Skip to content

為什麼客戶喜歡 Keepit 的易用性

The Keepit Approach to the Five Quality Components of Usability One prominent aspect of Keepit’s cloud backup and recovery solution that customers rave about most is its simplicity and ease of use. Where other similar solutions often require weeks of training, the Keepit solution is plug and play, capable of being implemented and fully operational within minutes – and by everyone on the team. No extensive courses and diplomas are required. The intuitive ease with which Keepit locates and restores files also means our customers are actively incorporating it into their day-to-day internal support operations, rather than just using it for finding and recovering files that have simply gone astray. The ease of use comes from a dedicated design process, which puts usability up front and users in the driver’s seat. There are many different opinions on what the word usability means, so here at Keepit — as with many other things — we are inspired by what we observe in the workplace and then have our take on it that fits our product. The Keepit Design Hierarchy Creating and following a design hierarchy goes to the heart of how we build and continue to improve Keepit’s backup solution. For every design and feature we implement, Keepit follows a clear usability vision that strongly focuses on following a design code. The hierarchy in which we make design and usability decisions is built around Principles, Pillars, and Patterns. Starting with our Design Principles, everything we do is based on these principles: They are abstractions of how we design our products and help designers make the right decisions. Design Pillars are more focused on how we implement designs and how the user should experience the Keepit solution. Pillar example: “The right functionality, at the right time, to the right person.” This Pillar is used rigorously for each feature we create throughout the entire user flow. Is this the right functionality being presented to the user? Is this the right time to show this functionality? Will it work for the person who is going to use it? Finally, we have Patterns. Design Patterns are specific implementations of functionality. This could be how we implement breadcrumbs, how we handle truncation, checkboxes, dropdowns, and wizards, just to name a few. Defining Usability Usability is a quality attribute that assesses how easy user interfaces are to use. The word ‘usability’ also refers to methods for improving ease of use during the design process. The most popular definition of Usability has five components, as explained by the Learnability: How easy is it for users to accomplish basic tasks the first time they encounter the design? Efficiency: Once users have learned the design, how quickly can they perform tasks? Memorability: When users return to the design after a period of not using it, how easily can they re-establish proficiency? Errors: How many errors do users make, how severe are these errors, and how easily can they recover from the errors? Satisfaction: How enjoyable is it to use the design? There are many other important quality attributes, one of which is utility, which refers to the design’s functionality. In other words, does it do what users need? How Keepit Measures Usability Learnability in Keepit: Let us look at the first item: Learnability. The nature of a backup application is not something our users check in to merely to “get a dopamine kick” from watching cool facts about their running backups. Instead, backup is more “set it and forget it,” and usually, our users come to the platform for one of two reasons. One, is to make sure that everything is running as it should. Two, is to restore data that was lost. For many of our users, the fact that the application is so easy to learn and understand saves them much time, money, and the frustration of being unable to find the data that needs to be restored. Memorability in Keepit: Our approach is not just that things should be easy to learn but also that they must be easy to get back into after being away for a period of time. We do this with a consistent system: most things work in a predictable, similar way, following the same ideas. This increases the chance that something is memorable and easy to re-learn. There are, of course, many things we do to improve the memorability of Keepit, with consistency and recognizability of the applications they are backing up being just some of them. Efficiency in Keepit: All of this leads to Keepit’s Efficiency. We like to look at efficiency from the point of view that you should “take the time to look before you jump.” This means we do not consider “few clicks” a success criterion in itself, but rather, we consider “carefully placed” clicks as a step in the right direction – i.e., solving the problem with just the right number of clicks. Errors in Keepit: Naturally, we do everything within our power to ensure the number of mistakes made in relation to the task being solved is at a minimum and that a tight correlation exists between the number of errors the user is making and the solution’s efficiency. Every time the user makes an error, it sends them back into the flow, and they will have to redo actions, which again leads to an ineffective solution. Learnability and memorability directly impact the user’s errors, so everything is connected, as you can see. Satisfaction in Keepit: Finally, there is one more thing to address: satisfaction. Satisfaction is a tricky topic to discuss when talking about a solution that’s practical in nature and does not contain any real incentive to be a pleasurable experience. In the Keepit design, we have gone to great lengths to fight against the tendency of “functional design” that flourishes in the world of IT management tools. Instead, we have moved toward the concept of “emotional design” because IT administrators also deserve good tools. In functional design, where the idea that showing everything all at once means more control and empowered admins, Keepit believes showing the right thing, at the right time, to the right person offers the ultimate degree of control and empowerment. We also believe that creating a pleasurable and satisfying experience with administration tools like Keepit, where everything “just works,” frees up administrators to focus on other priorities. Final Thoughts Despite our mission to create the perfect solution that requires no previous knowledge to recover data, we are painfully aware that achieving perfect usability is a goal yet to be reached. But we strive every day to get there. That said, we recommend that our users regularly make sure they understand the flows and the emergency training so that in the case of an emergency, they know exactly what to do and when to do it, which we’ll save for a future blog post. At Keepit, we put a lot of effort into ensuring that the design leaves little room for mistakes and is easy to pick up again after a long vacation – even for an inexperienced administrator. Help The Keepit Design Team We are always looking for people who would like to provide feedback on our solution and help us create the best design in the world. Please if you are interested in becoming part of the user feedback forum.

About Version 2 Limited
Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Keepit
At Keepit, we believe in a digital future where all software is delivered as a service. Keepit’s mission is to protect data in the cloud Keepit is a software company specializing in Cloud-to-Cloud data backup and recovery. Deriving from +20 year experience in building best-in-class data protection and hosting services, Keepit is pioneering the way to secure and protect cloud data at scale.

Windows 註冊表取證 – Pt. 2

Intro

I talked for a bit about the Windows Registry and what are its main purposes, as well as what we can do with it; before delving further into that, I wanted to briefly mention a tool you might use for your forensic Analysis – Autopsy.

I will also just touch upon another tool you might use as well – FTK Imager.

Finally, I will also provide some useful links at the end of the article.

 

Data Acquisition

So, you have a disk to analyze, and want to access it so you can dig around for useful artifacts to uncover what has transpired on the said system. Remember that your disk needs cloning/imaging – this is best practice, and you should always try to copy the data you want to do some forensics on. This is also known as data acquisition.

By now, you know that you can look at the Windows Registry with the registry editor (regedit.exe), however the best way to do this is to acquire a copy of that data and analyze the copy.

Tooling

You can go to %WINDIR%\System32\Config and try to copy those files that are in fact our registry hives:

I selected the files here and tried to copy them to my Desktop:

After checking the box and clicking on continue, Windows won’t let me copy the files to the desktop:

This happens because the files are restricted.

Luckily, there are tools that can help us with acquisition of the registry hive files. One such tool is Autopsy, which lets you acquire data from both live system and disk images.

Once installed and ran, you need to create a new case:

You then have some optional info to fill, to help you stay organized etc. (I won’t be doing that here – see the image below)

Further, you need to add a data source:

I am choosing Disk Image or VM file here which I previously downloaded from the Cfreds (Computer Forensics Reference DataSet portal) found here:

Note that if you download the dataset I linked, you should download all the files from .7z.001 to .7z.003 and place them in the same folder; afterward, just extract the .001 and 7z will know to merge the three files together, giving you the disk image I am using in the article here.

For the configure ingest step, you can do a lot of stuff here, but I am choosing just two options – Recent Activity and File Type Identification. If you were to choose all for let’s say a disk that’s slightly larger, you’d have to wait for a bit, before Autopsy did all its stuff.

Now, I just must wait for Autopsy to do its thing and see what I’ve got!

One more quick note: This can take some time and eat up your RAM – Autopsy 64bit recommends you have 16GB RAM. Also, when ran on Windows it will create a max heap size of 4GB, leaving the remaining memory to the OS, and Solr text indexing service. You can change this value by changing the value of Maximum JVM memory, found under Tools -> Options -> Application as shown in the image below:

Going back to our dataset, the situation is now looking something like this:

As you can see in the screenshot above, Autopsy has found a bunch of very interesting things! From Installed software to OS info, Web History, Bookmarks… so many artifacts! 

But, since the topic here is the Registry, let’s investigate that specifically.

Before going further, I’d like to add that this image comes with 12 questions for you to try and answer. This is perfect for the scope of this article and the reason why I included it.

I will answer a couple of questions and leave you to try and solve the others yourself. With some Google-fu, you could probably find the answers online, but for the sake of learning do try to go for the questions yourself first. (There’s even a Youtube video, that I won’t link here, but if you get stuck search for it, or write in the comment section of this article and I will share it with you)

Practice Questions

The questions are:

  1. What operating system was used on the computer?
  2. When was the install date?
  3. Who is the registered owner?
  4. What is the computer name?
  5. Who was the last user to logon into PC?
  6. What is the account name of the user who mostly uses the computer?
  7. When was the last recorded computer shutdown date/time?
  8. What is the timezone settings?
  9. Explain the information of network interface(s) with an IP address assigned by DHCP.
  10. List all accounts in OS except the system accounts: Administrator, Guest, systemprofile, LocalService
  11. What applications were installed by the suspect after installing OS?
  12. List external storage devices attached to PC.

Q1: What operating system was used on the computer?

A: For this, we can look under the Operating System Information – which is the output for the ingest module:

On the righthand side we can see two source files for the Software hive, by clicking on one of those, we can see in the window below all that Autopsy knows about this image.

From the underlined part above, we can conclude that this is a backup of the Registry – because of the RegBack in the path.

When we look at the second Software Hive, we can see what OS is used on this computer:

We now know the answer to first question is – Windows 7 Ultimate SP 1.

  

Q2: When was the install date?

A: I will just drop a hint here! The answer is already visible… no need to even install Autopsy and load the image from this article.

Q3: Who is the registered owner?

A: See above.

Q4: What is the computer name?

A: Same as Q3.

Q5: Who was the last user to logon to the PC?

A:

Q6: What is the account name of the user who mostly uses the computer?

A:

Q7: When was the last recorded computer shutdown date/time?

A: We can look at the System Hive again, and click on the Application tab (remember to use the one that doesn’t have RegBack in its name)

Under application, we drill down to ControlSet001, expand the Control node, and go all the way down to the Windows node (notice the size of the scroll bar)

Highlighting the Windows node, we can see the ShutdownTime key, which we now just need to convert to something human readable

We go to our trusty Cyberchef and create our recipe to decode this value.

Step 1 – We change the Little Endian in our Cyberchef recipe – we used Swap Endianness recipe

Note that I copied the value from Autopsy, but removed the whitespaces

We’re also converting from 8 byte words, so I changed the default 4 byte word length to 8 bytes.

Step 2 – We search for Remove Whitespace module and add it to our recipe

Step 3 – We add Windows Filetime to UNIX Timestamp to our recipe

The output above is what we’re after, we just need to convert the UNIX timestamp. Also, the default is Decimal, which I changed to Hex (Big Endian)

Step 4 – For our final step, we add one last ingredient to the recipe – From UNIX Timestamp

And that’s it! The answer to our question is – last recorded shutdown time was on Wednesday, 25th of March, 15:31:05 UTC, 2015

*Note that in the Windows Filetime to Unix Timestamp Hex (big endian) is selected. Change it to Little endian, and pay close attention to the output.

Questions 8 to 12 (and other unanswered questions) are left for you to try and solve. Feel free to share your experiences, results, or anything really, in the comment section!

FTK Imager

Before concluding, I wanted to mention another tool you might end up using in your analysis – FTK Imager.

This one can also extract files from a disk image (or a live system) through the mounting of the disk/drive in the program.

Below is one screenshot of my mounted C: drive.

You can also extract the Registry Hives with FTK Imager by clicking on the little yellow safe icon (image above) – called Obtain Protected Files.

This option is only there when a live system is being investigated. Also, I’d like to note that this option, even though it can extract all the hives to a path you chose, it isn’t able to copy the Amcache.hve (See 1st part of the series) which keeps information about executed applications, which are usually interesting (even necessary) to investigate when conducting a forensic analysis – specifically because it contains evidence about programs last executed.

Conclusion

I hope you liked my part 2 of the series! It was a blast for me, and I will continue with this topic in the future.

I purposefully chose to make a ‘demo’ by using a tool, but I will also write about some important artifacts/keys that you might want to keep in mind when investigating those hives!

Stay tuned.

 

Links/Resources

https://www.autopsy.com/

https://what-when-how.com/windows-forensic-analysis/registry-analysis-windows-forensic-analysis-part-1/

https://content-calpoly-edu.s3.amazonaws.com/cci/1/documents/ccic_forensics_manual/CCIC%20Chapter%204%20-%20Understanding%20the%20Registry.pdf

https://cfreds.nist.gov/

Cover image by Alexandre Debiève

#autopsy #registry #ftk_imager #windows #hives

About Version 2 Limited
Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About vRx
vRx is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.

SSL 證書：您需要知道的

According to the International Telecommunications Union (ITU) report published at the end of 2021, about 4.9 billion people used the Internet that year. This represents a jump of 800 million more people than before the pandemic.

This means that every day, an immeasurable amount of data is made available on the web, including sensitive information such as names, addresses, document numbers, and bank details.

Therefore, malicious agents have a large space to act, breaking into websites and stealing passwords and financial information, among other data that may be useful for their criminal practices.

Key ways to hack into a website include:

  • Software vulnerability or poor server or network configuration;
  • Vulnerability of the website itself;
  • Weak passwords;
  • Attacks on those responsible for the websites.

One of the ways to protect your website is by deploying SSL certificates. They protect the communication between the server and the user. In addition, they are required for websites that receive payments and allow their customers to feel secure knowing who they are interacting with.

For these reasons, we prepared special content about SSL certificates, explaining their concept, importance, and operation, among other information. To facilitate your reading, we divided our text into topics. They are:

  1. What Are SSL Certificates
  2. What Is The Importance of SSL Certificates
  3. Types of SSL Certificates
  4. Subdomains
  5. How They Work
  6. How to Tell if a Website Has the Certificate
  7. How to Install SSL Certificate on a Website
  8. Are SSL Certificates Enough to Ensure the Security of a Website?
  9. What Are SSL and TLS
  10. What Are the Differences Between SSL and TLS
  11. Best Practices for the Security of Your Website
  12. History of SSL Certificates
  13. Digital Certificates: Learn about Their Characteristics
  14. Digital Certificates in the World
  15. Different Uses of Digital Certificates
  16. About senhasegura
  17. Conclusion

    Follow our text to the end!

What Are SSL Certificates

SSL certificates consist of data files hosted on a source server of a website, which make it more secure as they move from HTTP to HTTPS.

Their function is to authenticate the identity of the website and allow the encryption of the connection, as they contain the identity of the website and the public key, plus other information.

Therefore, when establishing communication between a device and the source server, SSL certificates are used to give access to the public key and confirm the identity of that server. Meanwhile, the private key remains secret.

What Is The Importance of SSL Certificates

Using SSL certificates provides several benefits, such as:

Data Protection
Their main purpose is to protect communication between the client and the server. For this reason, all bits of information are encrypted with the installation of SSL certificates. In practice, this information is blocked so that only the browser or server has the key to unlock it. With this, SSL technology allows the administration of sensitive data such as passwords, credit card numbers, and IDs without causing vulnerabilities when there are malicious agents.

They Enable Identity Verification
SSL certificates also make it possible to perform identity verification, providing security for those who use the Internet. This is because the digital environment is a fertile space for many types of scams, but this tool allows people to confirm who they are talking to before passing their data to fake websites.

When installing an SSL certificate, the user goes through a process called Validation Authority, which can validate their identity and their company’s, in addition to allowing them to receive reliable indicators.

It works like a verified Twitter account, but this is done on your website so that no cybercriminals create another one pretending to be yours, a practice known as spoofing.

They Are Critical to Receiving Payouts
If you have a business and receive payments through your website, you need to invest in SSL certificates. This is because they are among the 12 criteria required by the payment card industry (PCI). In other words, it is a fundamental resource for their transitions.

They Contribute to Optimizing Website Ranking in Search Engines
When you enable your website for HTTPS, it achieves higher rankings in search engines like Google, which since 2014 has favored this type of website. That’s what SEO experts around the world say, based on studies like the one by Brian Dean, founder of Backlinko.com.

Nowadays, when customers carry out most of their research on the Internet, this represents a great competitive advantage.

Detailed Traffic Data
If your website does not use HTTPs, you are missing information about the visits it receives. This is because when a secure browsing website uses referral links to an unsecured website, it appears as direct access, since HTTP websites do not receive referral data from HTTPS websites.

On the other hand, if you invest in SSL certificates, you will have access to your website’s traffic data in detail, regardless of its source.

SSL Certificates Favor Client Confidence
SSL certificates are important to ensure client confidence. This is because they let you know your data is protected. In addition, by installing an OV or EV SSL, it is possible to show your company in detail, ensuring it is a legitimate organization and enabling your business.

Free Installation
Supported by companies such as Facebook, Cisco, and Mozilla, a movement called Let’s Encrypt has democratized the use of SSL certificates, promoting their free and integrated installation to the control panel, even in the case of shared hosting.

Today, this solution is affordable. Even WordPress users can activate it through a special plan and generate more results for their business.

Types of SSL Certificates

There are three types of SSL certificates. They are: Extended Validation SSL (EV SSL), Organization Validation (OV SSL), and Domain Validation (DV SSL). Below, we explain each one in detail:

  • Extended Validation SSL Certificate (EV SSL)
    The Extended Validation SSL Certificate (SSL EV) allows the Certificate Authority to verify the applicant can use the chosen domain name, in addition to performing a company verification.

    To issue an Extended Validation SSL Certificate (SSL EV), it is necessary to contemplate the EV standards approved in 2007 by the CA/Browser Forum, going through the following stages:

  • Confirmation of the operational, physical, and legal existence of the organization;
  • Validation of the official records of the entity;
  • Verify if it has an exclusive right to use the chosen domain; and
  • Confirm there is an adequate authorization for the issuance of the EV SSL certificate.

    All types of organizations can benefit from EV SSL, but must comply with EV audit guidelines and undergo audits every year.

Organization Validation Certificates (OV SSL)
In this type of certificate, it is also checked whether the applicant can use a certain domain name, in addition to the institution’s validations. One of its greatest advantages is the trust provided to the user, since by clicking on the seal of the Secure Website, customers receive information, which increases their visibility about who is behind the website.

Domain Validation Certificates (DV SSL)
Another case in which CA verifies whether the applicant can use a given domain name. However, here, data related to the company’s identity is not validated and displayed, only encryption.

In this way, the user knows their data is encrypted, but cannot know who receives this information. The great advantage of this type of certificate is its almost immediate issuance, without sending the entity’s documentation. In addition, DV SSL still has an affordable cost.

Subdomains

Another way to differentiate SSL certificates is by taking into account the number of subdomains they have. Thus, they are divided into three: single-domain SSL, multi-domain SSL, and wildcard SSL. Check out their characteristics below:

Single-Domain SSL
As its name suggests, this SSL provides certificates for a single domain. When the entity needs other certificates, it needs to re-hire the service, which makes the domain types below more advantageous options.

Multi-domain SSL
One can use these SSL certificates in all categories (SSL EV, SSL OV, and SSL DV) and validate more than one domain with the same certificate. However, this service is limited, so we recommend you review the number of domains and subdomains covered by the certificate before opting for multi-domain SSL.

Wildcard SSL
Perfect for websites that need encryption security and have many domains, as it covers an unlimited number of domains. It includes VD SSL and OD SSL domain certificates.

How Do They Work?

When you enter sensitive data on a website that has SSL certificates, it is automatically encrypted and accessed only by the applicant.

With the protection of the encryption key, if there is a hacker attack and your information is intercepted, the malicious agent will not be able to view your data.

What’s more: SSL certificates also have the function of assuring the user they are accessing a legitimate website and not a page used for scams.

Through the lock symbol next to the URL, you can feel secure accessing a website and performing operations within it, which is positive for those who use your page for business.

How to Tell if a Website Has the Certificate

Websites that have SSL certificates display the symbol of a lock on the browser bar before HTTPS, as mentioned in the previous topic. This detail points out that entering your data on the website is a secure procedure, without risks related to hackers.

In this sense, all pages must have SSL certificates, especially those where credit card or username and password data are entered. Therefore, it is essential to verify that the HTTPS actually appears in the address.

Another important purpose of SSL certificates is to ensure the legitimacy of the website, providing security to its users.

How to Tell if a Website Has the Certificate

Websites that have SSL certificates display the symbol of a lock on the browser bar before HTTPS, as mentioned in the previous topic. This detail points out that entering your data on the website is a secure procedure, without risks related to hackers.

In this sense, all pages must have SSL certificates, especially those where credit card or username and password data are entered. Therefore, it is essential to verify that the HTTPS actually appears in the address.

Another important purpose of SSL certificates is to ensure the legitimacy of the website, providing security to its users.

How to Install SSL Certificate on a Websit

To obtain an SSL certificate, you will need a Certificate Authority (CA), which consists of a trusted organization capable of signing the certificate with its keys, certifying its validity. This service may be charged, but there are also free alternatives.

Then, your certificate must be installed on the website’s server, which can be facilitated with a quality host and a provider that takes responsibility for this task.

Once you have enabled the SSL certificate, you will be able to load your website over HTTPS and secure its encryption.

Are SSL Certificates Enough to Ensure the Security of a Website?

Information propagated around SSL certificates suggests that their implementation would be enough to ensure the security of a website. This is because when you adhere to this solution, the lock icon appears next to the URL, suggesting protection.

However, despite effective, SSL certificates are not enough to combat the action of cybercriminals, since the interception of the information exchanged between the user and the website is not their only means of action.

Moreover, if SSL deployment does not occur properly, not everything on the website will be protected by encryption. In these cases, the browser will still indicate a protected connection, which can generate a false sense of security.

Other exploits that can make the exchange of information risky include Scripting between websites, MIME mismatches, and Clickjacking.

These practices are widely used by malicious agents to obtain information exchanged between websites and users.

What Are SSL and TLS?

Transport Layer Security (TLS) is an encrypted protocol that provides security when navigating HTTP pages, accessing an email (SMTP), or transferring data in some other way.

The Secure Sockets Layer (SSL) Protocol came later and also guarantees security for website access. Through this feature, one can encrypt sensitive data so that it is not used by malicious actors.

TLS, in turn, represents a more current and efficient version of SSL, used to configure emails and provide security in information exchanges.

What Are the Differences Between SSL and TLS?

TLS works on different ports and uses more efficient encryption algorithms, including the Keyed ? Hashing for Message Authentication Code (HMAC), while the algorithm used by SSL is the Message Authentication Code (MAC).

These features provide protection in Internet communication protocols (TCP/IP), making it possible to view HTTP and HTTPS terminations.

In the case of HTTP, data travels freely, while HTTPS allows you to encrypt the data through SSL/TLS. To do this, the user needs to set up a secure connection.

Best Practices for the Security of Your Website

In addition to the implementation of SSL certificates, other practices are required to ensure the security of your website. Among them, we can highlight:

Employee Training and Awareness
Information security should be a constant concern in your company, so in addition to investing in technology, it is extremely important to make your employees aware of the risks involved in online interactions and train them to deal with these threats.

Use Plugins Focused on the Security of Your Website
One of the great advantages of using WordPress is the availability of plugins specifically designed to ensure the security of your website. Among the options, we highlight: VaultPress, WordFence, Sucuri, and Defender.

Choose a Good Host
Check the host options available in the market and choose the one that addresses all the demands of your company, including the security of your website users and your business strategy.

History of SSL Certificates
In 1990, the HTTP protocol emerged as a form of communication and became indispensable because of its practicality. However, this protocol did not provide protection for connections and for people who needed to enter their data on web pages.

Three years later, they tried to make this interaction more secure through the S-HTTP protocol, without great success.
The following year, Netscape produced the first version of SSL in order to provide security in communication between servers and clients that took place on the Internet.

Due to its numerous flaws, this version was never officially released, but in 1995, it would be replaced by a second version and, in 1996, by a third improved version.

In 1999, TLS 1.0, an upgrade of SSL V3, emerged, with little difference. Seven years later, in 2006, it was time to release TLS 1.1, which was already very different from its first version.

The changes that came in 2008 with TLS 1.2 were even more pronounced, and made it impossible to downgrade to versions before SSL V3.

In 2015, an outline of what TLS 1.3 would be, designed from the version that preceded it, began.

Digital Certificates: Learn about Their Characteristics

The provisional measure 2020-1 of 2001 enabled the creation of the Brazilian Public Key Infrastructure (ICP Brazil), which operates through the National Institute of Information Technology, an agency linked to the Civil House of the Presidency of the Republic.

From then on, it became possible to issue digital certificates, electronic documents that provide legal validity to operations carried out remotely.

In Brazil, the public key infrastructure is used, which we also call a single-root certificate. In practice, the management committee of ICP-Brasil approves technical and operational standards that must be performed by each Root Certificate Authority.

There are also Certificate Authority (CA) in Brazil, which consist of institutions that issue, distribute, renew, revoke, and manage digital certificates. Another purpose of these entities is to make sure the user has the private key corresponding to the public one, through a process called asymmetric encryption.

It works like this: each person or entity holding a digital certificate has access to two codes: a private certificate, which must be kept confidential, and a public certificate, which can be shared.

This means that whenever a document is encoded with the public key, it can only be decoded using the private key.
Another body associated with the Certificate Units is the Registration Authority (RA), which facilitates the interaction between the Certificate Units and the users, and the Time Certificate Authority, responsible for verifying the timing of the interaction and carrying out legal validation.

Several types of digital certificates differ according to the level of security they provide and their applications. These are:

Type A Certificate: This is a digital certificate used to sign any type of document. It is widely used by self-employed professionals, private organizations, and public agencies that need to save time and financial resources, with quick validations for several documents.

Type S Certificate: It consists of a certificate whose decoding can only be performed by those who have authorization. Therefore, if you work with sensitive documents, which include data such as monetary values and personal information, this is your best alternative.

Type T Certificate: This certificate must be used with the other models. This is because it records the date and time of digital transactions, ensuring this information remains in the files without changing.

Type A, S, or T1 Security: All certificates are secure, but type 1 is the one that provides the least security. This certificate is accessible due to the way keys are generated, with a process done by a program on the computer. It is valid for one year, as it can be accessed using a username and password.

Type A, S, or T3 Security: Type 3 digital certificates are generated and stored in a token or smart card. Therefore, only authorized people can access them, making the operation more secure and with a longer expiration time: three years.

Type A, S, or T4 Security: Here we are talking about ICP-Brasil’s most secure digital certificate model. Your private key is generated and stored within the Encryption Security Module and only allows copying to HSM. It is an inviolable model, which erases data if an invasion occurs. So, it is also known as a digital vault.

Digital certificates are increasingly useful for companies and manage a large number of files and sensitive data. After all, they allow files to be sent over the Internet without being misplaced or corrupted.

In addition, since 2018, there is the NF-e 4.0 version, which makes it possible to issue tax documents without using paper. However, those who want to adopt this electronic model to issue tax receipts need to rely on a digital certificate, because it enables the interaction between the servers of the Federal Revenue Service and the computers of the organization.

Digital Certificates in the World

Digital certificates are not a mechanism used only in Brazil. Other nations have also adhered to this resource in their daily lives.

To begin with, the National Identification Document (DIN), which is being implemented in Brazil, is similar to the models used by other countries, in order to bring agility, ease, and security to citizens.

In DIN, the user identification data is gathered in a chipped device, where professional documents and digital certificates can also be included.

Among the countries that have already joined the electronic signature to authenticate documents, the following stand out:

  • The United States;
  • Mexico;
  • Indonesia;
  • China;
  • Turkey;
  • Switzerland; and
  • Member states of the European Union.

With the mandatory digital identification system for all citizens, Estonia is an example of the efficiency of digital certificates to reduce bureaucracy. There, the process of selling and transferring a vehicle is completed in 15 minutes.

In addition, Estonians can use the same documentation for healthcare, access to bank accounts, distance voting, and identification when traveling in the European Union.

In Spain, people have a single document called DNI, which is integrated into the digital certificate and groups user information.

This documentation includes data on biometrics and can be used to drive a vehicle, travel, and report income tax via the Internet.

Currently, regulations related to digital identification are not shared between countries and each nation has its own mechanisms, security practices, and an ICP of its own.

However, with the need to sign documents online, international agreements may soon be made to allow the use of certificates beyond this barrier.

Different Uses of Digital Certificates

Here’s how the different types of digital certificates are used:
As we have already mZentioned in this article, digital certificates are used by websites, providing trust and security to their users.

Another widely used mode is in emails, to identify users, or to enable the digital signature of documents.
They are also used in credit and debit cards via chips that connect banks to commercial establishments in order to enable secure banking transactions.

They are also useful to digital payment companies that need to authenticate kiosks, ATMs, and vending equipment through their data center.

To counter cyber threats and protect intellectual property, a large number of organizations are inserting digital certificates into the IoT devices they operate.

People who develop computer programs also use digital certificates to prevent device cloning and theft of broadband services.

About senhasegura

Senhasegura is part of the MT4 Tecnologia group, which was founded in 2001, focusing on information security.
Present in 54 countries, the company aims to provide cybersecurity to its clients, who now have control over actions and privileged data.

With this, organizations can avoid disruptions related to the performance of malicious actors and information leaks.
The work of senhasegura assumes that digital sovereignty is a right of all and that applied technology is the only way to achieve this goal.

Therefore, it follows the life cycle of privileged access management, before, during, and after access, relying on machine automation, since managing privileged access manually is not enough. Among its commitments, the following stand out:

  • Provide more efficiency and productivity to companies, while avoiding interruptions due to expiration;
  • Perform automatic audits on the use of privileges;
  • Automatically audit privileged changes to detect abuses;
  • Ensure client satisfaction through successful deployments;
  • Provide advanced PAM capabilities;
  • Reduce risks quickly;
  • Bring companies into compliance with audit criteria and standards such as PCI DSS, Sarbanes-Oxley, ISO 27001, and HIPAA.

Conclusion

By reading this article, you saw that:

  • SSL certificates are data files hosted on the source server of a website, which make it more secure by allowing them to move from HTTP to HTTPS;
  • Their main function is to provide security to the communication between the client and the server;
  • Their technology makes it possible to manage sensitive data such as passwords, credit card numbers, and IDs without causing vulnerabilities;
  • SSL certificates make it possible to perform identity validation, as with Twitter accounts, but on websites;
  • They are essential to receive payments through a website;
  • When you enable your website for HTTPS, it achieves higher rankings in search engines like Google;
  • Whoever invests in SSL certificates has access to detailed data about their website visits, regardless of their origin;
  • SSL certificates ensure the legitimacy of your company, leaving your customers assured that their data is protected;
  • One can install an SSL certificate for free;
  • There are three types of certificates: Extended Validation SSL Certificate (EV SSL), Organization Validation Certificates (OV SSL), and Domain Validation Certificates (DV SSL);
  • They can also be classified according to the number of subdomains they present, such as single-domain SSL, multi-domain SSL, and wildcard SSL;
  • Websites that have SSL certificates can be identified by the lock symbol, which is in the browser bar, before https;
  • To install this feature on a website, you must have a certification authority (CA);
  • Although effective, SSL certificates are not enough to combat the action of malicious agents;
  • SSL and TLS provide protection in Internet communication protocols (TCP/IP);
  • You have also learned about best practices for your website security and the history of SSL certificates.
  • Another topic shared in this article was the creation of ICP Brasil, which allows issuing digital certificates, providing legal validity to operations carried out remotely.
  • There are different types of digital certificates, which can be used for the most diverse purposes.

    Was our text on SSL certificates helpful to you? Then share it with someone who might benefit from this content.

About Version 2 Limited
Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Senhasegura
Senhasegura strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.

要是他們有 NAC 就好了……了解 Cisco Hack

Cisco recently confirmed they were the victim of a data breach in which hackers were able to steal 2.8 GB of data. Although these breaches are nothing new (SolarWinds, Credit Suisse, Twitter, the list goes on…) the Cisco breach is especially concerning because many organizations rely on Cisco products to keep their networks safe.   

The Cisco Hack: What Happened?

The threat actors behind the Cisco hack were able to successfully compromise an employee’s personal Google account.  Since the employee had enabled password syncing via Chrome and had saved their Cisco credentials in their work browser, once the account was compromised the hackers had the first bit of information they needed to break in.   

MFA Fatigue & Vishing

Of course, Cisco has MFA (multi-factor authentication) set up for VPN access, so the hackers then used a combination of MFA Fatigue and Vishing (Voice Phishing) attacks to get the employee to accept a push notification. MFA Fatigue is when they spam your device with Push requests to allow access; if you’ve ever accidentally clicked “OK” when you meant to click “Cancel” you know how easy it can be to get it wrong and it only takes once. And if you didn’t know beforehand this was a method hackers use to get break into a VPN….you might just assume it was a glitch, press OK and move on. 

 Vishing is when someone calls you and pretends to be from a legitimate business entity to get you to give up personal and/or financial details. Your first thought is likely to be “I would never fall for that” but these bad actors have plenty of information stored on you to convince you that they’re really calling from where they say they are. Such tactics often include number spoofing to impersonate your bank or corporate office, to confirm details like your credit card number and the last four digits of your SSN.  Everyone has a story of a “near miss” when they almost clicked on a suspicious link or answered some questions they shouldn’t – it only takes one moment of being too trusting.     

And Then…

From there the hackers went on a whirlwind tour of expanding the systems they could access until they reached a domain controller, downloading all the user data, enrolling other devices for VPN access, creating a new user just called “Z” and adding them to the local administrators group, and installing other hacking and access tools like TeamViewer, LogMeIn, Cobalt Strike, and more.  

There is an excellent, detailed write-up here for those interested in a deep dive.   

Could a NAC Have Stopped the Cisco Hack?

Is there a tool that could have prevented the Cisco hack from happening?  If you had a robust NAC solution like Portnox NAC-as-a-Service, would you be safe from this kind of attack?  The answer is absolutely, without a doubt…maybe. 

ZTNA (Zero-Trust Network Access) is a term that gets thrown around a lot, but this is a perfect example of why it’s so important. It boils down to this: your network should never trust that you are who you say you are. Many people think of VPNs as totally safe, and you’ve probably rolled your eyes a time or two when you had to go through the extra MFA step, but when it comes down to it, you don’t want trust just any device accessing your network, even if the user account is valid (because as we know from the Cisco example, sometimes it simply isn’t.) 

So, the best way to prevent a compromised account from accessing your network is to make sure access is limited to only people AND devices you trust. 

Without a VPN, this is easy – you can use the MAC address of the device to verify it and block anything that is using an unknown MAC even if the user credentials are valid. When you introduce a VPN, though, it becomes a little trickier, because VPNs use a ‘virtual’ network interface with a completely made-up MAC address. 

The best way to accomplish true ZTNA is via user account and certificate validation.  Certificate-based authentication is the use of a digital certificate to identify a device before granting access to a network resource (versus granting access to any device when a user account is valid.)  Certificates are stored on a specific device, signed by a trusted root certificate authority, and are only good for a set amount of time. Your NAC checks for the certificate to be valid and properly signed when you try to log in, thus verifying both the user account and device.  While certificate-based authentication is certainly not new, it is gaining popularity due to closing the gaps left by purely password-based authentication. 

There is also a possibility of using ComputerName as a RADIUS Attribute, but the device needs to support additional RADIUS attributes and not all of them do.  If your network is comprised of hardware from several different vendors, certificates are the way to go when you need your solution to be truly vendor agnostic.   

Users are always the biggest threat to network security, and at the end of the day most of our tools are designed to save us from the people who also need access to internal resources to keep us running.   

 

About Version 2 Limited
Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

SafeDNS 被公認為 IT 專業人員必備的 IT 工具

GetApp, an established software review, and recommendation engine, featured SafeDNS in its “10 Must-Have IT Tools for IT Professionals” report. With an overall rating of 4.7,SafeDNS was mentioned as one of the Must-Have IT Tools for IT Professionals with an overall positive rating of 97%.

Not only this, SafeDNS is a winner of not 1 but 2 GetApp Category Leaders reports in the first half of this year! Check out our incredible win:

SafeDNS has been a top-rated product on GetApp. Our users have made it possible! Check out our performance on GetApp –

Here’s what our users have to say about us:

“SafeDNS is a really great product, we have been using it for over 5 years now and it’s really robust. We deploy for all our customers internal networks and this includes our Azure infrastructure and it just works.”

Jason T.

“We have been using this software for years and are very happy with the results. School and Parents are grateful for the safety this software brings to us. When I check our stats and can see the protection that is being provided. Makes us very happy.”

Ruth P.

Want to review SafeDNS? Click here.

About Version 2 Limited
Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SafeDNS
SafeDNS breathes to make the internet safer for people all over the world with solutions ranging from AI & ML-powered web filtering, cybersecurity to threat intelligence. Moreover, we strive to create the next generation of safer and more affordable web filtering products. Endlessly working to improve our users’ online protection, SafeDNS has also launched an innovative system powered by continuous machine learning and user behavior analytics to detect botnets and malicious websites.

道德和道德上模棱兩可的安全追求

Most cybersecurity professionals understand moral ambiguity. Just ask Marcus Hutchins, the “accidental hero” who stopped the WannaCry ransomware attack in its tracks.

Hutchins was working as a security researcher when he discovered a critical flaw in the malware — its kill switch. Not long after, he was indicted on federal charges related to his previous work as a malware developer on HackForums – a bustling collective of young hackers.

Thankfully, Hutchins was eventually cleared of all charges. But his story highlights the murky ethical landscape that many security researchers operate in.

On one hand, companies and individuals are better off when security researchers find and disclose vulnerabilities. On the other hand, some researchers find – or develop – exploits to sell on the dark web. For budding cybersecurity researchers, it’s not always clear where the line is.

After reading Hutchins’ story, I thought a lot about the nature of communities. Communities in the Internet age, specifically, and how they can lead us to the best things the Internet has to offer, or to the worst corners of others’ minds.

Take YouTube, for instance – its algorithm is designed to serve content that pushes users deeper into a specific topic, often toward morally questionable content. The same is true of TikTok, Facebook, and a slew of others. This subconscious manipulation is one of many reasons why it’s so difficult to find a like-minded community where you can collaborate and learn.

Hutchins didn’t need an algorithm to push him into the dark side. He found it while poking around a young hacking forum. Pretty soon, he would go from admiring malware to building his own, with increasingly dark results. Eventually, Hutchins built his own community, amassed followers on the order of tens of thousands, and attracted the attention of Kryptos Logic. And thus began his white-hat path toward neutering WannaCry.

“There’s [a] misconception that to be a security expert you must dabble in the dark side,” said Hutchins. “It’s not true. You can learn everything you need to know legally. Stick to the good side.”

I can only wonder how much more good Hutchins could have done had he found the “good side” long ago. Or, how much good current black-hat hackers could accomplish with encouragement from the right community.

The Modern Security Researcher’s Tribe

In the early days of hacking, only a handful of people could exploit vulnerabilities and gain unauthorized access to systems. These individuals were self-taught, like Hutchins, and their skills were not widely known or understood. As the Internet grew, more and more people became interested in hacking culture, sharing their knowledge and developing new techniques.

It’s a constantly evolving field.

Researchers used to be seen as “lone wolf” operators, working in isolation to scratch an intellectual itch. But the cybersecurity profession has undergone a dramatic transformation in recent years. Today’s security researcher is less likely to be a lone wolf and more likely to be part of a team, working together to uncover critical vulnerabilities and exploits (CVEs) and develop solutions. They are also more likely to use sophisticated tools and techniques to find vulnerabilities in systems. And thanks to the power of the Internet, they can reach a global audience with their findings.

This shift has been driven by the increasing complexity of attacks, which require greater levels of expertise to defend against. Security research is now an essential part of the modern IT landscape, and it is only going to become more important in the years to come.

One thing is certain, though: The work of security researchers has a profound impact on society. They are the ones who find the vulnerabilities that can be exploited to cause massive damage – like WannaCry. But the vulnerabilities they find could just as easily end up in the hands of bad actors who are intent on ripping off people and/or harming critical infrastructure.

The job is a delicate balancing act, one that requires a great deal of responsibility.

It’s important to remember that security researchers are not immune to the same biases and motivations that affect everyone else. They need support, and people to hold them accountable when they come across that ethically dubious line.

There’s no question that security research is a vital part of keeping our online world safe. But where do these researchers thrive? In what types of environments do they do their best work?

For many security researchers, it’s all about the community. It’s here where groups of like-minded individuals share information and ideas. And there are numerous online forums and newsletters where they can share ideas, debate techniques, and collaborate. In addition, there are conferences and in-person meetups to discuss the latest trends and challenges.  

By working together, they can pool their knowledge and resources, making it easier to identify and neutralize threats. In addition, the security research community provides a supportive environment for new researchers, helping them to develop the skills and knowledge that they need to be successful.

Today, the security research community is vast and diverse. It includes individuals from all walks of life, with varying levels of expertise. Some security researchers are full-time professionals, while others are hobbyists or students. But regardless of their background or experience, they all share one common goal: to find and report CVEs. That’s why we developed vsociety – for security researchers to share CVEs and gain communal support.

Of course, not all security researchers need or want to be part of a community. Some prefer to work independently, researching new vulnerabilities and developing innovative new solutions to exploits. For these researchers, the lack of community involvement can actually be a benefit, as it allows them to focus entirely on their work as they see fit. And, for that matter, not every community offers consistent, genuine support.

Take Twitter, where many security researchers gravitate due to a lack of good online communities. Twitter can be a great source of support, but it can also be a breeding ground for new threats. In recent years, we’ve seen several cases of hackers on Twitter developing and releasing malware that caused real-world damage.

Yes, social media intelligence can be a valuable asset for gathering insights on threats or contextualizing current research. But the information found on Twitter needs a thorough scrubbing for veracity and reliability.

Why? Because Twitter is rife with fake news and content disguised to harm organizations or people. The proliferation of misinformation requires security researchers on Twitter to always use keen judgment. But some activities on social media can fall in a gray area; meaning they may be illegal in certain jurisdictions but do not violate Twitter’s terms of service. If a security researcher runs with such information, they could be compromised..

Indeed, it’s more important than ever to find a cybersecurity community that nurtures “good faith” vulnerability hunting. After all, we’re on the verge of the new age in security research…

A New Catalyst for Good Emerges

Security researchers work tirelessly to find vulnerabilities in software and systems, and they report these bugs to the appropriate parties so they can be patched. Many of these researchers also participate in bug bounty programs, which offer rewards for finding and reporting security vulnerabilities. In other words, they get paid to hack systems and find weaknesses. Without security researchers, we would be living in a much less safe and secure world.

While bug bounties can be a great way to crowdsource security testing and build goodwill with the bug-hunting community, it can also be great for adding a misdemeanor (or worse) to your record. The good news is that the U.S. Justice Department recently directed prosecutors not to go after hackers under the Computer Fraud and Abuse Act (CFAA). But only if their reasons for hacking are ethical. Ethical reasons include bug hunting, disclosing CVEs responsibly, and above-board penetration testing.

This is huge news.

While some believe the new policy doesn’t go far enough to protect individual bug hunters, it does provide more freedom for security researchers to find and report CVEs without the fear of legal repercussions. Still, individual security researchers must mind the ethical gap. If they unwittingly cross a muddled line (made even more indecipherable by the policy’s bureaucratic speak), they could be met with legal consequences—making it all the more important for security researchers to learn how to apply caution and ethics in their bug hunting.

A Tribe Called Home

“In my career I’ve found few people are truly evil, most are just too far disconnected from the effects of their actions,” wrote Marcus Hutchins. “Until someone reconnects them.”

A good community – if it does its job well – can reconnect even the most ethically disconnected individuals. But it’s essential for everyone – from individuals to companies to government agencies – to do their part to improve cybersecurity. Whether it’s investing in better security tools or simply being more careful about what information is shared online, we all have a role to play. Our role is in building a community that security researchers may turn to for education, collaboration, and thought leadership.

As technology advances, so must the methods used to protect our data. Cybersecurity professionals are constantly working to stay ahead of hackers by developing new security measures and techniques. At the same time, security researchers are working just as hard to identify potential vulnerabilities in these systems so that they can be addressed before they can be exploited. As security professionals, we are constantly trying to stay ahead of the latest threats and vulnerabilities. We need to be able to quickly identify attacks, respond to them, and prevent them from happening again. To do this, we rely on security researchers who help us understand how attackers operate and what new techniques they are using. It is a never-ending race, but it is one that is essential to the safety of our digital world. And in today’s digital landscape, community plays a pivotal role in driving security researchers toward “good faith” vulnerability hunting.

There will be plenty more people like Marcus Hutchins. Some of whom discover the “dark side” and transition over to the “good side.” And others who discover the “dark side” and remain. With positive support from the right community, we can better steer the Marcus Hutchins’ of this world over to the good side of security research.

#security #community #ethics #hacking #hackers

About Version 2 Limited
Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About vRx
vRx is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.

Log4Shell：如何緩解 Log4j 漏洞 (CVE-2021-44228)

In the end of 2021, the whole digital world has suffered the new cybersecurity flaw named Log4Shell. A new vulnerability is considered to be one of the worst that have been discovered during the last years. It scored 10 out of 10 points on the CVSS vulnerability rating scale, and it puts countless servers at risk.

What is Log4Shell?

On December 9th, a critical vulnerability that allows arbitrary code to be executed was discovered. The exposure got the code CVE-2021-44228.

The Log4Shell is a vulnerability in the open-source logging library, Log4j version 2, which is used by millions of Java-based applications/servers to log error messages. Such digital giants as Tesla, Twitter, Apple iCloud, Amazon, and millions of other companies use the Log4j library.

There is a lookup substitution function in the Log4j library. Log4Shell vulnerability exists because lookup substitutions are not protected enough when dealing with user-controlled input. Unauthenticated users can exploit this vulnerability via a web request to execute arbitrary code with the permission level of the running Java process.

The first worldwide famous target was Minecraft. On December 10th, people started sharing videos showing that, while playing online, they could just insert code to chat on the server and seize power over the server. But most likely, everything started earlier. Cloudflare -Content Delivery Network and DDoS mitigation services provider – checked their systems and noticed that the first attack on their clients with Log4Shell vulnerability had been tried to conduct on December 1st.

What makes Log4j uniquely dangerous even though you seem protected

Exploiting Log4Shell vulnerability allows hackers to launch Remote Code Execution (RCE) and remotely take full control of the victims’ systems. Hackers are already actively exploiting this vulnerability. For the last week, Ransomware groups weaponized their toolset with this exploit and are using it to disrupt normal businesses operations, exfiltrating data & making affected servers unavailable for customers.

One more point which makes Log4Shell as dangerous as it is the simplicity of exploitation. Even “junior” hackers can use this exploit. To gain control over the victim’s system, a hacker inserts the code anywhere this library handles – fill the form the website, modify website URI or Browser user-agent, or text in the support chat – and it will lead to code execution.

The whole java-world is trying to deal with Log4Shell and emphasize that it is the highest possible priority for all-sized businesses. Cisco, Apple iCloud, Microsoft, and so many other huge technology companies have already stated that some of their systems were vulnerable, but they are fixing it. But for small-sized companies without a cybersecurity department, it might be quite hard to mitigate the attack independently.

Which Version is not affected?

Almost all versions of log4j version 2 are affected. On December 14th, version 2.15 was found to still have a possible vulnerability. And a few days later, a Denial of Service (DoS) vulnerability was found in 2.16 too. The developers have already prepared version 2.17 and, as of December 20th, recommend updating the library again.

How to Mitigate the Log4Shell Vulnerability? First aid actions

Put a high priority on your IT/DevOps on patching/mitigating this vulnerability. This is worth immediate effort.

Update

It was previously thought that to be not vulnerable to Log4Shell, it is enough to turn off the lookup substitution function. But after a few days, it came across that it doesn’t work like that. Generally, the main action now (on December 20th) is to update the Log4J library to 2.17, which is supposed to be safe and has lookups turned off.

“To my satisfaction, our programs are not written in Java,” – you might think. But the point is that you may have hundreds of different systems, and they most likely are not developed by the inside team but developed by third parties – as it usually occurs. Therefore, you might not even know what is inside these systems. In this case, you should look at the product’s website or contact support for instructions on what to do to be safe.

Constant Security Monitoring

Log4Shell vulnerability is one of many, critical vulnerabilities that were found during the past ten years. And the situation is constantly evolving. The only way to see what is happening inside your system is to have 24×7 security monitoring and threat remediation and response. It will help you identify your vulnerable internal and external assets, patch production, review your log files for any Remote Command Execution attempts. Security analytics can see attempts to exploit Log4Shell vulnerability in the logs and block them*.

*Only in one client, the UnderDefense Managed Detection and Response team blocked six attempts to exploit this vulnerability only a week after the vulnerability was discovered.

A firewall is not a panacea

A firewall can block the attempts to exploit Log4Shell vulnerability, but this is not a panacea because the firewall main task is “not to pass such text.” But the exploitation of this vulnerability can vary. Hackers can easily make it so that the text does not match 100%, writing the same code using different methods, but still works WAF bypass. Accordingly, WAF is not enough but still shouldn’t be neglected.

Enable blocking on Web Application Firewall through AWS WAF, Cloudflare, or any other WAF you have, or directly on your web-server, reverse-proxy, load balancer.

Penetration Testing

After remediating this vulnerability with your DevOps team, it is worth running a penetration test to ensure external and internal systems are patched correctly, and other old vulnerabilities are not exploitable. Generally, pentesters will do the same as hackers do – try to conduct an attack on the vulnerable system. But don’t forget about other vulnerabilities that existed before Log4Shell and didn’t disappear. It is the same as having 12 bad teeth, but to treat only 1 of them. So, conducting a pentest, it is better not to choose only one vulnerability test.

Conclusion

Since December 9th, developers have thought that user can just turn off lookups in the Log4J library to fix the vulnerability. But a few days ago came across that this method doesn’t work, and millions of systems still stay vulnerable. Developers told to update the Log4J v2 library to 2.16. And people did it. But recently, the vulnerability was also found in 2.16, and now there is a 2.17 version, which is supposed to be safe.

The situation is evolving. Log4Shell is something new, something dangerous, and something that is not studied enough. We recommend you to have your finger on the pulse and take care of your cybersecurity.

About Version 2 Limited
Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About UnderDefense
UnderDefense, a globally top-ranked firm by Gartner and Clutch, provides cyber resiliency consulting and technology-enabled services to anticipate, manage and defend against cyber threats. We empower clients to predict, prevent, detect, and respond to threats.

評估整個 OT 架構的風險

A SCADAfence New Feature Report

Here is the standard, old school way of automated risk assessment across an OT network:  First, scan each device individually. Then evaluate its specific level of risk based on the device’s known vulnerabilities, exposure outside the network, level of criticality to operations, and several other factors. If the device creates a risk, the system issues an alert. This is probably how your current system operates and overall, you likely think that works pretty well.

But the truth is, that approach leaves a large opening in your overall security. Because each device doesn’t just exist in its own bubble. It has a specific place as part of a larger network, and it needs to be analyzed as such. Therefore, The SCADAfence Platform organizes logical groups of connected devices into units called “security zones.” A security zone might be a number of PLCs all on the same line, groups of engineering stations, or it could be groups of devices that exist in the same area of the network. 

The SCADAfence Platform’s new Architecture Risk Assessment feature provides insights into OT network risks based on automated assessments of each security zone and interactions between devices in separate zones. This method uncovers risks that would otherwise be missed.

Detecting Risks Across Security Zones

SCADAfence’s security experts have designed a method to evaluate each security zone in a more holistic manner and rate the risk from each zone to the overall architecture of your OT network.

Architecture Risk Assessment mimics the mind of a top security expert who analyzes the entirety of a network. It closes the gap between the current practice of alerting only on security issues of individual devices and the best-practice risk assessment methodologies of security experts who assess the entire network. The end result is more high-level risks being detected across your OT network. Also, it allows network administrators to reduce risks to their network and identify potential problems before incidents occur.

Without this functionality, you would require an analyst to manually review and analyze the traffic between security zones, and identify possible risks. And of course, reviewing things manually is more time consuming, more expensive, and would overlook many important risks. 

The Architecture Risk Assessment feature can be used during the risk assessment / security posture process which is typically performed before introducing new security controls, or it can be scheduled to be re-run periodically. 

Use This Feature Out-Of-The-Box or Customize It

The SCADAfence Platform has built-in rules that alert on insecure behavior between assets when they are interacting across security zones. For example, the system will alert if it detects administrative access from an external network to critical process equipment inside the OT network. Other systems, that alert only on activities of an individual device, would overlook this risk.

In addition to the built-in rules, the Architecture Risk Assessment functionality allows user-defined rules to be added as well.

The SCADAfence Platform Architecture Risk Assessment Feature evaluates the security risk across logical zones and allows user-defined rule sets.

Summary of Benefits of Architecture Risk Assessment

  • Automatically identify potential risks to your OT network caused by architectural weaknesses such as lack of network segmentation.
  • Understand additional layers of risk caused by activity happening between groups of assets in addition to risks caused by weaknesses of individual assets.
  • Out-of-the-box expertise for architecture risk assessment.
  • Save your organization time and money. No more need for manual analysis and review of traffic between network zones.

SCADAfence New Feature Reports is an occasional series of blogs exploring the many newly added features of the SCADAfence Platform in detail. For more information or to see SCADAfence in action, request a personalized demo.

About Version 2 Limited
Version 2 Limited is one of the most dynamic IT companies in Asia. The company develops and distributes IT products for Internet and IP-based networks, including communication systems, Internet software, security, network, and media products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 Limited offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SCADAfence
SCADAfence helps companies with large-scale operational technology (OT) networks embrace the benefits of industrial IoT by reducing cyber risks and mitigating operational threats. Our non-intrusive platform provides full coverage of large-scale networks, offering best-in-class detection accuracy, asset discovery and user experience. The platform seamlessly integrates OT security within existing security operations, bridging the IT/OT convergence gap. SCADAfence secures OT networks in manufacturing, building management and critical infrastructure industries. We deliver security and visibility for some of world’s most complex OT networks, including Europe’s largest manufacturing facility. With SCADAfence, companies can operate securely, reliably and efficiently as they go through the digital transformation journey.

使用 CVE 優先級來提高您的 OT 安全性

A SCADAfence New Feature report

A large, robust Industrial Control Systems (ICS) network can contain tens of thousands of devices. Each of those devices may have any number of associated known CVEs (Common Vulnerabilities and Exposures). Do the math and what you’ll come up with is a terrifying mountain of possible vulnerabilities. What’s a CISO to do? How to prioritize the work of implementing all the patches needed to keep the OT network safe? The problem is exacerbated if the CISO has limited OT Security team members available. (Check out the 2022 State Of Operational Technology Report for more on that)

Continue reading