Netizen Blog and News

The Netizen team sharing expertise, insights and useful information in cybersecurity, compliance, and software assurance.

recent posts

about

  • Netizen Cybersecurity Bulletin (November 28th, 2024)

    Netizen Cybersecurity Bulletin (November 28th, 2024)

    Overview:

    • Phish Tale of the Week
    • Microsoft’s Monday Outlook and Teams Outage Almost Fully Resolved
    • CMMC 2.0 Program: Key Timeline for Defense Contractors
    • How can Netizen help?

    Phish Tale of the Week

    Often times phishing campaigns, created by malicious actors, target users by utilizing social engineering. For example, in this email, the actors are appearing as a the United States Postal Service. They’re sending us a text message, telling us that due to incomplete address information, our shipment is on hold, and that it’s imperative that we click the link below in order to fill our information out. It seems both urgent and genuine, so why shouldn’t we send it to them? Luckily, there’s plenty of reasons that point to this being a scam.

    Here’s how we can tell not to fall for this phish:

    1. The first warning sign for this SMS is the context in which it was sent. When I recieved this SMS, I immediately knew not to click on the link due to the fact that I did not recently order anything that would be sent through a USPS package. On top of that, it’s very apparent that this message was blasted out to random numbers: the message doesn’t even include my name or attempt to provide any level of familiarity that would convince me to click on their fake link.
    2. The second warning signs in this email is the messaging. This message tries to create a sense of urgency in order to get you to click on their link. Phishing and smishing scams commonly attempt to create a sense of urgency/confusion in their messages in order to get you to click their link without thinking about it first. Always be sure to thoroughly inspect the style and tone of all texts before following a link or other attachment sent through SMS.
    3. The final warning sign for this email is the wording. The grammar is strange and unprofessional, if the actual USPS needed to send you a message they would not include the sentence “The USPS team appreciates your attention,” or anything else with poor sounding English. The final message that should clue you in that the message is a phish is the ending of the text, “Have a pleasant life.” This is a very poor way to get someone to click on your link. All of these different signs point directly to this being a smishing text.


    General Recommendations:

    A phishing attack will typically direct the user to click on a link where they will then be prompted to update personal information, such as a password, credit card, social security, or bank account information. A legitimate company already has this sensitive information and would not ask for it again, especially via your text messages. 

    1. Scrutinize your messages before clicking anything. Have you ordered anything recently? Does this order number match the one I already have? Did the message come from a store you don’t usually order supplies from or a service you don’t use? If so, it’s probably a phishing attempt.
    2. Verify that the sender is actually from the company sending the message.
    3. Did you receive a message from someone you don’t recognize? Are they asking you to sign into a website to give Personally Identifiable Information (PII) such as credit card numbers, social security number, etc. A legitimate company will never ask for PII via instant message or email.
    4. Do not give out personal or company information over the internet.
    5. Do not click on unrecognized links or attachments. If you do proceed, verify that the URL is the correct one for the company/service and it has the proper security in place, such as HTTPS.

    Many phishing messages pose a sense of urgency or even aggressiveness to prompt a form of intimidation. Any email requesting immediate action should be vetted thoroughly to determine whether or not it is a scam. Also, beware of messages that seek to tempt users into opening an attachment or visiting a link. For example, an attachment titled “Fix your account now” may draw the question “What is wrong with my account?” and prompt you to click a suspicious link.

    Cybersecurity Brief

    In this month’s Cybersecurity Brief:

    Microsoft’s Monday Outlook and Teams Outage Almost Fully Resolved

    Microsoft has reported significant progress in restoring its Outlook and Teams services after a major outage on Monday, November 25, 2024. By late Monday evening, the company confirmed that the majority of its services had been restored, with full recovery expected by Tuesday. The issue primarily affected Microsoft 365 users, causing disruptions to email communications and team collaborations across various industries.

    At the peak of the outage, over 5,000 user-reported issues were logged on Downdetector, indicating widespread impact, although the actual scale of the problem was likely larger. Microsoft clarified in a statement on X (formerly Twitter) that “all impacted services except Outlook on the web have been restored.” While most systems were back online, a small subset of users were still experiencing issues accessing Outlook via the web, and Microsoft was actively monitoring and troubleshooting these remaining problems.

    Microsoft’s response included deploying a fix that reached about 98% of affected environments by noon on Monday, although the recovery process was slower than anticipated for some users. By 7:30 p.m. ET, the company had forecasted that service would be fully restored in three hours, but some delays persisted into the evening.

    This disruption, though significant, pales in comparison to other high-profile tech outages this year. For example, the summer 2024 CrowdStrike software issue, which affected global operations, is considered one of the largest IT outages in history, resulting in major losses for Fortune 500 companies and disrupting air travel and hospitals worldwide.

    Despite the inconvenience, some users in the U.S. took to social media to express a mix of frustration and humor, with a few even welcoming the unplanned break before the Thanksgiving holiday. As of now, Microsoft continues to monitor the situation, with the expectation that all services will be fully operational by the following day.

    To read more about this article, click here.

    Hackers Exploit Godot Game Engine to Infect Thousands of PCs

    Cybersecurity researchers have uncovered a malicious campaign leveraging the popular Godot game engine to distribute malware to over 17,000 devices in just three months. According to a report from Check Point Research, attackers have used a custom malware loader dubbed “GodLoader” to exploit Godot’s scripting capabilities, deploying harmful payloads undetected by antivirus solutions.

    The campaign’s primary targets include gamers and developers across multiple platforms such as Windows, macOS, and Linux. Threat actors are taking advantage of Godot’s flexible GDScript scripting language and its .pck file format, which is typically used for game assets, to embed malicious scripts that evade detection. Once these files are executed, they enable attackers to deliver additional malware, such as the XMRig cryptocurrency miner, or to steal sensitive user credentials.

    The malware was distributed via the Stargazers Ghost Network, a sophisticated malware Distribution-as-a-Service (DaaS) platform that abuses GitHub repositories. Between September and October 2024, attackers used over 200 repositories and 225 accounts to propagate infected files, relying on GitHub’s popularity and trustworthiness to disguise their malicious payloads as legitimate resources.

    Victims were tricked into downloading infected tools or games, often from repositories that appeared genuine. While Check Point primarily identified Windows samples, researchers demonstrated how the malware could easily be adapted to other systems such as macOS and Linux.

