Netizen Blog and News

The Netizen team sharing expertise, insights and useful information in cybersecurity, compliance, and software assurance.

recent posts

about

  • CrowdStrike Falcon Sensor Update Triggers Global BSOD Crisis

    CrowdStrike Falcon Sensor Update Triggers Global BSOD Crisis

    On July 19, 2024, a seemingly routine software update from cybersecurity firm CrowdStrike unleashed a cascade of disruptions across multiple industries worldwide. The update to CrowdStrike’s Falcon Sensor, intended to enhance security for mission-critical systems, instead caused Windows-based systems to crash with Blue Screens of Death (BSODs). The incident began in Australia and quickly spread globally, severely affecting sectors such as airlines, emergency services, financial institutions, and even the news.

    Skynews, a British news site, was unable to broadcast properly this morning due to the CrowdStrike incident

    Sequence of Events

    The first reports of BSODs emerged from Australia, where systems in TV networks, 911 call centers, and financial institutions began crashing. As the problem followed the dateline, similar reports surfaced from other regions, including India, South Africa, Thailand, and several European countries. The Paris Olympics and numerous airlines, including American Airlines, United, Delta, and Frontier, faced significant operational challenges due to the widespread system failures.

    In a thread within the official CrowdStrike subreddit, the moderators posted an statement detailing a manual workaround. The suggested steps involved booting affected systems into Safe Mode or the Recovery Environment, navigating to a specific directory, and deleting a .sys file before rebooting. This labor-intensive solution, requiring manual intervention, exacerbated the disruption as it could not be deployed through a network push.

    At 5:45 am Eastern time, CrowdStrike CEO George Kurtz addressed the issue on social media, confirming that the problem stemmed from a defect in a single content update for Windows hosts. He reassured that the issue had been identified, isolated, and a fix had been deployed. Kurtz emphasized that this was not a security incident or cyberattack, but rather a technical defect in the update.

    Widespread Impact

    The repercussions of the faulty update have been extensive and multifaceted. Airlines have been among the hardest hit, with numerous flights grounded or delayed due to system failures. United Airlines, Delta, American Airlines, and Frontier experienced significant disruptions, with passengers facing long delays and cancellations. The aviation sector’s reliance on interconnected IT systems meant that the outage had a profound ripple effect, causing logistical chaos and operational bottlenecks.

    Emergency services also reported major issues. In Alaska, 911 and non-emergency lines experienced outages, while similar problems were reported across other states and countries. Airports in major cities such as Amsterdam, Berlin, London, and Paris saw delays and long queues as check-in systems malfunctioned. Financial institutions in multiple countries faced operational disruptions as computers crashed, affecting banking services and financial transactions.

    A view of the various blue screens of death at the Amsterdam Airport, via X/Twitter

    Adding to the complexity, Microsoft experienced concurrent outages. Multiple Azure services went down due to a backend cluster management workflow issue, which blocked access between storage clusters and compute resources. This overlap in outages led to confusion regarding the root cause, with some attributing disruptions to Microsoft’s services and others to the CrowdStrike update.

    Microsoft issued an advisory on the BSOD issue affecting virtual machines running Windows, suggesting multiple reboots and manual deletions of the problematic file. This highlighted the intertwined nature of modern IT infrastructures, where issues in one system can have far-reaching consequences across various services.

    Analysis: Overreliance on a Single Vendor

    The CrowdStrike incident presents into the public eye a significant vulnerability in modern IT practices: the overreliance on a single vendor for critical security updates. This dependency can lead to catastrophic outcomes when a failure occurs, as demonstrated by the widespread disruptions following the faulty update.

    Key Issues Identified:

    1. Single Point of Failure: This incident has proven how a single update from one vendor could cascade into a global IT crisis. Many organizations, reliant on CrowdStrike for their security needs, were left vulnerable when the update caused system crashes. This single point of failure disrupted operations across diverse sectors, from aviation to emergency services.
    2. Lack of Redundancy and Diversification: Organizations affected by the outage lacked alternative solutions or redundant systems to mitigate the impact. The absence of diversified security measures meant that when CrowdStrike’s update failed, there were no immediate fallback options, leading to prolonged downtime and operational chaos.
    3. Complexity of Manual Interventions: The suggested manual workaround to fix the issue highlighted the challenges of relying on centralized updates. The labor-intensive process of booting systems into Safe Mode and manually deleting files was impractical at scale, especially for large organizations with thousands of affected machines.
    4. Dependency on Interconnected Systems: The concurrent outages at Microsoft illustrated the risks of interconnected IT ecosystems. The reliance on multiple vendors’ systems created a scenario where failures in one could amplify the impact of failures in another, complicating recovery efforts and prolonging disruptions.

    How Does the Faulty Falcon Sensor Driver Cause a BSOD?

    CrowdStrike Falcon requires installing a lightweight tool called “Falcon Sensor,” which includes services and, crucially, drivers that run in Kernel mode to monitor system activity at a low level—a common practice among security software. When a regular application crashes, it can simply be reopened because it operates in User Mode. However, since Falcon Sensor operates in Kernel Mode, any problem can cause a Kernel Panic, resulting in the dreaded Blue Screen of Death (BSOD) on Windows. In this case, the faulty driver, named “C-00000291*.sys,” caused a Kernel Panic due to a bad read to 0x9c as indicated by the stack trace. Because device drivers load during boot, this issue forces Windows into recovery mode. The only fix is to boot into Safe Mode and delete all files starting with “C-00000291” from the C:\Windows\System32\drivers\CrowdStrike directory. While some systems might be fixed through an update, many will require manual intervention via Safe Mode.

    How Does one Fix a BSOD Caused by the Update?

