages, two-factor codes, shipping alerts, and other user data.

https://www.darkreading.com/cloud/26m-texts-exposed-in-poorly-secured-vovox-database/d/d-id/1333292

Vendor Blunder - Cisco “inadvertently” shipped in-house exploit code that was used in security tests of scripts as part of its TelePresence Video Communication Server and Expressway Series software.

The code was used internally by Cisco in validation scripts to be included in shipping software images – it was used to ensure that Cisco’s software is protected against known exploits. However, there was a failure in the final QA validation step of the software, and as a result someone from Cisco forgot to remove the code before release

https://threatpost.com/cisco-accidentally-released-dirty-cow-exploit-code-in-software/138888/

Another incident to remind us that our vendor/contractor's security practices are part of our security - One of American Express (India) subcontractor missed to encrypt 700,000 customer records , exposing names, email addresses, phone numbers and card type.

The bulk of the data – more than 2.3 million records – it housed was encrypted, requiring an encryption key but the nearly 700,000 customer records were in plaintext, exposing names, email addresses, phone numbers and card types.
the database was not managed by AmEx itself but instead by one their subcontractors who were responsible for SEO or lead generation.

Sensitive information is left publicly available in a data repository due to poor developer practices

https://www.scmagazine.com/home/security-news/leaky-mongodb-server-exposes-personal-info-on-700k-amex-india-customers/

Do you have a process to decom your old apps/websites? - Don't worry, even some Fortune 500 companies forget it. Here are some scary stats.

• 70% of FT Global 500 firms have access to a portion of their websites being sold on the internet black market. 
• 92% of external web applications have exploitable security flaws or weaknesses.
• 19% percent of the companies examined have external unprotected cloud storage.
• 27%of the U.S. companies have at least one external cloud storage (e.g. AWS S3 bucket) accessible without any authentication from the internet.
• WordPress- 94% have a default admin location (on /wp-admin URL) not protected by any additional means.

https://threatpost.com/threatlist-dead-web-apps-haunt-70-percent-of-ft-500-firms/138659/

Even Google’s own developers don’t necessarily follow Android Security guidelines.” So, we have a new "Man in the Disk" Attack - Which allows a bad actor to hijack the communications between privileged apps and the device disk, bypassing sandbox protections to gain access to app functions and potentially wreak havoc

“Some of the apps in question are made by Google themselves,” said Gan. “So even Google’s own developers don’t necessarily follow Android guidelines.”

Android’s OS makes use of two types of storage – internal storage which provides every app with its own sandbox; and an external storage mechanism that uses a removable SD card. This latter storage is shared across the OS, because it’s designed to enable apps to transfer data from one app to another. So, if a user takes a picture and then wants to send it to someone using a messaging app, the external storage is the platform that allows this to happen.


Google provides developer guidelines meant to provide a road map for security best practices. These include advice such as never writing critical data files to the external storage, and not using it to store executables or files that impact the way apps operate. Also, external storage files should be signed and cryptographically verified prior to dynamic loading,

In fact, roughly half of the Android apps in Google Play that Check Point examined did not comply with the guidelines. The firm examined Google Translate, Yandex Translate, Google Voice Typing, Google Text-to-Speech and Xiaomi Browser, among others.



https://threatpost.com/def-con-2018-man-in-the-disk-attack-surface-affects-all-android-phones/134993/

ExxonMobil - Sends mail with a confusing toll free number and directs customers to a parked page that tries to foist Web browser extensions on visitors.

Looks like, ExxonMobil marketing team did not bother to perform a sanity check with security team


Many people on Twitter who expressed confusion about the mailer said they accidentally added an “e” to the end of “exxonmobil” and ended up getting bounced around to spammy-looking sites with ad redirects and dodgy download offers.

It always amazes me when major companies roll out new marketing initiatives without consulting professionals who help mitigate security and privacy issues for a living. It seems likely that happened in this case because anyone who knows a thing or two about security would strongly advise against instructing customers to visit a parked domain or one that isn’t yet fully under the company’s control.

https://krebsonsecurity.com/2018/07/exxonmobil-bungles-rewards-card-debut/

IaaS is great except when the vendor offering it has security issues. Identity-as-a-service vendor (Auth0) could allow bad actors to spoof a legitimate website and collect sensitive information from visitors.

Possible consequences - phishing attacks, harvest user credentials, or even possibly launching cryptomining attacks.

https://threatpost.com/auth0-glitch-allows-attackers-to-launch-phishing-attacks/132554/

Do you use Trello? - it is time to check if your admin or your vendor admins have "misconfigured" it to expose credentials.

Examples
Seceon, a Westford, Mass. cybersecurity firm that touts the ability to detect and stop data breaches in real time. But until a few weeks ago the Trello page for Seceon featured multiple usernames and passwords, including credentials to log in to the company’s WordPress blog and iPage domain hosting.

A senior software engineer working for Red Hat Linux in October 2017 posted administrative credentials to two different servers

Maricopa County Department of Public Health (MCDPH) in California used public Trello boards to document a host of internal resources that are typically found behind corporate intranets, such as this board that aggregated information for new hires (including information about how to navigate the MCDPH’s payroll system)

A public Trello page maintained by HealthIT.gov — the official Web site of the National Coordinator for Health Information Technology, a component of the U.S. Department of Health and Human Services (HHS) — that was leaking credentials


https://krebsonsecurity.com/2018/06/further-down-the-trello-rabbit-hole/

You worry about "weakest link in security chain" how about, "high-risk link", your cloud app admin. Need evidence?

(1)Universal Music Group contractor neglected to protect an Apache Airflow server 

(2) Honda affiliate in India left two Amazon S3 buckets misconfigured for more than a year


The Honda mistake affects 50,000 users of the Honda Connect App, which is used to manage automobile service and maintenance. It can also pair with the car to offer vehicle health monitoring, “find my car” capability, trip analysis and an SOS function for emergencies.

A cybercriminal could know “where someone’s car is currently located, where they went, where they typically drive, how they drive, and where they start and stop


https://threatpost.com/honda-universal-music-group-expose-sensitive-data-in-misconfig-blunders/132451/

Your cloud security is directly proportional to you admin's security knowledge and mindset. For example, unauthenticated adversaries can extract user credentials from misconfigured reverse proxy servers in order to delete, manipulate or extract data from websites and applications.

Researchers have created a proof-of-concept attack that allows unauthenticated adversaries to extract user credentials from misconfigured reverse proxy servers in order to delete, manipulate or extract data from websites and applications

The PoC targets APIs that provide access to the metadata associated with identity services such AWS’ Identity and Access Management (IAM), Microsoft’s Azure Managed Service Identity (MSI), and Google’s Cloud Cloud IAM.

In its PoC attack, researchers created a typical configuration for a web server or application server using a reverse proxy server running a default NGINX installation. NGINX is web server software that can also be used as a reverse proxy. A reverse proxy server is a type of server that retrieves resources on behalf of a client from one or more servers.

https://threatpost.com/misconfigured-reverse-proxy-servers-spill-credentials/132085/

LocationSmart (not so smart when it comes to security) - Leaked Location Data for Customers of All Major U.S. Mobile Carriers Without Consent in Real Time Via Its Web Site

This company  that acts as an aggregator of real-time data about the precise location of mobile phone devices, has been leaking this information to anyone via a buggy component of its Web site — without the need for any password or other form of authentication or authorization


https://krebsonsecurity.com/2018/05/tracking-firm-locationsmart-leaked-location-data-for-customers-of-all-major-u-s-mobile-carriers-in-real-time-via-its-web-site/