    The malicious campaign recorded over 200,000 visits to configuration files hosting XMRig malware settings, suggesting the extensive scale of operations. The Stargazer Goblin group, responsible for managing the Stargazers Ghost Network, has reportedly earned over $100,000 since its inception in mid-2022. They also use GitHub “ghost accounts” to manipulate the platform’s trending algorithms, further legitimizing their malicious repositories.

    Godot itself is not inherently insecure. Rémi Verschelde, a Godot maintainer and security team member, clarified:
    “The vulnerability is not specific to Godot. It is possible to write malicious programs in any programming language. We encourage people to only execute software from trusted sources.”

    Verschelde further emphasized that Godot does not register file handlers for .pck files, meaning malicious actors must ship the Godot runtime alongside these files. This requirement adds a layer of complexity for attackers, although it doesn’t mitigate the risk entirely.

    To mitigate such risks, experts recommend only downloading software and tools from verified sources and staying vigilant about suspicious downloads. Developers using platforms like Godot should integrate robust security practices into their workflows, including regular scans for malicious components and updates to mitigate vulnerabilities.

    To read more about this article, click here.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is a CMMI V2.0 Level 3, ISO 9001:2015, and ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

  • Starbucks Forced to Revert to Manual Systems After Major Ransomware Attack

    Starbucks Forced to Revert to Manual Systems After Major Ransomware Attack

    On November 25th 2024, Starbucks became the latest high-profile victim of a ransomware attack that targeted Blue Yonder, a third-party software provider used by many major companies. The attack disrupted Starbucks’ ability to manage employee schedules and payroll systems, forcing the coffee giant to shift operations to a manual system temporarily.

    A spokesperson from Starbucks, Jaci Anderson, assured employees that despite the disruption, the company would ensure all workers are paid for their hours worked, saying: “Store leadership have advised their employees on how to work around the outage manually, and the company will make sure everyone gets paid for all hours worked.” While this issue has caused significant operational headaches for the coffee chain, customers have not experienced any direct impact on their service.

    The Impact of the Blue Yonder Hack

    Blue Yonder, an Arizona-based provider of supply chain management software, has confirmed that its system was hit by a ransomware attack. This provider’s cloud-based tools are used by many companies to manage logistics, payroll, and inventory. In Starbucks’ case, the attack severely disrupted payroll and scheduling functions across 11,000 stores in North America. Blue Yonder, in its statement, said, “The team is working diligently to restore services, but at this point, there is no estimated timeline for full restoration.”

    Other major companies, including grocery chains in the UK, have also been affected by this breach, which has further raised concerns about the vulnerability of supply chain systems, especially those managed by third parties.

    A Larger Trend of Supply Chain Attacks

    This ransomware attack is part of a broader trend that has seen a rise in supply chain-targeted cyberattacks. Experts have noted that these types of breaches are becoming more frequent and more damaging. David Hall, a criminology professor at Leeds University, highlighted the growing scale of these attacks: “We were getting five major ones a year back in 2011, now we’re getting 20, 25 major ones a day.” This increase is largely driven by the rise of third-party vulnerabilities, where attackers gain access to multiple organizations by compromising one trusted service provider.

    The Role of Third-Party Service Providers

    For companies like Starbucks, using third-party services for critical operations like payroll and scheduling carries inherent risks. The Blue Yonder attack is a stark reminder of the dangers of relying on external providers for key business functions. While these services offer efficiency and cost savings, they can also become targets for cybercriminals, as demonstrated by this incident.

    Ransomware attacks often involve locking down systems and demanding a ransom for their release. However, as the frequency of these attacks increases, so too does the complexity of the threat. Blue Yonder has enlisted the help of CrowdStrike to assist in the recovery efforts. This suggests that the company is taking the threat very seriously, as it works to regain control over its systems.

    What Does This Mean for Businesses?

    The Starbucks and Blue Yonder attack underscores the need for organizations to rethink their approach to cybersecurity. Many businesses rely heavily on third-party service providers, and a single breach can create a cascading effect that disrupts entire operations. The focus on supply chain security, particularly in the wake of this attack, is now more critical than ever. It’s clear that investing in robust cybersecurity measures, both internally and through trusted third-party partners, is vital to preventing widespread disruptions.

    Looking Ahead: The Bigger Picture

    While Starbucks and Blue Yonder work to restore normal operations, this incident serves as a reminder of the growing cybersecurity risks that come with interconnected, cloud-based supply chains. As companies, large and small, continue to rely on external vendors, the need for continuous monitoring, auditing, and vulnerability assessments becomes more pressing. The role of government agencies, including the Cybersecurity and Infrastructure Security Agency (CISA), in coordinating response efforts will likely increase as attacks like these continue to grow in scale and impact.

    In the world of cybersecurity, the message is clear: securing the supply chain is not just an IT issue, but a strategic necessity. The path forward will require greater collaboration between businesses and their suppliers, with an emphasis on fortifying defenses and minimizing the impact of future cyberattacks.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • Why CMMC 2.0 Requires Cybersecurity Training for All Employees—and How to Implement It

    Why CMMC 2.0 Requires Cybersecurity Training for All Employees—and How to Implement It

    As the DoD finalizes its Cybersecurity Maturity Model Certification (CMMC) 2.0 framework, effective December 2024, one key element stands out for businesses seeking compliance: training. CMMC 2.0 emphasizes not only technical measures but also the human element, recognizing that employees play a critical role in safeguarding sensitive information. For small and medium-sized businesses (SMBs), a comprehensive, ongoing training program is not just an asset—it’s a necessity.

    Why Training Matters for CMMC 2.0

    The success of any cybersecurity framework hinges on the people tasked with implementing and adhering to its standards. CMMC 2.0 requires contractors to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) through structured levels of security practices. Employees across all roles must understand how their actions influence the organization’s cybersecurity posture and compliance readiness.

    Neglecting training exposes businesses to two significant risks: non-compliance with DoD regulations and vulnerabilities to increasingly sophisticated cyber threats. By educating employees on proper practices, organizations reduce the risk of human error, ensure consistent application of security protocols, and foster a culture where cybersecurity becomes second nature.