    To fix the Blue Screen of Death (BSOD) and the “Recovery” loop caused by CrowdStrike, you can follow several methods.

    Method 1

    The first method involves using Safe Mode to delete the faulty file. Boot your computer into Safe Mode by selecting “See advanced repair options” on the Recovery screen, then navigating through “Troubleshoot” > “Advanced options” > “Startup Settings” and restarting your PC. After it restarts, press 4 or F4 to enter Safe Mode. Alternatively, you can press F8 repeatedly during startup to access Safe Mode. Once in Safe Mode, open Command Prompt (Admin) and navigate to the CrowdStrike directory by typing cd C:\Windows\System32\drivers\CrowdStrike. Use the command dir C-00000291*.sys to locate the faulty file and then delete it using del C-00000291*.sys.

    Method 2

    Another method involves renaming the CrowdStrike folder. Boot into Safe Mode as described above, open Command Prompt, and navigate to the drivers directory using cd \windows\system32\drivers. Rename the CrowdStrike folder by typing ren CrowdStrike CrowdStrike_old. This allows the system to bypass the faulty driver during startup.

    Method 3

    A third method requires using the Registry Editor to block the CSAgent service. Boot into Safe Mode and open the Registry Editor by pressing Win+R, typing regedit, and pressing Enter. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CSAgent. Find the Start entry, double-click it, and change its value from 1 to 4, which disables the service. Save the changes, close the Registry Editor, and restart your computer. These steps should resolve the BSOD and recovery loop, allowing your system to boot normally.

    Conclusion

    The CrowdStrike incident serves as a critical lesson in the importance of diversification and redundancy in IT security practices. Organizations must re-evaluate their reliance on single vendors and implement comprehensive strategies to mitigate risks, ensuring resilience in the face of unforeseen disruptions.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • Federal Court Ruling: Corporate Liability for Law Firm Data Breaches

    Federal Court Ruling: Corporate Liability for Law Firm Data Breaches

    A recent federal court decision has significant implications for corporate cybersecurity and third-party risk management. The court ruled that a company could be held negligent for a data breach that occurred at its law firm, allowing a negligence claim against Mondelez Global LLC to proceed following a breach at its law firm, Bryan Cave Leighton Paisner, LLP.

    Case Background

    Mondelez Global LLC, a leading snack food manufacturer, hired Bryan Cave to handle legal services. During this engagement, Mondelez provided Bryan Cave with sensitive personal information (PII) of its employees, including names, dates of birth, social security numbers, and addresses.

    In early 2023, Bryan Cave discovered unauthorized access to its systems, revealing that hackers had stolen the PII of 51,100 current and former Mondelez employees. This breach put the affected individuals at risk of identity theft, prompting them to take protective measures such as signing up for credit monitoring and securing their financial accounts.

    Legal Arguments

    Following the breach, the affected employees filed lawsuits against both Mondelez and Bryan Cave. Mondelez sought to dismiss these lawsuits, arguing that it could not be considered negligent merely for sharing employee information with its law firm. However, the plaintiffs argued that Mondelez had a duty to ensure that its law firm adhered to proper data security practices and that unnecessary personal information should have been deleted rather than shared.

    The court declined to dismiss the negligence claim against Mondelez, allowing the plaintiffs to further develop their case. This decision suggests that Mondelez will likely incur significant legal fees during the discovery phase and may ultimately settle to avoid an adverse ruling at trial. If Bryan Cave and its insurers cannot satisfy any judgment, Mondelez may be exposed to further liability.

    Implications for Corporate Cybersecurity

    This ruling underscores several critical areas for corporate cybersecurity and compliance:

    1. Third-Party Risk Management (TPRM)
      • Comprehensive Evaluations: Businesses must conduct thorough and ongoing evaluations of their third-party vendors’ data security practices, including regular audits and continuous dialogue about cybersecurity protocols.
      • Security Questionnaires and Checklists: Detailed assessments should be implemented to ensure compliance with the latest security standards.
    2. Data Minimization
      • Assessing Necessity: Companies should determine what information is essential for their operations and ensure that unnecessary PII is securely deleted.
      • Reducing Risk: Minimizing data shared with third parties reduces the exposure risk in the event of a breach.
    3. Contractual Safeguards
      • Mandating Data Protection: Contracts with third-party vendors should include clauses that mandate stringent data protection measures, including regular security audits and breach notification requirements.
      • Provisions for Updates: Contracts should allow for periodic review and updates to security provisions as threats evolve.
    4. Continuous Monitoring
      • Real-Time Visibility: Advanced monitoring tools and technologies should be deployed to provide real-time visibility into third-party vendor activities.
      • Security Information and Event Management (SIEM): Implementing SIEM systems and intrusion detection systems (IDS) can help promptly identify vulnerabilities.
    5. Incident Response and Recovery
      • Robust Plans: Companies should have clear incident response protocols for third-party breaches, including immediate action, communication with affected parties, and coordination with vendors.
      • Breach Simulations: Regular breach simulations can ensure preparedness and effective response to real incidents.

    Impact on Corporate Policy and Strategy

    The court’s decision has broader implications for corporate policy and strategy. Companies must recognize that their responsibility for data security extends beyond their internal systems to include their entire supply chain. This ruling could lead to an increase in litigation against companies whose vendors suffer data breaches, emphasizing the need for proactive third-party risk management.

    Moreover, the case highlights the importance of cross-functional collaboration within organizations. Legal, compliance, IT, and procurement departments must work together to manage third-party relationships with a focus on security. This collaborative approach can help identify potential risks early and implement appropriate safeguards.

    Recommendations

    • Vendor Assessment: Develop a comprehensive framework for evaluating third-party vendors, including detailed security questionnaires and regular audits.
    • Data Minimization: Implement strict data retention policies that mandate the deletion of unnecessary PII and limit data sharing to essential information.
    • Contractual Obligations: Include clear data security requirements in contracts, with provisions for audits, breach notifications, and penalties for non-compliance.
    • Ongoing Monitoring: Use advanced monitoring tools to maintain real-time visibility into vendor activities and ensure compliance with security standards.
    • Incident Response Planning: Develop and regularly update incident response plans to include third-party breach scenarios and conduct breach simulations to ensure preparedness.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • Critical Vulnerabilities in Ivanti Endpoint Manager and Endpoint Manager for Mobile

    Critical Vulnerabilities in Ivanti Endpoint Manager and Endpoint Manager for Mobile

    Ivanti has released patches for multiple high-severity vulnerabilities affecting its Endpoint Manager (EPM) and Endpoint Manager for Mobile (EPMM) products. The most critical among these is an SQL injection flaw tracked as CVE-2024-37381, which affects the Core server of EPM 2024 flat. This vulnerability, with a CVSS score of 8.4, allows authenticated attackers with network access to execute arbitrary code.

    SQL Injection Flaw in Endpoint Manager (CVE-2024-37381)

    The SQL injection vulnerability, CVE-2024-37381, is considered highly critical due to its potential impact. An attacker with authenticated access within the network can exploit this flaw to execute arbitrary code on the Core server of EPM 2024 flat. Ivanti has released a hotfix for this vulnerability, applicable only to EPM 2024 flat. Full security updates addressing the vulnerability in future releases are planned.

    The hotfix includes updates to the PatchApi.dll and MBSDKService.dll files. Users must download the Security Hot Patch files, unblock the DLL files using PowerShell, and replace the original DLLs on the Core Server. After implementing these steps, rebooting the Core Server or running IISRESET is required to load the new DLLs.

    Vulnerabilities in Endpoint Manager for Mobile (EPMM)

    In addition to the SQL injection flaw, Ivanti has patched four other vulnerabilities impacting all versions of its Endpoint Manager for Mobile (EPMM). Three of these are high-severity flaws:

    1. CVE-2024-36130: Allows attackers within the network to execute arbitrary commands on the underlying operating system of the appliance.
    2. CVE-2024-36131: Similar to CVE-2024-36130, it enables command execution on the OS.
    3. CVE-2024-36132: Leads to authentication bypass and sensitive information disclosure.

    EPMM versions 11.12.0.3, 12.0.0.3, and 12.1.0.1 address these high-severity vulnerabilities along with a medium-severity improper authentication issue (CVE-2024-37403). This improper authentication flaw could allow attackers to access sensitive information.

    Dirty Stream Vulnerability in Docs@Work for Android (CVE-2024-37403)

    Ivanti has also patched a medium-severity vulnerability in its Docs@Work for Android product, tracked as CVE-2024-37403. This path traversal vulnerability, referred to as Dirty Stream, could allow malicious applications to overwrite files in other applications’ home directories, potentially leading to code execution. The updated Docs@Work for Android version 2.26.1 addresses this flaw.

    Security Advisory Details

    The table below provides detailed information on the key vulnerabilities patched:

    CVEDescriptionCVSS Score
    CVE-2024-37381SQL Injection in Core server of Ivanti EPM 2024 flat, allowing authenticated network attackers to execute arbitrary code8.4
    CVE-2024-36130Arbitrary command execution on the OS by network attackersHigh
    CVE-2024-36131Arbitrary command execution on the OS by network attackersHigh
    CVE-2024-36132Authentication bypass and sensitive information disclosureHigh
    CVE-2024-37403Path traversal in Docs@Work for Android, allowing malicious applications to overwrite filesMedium

    Mitigation and Resolution

    For EPM 2024 flat, the Security Hot Patch must be applied by downloading the patch files, unblocking the DLL files, replacing the original DLLs, and rebooting the Core Server or running IISRESET. For EPMM, users should update to the latest patched versions (11.12.0.3, 12.0.0.3, and 12.1.0.1). Docs@Work for Android users should upgrade to version 2.26.1 to mitigate the Dirty Stream vulnerability.

    Mitigation and Resolution

    Ivanti assures that there is no known public exploitation of these vulnerabilities at the time of disclosure. Customers are encouraged to review the advisory and apply the necessary patches promptly. For additional support, users can log a case or request a call via the Success Portal.

    For more detailed information, refer to the Ivanti Security Advisory.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • Security Flaw in Squarespace Migration Leads to Multiple Domain Hijackings

    Security Flaw in Squarespace Migration Leads to Multiple Domain Hijackings

    Between July 9 and July 12, 2024, at least a dozen organizations using domain registrar Squarespace experienced domain hijackings. These incidents predominantly targeted cryptocurrency businesses, including Celer Network, Compound Finance, Pendle Finance, and Unstoppable Domains. Attackers exploited a critical flaw in Squarespace’s migration process from Google Domains, allowing them to commandeer unclaimed accounts and redirect the hijacked domains to phishing sites designed to steal cryptocurrency funds.

    Background and Migration Process

    In June 2023, Squarespace acquired approximately 10 million domain names from Google Domains. The migration process, intended to be seamless, involved pre-linking emails associated with Google Domains accounts to new Squarespace accounts. Squarespace assumed users would utilize social login options like “Continue with Google” or “Continue with Apple.” However, the option to log in via email was available until recently, which became a significant security loophole.

    Methodology of the Attack

    The attackers identified and exploited this oversight by creating accounts using email addresses associated with recently migrated domains before the legitimate owners could register their accounts. This allowed the attackers to gain control without email verification. Once inside the account, they manipulated DNS records to redirect domain traffic and changed MX records to intercept emails.

    Expert Analysis and Findings

    Security experts from Metamask and Paradigm conducted an analysis, revealing that Squarespace did not account for the possibility of threat actors exploiting the email-based login option. Taylor Monahan, lead product manager at Metamask, explained that since there was no password on the account initially, attackers could complete the account setup and gain full access to the domains.

    Monahan stated, “Nothing actually stops them from trying to log in with an email. Since there’s no password on the account, it just shoots them to the ‘create password for your new account’ flow. And since the account is half-initialized on the backend, they now have access to the domain in question.”

    Immediate Response and Actions Taken

    Sometime in the last 24 hours, Squarespace removed the ability for people to create an account with just an email address. However, this step came after the hijackings had already occurred, and the damage had been done. Squarespace has not yet issued an official statement or postmortem analysis of the incident.

    Recommendations for Users

    1. Enable Multi-Factor Authentication (MFA): Log into your Squarespace account, create a new password, and enable MFA to enhance security.
    2. Audit and Remove Excess Contributor Accounts: Log in with the primary domain owner account and remove access to any contributors who no longer need it.
    3. Disable Reseller Access in Google Workspace: If your Google Workspace account was migrated, disable reseller access to prevent unauthorized changes.
    4. Review and Revert Unauthorized Changes: Check your DNS and Google Workspace settings for any unauthorized modifications and revert them as needed.
    5. Consider Transferring Domains: To mitigate future risks, consider transferring your domains to more secure registrars such as Cloudflare, Amazon Route53, or MarkMonitor.

    Detailed Steps for Securing Your Account

    Security experts have published a comprehensive guide for locking down Squarespace user accounts, emphasizing the importance of enabling multi-factor authentication, auditing user access, and securing Google Workspace integration. The guide provides step-by-step instructions for identifying which email accounts have access to your Squarespace account and removing unnecessary user accounts.

    Step-by-Step Instructions:

    1. Enable MFA:
      • Log into your Squarespace account.
      • Navigate to the security settings.
      • Enable multi-factor authentication.
    2. Audit User Access:
      • Review the list of users with access to your domain.
      • Remove any users who no longer need access.
    3. Disable Reseller Access:
      • Access your Google Workspace admin panel.
      • Follow the instructions to disable reseller access provided by Squarespace.
    4. Revert Unauthorized Changes:
      • Check your DNS records to ensure they point to the correct servers.
      • Review MX records to ensure emails are routed correctly.
      • Revert any unauthorized changes.

    Conclusion

    The recent domain hijackings highlight the critical need for robust security measures during domain migrations. Organizations must remain vigilant and proactive in securing their digital assets. By following the recommendations and steps outlined above, Squarespace users can better protect their accounts and domains from unauthorized access and potential security threats.

    For more detailed guidance, refer to the comprehensive security advisory published by Metamask and Paradigm, which includes additional steps and recommendations for securing Squarespace accounts.

    Additional Resources

    By taking these precautions and staying informed about potential vulnerabilities, organizations can mitigate the risks associated with domain migrations and protect their valuable digital assets from malicious actors.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • Expanding on the OpenSSH Vulnerability: New Findings and Continued Risks

    Expanding on the OpenSSH Vulnerability: New Findings and Continued Risks

    Understanding the ‘regreSSHion’ (CVE-2024-6387)

    On July 1, 2024, cybersecurity researchers from the Qualys Threat Research Unit (TRU) disclosed a critical vulnerability in OpenSSH, named ‘regreSSHion’ (CVE-2024-6387). This flaw allows unauthenticated remote code execution (RCE) within OpenSSH’s server (sshd) on glibc-based Linux systems. The vulnerability exploits a signal handler race condition triggered when a client fails to authenticate within the specified LoginGraceTime, potentially granting attackers full root access to affected systems. This significant threat emphasizes the need for robust security measures and prompt patching within Linux environments.

    Introducing a New Vulnerability: CVE-2024-6409

    Building on the initial disclosure, another related issue has been identified: CVE-2024-6409. This vulnerability also involves a race condition in OpenSSH, specifically within the privsep (privilege separation) child process. This vulnerability can lead to remote code execution (RCE) due to improper handling of signals.

    Technical Details

    The CVE-2024-6409 vulnerability arises from a race condition in signal handling within OpenSSH versions 8.7 and 8.8, particularly when the system invokes the cleanup_exit() function from within the grace_alarm_handler(). This function was not designed to be called from a signal handler and may invoke other functions that are not safe to use asynchronously. This issue is exacerbated by distribution-specific patches, such as those found in Red Hat’s OpenSSH packages for RHEL 9, which introduce additional code to cleanup_exit().

    A signal handler race condition vulnerability was found in OpenSSH’s server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd’s SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). This issue leaves it vulnerable to a signal handler race condition on the cleanup_exit() function, which introduces the same vulnerability as CVE-2024-6387 in the unprivileged child of the SSHD server.

    Impact and Exploitability

    While the immediate impact of CVE-2024-6409 is lower compared to CVE-2024-6387, as it affects a child process with reduced privileges, it still presents a significant risk. Differences in the exploitability of these vulnerabilities in specific scenarios might make one more attractive to attackers. Moreover, mitigating one vulnerability without addressing the other can leave systems exposed.

    As a consequence of a successful attack, in the worst case scenario, the attacker may be able to perform a remote code execution (RCE) within unprivileged user running the sshd server. This vulnerability affects only the sshd server shipped with Red Hat Enterprise Linux 9, while upstream versions of sshd are not impacted by this flaw.

    Coordinated Disclosure and Analysis

    This new issue was brought to the attention of major Linux distributions on June 26, 4. Qualys confirmed and completed the analysis on the same day. Although the analysis is ongoing, it has been established that the race condition and potential RCE in the privsep child process pose a considerable risk. This was not disclosed simultaneously with CVE-2024-6387 due to coordination with Red Hat, which had already begun addressing the earlier vulnerability.

    Mitigation Strategies

    Organizations should immediately consider implementing the following measures to mitigate the risks associated with these vulnerabilities:

    1. Patch Management: Update OpenSSH to the latest version that addresses these issues. For instance, replacing calls to cleanup_exit() with _exit(1) in affected versions can prevent exploitation.
    2. Configuration Adjustments: Set LoginGraceTime to 0 to mitigate the race condition and limit the window of opportunity for attacks.
    3. Access Controls: Restrict SSH access to trusted networks and implement strict authentication mechanisms, such as key-based authentication.
    4. Monitoring and Detection: Employ intrusion detection systems (IDS) to monitor for abnormal SSH activity and potential exploitation attempts.

    Risk Information

    CVSS v2:

    • Base Score: 9
    • Vector: CVSS2#AV/AC/Au/C/I/A
    • Severity: High

    CVSS v3:

    • Base Score: 7
    • Vector: CVSS:3.0/AV/AC/PR/UI/S/C/I/A
    • Severity: High

    About OpenSSH

    OpenSSH continues to play a pivotal role in enabling secure communication across Unix-like systems. It remains a cornerstone of secure network management, providing robust encryption and authentication mechanisms essential for maintaining confidentiality and integrity in network operations globally. Despite vulnerabilities like ‘regreSSHion,’ OpenSSH’s commitment to security and ongoing community support underscores its critical importance in modern cybersecurity practices.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • Hackers Reverse Engineer Ticketmaster Bypassing Anti-Scalping Measures on “Non-Transferable” Tickets

    Hackers Reverse Engineer Ticketmaster Bypassing Anti-Scalping Measures on “Non-Transferable” Tickets

    A lawsuit in California filed by concert giant AXS has brought to light a significant issue plaguing the ticketing industry: the battle between ticket scalpers and platforms like Ticketmaster and AXS. Scalpers have managed to reverse-engineer the methods these companies use to generate “non-transferable” tickets, creating and selling them through their own systems.

    Reverse-Engineering Ticketmaster and AXS Systems

    Scalpers have figured out how to regenerate legitimate tickets from the ground up by understanding the underlying code used by Ticketmaster and AXS. This allows them to bypass anti-scalping measures put in place by these platforms. In the lawsuit, AXS claims that brokers are providing “counterfeit” tickets to consumers, alleging that these tickets are produced by illicitly accessing and mimicking the AXS platform. Despite these accusations, the tickets often scan as genuine at events.

    Two security researchers have demonstrated how Ticketmaster’s ticket barcodes can be reverse-engineered, allowing scalpers to generate authentic tickets for concerts. The same method likely applies to AXS tickets, which use similar “rotating barcodes” that change every few seconds. One researcher, after publishing their findings, received offers from brokers to create ticket transfer services for them.

    How Scalpers Bypass Anti-Scalping Measures

    Some brokers have already established their own websites or apps to generate genuine tickets and share them with customers through secondary market services like StubHub, SeatGeek, and VividSeats. These services, often named Secure.Tickets, Amosa App, Virtual Barcode Distribution, and Verified-Ticket.com, are not widely known and typically appear as broken websites when accessed directly. According to an anonymous ticket broker, some of these services are part of larger ticket management software packages, while others are standalone services sold through word-of-mouth.

    The only online information about these services comes from confused fans who question the legitimacy of their tickets for popular concerts and sports events. Despite initial concerns, most tickets bought through these services work as expected. For instance, a Blink-182 fan on Reddit confirmed that tickets from Secure.Tickets were genuine after worrying they had been scammed.

    These ticket generation services offer an easier way for brokers and fans to transfer tickets without needing to meet in person or share account passwords. This technology has given Ticketmaster and AXS more control over how and when tickets can be sold and transferred on the secondary market. However, for highly sought-after events, these companies have started restricting ticket transfers to prevent scalping. This restriction means tickets cannot be moved from one account to another, forcing sales to occur only on Ticketmaster or AXS platforms.

    Legal Actions and Accusations

    Scalpers’ ability to generate tickets from metadata created by Ticketmaster is particularly concerning. A hacking group recently claimed to have dumped thousands of barcodes for Taylor Swift’s Eras Tour. Ticketmaster’s SafeTix technology, which uses rotating barcodes, is supposed to protect tickets, but this system’s vulnerabilities have been exposed.

    404 Media discovered this broker infrastructure after fans of DJ Fred Again expressed concerns about resale tickets bought from Secure.Tickets. A lawsuit filed by AXS against Secure.Tickets and other scalper services accused them of copyright infringement and creating “counterfeit” tickets. The lawsuit alleges that these services misrepresent themselves as using AXS’s proprietary technology while actually circumventing it.

    Security researchers Conduition and David Pokora have both confirmed that the process to generate these tickets is not highly sophisticated and can be replicated by financially motivated individuals. Conduition’s blog post detailed how Ticketmaster’s SafeTix technology works and how it can be bypassed. They built a proof-of-concept app called “TicketGimp” to demonstrate this capability.

    Industry Response and Future Challenges

    Despite multiple requests for comment, Ticketmaster and AXS did not respond to inquiries about these security issues. The companies have not publicly addressed the vulnerabilities exposed by these researchers. Instead, they continue to play a legal game of whack-a-mole with scalpers rather than addressing the root cause with better technology.

    The situation reveals a larger problem in the ticketing industry: the need for more secure and open ecosystems that support third-party ticket resale and delivery platforms. Until such systems are in place, scalpers will continue to exploit vulnerabilities, and ticket buyers will remain at risk of purchasing dubious tickets.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • Major Data Breach Hits AT&T: What You Need to Know

    Major Data Breach Hits AT&T: What You Need to Know

    AT&T has confirmed a major data breach affecting nearly all of its wireless customers, as well as those of mobile virtual network operators (MVNOs) using AT&T’s network. Between April 14 and April 25, 2024, threat actors accessed an AT&T workspace on a third-party cloud platform, resulting in the exfiltration of sensitive customer data.

    Scope and Nature of the Breach

    The compromised data includes records of customer call and text interactions from May 1 to October 31, 2022, and on January 2, 2023. This data consists of telephone numbers that interacted with AT&T or MVNO wireless numbers, interaction counts, and aggregate call durations. Some records also contain cell site identification numbers, which could allow threat actors to approximate the location of customers during interactions.

    Affected MVNOs

    The breach impacted a wide range of MVNOs, including:

    • Black Wireless
    • Boost Infinite
    • Consumer Cellular
    • Cricket Wireless
    • FreedomPop
    • FreeUp Mobile
    • Good2Go
    • H2O Wireless
    • PureTalk
    • Red Pocket
    • Straight Talk Wireless
    • TracFone Wireless
    • Unreal Mobile
    • Wing

    Details of the Compromised Data

    Although the breach did not include the content of calls or texts, nor personal information like Social Security numbers or dates of birth, it still poses significant risks. The stolen call data records (CDRs) are valuable for intelligence analysis, as they reveal communication patterns. Jake Williams, a former NSA hacker and faculty member at IANS Research, commented, “What the threat actors stole here are effectively call data records (CDR), which are a gold mine in intelligence analysis because they can be used to understand who is talking to who — and when.”

    The Third-Party Cloud Provider and the Attacker

    While AT&T did not name the third-party cloud provider, Snowflake confirmed its connection to the breach, which also affected other clients such as Ticketmaster, Santander, Neiman Marcus, and LendingTree. The attackers used stolen Snowflake credentials, obtained from dark web services, to access the data.

    Identified by Google-owned Mandiant as part of the financially motivated threat actor group UNC5537, the attackers demanded ransoms ranging from $300,000 to $5 million for the stolen data. This group includes members based in North America and collaborates with a member in Turkey.

    Response and Mitigation Efforts

    AT&T discovered the breach on April 19, 2024, and promptly initiated its response protocols. The company secured the access point used in the breach and is working with law enforcement to apprehend those involved. As of the latest reports, John Binns, a 24-year-old U.S. citizen, has been apprehended in connection with the incident. Binns was previously arrested in Turkey and indicted in the U.S. for infiltrating T-Mobile in 2021 and selling its customer data.

    Impact on Customers

    AT&T is notifying current and former customers whose information was compromised. Although the breached data does not include names, the availability of phone numbers and call records increases the risk of phishing, smishing, and other online fraud. Customers are advised to be vigilant and only open messages from trusted senders.

    In response, Snowflake has implemented mandatory multi-factor authentication (MFA) for all users to reduce the risk of future account takeovers.

    Industry-Wide Implications

    This breach highlights the vulnerabilities in third-party cloud platforms and the need for robust security measures. The fallout from the Snowflake data theft has affected 165 customers, illustrating the cascading effects of cyber incidents. This event underscores the critical importance of securing access points and implementing stringent authentication protocols to protect sensitive information.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • ACAS: Optimizing Vulnerability Management and Threat Mitigation

    ACAS: Optimizing Vulnerability Management and Threat Mitigation

    In today’s digital age, organizations face an ever-evolving landscape of cyber threats that demand robust security measures. To address these challenges, leveraging the Assured Compliance Assessment Solution (ACAS) has become crucial for conducting comprehensive cybersecurity assessments. ACAS is a powerful suite of tools designed to help organizations identify, assess, and mitigate vulnerabilities within their networks and systems, ensuring they remain compliant with various security standards and regulations.

    What is ACAS in Cyber Security?

    The Assured Compliance Assessment Solution, commonly referred to as ACAS, is a set of tools developed by the Defense Information Systems Agency (DISA) in collaboration with Tenable, Inc. ACAS primarily serves the United States Department of Defense (DoD), but its robust capabilities have made it a valuable asset for other government agencies and private sector organizations. ACAS integrates network vulnerability scanning, configuration assessment, and network discovery into a unified platform, providing a comprehensive overview of an organization’s security posture.

    Key Components of ACAS

    ACAS comprises several components, each playing a critical role in the vulnerability management process:

    1. Nessus Scanner: The core scanning engine, Nessus, performs detailed vulnerability scans on network devices, servers, and applications. It identifies known vulnerabilities, misconfigurations, and potential security risks. Nessus is renowned for its extensive plugin library, which is regularly updated to include the latest vulnerability checks.
    2. Security Center: This centralized management interface consolidates scan data, providing administrators with a holistic view of their network’s security status. Security Center facilitates reporting, trend analysis, and compliance tracking. It also allows for customized dashboards and reports, making it easier for security teams to communicate findings to stakeholders.
    3. Passive Vulnerability Scanner (PVS): PVS continuously monitors network traffic to detect vulnerabilities in real-time, without the need for active scanning. This component is particularly useful for identifying new devices and emerging threats. By monitoring traffic, PVS can detect anomalous behavior that might indicate a security incident.
    4. 3D Tool: This visual representation tool aids in mapping the network topology, enabling administrators to understand the relationships and dependencies between various network assets. It provides a visual context to the scan results, which can help in identifying potential security issues related to network architecture.

    The Role of ACAS in Vulnerability Assessment Services

    Vulnerability assessment services are critical for maintaining a secure and resilient IT environment. These services involve the systematic evaluation of systems and networks to identify security weaknesses that could be exploited by attackers. ACAS enhances vulnerability assessment services in several ways:

    1. Comprehensive Scanning: ACAS’s Nessus Scanner conducts thorough scans, covering a wide range of vulnerabilities across different platforms and technologies. This ensures that even the most obscure vulnerabilities are identified. The extensive plugin library of Nessus is particularly beneficial in detecting a variety of vulnerabilities, from outdated software versions to complex misconfigurations.
    2. Continuous Monitoring: The Passive Vulnerability Scanner allows for real-time detection of vulnerabilities as they appear. This continuous monitoring capability is essential for promptly addressing new threats. Continuous monitoring helps in maintaining a high level of security by ensuring that vulnerabilities are detected and addressed before they can be exploited.
    3. Automated Reporting: ACAS automates the generation of detailed reports, highlighting critical vulnerabilities and providing actionable insights. These reports are essential for compliance audits and for informing stakeholders about the security posture. Automated reporting reduces the administrative burden on security teams, allowing them to focus more on remediation efforts.
    4. Risk Prioritization: By leveraging the Security Center, organizations can prioritize vulnerabilities based on their severity and potential impact. This helps in allocating resources effectively to address the most critical risks first. Prioritization is crucial for efficient vulnerability management, ensuring that the most significant threats are mitigated promptly.

    Benefits of Using ACAS for Cybersecurity Assessments

    The adoption of ACAS offers numerous benefits for organizations aiming to strengthen their cybersecurity defenses:

    1. Enhanced Security Posture: ACAS provides a comprehensive understanding of an organization’s vulnerabilities, allowing for timely remediation and improved overall security. With its detailed scanning and reporting capabilities, ACAS helps organizations stay ahead of potential threats.
    2. Regulatory Compliance: ACAS supports compliance with various regulatory frameworks such as NIST, FISMA, and DoD policies. This is particularly important for organizations handling sensitive information. Compliance with these standards not only helps in avoiding legal penalties but also builds trust with clients and stakeholders.
    3. Resource Optimization: The prioritization and automation features of ACAS enable efficient use of resources, reducing the time and effort required for vulnerability management. By automating repetitive tasks and focusing on critical vulnerabilities, organizations can make better use of their security personnel and tools.
    4. Proactive Threat Management: With continuous monitoring and real-time detection capabilities, ACAS empowers organizations to adopt a proactive approach to threat management, staying ahead of potential attackers. Proactive threat management involves anticipating and mitigating threats before they can cause significant damage, thus maintaining the integrity of IT systems.

    Implementing ACAS in Your Organization

    Implementing ACAS in an organization involves several steps to ensure its effectiveness. Firstly, it is essential to perform a thorough inventory of all network assets to be scanned. This inventory helps in configuring the Nessus Scanner to cover all critical systems. Regularly updating the scanner’s plugin library is also crucial to ensure it can detect the latest vulnerabilities.

    Secondly, integrating ACAS with other security tools and processes can enhance its effectiveness. For instance, integrating ACAS with a Security Information and Event Management (SIEM) system can provide a more comprehensive view of the organization’s security posture.

    Lastly, regular training for security personnel on using ACAS is vital. Keeping the team updated on the latest features and best practices ensures that the organization can fully leverage ACAS’s capabilities.

    Conclusion

    In the face of growing cyber threats, leveraging advanced tools like ACAS is vital for conducting comprehensive cybersecurity assessments. ACAS’s integrated suite of components provides organizations with the necessary capabilities to identify, assess, and mitigate vulnerabilities effectively. By incorporating ACAS into their cybersecurity strategy, organizations can enhance their security posture, ensure regulatory compliance, and optimize their vulnerability management processes. Embracing such robust solutions is essential for safeguarding sensitive data and maintaining the integrity of IT infrastructures in today’s dynamic cyber landscape. Implementing and utilizing ACAS effectively can significantly bolster an organization’s defense against potential cyber threats, ensuring long-term security and resilience.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • RADIUS Protocol Vulnerability BlastRADIUS Exposes Networks to MitM Attacks

    RADIUS Protocol Vulnerability BlastRADIUS Exposes Networks to MitM Attacks

    Cybersecurity researchers have uncovered a critical security flaw in the RADIUS network authentication protocol, termed BlastRADIUS, which can be exploited to conduct Man-in-the-Middle (MitM) attacks and bypass integrity checks under specific conditions.

    “The RADIUS protocol allows certain Access-Request messages to lack integrity or authentication checks,” stated Alan DeKok, CEO of InkBridge Networks and creator of the FreeRADIUS Project. “This means an attacker can alter these packets undetected, forcing user authentication and granting unauthorized access.”

    Understanding RADIUS

    RADIUS, or Remote Authentication Dial-In User Service, is a client/server protocol that centralizes authentication, authorization, and accounting (AAA) for network users. Its security relies on a hash derived from the MD5 algorithm, which has been deemed cryptographically broken since December 2008 due to collision attack vulnerabilities.

    Technical Details of the Vulnerability

    The BlastRADIUS vulnerability leverages a chosen prefix attack on Access-Request packets, allowing modification of the response packet to pass integrity checks. Successful exploitation requires the ability to alter RADIUS packets in transit, posing significant risks to organizations transmitting packets over the internet.

    While using TLS for RADIUS traffic and employing the Message-Authenticator attribute enhances packet security, the inherent design flaw in RADIUS affects all standards-compliant clients and servers. This necessitates urgent updates from internet service providers (ISPs) and organizations using the protocol.

    Vulnerable Authentication Methods

    Particularly vulnerable are PAP, CHAP, and MS-CHAPv2 authentication methods. DeKok emphasized the need for ISPs to upgrade their RADIUS servers and networking equipment to mitigate this risk. Anyone using MAC address authentication or RADIUS for administrative logins is also vulnerable unless they utilize TLS or IPSec, as 802.1X (EAP) is not affected.

    Impact on Enterprises and ISPs

    For enterprises, attackers would need access to the management virtual local area network (VLAN). ISPs are at risk if they send RADIUS traffic over intermediate networks or the wider internet. The vulnerability, scoring a high CVSS score of 9.0, mainly threatens networks transmitting RADIUS/UDP traffic in the clear.

    Recommendations for Mitigation

    Immediate action is essential for system administrators to determine their exposure and upgrade their systems accordingly:

    1. RADIUS Traffic Accounting Only: If your RADIUS traffic is purely accounting, the attack doesn’t affect you immediately, but upgrades are still necessary.
    2. Access-Request Packets via RADIUS/TLS (RadSec): The attack doesn’t affect you immediately, but upgrades are still necessary.
    3. EAP Authentication Only: The attack doesn’t affect you immediately, but upgrades are still necessary.
    4. Local Requests Only: Upgrade your RADIUS servers to be protected, though the NAS equipment also needs updating.

    For everyone else, upgrading RADIUS servers is urgent to prevent a broad class of attacks. Further protection requires complex configuration changes. Vendor documentation can guide upgrading multiple systems, but comprehensive resources like BlastRADIUS product guides and test software are invaluable.

    Proof of Concept and Exploitation

    Researchers have developed a proof of concept, though it is not publicly available. No evidence indicates active exploitation in the wild. Even if recreated, the attack demands significant cloud computing power per packet, making large-scale attacks cost-prohibitive except for high-resourced attackers like nation-states.

    Conclusion

    If your network isn’t using RADIUS, it may be more vulnerable than networks employing RADIUS. The root cause of the vulnerability lies in certain Access-Request packets lacking authentication and integrity checks, allowing attackers to manipulate network access.

    Safe Practices

    All EAP (802.1X) authentication, Accounting-Request, CoA-Request, Disconnect-Request packets, and RADIUS over TLS (RadSec) are secure against this vulnerability.

    System administrators must swiftly upgrade and secure their networks against this critical flaw to protect against potential exploits and ensure robust network security.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • Corporate Chatbots at Risk: Insights from a Twitter Thread on LLM Input Handling

    Corporate Chatbots at Risk: Insights from a Twitter Thread on LLM Input Handling

    In a seemingly light-hearted tweet on July 9, 2024, Jay Phelps (@_jayphelps) pointed to a significant concern in the world of large language models (LLMs) and their input handling. His tweet, suggesting that Amazon product pages could replace ChatGPT subscriptions for AI needs, accompanied by a screenshot showing an Amazon response with a React code snippet, sheds light on a crucial issue: the precision and security of LLM input management.

    X/Twitter user @_jayphelps demonstrating the improper input handling by Amazon’s “Looking for specific info?” search bar

    Contextual Relevance and Security

    LLMs like ChatGPT are sophisticated tools designed to provide contextually accurate responses based on user inputs. However, the incident highlighted by Phelps reveals the potential for these models to return contextually inappropriate outputs. The Amazon product page, intended for customer queries about products, delivering a technical code snippet, underscores a fundamental challenge in AI development: ensuring that responses are relevant and confined to the appropriate context.

    This is not merely an amusing glitch but a reminder of the vulnerabilities that can arise from improper input handling. The security implications are profound. If AI systems can be manipulated to produce unintended responses, they could be exploited in ways that jeopardize user data and system integrity.

    Ambiguity and Misinterpretation

    One of the inherent challenges in LLMs is handling ambiguous inputs. Misinterpretations can lead to responses that are not just irrelevant but potentially harmful. In cybersecurity, where precision is critical, such errors can open doors to exploitation. A system’s inability to correctly interpret and respond to inputs can result in the dissemination of incorrect information, which malicious actors could leverage to their advantage.

    Security and Privacy Concerns

    The use of AI on platforms not specifically designed for secure communication raises significant security and privacy issues. When sensitive queries are input into non-secure systems, there is a risk of unauthorized logging and exposure of confidential information. Ensuring that AI responses are generated and handled securely is paramount to maintaining user trust and protecting sensitive data.

    The Susceptibility of Corporate Chatbots

    Corporate chatbots, widely used for customer service and interaction, are particularly susceptible to these issues. There have been multiple instances where users have manipulated chatbots into providing information or performing actions outside their intended scope. This susceptibility underscores the importance of rigorous security measures in AI systems deployed by companies.

    For instance, several Twitter posts have highlighted how users have tricked corporate chatbots into divulging sensitive information or generating unintended outputs. These examples serve as cautionary tales for businesses relying on AI to interact with customers, emphasizing the need for robust input validation and context management.

    X/Twitter user @wunderwuzzi23, using Expedia’s chatbot travel assistant to assist them in writing a bubble sort algorithm in Go

    Mitigation Strategies

    To address these challenges, developers and cybersecurity professionals must prioritize the development of advanced contextual algorithms capable of accurately discerning user intent. Implementing stringent security protocols and conducting regular audits to identify and rectify vulnerabilities are critical steps in this process.

    Moreover, educating users on the proper use of AI platforms and the importance of secure and contextually appropriate queries can help mitigate the risks associated with improper input handling. Developing integrated security frameworks that ensure consistent and reliable handling of user inputs across different AI platforms is also crucial.

    Conclusion

    While humorous, these Twitter exploits demonstrate significant issues across the board with LLM input handling that cannot be ignored. As AI technology continues to evolve, ensuring the security and contextual accuracy of LLMs is essential. By addressing these challenges head-on, we can enhance the reliability and security of AI systems, ensuring they serve as valuable assets rather than potential vulnerabilities.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact