Security vulnerabilities are a common occurrence in managing any business’s organizational security. The prompt patching and remediation of any new vulnerabilities are critical to reducing the outside attack surface. Netizen’s Security Operations Center (SOC) has compiled five vulnerabilities from October that should be immediately patched or addressed if present in your environment. Detailed writeups below:
CVE-2023-22515:
A Broken Access Control issue could lead to unauthorized administrative access and potential data exfiltration. This vulnerability has a NIST CVSSv3 base score rating not provided in the information and it affects Atlassian Confluence Data Center and Server versions 8.0.0 through 8.5.1. The vulnerability allows unauthenticated remote threat actors to create unauthorized Confluence administrator accounts, by triggering a vulnerability via a request on the unauthenticated /server-info.action endpoint, subsequently accessing the /setup/setupadministrator.action endpoint to create a new administrator user. Attacks utilizing this CVE require no user interaction as it can be exploited remotely. Exploit details and proof of concepts have been observed in open source publications as of October 10, 2023. The recommended mitigation is to immediately upgrade to fixed versions as per Atlassian’s upgrading instructions. If upgrading is not immediately feasible, restricting untrusted network access is advised until upgrades can be applied. For more technical details or proof of concept, refer to Atlassian’s security advisory for CVE-2023-22515 and the CISA advisory AA23-289A.
CVE-2023-4966
A Sensitive Information Disclosure issue, nicknamed Citrix Bleed, could lead to unauthorized access to sensitive data. This vulnerability has a NIST CVSSv3 base score rating of 9.4/10 and it affects Citrix NetScaler ADC and NetScaler Gateway versions: 14.1 before 14.1-8.50, 13.1 before 13.1-49.15, 13.0 before 13.0-92.19, 13.1-FIPS before 13.1-37.164, 12.1-FIPS before 12.1-55.300, and 12.1-NDcPP before 12.1-55.300. The vulnerability allows malicious actors to disclose sensitive information if the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Exploits of CVE-2023-4966 on unmitigated appliances have been observed. The recommended mitigation is to install the relevant updated versions of NetScaler ADC and NetScaler Gateway. For more information, refer to this Citrix Security Bulletin or the NVD.
CVE-2023-4911
A Buffer Overflow issue, nicknamed Looney Tunables, could lead to local privilege escalation. This vulnerability has a NIST CVSSv3 base score rating of 7.8/10 and it affects GNU C Library (glibc) version 2.34 and specific backported versions in RHEL-8.5 and onwards. The vulnerability arises from a buffer overflow in the GNU C Library’s dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable, which could allow a local attacker, by crafting malicious GLIBC_TUNABLES environment variables when launching binaries with SUID permission, to execute code with elevated privileges. The attack complexity is Low and requires Low privileges but does not require user interaction. There have been mitigations provided such as a SystemTap script to prevent setuid programs from being invoked with GLIBC_TUNABLES in the environment, requiring users to unset or clear the GLIBC_TUNABLES envvar to invoke the setuid program. This mitigation will need to be re-applied upon system reboot. Once the glibc package is updated to a version containing the fix, the systemtap generated kernel module can be removed. For more technical details or proof of concept, refer to this link from the NVD.
CVE-2023-46747
A Critical Authentication Bypass issue could lead to remote code execution (RCE) by unauthenticated attackers. This vulnerability has a NIST CVSSv3 base score rating of 9.8/10 and it affects F5 BIG-IP, specifically the Traffic Management User Interface (TMUI). The vulnerability allows attackers to send arbitrary requests to bypass authentication and execute system commands with full administrative privileges. An attack utilizing CVE-2023-46747 does not require user interaction. No proof of concept has been released as of October 27, however, past vulnerabilities in BIG-IP have seen prompt exploitation and release of PoCs by researchers. The recommended mitigation is to apply patches provided by F5 for affected versions of BIG-IP as soon as possible. In case patching cannot be performed immediately, F5 has provided some mitigation guidance in article K000137353, though this comes with certain warnings regarding its applicability. For more technical details or proof of concept, refer to the NVD.
CVE-2023-43208
A Remote Code Execution (RCE) issue could lead to unauthorized access and execution of commands. This vulnerability has a NIST CVSSv3 base score rating of N/A as the score is not yet provided. It affects Mirth Connect versions prior to 4.4.1. The vulnerability allows attackers to execute arbitrary code on the system due to an incomplete patch for a previous vulnerability (CVE-2023-37679). The attack complexity has not been provided but does require no user interaction as it’s an unauthenticated vulnerability. There’s no publicly available technical details or exploits as of now. The recommended mitigation is to upgrade to Mirth Connect version 4.4.1. For more technical details, check out this link from the NVD.
Conclusion:
In conclusion, software vulnerabilities are a common nuisance to IT and security teams everywhere. Organizations that prioritize the remediation and patching of these vulnerabilities will drastically reduce their attack surface and ensure no doors into their environment are left unlocked.
How Can Netizen Help?
Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time.
We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type.
Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.
Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans.
Questions or concerns? Feel free to reach out to us any time –
Google Launches AI Security Initiatives Including Bug Bounty Program and $10 Million AI Safety Fund
VMware Releases Patches for Critical vCenter Server RCE Vulnerability CVE-2023-34048
How can Netizen help?
Phish Tale of the Week
Often times phishing campaigns, created by malicious actors, target users by utilizing social engineering. For example, in this text message, the actors are appearing as USPS, the United States Postal Service, and informing you that action needs to be taken regarding your delivery. The message politely explains that “USPS” is holding our package at a warehouse, and that we just need to update our address in order to receive it. It seems both urgent and genuine, so why shouldn’t we visit the link they sent us? Luckily, there’s plenty of reasons that point to this being a scam.
Here’s how we can tell not to click on this smishing link:
The first red flag in this message is the senders’ address. Always thoroughly inspect the sender’s address to ensure it’s from a trusted sender. In this case, the actors neglected to spoof their messaging address, and a simple look at the sender’s address makes it very apparent that the email is not from USPS. In the future, review the sender’s address thoroughly to see if a text could be coming from a threat actor.
The second warning signs in this text is the messaging. This message tries to create a sense of urgency by using language such as “cannot be delivered” and “within 12 hours.” Phishing scams commonly attempt to create a sense of urgency in their messages in order to get you to click their link without thinking about it first. Always be sure to thoroughly inspect the style and tone of all texts before following a link sent through SMS.
The final warning sign for this email is the lack of legitimate USPS information. Fortune 500 companies, the government and similar organizations standardize all communications with customers. This text includes a small “thank you” message at the bottom in an attempt to gain credibility, but it lacks all of the parts of a credible USPS message and can be immediately detected as a phishing attempt.
General Recommendations:
A smishing attack will typically direct the user to click on a link where they will then be prompted to update personal information, such as a password, credit card, social security, or bank account information. A legitimate company already has this sensitive information and would not ask for it again, especially via your text messages.
Scrutinize your messages before clicking anything. Have you ordered anything recently? Does this order number match the one I already have? Did the message come from a store you don’t usually order supplies from or a service you don’t use? If so, it’s probably a phishing attempt.
Verify that the sender is actually from the company sending the message.
Did you receive a message from someone you don’t recognize? Are they asking you to sign into a website to give Personally Identifiable Information (PII) such as credit card numbers, social security number, etc. A legitimate company will never ask for PII via instant message or email.
Do not give out personal or company information over the internet.
Do not click on unrecognized links or attachments. If you do proceed, verify that the URL is the correct one for the company/service and it has the proper security in place, such as HTTPS.
Many smishing messages pose a sense of urgency or even aggressiveness to prompt a form of intimidation. Any SMS requesting immediate action should be vetted thoroughly to determine whether or not it is a scam. Also, beware of messages that seek to tempt users into opening an attachment or visiting a link. For example, an attachment titled “Fix your account now” may draw the question “What is wrong with my account?” and prompt you to click a suspicious link.
Cybersecurity Brief
In this week’s Cybersecurity Brief:
Google Launches AI Security Initiatives Including Bug Bounty Program and $10 Million AI Safety Fund
In a move to bolster the security of Artificial Intelligence (AI) technologies, Google has unveiled a series of initiatives that underscore its commitment to AI safety. These include an AI-specific vulnerability reporting program (VRP), a $10 million fund, and the introduction of a Secure AI Framework (SAIF).
One of the standout features of this announcement is the AI-Specific VRP, which promises rewards to security researchers identifying vulnerabilities in generative AI. These vulnerabilities could range from unfair biases and hallucinations to tampering with model behaviors. With increasing concerns about the misuse of generative AI, Google is keen to harness the expertise of the global research community to highlight and mitigate potential threats. Google’s expanded VRP focuses on both conventional security vulnerabilities and threats specific to AI-powered tools. The company stated, “Reward amounts are dependent on the severity of the attack scenario and the type of target affected.”
To tackle potential threats in the AI supply chain, Google introduced the Secure AI Framework (SAIF). This aims to fortify critical components within the machine learning supply chain, essential for building trustworthy AI applications. Google’s initial efforts under SAIF spotlight the model signing and attestation verification prototypes, leveraging tools like Sigstore and SLSA. These tools work in tandem to verify software identities, thereby enhancing supply chain resilience. Amid a surge in supply chain attacks, Google is intent on increasing transparency in the machine learning supply chain throughout its development lifecycle. Drawing parallels between traditional software and machine learning models, Google proposes adopting supply chain solutions in order to protect ML models. The Google Open Source Security Team (GOSST) will utilize SLSA and Sigstore to enhance the overall integrity of AI supply chains. This collaborative endeavor builds upon Google’s earlier alliance with the Open Source Security Foundation.
Additionally, in collaboration with industry giants Anthropic, Microsoft, and OpenAI, Google is setting up a $10 million AI Safety Fund. The fund aims to stimulate further research in AI safety, reflecting a collective commitment to ensuring the secure development and deployment of AI technologies. Below is a chart detailing Google’s scope on what constitutes a reward in their AI bug bounty program.
Category
Attack Scenario
Guidance
Prompt Attacks
Crafting adversarial prompts that allow an adversary to influence the behavior of the model, and hence the output in ways that were not intended by the application.
In Scope
Prompt Attacks
Prompt injections that are invisible to victims and change the state of the victim’s account or any of their assets.
In Scope
Prompt Attacks
Prompt or preamble extraction in which a user is able to extract the initial prompt used to prime the model only when sensitive information is present in the extracted preamble.
In Scope
Prompt Attacks
Using a product to generate violative, misleading, or factually incorrect content in your own session: e.g., ‘jailbreaks’. This includes ‘hallucinations’ and factually inaccurate responses. Google’s generative AI products already have a dedicated reporting channel for these types of content issues.
Out of Scope
Training Data Extraction
Attacks that are able to successfully reconstruct verbatim training examples that contain sensitive information. Also called membership inference.
In Scope
Training Data Extraction
Extraction that reconstructs nonsensitive/public information.
Out of Scope
Manipulating Models
An attacker able to covertly change the behavior of a model such that they can trigger pre-defined adversarial behaviors.
In Scope (Only when a model’s output is used to change the state of a victim’s account or data.)
Manipulating Models
Attacks in which an attacker manipulates the training data of the model to influence the model’s output in a victim’s session according to the attacker’s preference.
In Scope (Only when a model’s output is used to change the state of a victim’s account or data.)
Adversarial Perturbation
Inputs that are provided to a model that results in a deterministic, but highly unexpected output from the model.
In Scope (In contexts where an adversary can reliably trigger a misclassification in a security control for malicious use or adversarial gain.)
Adversarial Perturbation
Contexts in which a model’s incorrect output or classification does not pose a compelling attack scenario or feasible path to Google or user harm.
Out of Scope
Model Theft / Exfiltration
Attacks in which the exact architecture or weights of a confidential/proprietary model are extracted.
In Scope
Model Theft / Exfiltration
Attacks in which the architecture and weights are not extracted precisely, or when they’re extracted from a non-confidential model.
Out of Scope
Other Issues
A bug or behavior that clearly meets our qualifications for a valid security or abuse issue.
In Scope
Other Issues
Using an AI product to do something potentially harmful that is already possible with other tools. For example, finding a vulnerability in open source software (already possible using publicly-available static analysis tools) and producing the answer to a harmful question when the answer is already available online.
Out of Scope
Other Issues
Issues that we already know about are not eligible for reward.
Out of Scope
Other Issues
Potential copyright issues: findings in which products return content appearing to be copyright-protected. Google’s generative AI products already have a dedicated reporting channel for these types of content issues.
Out of Scope
Google’s reward criteria for reporting bugs in AI products
VMware Releases Patches for Critical vCenter Server RCE Vulnerability CVE-2023-34048
Recently, a highly critical vulnerability surfaced in VMware’s vCenter Server, a pivotal component in VMware’s vSphere suite, widely recognized for overseeing virtualized environments. This flaw, indexed as CVE-2023-34048, has garnered significant attention due to its severe implications and the inherent risks it presents.
This vulnerability revolves around an out-of-bounds write condition in vCenter Server’s implementation of the Distributed Computing Environment / Remote Procedure Calls (DCERPC) protocol. For those unfamiliar, DCERPC serves as a fundamental protocol for remote procedure call (RPC) systems, enabling inter-process communication.
To understand the magnitude of this flaw, one should note that if successfully exploited, it allows an attacker – even without authentication – to induce a remote code execution (RCE) scenario. This essentially hands over the complete reins of the affected system to the malicious actor. The vulnerability was given a CVSSv3 base score of 9.8 after being disclosed on October 25th.
The actual threat of this vulnerability lies mainly in its exploitation parameters, which shockingly require little to no effort to achieve:
Authentication: Not required.
Attack Complexity: Low.
User Interaction: None.
This essentially means that attackers can execute the exploit remotely without necessitating any user interaction, making it a lucrative target for cybercriminals. Moreover, the vulnerability facilitates a pathway for a potential cascading attack, where an intruder can pivot from the compromised vCenter Server to other interconnected systems and in using this lateral movement amplifying the breach’s ramifications.
In response to the detection of this flaw, VMware demonstrated commendable proactiveness. The intriguing aspect of their response was the decision to roll out patches for multiple end-of-life products. It’s rare for companies to revisit phased-out versions, but given the exceptional threat this vulnerability poses, VMware deemed it essential to provide patches even for outdated versions. VMware’s advisory said patches have been issued for vCenter Server versions 6.7U3, 6.5U3, VCF 3.x, and vCenter Server 8.0U1.
Organizations and system administrators leveraging VMware’s products must be cognizant of the following action points:
Prompt Patching: Considering the absence of viable workarounds, applying the security patches for the affected versions of vCenter Server and VMware Cloud Foundation becomes paramount.
Network Vigilance: Heightened monitoring of network traffic is advised, with emphasis on the potential exploitation vectors like ports 2012/tcp, 2014/tcp, and 2020/tcp.
Access Control: Implementing stringent access controls and firewall rules can significantly mitigate the risk of a potential breach.
Continuous Monitoring: Ensure that the systems are monitored in real-time for any signs of breaches or unusual activities. Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) should be up-to-date and operational.
User Education: While this specific vulnerability doesn’t require user interaction for exploitation, cultivating a culture of security awareness can safeguard against other potential threats.
Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time.
We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type.
Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.
Netizen is a CMMI V2.0 Level 3, ISO 9001:2015, and ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans.
Cisco IOS XE Software, a critical component of many Cisco network devices, has recently been found to have vulnerabilities in its Web UI feature. These vulnerabilities, if exploited, can provide attackers with significant access and control over affected devices. The vulnerabilities are particularly concerning for systems where the web UI feature is activated in the Cisco IOS XE Software. The activation of this feature is typically done using the ip http server or ip http secure-server commands. If a system administrator has used either of these commands, the device is potentially vulnerable. Cisco’s internal investigation has uncovered two distinct vulnerabilities: CVE-2023-20198 and CVE-2023-20273, which in tandem can result in a privilege escalation and system compromisation.
CVE-2023-20198: Privilege Escalation in Cisco IOS XE Software Web UI
This vulnerability allows attackers to gain initial access to the device. Specifically, attackers exploit this vulnerability to issue a privilege 15 command, which in turn allows them to create a local user with a specific password. This user can then log in with standard user access rights.
Technical Details:
Nature of Vulnerability: CVE-2023-20198 is a privilege escalation flaw in the web UI feature of Cisco IOS XE software. Both physical and virtual devices with the HTTP or HTTPS Server feature enabled are vulnerable.
Exploitation Path: The exploitation allows an attacker to gain full administrative rights and unauthorized access to the system. Once the attacker has secured this privileged account, they can create a secondary local user account with standard access rights. This user serves as a pivot for further exploits, particularly to leverage the subsequent vulnerability, CVE-2023-20273.
CVE-2023-20273: Command Injection in Cisco IOS XE Software Web UI
Once initial access is secured, attackers can exploit this second vulnerability. Leveraging the previously created local user, they can elevate their privileges to the ‘root’ level. With root access, they can write malicious implants to the device’s file system.
Technical Details:
Nature of Vulnerability: CVE-2023-20273 is a command injection flaw within the Web UI feature of Cisco’s IOS XE software. While it can be exploited independently, its potential is significantly amplified when used in tandem with CVE-2023-20198.
Exploitation Path: With a local user account, attackers can exploit this vulnerability to inject arbitrary commands. This ability becomes particularly concerning when these commands are executed with root privileges, offering the attacker almost unrestricted control over the device’s functionalities and data.
Sequential Exploitation
As per the sequence outlined, after obtaining initial access and creating a privileged account via CVE-2023-20198, an attacker creates a local user account with normal privileges. Utilizing this local user account, the attacker exploits CVE-2023-20273 to run commands with elevated (root) privileges on the device, further consolidating their hold on the system. Both vulnerabilities are being actively tracked by Cisco under the identifier CSCwh87343.
Mitigation and Recommendations
Given the seriousness of the vulnerabilities discovered in the Cisco IOS XE Software’s Web UI feature, we urge all stakeholders to take immediate and decisive action, including the following steps:
Check for Affected Systems: System administrators should immediately verify if the HTTP Server feature is operational on their devices. This can be achieved by logging into the system and using specific CLI commands. If the ip http server or ip http secure-server command is present in the global configuration, the device is potentially at risk.
Disable the HTTP Server Feature: Cisco’s primary recommendation is to disable the HTTP Server feature on all devices that are accessible from the internet. This can be achieved using the no ip http server and no ip http secure-server commands in the global configuration mode.
Limit Access: If disabling the HTTP Server feature is not feasible, it’s crucial to restrict its access only to trusted source addresses. Cisco believes that access lists applied to the HTTP Server feature, which limit access from untrusted hosts and networks, can effectively mitigate risks.
Upgrade: Cisco advises all customers to upgrade to a fixed software release that addresses these vulnerabilities. They have provided a detailed table in their advisory to guide customers on the appropriate software versions.
Stay Informed: As this is an evolving situation, it’s essential to stay updated with announcements from Cisco. The company has committed to updating their advisory as more information becomes available.
How Can Netizen Help?
Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time.
We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type.
Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.
Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans.
Questions or concerns? Feel free to reach out to us any time –
The highly exploitable CVE-2023-4966 vulnerability in Citrix NetScaler at first glance proves incredibly dangerous to NetScaler environments. While initial analyses have highlighted the potential risk and exploitation scenarios, a deeper technical examination is essential to fully comprehend its intricacies and the subsequent steps for mitigation.
Affected Products and Versions:
Affected Product
Affected Version
Fixed Version
NetScaler ADC and NetScaler Gateway
Prior to 13.0-92.19
13.0-92.19 and later releases of 13.0
NetScaler ADC and NetScaler Gateway
Prior to 13.1-49.15
13.1-49.15 and later releases of 13.1
NetScaler ADC and NetScaler Gateway
Prior to 14.1-8.50
14.1-8.50 and later releases
NetScaler ADC 12.1-NDcPP
Prior to 12.1-55.300
12.1-55.300 and later releases of 12.1-NDcPP
NetScaler ADC 12.1-FIPS
Prior to 12.1-55.300
12.1-55.300 and later releases of 12.1-FIPS
NetScaler ADC 13.1-FIPS
Prior to 13.1-37.164
13.1-37.164 and later releases of 13.1-FIPS
Note: Citrix has emphasized that NetScaler ADC and NetScaler Gateway versions 12.1 are End of Life (EOL). Users are strongly advised to upgrade to a supported version immediately.
CVE Details:
CVE
Description
CVSSv3
Severity
CVE-2023-4966
Sensitive information disclosure
9.4
Critical
CVE-2023-4967
Denial of service (DoS)
8.2
High
Note: Apart from CVE-2023-4966, Citrix addressed one additional vulnerability in security bulletin CTX579459.
Technical Analysis of CVE-2023-4966
CVE-2023-4966 is rooted in an information disclosure vulnerability that has far-reaching implications. Although it’s categorized as an information disclosure type, the flaw’s potential to allow session hijacking amplifies its severity. When an attacker exploits this vulnerability, they gain the ability to hijack authenticated sessions, an action that could potentially bypass MFA. This means unauthorized actors could gain full control over NetScaler environments, pivotal in managing application delivery within corporate settings.
Cybersecurity firm Mandiant’s discovery that the flaw has been under active exploitation since August only emphasizes the ongoing issue. The attacks have primarily targeted professional services, technology, and government organizations. Charles Carmakal, Mandiant’s CTO, emphasized the persistence of authenticated sessions even after the application of patches, leading to a scenario where attackers could still utilize stolen session data for unauthorized access. On LinkedIn, he advised all organizations to “terminate all active sessions,” explaining that “these authenticated sessions will persist after the update to mitigate CVE-2023-4966 has been deployed. Therefore, even after the patch is applied, a threat actor could use stolen session data to authenticate to resources until the sessions are terminated.”
The exploitation of CVE-2023-4966 isn’t straightforward, as it leverages the persistence of authenticated sessions post-patch. This means the attackers could potentially maintain control over the sessions until they are manually terminated. The information disclosure mechanism is potent, giving attackers insights into session IDs and other sensitive data pivotal for maintaining unauthorized access.
The Importance of Proactive Security
The patches introduced by Citrix for the CVE-2023-4966 vulnerability are targeted specifically at rectifying issues in certain versions of the NetScaler ADC and NetScaler Gateway. A notable point of concern in these patch notes is the recommendation for users of the 12.1 version to transition to a more recent version, given its designation as End of Life (EOL). This situation accentuates the broader principle that cybersecurity is not just about reactive measures like patching, but also proactive strategies. It’s crucial for organizations to not only apply timely patches but also to be forward-thinking by upgrading to supported and more secure software versions, to avoid issues like this vulnerability. In addition, maintaining a robust security posture necessitates an ongoing and thorough review of security practices and infrastructures to ensure vulnerabilities are identified and addressed promptly, and potential risks are mitigated effectively.
Advisory
The critical nature of this vulnerability, combined with the active exploitation in the wild, calls for an immediate and comprehensive response. Beyond patch application, organizations must follow Carmakal’s advice and terminate all active sessions to nullify the persistence of potential unauthorized access. Citrix has issued patches for the affected versions, but the termination of sessions is a manual step that organizations must undertake to ensure the complete eradication of the risk.
How Can Netizen Help?
Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time.
We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type.
Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.
Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans.
Questions or concerns? Feel free to reach out to us any time –
The GPU.zip vulnerability, discovered by researchers from Carnegie Mellon Software and Societal Systems and detailed in their research paper titled “GPU.zip: On the Side-Channel Implications of Hardware-Based Graphical Data Compression,” jeopardizes the security of numerous graphics processing units (GPUs). This side-channel attack exploits an inherent weakness associated with graphical data compression in integrated GPUs (iGPUs). The vulnerability emanates from the data-dependent nature of the compression algorithms, which inadvertently leak sensitive information through observable patterns in DRAM traffic and cache occupancy. Exposure of this nature leaves a broad spectrum of GPUs, including those manufactured by industry giants like AMD, Apple, Arm, Intel, Nvidia, and Qualcomm, susceptible to unauthorized data access. Browsers like Google Chrome and Microsoft Edge are particularly vulnerable due to their specific architectural and security configurations.
A Vulnerability in iGPUs
A common feature in integrated GPUs (iGPUs) is graphical data compression. While it’s instrumental in enhancing memory efficiency and rendering performance, this feature isn’t without drawbacks. The compression process’s data-dependent nature can unintentionally create extremely exploitable security vulnerabilities. Research indicates that it can cause data-dependent traffic in DRAM and cache occupancy, leading to potential side-channel exploits. The GPU.zip vulnerability allows an attacker to exploit this iGPU-based compression channel. By manipulating SVG filters within web browsers, one can execute pixel stealing attacks, which are based on creating specific patterns influenced by a secretive pixel within a browser. When the iGPU processes these patterns, the compression output reveals details about the secret pixel.
Technical Implications of the Vulnerability
In real-world scenarios, this vulnerability can be exploited by malicious webpages to extract pixel values from another webpage, especially in browsers like Google Chrome, sidestepping security protocols like the same-origin policy (SOP). The exploitation pathway works in a simple, direct fashion in which attackers use the GPU data compression leakage channel to their advantage. By observing rendering time differences or using specific metrics, they can extract valuable information. Chrome and Microsoft Edge are particularly vulnerable to the GPU.zip attack; their architecture, which permits certain actions with iframes and delegates rendering to the GPU, makes them susceptible. However, it’s worth noting that the inherent issue isn’t with the Chromium engine itself, suggesting that browsers can potentially mitigate the risk.
GPU.zip Attack Example
In the research paper, the team presents a proof-of-concept, a real-world attack that extracts a username from Wikipedia. The results, as illustrated in the accompanying figure, highlight the attack’s potency on two distinct processors: an Intel i7-8700 (c) and an AMD Ryzen 7 4800U (b). While the assault on the AMD Ryzen was swift, clocking in at a mere 30 minutes and boasting a striking 97 percent accuracy, the Intel i7 variant took a more leisurely 215 minutes but delivered an even more precise accuracy rate of 98.3 percent. Both are terrifyingly close to the original ground truth (a).
A graphic from “GPU.zip: On the Side-Channel Implications of Hardware-Based Graphical Data Compression,” showing the differences between a username extraction using an Intel i7-8700 (c) and an AMD Ryzen 7 4800U (b) respectively
Conclusion
In conclusion, the GPU.zip vulnerability shines a spotlight on the intricate challenges embedded within the very fabric of modern graphical processors. As researchers from Carnegie Mellon Software and Societal Systems have highlighted, the quest for optimization and efficiency in GPUs has inadvertently opened doors to potential security breaches. The demonstrated ability to extract sensitive information like usernames from platforms as ubiquitous as Wikipedia makes evident the pressing need for robust cybersecurity measures. Balancing performance enhancement and data protection is a necessary measure that needs to be taken into account when developing both hardware and software in our future.
How Can Netizen Help?
Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time.
We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type.
Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.
Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans.
Questions or concerns? Feel free to reach out to us any time –
Ransomware is quickly becoming the largest cybersecurity threat, with major innovations in both technique and technology over the past few years creating a large and ever-persistent issue. With security researchers and cybersecurity professionals constantly repositioning to face off against new threats, ransomware gangs are forced to invent new problems that haven’t been previously solved, evolving into a greater and greater threat over time. Here are some dangerous innovations, technologies, and strategies that have developed in the ransomware sector:
Data Extortion and Monetization:
The paradigm of ransomware has shifted from merely encrypting data to a more sinister form of extortion. Groups like LAPSU$ have exploited this tactic, targeting heavyweights like Microsoft and Nvidia, causing not only financial loss but also reputational damage. This evolution emphasizes the nefarious potential of ransomware, going beyond encryption to a form of cyber blackmail, making cybersecurity measures increasingly complex and critical.
Exploitation of Cloud Endpoints:
As organizations migrate to cloud platforms, the landscape of vulnerabilities morphs. The decentralized nature of cloud computing provides a ripe environment for ransomware groups to exploit misconfigurations and unpatched vulnerabilities. This evolution reflects the dire need for robust cloud security measures to safeguard against the escalating threat of ransomware in cloud environments.
Targeting Uncommon Platforms:
The focus on uncommon platforms highlights the relentless innovation of ransomware groups. By targeting business-critical devices lacking robust backups, adversaries exploit the unique vulnerabilities inherent in such platforms. This trend underscores the imperative of having a comprehensive cybersecurity strategy that encompasses all aspects of an organization’s digital infrastructure.
Supply Chain Attacks and Double Extortion:
Supply chain attacks exemplify the extensive reach of modern ransomware operations. Similarly, double extortion magnifies the threat by adding data leakage to encryption, forcing organizations to re-evaluate and bolster their cybersecurity frameworks to counter these evolving ransomware tactics.
Ransomware as a Service (RaaS):
RaaS democratizes the realm of cyber extortion, enabling even less technical individuals to launch ransomware campaigns. This model amplifies the ransomware threat manifold, necessitating advanced cybersecurity solutions to tackle the burgeoning menace posed by RaaS platforms.
Weaponization of Vulnerabilities:
The exploitation of vulnerabilities to deliver ransomware signifies a growing sophistication among cyber adversaries. The weaponization of zero-day vulnerabilities, in particular, presents a formidable challenge for cybersecurity, demanding proactive and predictive security measures to stay ahead of the threat curve.
Sectoral Focus Shift:
The shift in focus towards sectors like healthcare, marked by high-value sensitive data, epitomizes the calculated approach of ransomware operators. This sectoral focus amplifies the need for industry-specific cybersecurity frameworks to thwart the ever-evolving ransomware threat.
Emergence of New Ransomware Groups:
The constant emergence of new ransomware groups forces organizations to prepare for not only an ever-evolving threat, but an ever-growing one. The continuous influx of new players with varying tactics necessitates a robust and adaptive cybersecurity strategy to mitigate these ransomware threats.
Technological Innovations:
The adoption of new programming languages like Go and Rust for crafting ransomware variants demonstrates the technological innovation driving the evolution of ransomware. This tech-savvy approach by ransomware groups threatens to outpace the cybersecurity measures in place, calling for continual advancements in cybersecurity technologies.
Geographic Focus:
The consistent targeting of specific regions like the United States accentuates the geopolitical dimension of ransomware threats. The evolving tactics employed by ransomware groups pose a significant challenge to national and global cybersecurity efforts, emphasizing the need for cross-border cooperation and enhanced cybersecurity measures to safeguard against these transnational cyber threats.
How Can Netizen Help?
Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time.
We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type.
Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.
Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans.
Questions or concerns? Feel free to reach out to us any time –
Web 3.0, often referred to as the Semantic or Decentralized Web, has emerged over the past few years as a both an ideological and technological shift from the current state of the internet, referred to as Web 2.0. The new technology is defined by decentralized databases and distributed ledgers across nodes, reducing the risks in Web 2.0 associated with centralized honeypots of sensitive information. The underpinning blockchain technology of Web 3.0 facilitates a unique representation of transactions, interactions, or identifications, enabling tokenization and creating a digital economy where assets, content, and credentials are user-controlled, independent of centralized authorities. While the emerging technology is powerful and aims to create a more decentralized, user-driven Internet, the future implementation of Web 3.0 comes with several risks to our cybersecurity. Here’s a deep dive into how Web 3.0 functions and the benefits and threats it poses to our networks.
Security Benefits in Web 3.0
Identity and Tokenization:
Within the Web 3.0 framework, identity management takes a more user-centric approach, known as self-sovereign identity, in which individuals have control over their data and credentials. Through unique hashes and blockchain technology, Web 3.0 allows for the authentication and control of digital assets by users. This form of identity management is made possible through smart contracts which determine user privileges and eligibility based on various metrics tied to their digital identities. By having a decentralized identity management system, risks associated with centralized data storage such as data breaches and identity theft can be significantly reduced.
Distributed Ledger Technology (DLT):
Distributed Ledger Technology forms the backbone of Web 3.0’s decentralized framework. Unlike the centralized databases of Web 2.0, DLT distributes digital information across a network of computers, ensuring transparency, and reducing the likelihood of data tampering and fraud. Every transaction on the network is recorded in a ledger that’s distributed across all nodes, making unauthorized alterations extremely difficult. This feature enhances the security and trustworthiness of digital interactions on the web.
Zero Trust:
The Zero Trust security model, which treats everything on a network as untrusted by default, aligns well with the decentralized paradigm of Web 3.0. Using the Zero Trust security model, data travels from peer to peer in decentralized applications rather than passing through trusted intermediaries like in Web 2.0. This shift towards a trustless web minimizes reliance on central authorities, which in turn reduces the overall potential attack surfaces for a potential attacker.
Cybersecurity Risks in Web 3.0
Smart Contract Logic Hacks:
Smart contracts, self-executing contracts with the terms directly written into code, are a hallmark of blockchain technology underpinning Web 3.0. However, they are not immune to cyber threats. Hackers can target the logic encoded in these smart contracts to exploit various functions and services like interoperability, crypto-loan services, and cryptocurrency wallet functions. These hacks could lead to financial losses and pose significant legal challenges as smart contracts often operate in a legal grey area with a complicated jurisdictional system.
Enhanced Spam:
The interconnectedness of data in Web 3.0 creates channels through which spam attacks can thrive. Adversaries can target, exploit, and pollute specific resources to distribute spam across websites, search engines, and applications. These spam campaigns could carry malicious JavaScript code or ransomware, delivering it to every user interacting with the contaminated resources. The capability to distribute spam at this scale could be leveraged for widespread dissemination of malware or disinformation.
Social Engineering:
Even though blockchain records are essentially tamper-proof, the human element will always remain a weak link. Phishing attacks and other social engineering tactics can and will be employed by malicious actors to impersonate legitimate entities and harvest confidential information from both individuals and businesses. The proposed use of self-sovereign identity in Web 3.0 also presents identity risks where insecure authentication mechanisms could lead to identity theft risks, and hackers could piece together sensitive information about individuals from identifiers used across different interactions on the web.
How do I Utilize Web 3.0?
Utilizing Web 3.0 involves a shift from traditional centralized online platforms to decentralized applications (dApps) and services. To get started, you typically need a blockchain wallet which will act as your digital identity. This wallet can be used to manage cryptocurrencies, digital assets, and interact with dApps on various blockchain networks. Popular blockchain wallets currently include MetaMask and Coinbase Wallet. Once set up, you can explore a wide range of Web 3.0 platforms and dApps that offer services in finance (DeFi), gaming, social media, and more, all while maintaining a higher degree of control over your data compared to traditional web services.
How Can Netizen Help?
Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time.
We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type.
Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.
Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans.
Questions or concerns? Feel free to reach out to us any time –
A notable security vulnerability has been flagged and cataloged by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) in Adobe Acrobat Reader, making a critical entry in its Known Exploited Vulnerabilities (KEV) catalog. The flaw, tracked as CVE-2023-21608 with a CVSS (Common Vulnerability Scoring System) score of 7.8, is categorized as high-severity due to its potential for active exploitation.
Exploitation of the Vulnerability
The root cause of this vulnerability is a use-after-free bug, a type of memory corruption flaw that can lead to serious issues such as remote code execution (RCE). In this case, exploitation of the bug could lead to RCE with the privileges of the logged-in user. Essentially, a malicious actor could exploit this flaw to execute arbitrary code remotely on the affected system, which could further lead to unauthorized access or even data exfiltration. Adobe promptly addressed this flaw by releasing a patch in January 2023. The credit for discovering and reporting this vulnerability goes to HackSys security researchers Ashfaq Ansari and Krishnakant Patil. Their timely reporting has significantly contributed to the mitigation of the potential risks associated with this flaw.
Software Versions Affected
The versions of the software impacted by this vulnerability include:
Acrobat DC: Versions 22.003.20282 (Win), 22.003.20281 (Mac) and earlier, with the patch released in version 22.003.20310.
Acrobat Reader DC: Versions 22.003.20282 (Win), 22.003.20281 (Mac) and earlier, with the patch released in version 22.003.20310.
Acrobat 2020: Version 20.005.30418 and earlier, with the patch released in version 20.005.30436.
Acrobat Reader 2020: Version 20.005.30418 and earlier, with the patch released in version 20.005.30436.
Conclusion
As of now, the exact details surrounding the exploitation and the identity of the threat actors exploiting CVE-2023-21608 remain elusive. However, the disclosure of a proof-of-concept (PoC) exploit for this flaw in late January 2023 significantly raises concerns regarding potential active exploitation in the wild. This vulnerability is the second major flaw discovered in Adobe Acrobat and Reader that has been exploited in the wild, following CVE-2023-26369. The latter was an out-of-bounds write issue that could lead to code execution by opening a specially crafted PDF document. Federal Civilian Executive Branch (FCEB) agencies have been mandated to apply the vendor-supplied patches by October 31, 2023, to secure their networks against potential threats that these vulnerabilities pose. The directive underlines the critical importance of timely patch management in thwarting exploitation attempts and ensuring the security and integrity of network infrastructures.
A critical vulnerability within the GNU C Library (glibc) has recently come to light, putting a spotlight on the inherent complexities and potential oversights in system security, even within well-established, widely used open-source software. This vulnerability granted the name “Looney Tunables” by the researchers from Qualys, resides in glibc’s dynamic loader, a crucial component in the process of executing binary files on Linux systems.
The Looney Tunables Overflow Attack
The crux of the vulnerability lies in the mishandling of memory within a sanitizing parser function, specifically when parsing the GLIBC_TUNABLES environment variable, hence the name. This environment variable is a feature of glibc allowing runtime adjustments without the need for recompiling the application or the library, a vital flexibility for developers and system administrators. The parsing logic fumbles when it encounters malformed strings like tunable1=tunable2=AAA, which leads to a buffer overflow.
The timeline for a Looney Tunables buffer overflow attack is as follows:
Initialization: The sanitizing parser is initiated to process the GLIBC_TUNABLES environment variable
Searching: It begins iterating through the variable, searching for key=value pairs formatted like tunable1=aa, with each pair separated by colons.
Buffering: Upon finding valid key=value pairs, these strings are copied into a sanitized buffer for subsequent processing.
Encounter with Malformed String: The parser encounters a malformed string tunable1=tunable2=AAA.
First Equals Sign Processing: The first equals sign is processed as expected, interpreting tunable1 as the key and tunable2 as the value, and copies tunable2 into the buffer.
Misinterpretation Triggered: The second equals sign is encountered, which the parser misinterprets as indicating another key=value pair.
Buffer Overflow: Due to this misinterpretation, the parser continues to copy characters beyond the second equals sign into the buffer, leading to a buffer overflow.
Escalation of the Tunables Vulnerability
The intrigue surrounding this buffer overflow escalates owing to the privileges associated with the binary being executed. If a Set-User-ID (SUID) root application is the binary in question, the dynamic loader operates with root privileges as well, paving a smooth path for privilege escalation if the overflow is exploited for code execution. This exploitation becomes feasible by overwriting the pointer to the library search path, determining the directories where the dynamic loader seeks libraries. By manipulating this pointer to direct towards an attacker-controlled location, a malicious libc.so can be loaded effortlessly, leading to instant code execution.
That’s All, Folks:
This vulnerability, identified as CVE-2023-4911, extends its threat to numerous Linux distributions. With a Proof of Concept (PoC) already in the public domain, the urgency for patching this vulnerability cannot be overstated. The key takeaway from the “Looney Tunables” vulnerability is the pivotal role played by meticulous memory handling and robust parsing logic, especially in security-sensitive components like the dynamic loader of glibc. It’s paramount for system administrators and developers to expedite the patching process by seeking updates addressing CVE-2023-4911, strengthening their systems against potential exploitation. This “Looney Tunables” episode reinforces the notion that a seemingly innocuous misstep in code logic can unveil doors to grave security threats.
How Can Netizen Help?
Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time.
We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type.
Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.
Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans.
Questions or concerns? Feel free to reach out to us any time –
As technology advances, so do both cyberattacks and cybersecurity, both are constantly evolving in order to surpass the other. As new, cutting edge technology develops, like quantum computing, network defenders have a substantial problem on their hands, as quantum decryption could be a powerful tool for attackers. While it’s a thrilling shift with the promise to completely change how we solve complex problems, quantum computing also brings a hefty challenge to how we keep our online data safe and sound. In this exploration of the quantum computing world, we’ll uncover the risks it brings to encryption, and how the big players like the Cybersecurity and Infrastructure Security Agency (CISA) are preparing to tackle this challenge through their Post-Quantum Cryptography (PQC) Initiative.
The Quantum Issue:
Network systems are currently guarded by encryption algorithms, complex mathematical locks that keep intruders at bay. However, quantum computers, armed with the power of qubits, threaten to become skeleton keys, capable of unlocking these defenses with ease. Traditional stalwarts of encryption like RSA and ECC rely on the difficulty of certain mathematical problems (like factoring large numbers) for their security. Quantum computers, leveraging principles of quantum mechanics, can solve these problems exponentially faster than the best-known algorithms running on classical computers. This quantum advantage could shatter the existing encryption standards, laying bare the data they were designed to protect.
On the Frontlines: CISA’s PQC Initiative:
Recognizing the storm brewing on the horizon, CISA has marshaled the Post-Quantum Cryptography (PQC) Initiative. This is a clarion call to arms to the cryptographers, beckoning them to forge new locks and keys capable of withstanding quantum assaults. The initiative endeavors to unify efforts across agencies and industry sectors to develop and transition to quantum-resistant cryptographic standards. A significant cornerstone of this initiative is a roadmap developed in collaboration with the Department of Homeland Security (DHS) and the National Institute of Standards and Technology (NIST). This roadmap sketches the path towards new cryptographic standards that would remain robust against the quantum threat.
The Reality of our Quantum Future:
The shift towards post-quantum cryptography is a marathon requiring a detailed inventory of vulnerable systems and data, followed by rigorous testing of new cryptographic algorithms in controlled environments. The roadmap also underscores the importance of a thorough interdependence analysis to ascertain the ripple effects of transitioning to new cryptographic standards across various systems and sectors. Progress made to prepare for the dangers of quantum computing are not a solo endeavor but rather a collaborative expedition involving government agencies, private sectors, and the academic community. It’s about nurturing a synergy where stakeholders across various sectors contribute to the development, testing, and implementation of new quantum-resistant cryptographic standards.
In Conclusion:
As the reality of quantum computing gets closer, initiatives like CISA’s PQC are our strong defense against the threats it poses. The effort to strengthen our online security against quantum challenges is not just a technical hurdle but a joint mission to ensure the safety of our digital lives in the coming quantum era. Through united efforts and a common goal, the cybersecurity community is stepping up to make sure our online safety remains strong, even as we step into the new and uncharted territory of quantum computing.
How Can Netizen Help?
Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time.
We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type.
Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.
Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans.
Questions or concerns? Feel free to reach out to us any time –
Netizen Blog and News 
You must be logged in to post a comment.