    Building an Effective CMMC 2.0 Training Program

    Building an effective CMMC 2.0 training program for employees requires several steps:

    1. Cybersecurity Awareness for All Employees

    Cybersecurity awareness is the foundation of any training program. Employees at every level need to understand basic cybersecurity principles, such as:

    • Recognizing phishing attempts and promptly reporting them.
    • Properly handling sensitive data like FCI and CUI to prevent unauthorized exposure.
    • Using strong, unique passwords and enabling multifactor authentication (MFA) to secure accounts.
    • Avoiding risky online behaviors, such as clicking on unknown links or downloading unverified files.

    Even non-technical staff play a critical role in cybersecurity, as attackers often target end-users through social engineering tactics.

    2. Role-Specific Training

    One-size-fits-all training won’t suffice for CMMC 2.0 compliance. Tailored programs address the specific responsibilities of various departments:

    • IT Teams: Technical staff require advanced training on implementing system monitoring, encryption, and secure network configurations.
    • Managers: Leaders must be equipped to oversee compliance efforts, coordinate incident response plans, and maintain accurate documentation for audits.
    • End-Users: Employees interacting with sensitive systems should focus on recognizing potential threats and adhering to organizational security policies.

    3. Incident Response Preparedness

    No organization is immune to cyber incidents, making it essential to train employees on what to do when breaches occur. Real-world simulations, such as tabletop exercises, help staff practice response protocols, containment strategies, and escalation processes. These exercises also ensure that key personnel are ready to act decisively in high-pressure situations.

    4. Understanding Compliance Requirements

    CMMC 2.0 divides its framework into three levels, each with distinct requirements. Employees should understand how their role contributes to meeting these standards, especially for Level 2 (Advanced), which aligns with NIST SP 800-171. Training should clarify:

    • How the organization conducts self-assessments and third-party audits.
    • Specific practices required at the targeted certification level.
    • Procedures for documenting compliance efforts to demonstrate readiness during audits.

    Creating a Sustainable Training Program

    1. Assess Training Needs

    Identify knowledge gaps within your workforce. Are employees familiar with recognizing phishing attempts? Do technical teams understand how to configure secure networks? Tailoring training to address these gaps ensures no critical area is overlooked.

    2. Use Diverse Learning Formats

    Engage employees by offering training in various formats:

    • Interactive Workshops: Hands-on sessions help IT teams practice implementing cybersecurity tools.
    • E-Learning Modules: On-demand courses ensure all employees have access to foundational cybersecurity knowledge.
    • Regular Seminars: Updates on evolving threats and compliance requirements keep staff informed.

    3. Make Training an Ongoing Effort

    Cyber threats evolve, and compliance standards may change. To stay ahead, organizations should:

    • Schedule quarterly or biannual refresher courses.
    • Share updates on new cybersecurity tools and practices.
    • Analyze past incidents to improve training and prevent recurrence.

    4. Evaluate Effectiveness

    After each session, assess training outcomes through quizzes, feedback surveys, or performance metrics like reported phishing attempts or incident response times. Use this data to refine future programs.

    The Benefits of Training for CMMC 2.0 Compliance

    Investing in employee training provides measurable benefits for SMBs working toward CMMC 2.0 compliance:

    • Minimizes Risk: Educated employees are less likely to fall victim to phishing or mishandle sensitive data.
    • Ensures Consistency: A well-trained workforce applies security protocols uniformly, improving audit outcomes.
    • Strengthens Incident Response: Prepared employees can identify and address issues faster, reducing the impact of breaches.
    • Fosters a Security Culture: Training helps embed cybersecurity into the organization’s DNA, making it a shared responsibility.

    Accessible Resources for SMBs

    Small businesses often operate with limited budgets, but affordable training options are available:

    • Online platforms like KnowBe4 and Infosec IQ offer e-learning solutions tailored for SMBs.
    • Managed Security Service Providers (MSSPs) include training in compliance support packages.
    • The CMMC Accreditation Body (CMMC-AB) provides official resources to guide organizations through the compliance process.

    Training is more than just a compliance requirement for CMMC 2.0—it’s an investment in your organization’s cybersecurity resilience. By equipping your workforce with the knowledge and skills to recognize and respond to threats in accordance with CMMC 2.0, you’re not just meeting regulatory standards; you’re preparing for the future of cybersecurity.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • Netizen: Monday Security Brief (11/25/2024)

    Netizen: Monday Security Brief (11/25/2024)

    Today’s Topics:

    • U.S. Telecom Executives Meet Amid Fears of Chinese Cyber-Espionage
    • Remote Code Execution Threat in 7-Zip: Update to Patch CVE-2024-11477 Now
    • How can Netizen help?

    U.S. Telecom Executives Meet Amid Fears of Chinese Cyber-Espionage

    Chinese hackers have reportedly been embedding themselves into U.S. critical infrastructure systems, aiming to position their operations for potential future conflicts with the United States. According to Morgan Adamski, the executive director of U.S. Cyber Command, these activities are not mere espionage—they are strategic moves to create leverage in the event of geopolitical tensions escalating into open hostilities. The hackers have gained footholds in networks tied to essential services like energy, water, and telecommunications, potentially enabling them to disrupt vital systems at will. Earlier warnings from U.S. officials indicated that the breaches could lead to attacks as subtle as manipulating server cooling systems to cause failures or as devastating as shutting down critical utilities.

    One of the most alarming incidents tied to these cyber operations is the so-called “Salt Typhoon” campaign, described by Senator Mark Warner as the worst telecommunications hack in U.S. history. This breach compromised major telecom providers, such as AT&T and Verizon, and involved the interception of sensitive communications, including calls and messages from senior U.S. political figures. The operation extended to presidential campaign communications before the recent election, raising serious national security concerns. Despite ongoing efforts, officials have found it exceedingly difficult to fully expel the hackers from compromised systems, highlighting the sophistication of the intrusion.

    In an effort to address these escalating threats, U.S. national security officials recently convened with telecom executives at the White House. These meetings facilitated intelligence sharing and discussions on improving cyber defenses across critical infrastructure. Meanwhile, Cyber Command and allied nations have been conducting globally coordinated defensive and offensive operations to degrade and disrupt Chinese cyber activities. Public examples of these measures include indictments, sanctions, and cybersecurity advisories aimed at neutralizing threats.

    The Chinese government has consistently denied allegations of conducting state-sponsored cyberattacks, but experts view these denials as implausible given the scale, coordination, and precision of the operations. The “Salt Typhoon” breach, for instance, has been widely interpreted as part of a larger effort by China to assert dominance in cyberspace, with a particular focus on leveraging vulnerabilities within key U.S. industries. This campaign adds to a growing list of cyber incidents that have underscored the fragility of critical infrastructure and the urgent need for robust public-private partnerships to defend against state-sponsored threats.

    As tensions between the U.S. and China remain high, particularly over issues like Taiwan, cybersecurity experts warn that these intrusions could become precursors to more aggressive actions. The stakes are clear: without significant improvements in cyber defense strategies, the U.S. risks losing its edge in a domain increasingly central to national security.

    Remote Code Execution Threat in 7-Zip: Update to Patch CVE-2024-11477 Now

    A high-severity vulnerability, CVE-2024-11477, has been identified in the widely-used file archiver 7-Zip, posing serious risks to systems using older versions of the software. This flaw, discovered by Nicholas Zubrisky of Trend Micro Security Research, resides in the Zstandard decompression function of 7-Zip. Due to insufficient validation of user-supplied data, an integer underflow can occur, allowing attackers to execute arbitrary code within the affected process.

    With a CVSS score of 7.8, this vulnerability is a significant threat. Attackers can exploit the flaw by coercing victims into opening maliciously crafted archive files, a common attack vector in social engineering schemes. The potential outcomes of exploitation range from data exfiltration to complete system takeover, making this vulnerability particularly concerning for businesses and individuals alike.

    The exploit requires user interaction, as stated in the security advisory, but the implementation of the attack can vary depending on how 7-Zip is deployed. This variability broadens the scope of risk, especially for organizations that integrate 7-Zip into automated workflows or rely on it for managing large-scale archives.

    Tools like 7-Zip are foundational to many IT environments, often embedded in other software systems, making vulnerabilities in such tools a widespread risk. Cybercriminals frequently exploit outdated software as an entry point to broader networks, leveraging these flaws to propagate ransomware or steal sensitive information.

    Outdated versions of 7-Zip not only leave systems vulnerable but also create opportunities for attackers to exploit other systemic weaknesses. Enterprises, particularly those managing sensitive data, must prioritize vulnerability management as part of their overall cybersecurity strategy.

    The vulnerability is addressed in 7-Zip version 24.07, which resolves the integer underflow issue. Users and organizations are strongly urged to update immediately to this or a later version to mitigate risks. While patching is essential, it’s only part of the broader security process; organizations should also review their use of third-party libraries and tools to ensure security measures align with the latest best practices.

    Steps to Strengthen Security Posture

    1. Apply Updates Promptly: Ensure 7-Zip is updated to the latest version across all systems to close this vulnerability.
    2. Conduct Vulnerability Scans: Regularly scan systems for outdated software and known vulnerabilities to prevent exploitation.
    3. Educate Users: Train users to recognize phishing attempts and avoid interacting with suspicious archive files.
    4. Implement Zero Trust Principles: Limit access to sensitive systems and enforce strict application controls, ensuring malicious files cannot easily execute.
    5. Monitor for Indicators of Compromise (IOCs): Proactively watch for unusual system behaviors that may indicate an attempted exploit.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is a CMMI V2.0 Level 3, ISO 9001:2015, and ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

  • Deepening the Integration of C-SCRM in CMMC 2.0

    Deepening the Integration of C-SCRM in CMMC 2.0

    The cybersecurity supply chain risk management (C-SCRM) framework plays a pivotal role in ensuring that contractors within the Defense Industrial Base (DIB) are effectively addressing the risks posed by their interconnected supply chains. As noted in the National Institute of Standards and Technology’s (NIST) SP 800-161r1, C-SCRM ensures that organizations can identify, assess, and mitigate cybersecurity risks that arise from suppliers, their products, services, and the supply chain itself. The integration of C-SCRM within the Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) 2.0 is critical for securing the flow of sensitive data, particularly when dealing with Controlled Unclassified Information (CUI) and Federal Contract Information (FCI).

    Key Aspects of C-SCRM in CMMC 2.0

    Cybersecurity Risk Across the Supply Chain

    C-SCRM ensures that enterprises account for the risks that could arise from external entities such as suppliers, third-party contractors, or vendors. These risks are not just limited to malicious activities or cyberattacks but also include vulnerabilities resulting from poor manufacturing, insecure development practices, or lack of transparency within the supply chain itself. For example, compromised or vulnerable products from suppliers can provide attack vectors into larger enterprise systems. Within CMMC 2.0, this focus is reflected by the updated controls and practices that require organizations to vet suppliers more rigorously and ensure that they meet baseline security standards before integrating products or services

    Incorporating C-SCRM practices means assessing the supply chain continuously, ensuring that each third-party vendor, developer, or integrator is complying with relevant cybersecurity controls. A well-managed supply chain protects against the risks posed by supply chain threats such as software vulnerabilities (e.g., software dependencies from smaller vendors or COTS components) and risks arising from external service providers. CMMC 2.0’s structured approach highlights how organizations must prioritize securing their supply chains, especially when working with contractors that handle CUI or FCI.

    Comprehensive Supply Chain Assurance


    Under CMMC 2.0, contractors at Level 2 and 3 must demonstrate robust mechanisms for securing their supply chain. This includes implementing proper risk assessments, establishing stringent access controls, and maintaining effective vulnerability management practices to ensure products and services are secure throughout their lifecycle. This assurance is particularly important for high-risk government contracts involving sensitive or classified information.

    The new version of CMMC also integrates continuous monitoring of supply chain vulnerabilities—ensuring that contractors are consistently reviewing their relationships with suppliers to assess risk and remedy vulnerabilities. The idea of continuous vigilance ties in directly with Zero Trust Architecture (ZTA) principles, which emphasize never implicitly trusting any party or product, even if they come from trusted vendors or suppliers. Zero Trust demands that contractors authenticate every connection to their systems and verify it, regardless of where it originates within the supply chain.

    Alignment with NIST’s Cybersecurity Framework and Best Practices

    C-SCRM under CMMC 2.0 is deeply aligned with NIST SP 800-161r1, which provides detailed guidance on managing cybersecurity risks within the supply chain. According to NIST, effective C-SCRM practices are comprehensive, covering everything from the acquisition of products to their eventual disposal. This involves performing risk assessments that evaluate the security posture of every entity within the supply chain, identifying weaknesses and mitigating potential threats. For contractors under CMMC 2.0, this means assessing cybersecurity risks at every stage—from initial product sourcing to the decommissioning of a vendor’s services.

    Integrating Risk Management Activities


    CMMC 2.0’s inclusion of C-SCRM brings a strong emphasis on integrating risk management activities into the overall cybersecurity posture of an organization. The model encourages businesses to adopt comprehensive risk management strategies, specifically targeted at addressing cyber risks arising from suppliers and external parties. For example, the updated framework requires that contractors not only assess risks from external parties but also assess internal practices related to the design, development, and deployment of products that interact with external systems. This is particularly important for organizations engaged in software development or those relying heavily on cloud service providers (CSPs) and managed security service providers (MSSPs).

    The C-SCRM framework requires companies to have robust incident response plans in place that also cover the response to supply chain-related breaches. These plans must be coordinated with suppliers and contractors, ensuring that if an incident arises within the supply chain, it can be swiftly identified, communicated, and addressed. The introduction of self-assessments at lower levels of CMMC 2.0 simplifies this process for SMBs, but even smaller contractors must demonstrate the ability to recognize and respond to emerging risks within the supply chain.

    Supply Chain Resilience and NIST’s Guidelines

    A major concern within C-SCRM is ensuring that the supply chain remains resilient in the face of a cybersecurity breach. According to NIST’s guidelines, resilience is a key component in mitigating supply chain risks, emphasizing the importance of systems that can withstand cyberattacks and recover quickly. CMMC 2.0 reflects this by encouraging contractors to adopt practices that enhance the resilience of both their systems and the entire supply chain. This includes not only securing systems and software but also ensuring that third-party vendors maintain a strong security posture.

    Furthermore, CMMC 2.0 aligns well with NIST’s risk exposure framework, encouraging contractors to continually assess and adjust their security measures to adapt to changing cyber threat landscapes. These assessments enable organizations to focus on scalability and maintainability within their supply chains, ensuring that they can continue operating without disruption while addressing evolving threats.

    C-SCRM as a Pillar of CMMC 2.0 Compliance

    The C-SCRM approach integrated into CMMC 2.0 brings a proactive, structured method for managing risks throughout the supply chain, ultimately securing the flow of sensitive defense data. By focusing on thorough vetting of suppliers, rigorous risk assessments, and continuous monitoring, CMMC 2.0 enables contractors to better manage the complexities of modern, interconnected supply chains.

    With growing concerns over supply chain attacks and vulnerabilities within third-party products, C-SCRM under CMMC 2.0 is not just a compliance obligation; it’s a critical component of any organization’s cybersecurity strategy. By integrating strong C-SCRM practices into their operations, businesses within the DIB can bolster their defenses, maintain compliance with DoD requirements, and ultimately contribute to the broader effort to secure the defense ecosystem.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • Should Your SMB Adopt Zero Trust for CMMC 2.0 Compliance? Here’s What You Need to Know

    Should Your SMB Adopt Zero Trust for CMMC 2.0 Compliance? Here’s What You Need to Know

    The transition from Cybersecurity Maturity Model Certification (CMMC) 1.0 to 2.0 marks a significant evolution in how the Department of Defense (DoD) addresses cybersecurity within the Defense Industrial Base (DIB). With the new framework set to take effect on December 16, 2024, CMMC 2.0 simplifies compliance while maintaining robust protection for sensitive information. At the core of this transition is the growing alignment with Zero Trust Architecture (ZTA), a model that reflects a fundamental shift in cybersecurity strategy. For small and medium-sized businesses (SMBs), the question arises: should you adopt Zero Trust now to meet CMMC 2.0’s requirements?

    The Essence of CMMC 2.0

    CMMC 2.0 consolidates the original five maturity levels into three tiers, focusing on foundational, advanced, and expert cybersecurity practices. This streamlined approach reduces the complexity of compliance for small- and medium-sized businesses (SMBs), while ensuring contractors implement strong security measures based on the sensitivity of the data they handle. For example, Level 1 emphasizes basic cybersecurity practices for protecting Federal Contract Information (FCI), while Levels 2 and 3 address more stringent requirements for safeguarding Controlled Unclassified Information (CUI).

    What stands out in this new framework is its flexibility. The introduction of self-assessments for lower-risk contracts and a phased rollout of certification requirements make it feasible for SMBs to adapt without excessive financial strain. However, this flexibility doesn’t equate to leniency; the DoD’s approach emphasizes accountability and measurable security practices, particularly as contractors scale up to higher levels.

    Why Zero Trust Matters

    Zero Trust Architecture (ZTA) plays a pivotal role in bridging the compliance goals of CMMC 2.0 with the realities of modern cybersecurity threats. The underlying principle of ZTA—“never trust, always verify”—is designed to eliminate implicit trust in network environments. This model treats every user, device, and application as a potential threat until verified, providing layers of defense against sophisticated cyberattacks.

    The shift from CMMC 1.0 to 2.0 mirrors this philosophy. By streamlining the framework, the DoD has emphasized proactive security over reactive measures. At higher levels, the alignment with NIST SP 800-171 and SP 800-172 incorporates Zero Trust concepts such as least-privilege access, continuous monitoring, and secure data-sharing protocols. These practices align seamlessly with CMMC’s goals of protecting critical DoD data across its supply chain.

    CMMC 2.0’s Emphasis on Data and Identity

    One of the largest overlaps in concept between CMMC 2.0 and ZTA is the emphasis on identity management and data-centric security. Under the new framework, contractors must demonstrate robust access controls to ensure that only authorized users can interact with sensitive data. This requirement echoes Zero Trust’s principle of strict access control, where multifactor authentication and role-based access systems are paramount.

    For SMBs, this presents both a challenge and an opportunity. While implementing such controls can appear daunting, tools and services tailored for ZTA can simplify this process. Managed security service providers (MSSPs) and automated compliance platforms, for instance, offer scalable solutions that reduce the burden of managing these controls internally.

    Additionally, CMMC 2.0’s reliance on continuous monitoring and incident detection aligns perfectly with Zero Trust’s focus on real-time threat identification. These requirements ensure that contractors remain vigilant, not just during audits but throughout the entire lifecycle of their operations.

    So Should You Switch to Zero Trust?

    For many businesses, especially those navigating the complexities of CMMC 2.0, adopting Zero Trust Architecture (ZTA) might feel like a daunting prospect. However, with the advancement of threat actors and increasing reliance on interconnected systems, Zero Trust is rapidly becoming a necessity rather than an option. But is it the right move for your organization?

    The Case for SMBs

    SMBs might wonder if the shift to Zero Trust is worth the investment, given budget and resource constraints. However, with CMMC 2.0 emphasizing clear compliance requirements and scalable solutions, Zero Trust becomes a strategic decision. For example:

    1. CMMC 2.0 Integration: Adopting Zero Trust helps SMBs meet the stricter access control requirements of Levels 2 and 3 by implementing least-privilege principles and multifactor authentication.
    2. Cost-Effective Security: While implementing Zero Trust may involve upfront investment, it eliminates inefficiencies found in outdated security models, reducing long-term costs related to breach recovery or non-compliance penalties.
    3. Simplified Management: Many modern Zero Trust solutions are cloud-native and designed with scalability in mind. This is particularly beneficial for SMBs, which can leverage managed services to adopt Zero Trust without the need for extensive in-house expertise.

    Challenges and Considerations

    Switching to Zero Trust isn’t without its challenges. Organizations must assess their current infrastructure and determine how to phase in Zero Trust principles without disrupting operations. Key considerations include:

    • Legacy Systems: Older IT systems may not integrate seamlessly with Zero Trust frameworks, requiring upgrades or replacements.
    • Cultural Resistance: Transitioning to a “trust nothing” model can be a cultural shift for organizations accustomed to traditional perimeter-based security.
    • Implementation Complexity: Zero Trust requires granular visibility into user behavior, devices, and applications, which can be resource-intensive without proper tools.

    The Strategic Advantage

    Despite these challenges, Zero Trust is an investment in resilience, one that will definitely pay off. For organizations aiming to achieve CMMC 2.0 compliance, it provides a forward-thinking approach that not only satisfies regulatory requirements but also enhances overall security posture. The flexibility of modern Zero Trust solutions ensures that businesses can start small—such as implementing multifactor authentication and identity verification—and expand as needed.

    The question isn’t just whether you should switch to Zero Trust, but whether your business can afford not to. In an era where breaches are inevitable, Zero Trust serves as both a proactive defense mechanism and a pathway to meeting the increasingly rigorous cybersecurity standards of frameworks like CMMC 2.0. By adopting this model, organizations position themselves not only for compliance but also for long-term success in an evolving threat landscape.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • 400 GB of Bank Data Stolen: What We Know About the Finastra Breach

    400 GB of Bank Data Stolen: What We Know About the Finastra Breach

    Finastra, a major financial technology provider serving some of the largest banks globally, is investigating an alleged data breach involving its internal file transfer platform. The incident, first reported on November 7, 2024, involves a cybercriminal claiming to have exfiltrated over 400 gigabytes of sensitive customer data, which has since been put up for sale on a dark web forum.

    Scope of the Breach

    The company detected unusual activity in its secure file transfer protocol (SFTP) platform and promptly notified its customers. While Finastra has stated that the breach did not impact customer operations or involve malware deployment, the intruder reportedly accessed and extracted sensitive data. Screenshots posted on the dark web show directory listings of files associated with major banking clients, raising concerns about the potential exposure of financial transaction data.

    Investigation and Response

    Finastra confirmed that the incident stemmed from compromised credentials and has been working closely with affected clients to understand the breach’s impact. The company has since replaced the compromised platform with an alternative secure file-sharing system and has been sharing Indicators of Compromise (IOCs) with customers’ security teams.

    Finastra’s CISO is actively engaging with client security teams to provide updates on the eDiscovery process, which aims to identify affected customers and assess the full scope of the breach. Not all customers use the affected platform, and Finastra is prioritizing accuracy and transparency as it communicates findings.

    Potential 400gb of Stolen Data

    The alleged attacker, using the alias “abyss0,” began selling the stolen data on the BreachForums platform. Initial sales attempts date back to October 31, with more explicit mentions of Finastra and its clients surfacing in early November. Interested buyers have been directed to communicate via Telegram, though details about the exact nature of the stolen data remain unclear.

    The October 31st post from user abyss0, image via ke-la.com

    Brian Krebs reported that the threat actor “abyss0” initially listed the stolen Finastra data for $20,000 in late October, later dropping the price to $10,000 by early November. An active cybercriminal, they had previously advertised databases from dozens of other breaches over the past six months. The timeline of this breach indicates that the attacker may have accessed Finastra’s systems well before the suspicious activity detected by the company on November 7.

    As of now, abyss0 has since vanished. Their Telegram account was suspended or deleted, and their BreachForums profile, along with all related sales threads, disappeared shortly afterward.

    Moving Forward

    Finastra could face legal challenges from clients whose data was compromised in the breach. Financial institutions impacted by this incident may seek damages for any regulatory fines, reputational harm, or operational disruptions they experience as a result. Additionally, class-action lawsuits from end customers of affected banks could emerge if personal financial data is confirmed to have been part of the stolen information.

    Restoring trust will be a critical priority for Finastra moving forward. While the company has taken steps to address the immediate aftermath, including replacing the compromised platform and communicating proactively with clients, it must go further to reassure its customers.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • DOJ Reportedly Pressures Google to Divest Chrome Browser Amid Antitrust Push

    DOJ Reportedly Pressures Google to Divest Chrome Browser Amid Antitrust Push

    The U.S. Department of Justice (DOJ) is reportedly pressing for Google to sell off its Chrome browser, claiming the company’s practices have entrenched its monopoly in search and online advertising. Bloomberg reports that this move stems from a broader DOJ effort to implement structural remedies after Judge Amit Mehta ruled in August that Google had violated antitrust laws by dominating search and search text ads. The DOJ’s proposal, expected to be presented to Judge Mehta, may also target other aspects of Google’s operations, including its Android platform and artificial intelligence initiatives.

    Chrome’s Market Power and Role in Google’s Ecosystem

    With a commanding 61% share of the U.S. browser market, Chrome is integral to Google’s success. Its tight integration with Google’s search and advertising platforms has made it the world’s most-used browser. If forced to sell, experts estimate Chrome could be valued at $20 billion. However, the divestment raises questions about its viability as an independent entity. Critics worry that separating Chrome from Google could diminish its capabilities and force users to depend on less robust alternatives like Microsoft Edge or Apple Safari.

    Broader Implications of Antitrust Action

    This potential divestment represents a significant move in the Biden administration’s broader push to rein in Big Tech. By embedding its search engine into Chrome and Android, Google has created a powerful ecosystem that regulators say suppresses competition. Breaking up Chrome could set a precedent, potentially leading to similar actions against other tech giants accused of monopolistic behavior.

    Industry Reactions

    The DOJ’s proposal has ignited a debate among experts. Proponents see structural remedies like divestment as a necessary step to restore competition in the tech sector. Others, however, caution that standalone browsers may struggle financially. Mozilla’s Firefox, for instance, relies on financial backing from Google to survive, highlighting the challenges Chrome might face on its own.

    Some critics also suggest that splitting Chrome off could inadvertently benefit browsers like Safari and Edge, further consolidating power within Apple and Microsoft rather than diversifying the browser market.

    Privacy Concerns

    A central criticism of Chrome is its role in Google’s data-driven ecosystem. The browser collects extensive user data—including browsing history, location, and site interactions—to fuel Google’s advertising dominance. This tight integration has raised alarm among privacy advocates, who argue that Chrome’s dominance gives Google unchecked access to sensitive user information.

    If Chrome operates independently, it could present an opportunity to shift towards a more privacy-conscious model, similar to the direction taken by Mozilla’s Firefox. Enhanced features, such as stricter third-party cookie blocking, anonymized browsing, and user-controlled data permissions, could make an independent Chrome more appealing to privacy-focused users and organizations. However, questions remain about whether Chrome can sustain its development without revenue from Google’s ad network, which may deter significant investments in privacy innovation.

    What Comes Next?

    Google has vowed to appeal the DOJ’s broader antitrust case, ensuring the legal battle will continue for months, if not years. While no timeline for the proposed divestment has been confirmed, the DOJ’s actions suggest increased scrutiny of Google’s operations, with a focus on fostering competition in the tech industry.

    For consumers and industry stakeholders, the stakes are high. The resolution of this case could reshape the digital landscape, influencing not only browser competition but also the broader ecosystem of search, advertising, and mobile operating systems.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • Netizen: Monday Security Brief (11/18/2024)

    Netizen: Monday Security Brief (11/18/2024)

    Today’s Topics:

    • Zero-Day Vulnerabilities in Palo Alto Networks Firewalls Demand Immediate Action
    • Critical WordPress Plugin Vulnerability Exposes Millions of Websites
    • How can Netizen help?

    Zero-Day Vulnerabilities in Palo Alto Networks Firewalls Demand Immediate Action

    Palo Alto Networks has confirmed that a critical zero-day vulnerability in its PAN-OS firewall management interface is being actively exploited in targeted attacks. The issue, initially flagged in early November, has now been classified under two separate CVEs: CVE-2024-0012, an authentication bypass vulnerability (CVSS 9.3), and CVE-2024-9474, a privilege escalation flaw (CVSS 6.9). These vulnerabilities can potentially be chained to achieve remote code execution on exposed management interfaces.

    The exploitation, tracked under the name “Lunar Peek,” was identified on interfaces exposed to the internet. Palo Alto Networks strongly recommends restricting access to the firewall management interface to trusted IPs, as doing so can significantly reduce the attack surface. The vulnerabilities do not impact Prisma Access and Cloud NGFW products. Updates for patches and prevention signatures are expected soon.

    Separately, three additional vulnerabilities in Palo Alto’s Expedition platform (CVE-2024-9463, CVE-2024-9465, and another SQL injection flaw) have also been exploited in the wild, highlighting a broader need for vigilant monitoring and adherence to best practices, such as disabling internet-facing management interfaces.

    Forensic evidence so far includes indications of webshell payloads in attacks, pointing to the severity of potential exploits if these vulnerabilities are left unaddressed. Administrators are urged to monitor for suspicious activities such as unexpected configuration changes or unauthorized user accounts.

    To read more about this article, click here.

    Critical WordPress Plugin Vulnerability Exposes Millions of Websites

    A severe authentication bypass vulnerability has been uncovered in the Really Simple Security (formerly Really Simple SSL) plugin for WordPress. This flaw, tracked as CVE-2024-10924 with a critical CVSS score of 9.8, poses a significant threat to over 4 million websites using the plugin. If exploited, it could allow attackers to gain full administrative access remotely.

    The issue arises from improper error handling in the check_login_and_get_user function, particularly affecting the two-factor authentication feature in plugin versions 9.0.0 through 9.1.1.1. This oversight permits unauthenticated attackers to log in as any user, including site administrators, effectively bypassing security measures.

    The vulnerability’s nature makes it highly exploitable at scale. According to István Márton, a security researcher at Wordfence, the flaw is “scriptable,” enabling automated mass exploitation against WordPress websites.

    Following its responsible disclosure on November 6, 2024, the plugin maintainers released a patch in version 9.1.2 within a week. Due to the severity, WordPress collaborated with the plugin developers to force-update all affected installations, ensuring maximum protection even before public disclosure.

    Users are urged to confirm their plugin is updated to the latest version and audit their site access logs for potential unauthorized activity.

    Successful exploitation could allow threat actors to:

    • Gain unauthorized administrative access.
    • Hijack affected websites.
    • Execute additional malicious activities, such as phishing campaigns or malware distribution.

    This disclosure follows another critical issue reported by Wordfence in the WPLMS Learning Management System theme for WordPress, tracked as CVE-2024-10470 (CVSS score: 9.8). The vulnerability affects versions prior to 4.963 and enables attackers to:

    • Read and delete arbitrary files due to insufficient validation of file paths and permission checks.
    • Access sensitive files such as wp-config.php, forcing the website into a setup state. This state allows attackers to connect the site to a malicious database, potentially leading to a complete takeover.

    Users of the WPLMS theme are advised to upgrade to the latest version and implement strict access controls. Regular monitoring and secure backup practices are also essential to mitigate risks.

    To read more about this article, click here.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is a CMMI V2.0 Level 3, ISO 9001:2015, and ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

  • Greynoise, AI, Zero-Days: AI’s Rapid Advancement in the Field of IDR

    Greynoise, AI, Zero-Days: AI’s Rapid Advancement in the Field of IDR

    GreyNoise Intelligence has recently identified two critical zero-day vulnerabilities in IoT-connected live-streaming cameras, highlighting the need for enhanced cybersecurity measures and proactive detection capabilities in widely deployed devices. These vulnerabilities demonstrate the growing risks posed by IoT devices in sensitive settings, such as healthcare facilities, industrial plants, government operations, and religious institutions. This article will outline the nature of these security flaws, their potential impact across sectors, and the role of AI in uncovering these threats.

    Background: GreyNoise’s AI-Driven Threat Detection

    GreyNoise, a cybersecurity firm with a reputation for advanced threat intelligence, uses an extensive network of sensors to track malicious internet traffic and distinguish it from benign activity. This network enables the detection of emerging threats by analyzing patterns that might otherwise go unnoticed by conventional security measures. In this case, GreyNoise’s AI-driven tools flagged unusual activity targeting specific live-streaming PTZ (pan-tilt-zoom) cameras. The flagged traffic led to the discovery of two previously unknown vulnerabilities, underscoring the effectiveness of AI in early detection.

    Vulnerabilities Identified: CVE-2024-8956 and CVE-2024-8957

    GreyNoise’s findings include two zero-day vulnerabilities in PTZ cameras, which are often used in settings that require high privacy and operational reliability. Affected models include devices equipped with NewTek’s Network Device Interface (NDI) technology, primarily using firmware versions below 6.3.40. These cameras are made by brands such as PTZOptics, Multicam Systems SAS, and SMTAV Corporation, all of which employ the HiSilicon Hi3516A V600 system-on-chip platform.

    CVE-2024-8956 (Insufficient Authentication, CVSS Score: 9.1)

    The first vulnerability, CVE-2024-8956, exposes devices to unauthorized access due to inadequate authentication protocols. This flaw allows attackers to access usernames, MD5-hashed passwords, and other sensitive configuration data. Given the outdated and insecure nature of MD5 hashing, attackers could potentially crack these credentials, enabling them to take over the device and access private video feeds.

    CVE-2024-8957 (OS Command Injection, CVSS Score: 7.2)

    The second vulnerability, CVE-2024-8957, is an OS command injection flaw that allows attackers to execute arbitrary commands on the cameras. If combined with CVE-2024-8956, this flaw can enable total device control, allowing attackers to view, alter, or disable video streams. Attackers may also use compromised devices for Distributed Denial-of-Service (DDoS) attacks or other malicious purposes.

    Sector-Specific Risks

    The wide-ranging use of PTZ cameras in sensitive environments makes these vulnerabilities especially concerning:

    • Industrial Operations: Many manufacturing plants use PTZ cameras for quality control and equipment monitoring. Unauthorized access could allow attackers to surveil operations or disrupt critical monitoring.
    • Healthcare and Telehealth: In medical settings, these cameras may enable telehealth and surgical streaming. A breach could expose patient data, violate privacy regulations, and disrupt essential services.
    • Government and Judicial Settings: Government facilities, including courtrooms, rely on secure video streams for both transparency and security. A vulnerability in these environments could compromise sensitive proceedings or disrupt government operations.
    • Religious Institutions: Streaming cameras are often used in houses of worship to broadcast services. Unpatched vulnerabilities could allow attackers to disrupt live streams or monitor services.

    AI’s Role in Early Detection and Mitigation

    GreyNoise’s AI-driven tools played a critical role in identifying these vulnerabilities before they were widely exploited. By analyzing global traffic patterns, GreyNoise’s system flagged the exploit attempt as an anomaly. This proactive approach allowed researchers to isolate and investigate the vulnerabilities, leading to their disclosure and the timely development of solutions.

    Responsible Disclosure and Next Steps

    Following the discovery, GreyNoise collaborated with VulnCheck to disclose these vulnerabilities responsibly to the affected vendors. This collaboration provided manufacturers with the information needed to address the flaws before they could be exploited on a broader scale. Responsible disclosure is crucial in ensuring that security gaps are addressed swiftly, protecting users from potential exploitation.

    The Future of AI in IDR

    GreyNoise’s application of AI in incident detection and response (IDR) offers a strong case for using machine learning in managing and mitigating cybersecurity threats, especially in high-stakes settings that involve real-time data and sensitive environments. Here’s why you might see AI more heavily adopted in the IDR field:

    How AI Improves IDR

    The scale at which AI operates allows organizations to analyze vast amounts of data almost instantaneously, scanning for deviations that would take human analysts far longer to identify. AI in IDR is essential in IoT contexts, where the network size and device count often make manual monitoring inefficient. By leveraging AI, GreyNoise was able to sort through internet traffic at a global scale to identify malicious activity targeting live-streaming cameras without requiring manual oversight for each device. Once flagged, the system allowed for the vulnerabilities to be investigated and responsibly disclosed.

    Proactive vs. Reactive Cybersecurity

    The traditional approach to incident response often involves responding to detected breaches, which can already compromise sensitive data or operations. In contrast, AI’s real-time capabilities enable a proactive approach, where anomalous patterns are flagged before vulnerabilities are exploited at scale. GreyNoise’s detection of CVE-2024-8956 and CVE-2024-8957 illustrates how AI can offer organizations lead time to patch or isolate vulnerabilities. This proactive stance is crucial for settings such as industrial sites, healthcare facilities, and government agencies, where IoT vulnerabilities could lead to privacy breaches, service disruptions, or even physical security risks.

    AI as the Future of IDR

    The use of AI by GreyNoise demonstrates how machine learning and behavioral analytics will continue to reshape IDR. As AI becomes more integrated into cybersecurity, we can expect faster threat detection, more accurate identification of potential attacks, and a proactive approach to securing IoT networks and other critical infrastructure. These capabilities are essential in a world where the number and complexity of IoT-connected devices are only increasing. By enabling faster, data-driven responses to cyber threats, AI not only improves the security of individual devices but also contributes to broader network resilience and reliability across sectors.

    How Organizations Can Safeguard IoT Devices

    Organizations relying on IoT devices like PTZ cameras can take several steps to improve security:

    • Patch Management: Regularly update firmware and software for IoT devices. Contact vendors to confirm whether devices are affected by known vulnerabilities and apply patches promptly.
    • Network Segmentation: Isolate IoT devices on separate networks to prevent unauthorized access to sensitive systems if a device is compromised.
    • Enhanced Authentication: Implement strong, multi-factor authentication for all IoT devices, avoiding outdated or insecure methods like MD5 hashing.
    • Traffic Monitoring and AI Detection: Leverage AI-driven security tools to monitor network traffic and detect unusual activity, potentially flagging vulnerabilities before they become widespread.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact