research

Cybersecurity for Industrial Control Systems: Part 2

Posted on by Admin
Cybersecurity for Industrial Control Systems: Part 2

Legacy malware had the most detections in India, China, the US, and Taiwan. For coinminer, Equated malware, and WannaCry, India had the most detections. On the other hand, Japan had the most Emotet infections, while ICSs in Germany had the most adware incidents. Through this extensive research, we found that there were several malware threats that pose a great risk on ICSs. By identifying these threats, we can now determine various steps that your enterprise…

Read More

New Ransomware Spotted: White Rabbit and Its Evasion Tactics

Posted on by Admin
New Ransomware Spotted: White Rabbit and Its Evasion Tactics

New Ransomware Spotted: White Rabbit and Its Evasion Tactics Ransomware We analyze the ransomware White Rabbit and bring into focus the familiar evasion tactics employed by this newcomer. By: Arianne Dela Cruz, Bren Matthew Ebriega, Don Ovid Ladores, Mary Yambao January 18, 2022 Read time:  ( words) We spotted the new ransomware family White Rabbit discretely making a name for itself by executing an attack on a local US bank in December 2021. This newcomer takes a page from Egregor, a more established ransomware family, in hiding its malicious activity and carries a potential connection to the advanced persistent…

Read More

Earth Lusca Employs Sophisticated Infrastructure, Varied Tools and Techniques

Posted on by Admin
Earth Lusca Employs Sophisticated Infrastructure, Varied Tools and Techniques

Since mid-2021, we have been investigating a rather elusive threat actor called Earth Lusca that targets organizations globally via a campaign that uses traditional social engineering techniques such as spear phishing and watering holes. The group’s primary motivation seems to be cyberespionage: the list of its victims includes high value targets such as government and educational institutions, religious movements, pro-democracy and human rights organizations in Hong Kong, Covid-19 research organizations, and the media, among others. However,…

Read More

Cybersecurity for Industrial Control Systems: Part 1

Posted on by Admin
Cybersecurity for Industrial Control Systems: Part 2

Cybersecurity for Industrial Control Systems: Part 1 Ransomware In this two-part series, we look into various cybersecurity threats that affected industrial control systems endpoints. We also discuss several insights and recommendations to mitigate such threats. By: Trend Micro Research January 15, 2022 Read time:  ( words) The ever-changing technological landscape has made it possible for the business process on the IT side of an enterprise to be interconnected with the physical process on the OT…

Read More

Analyzing an Old Bug and Discovering CVE-2021-30995

Posted on by Admin
Analyzing an Old Bug and Discovering CVE-2021-30995

On April 26, 2021 Apple patched CVE-2021-1740, which was a vulnerable function inside the system daemon process cfprefsd (these types of processes usually run in the background and handle system tasks). The bug could have been exploited to read arbitrary files, write arbitrary files, and get root privilege escalation. It was addressed in Apple’s Security Update 2021-002 (Catalina) for a variety of Apple operating systems, including iOS and macOS. However, in early August 2021, Zhipeng…

Read More

Codex Exposed How Low Is Too Low When We Generate Code

Posted on by Admin
Codex Exposed How Low Is Too Low When We Generate Code

Codex Exposed How Low Is Too Low When We Generate Code In a series of blog posts, we explore different aspects of Codex and assess its capabilities with a focus on the security aspects that affect not only regular developers but also malicious users. This is the second part of the series. By: Forward-Looking Threat Research Team January 14, 2022 Read time:  ( words) In June 2020, OpenAI released version 3 of its Generative Pre-trained…

Read More

LoRaWAN’s Protocol Stacks: The Forgotten Targets at Risk

Posted on by Admin
LoRaWAN’s Protocol Stacks: The Forgotten Targets at Risk

First, we compiled the code into something easily handled by a fuzzer. For our purposes, we used the generation method that will allow us to cover as many code paths as possible with legitimate and dumb fuzzing using the AFL++ framework (evolution of AFL). This supplies some instrumentation for mutating pseudorandom bits, bytes, and words. We also attempted to collect every type of message that could be interpreted by the parser. We used the persistent…

Read More

Defending Systems Against Attacks With Layers of Remote Control

Posted on by Admin
Defending Systems Against Attacks With Layers of Remote Control

Fortunately, we were able to provide the customer with timely alert and intervention from the moment the initial intrusion via the cloud server was observed all the way to guidance during the cleanup and remediation process. Insights from the threat report and the threat handling perspective Incidents such as this provide security teams opportunities to see attacks from different angles and in a big-picture manner. We discuss key insights below that organizations can consider when…

Read More

Codex Exposed Exploring the Capabilities and Risks of OpenAIs Code Generator

Posted on by Admin
Codex Exposed Exploring the Capabilities and Risks of OpenAIs Code Generator

While GPT-3, the general-purpose language transformer that powers Codex, has recently been opened to the public, Codex itself remains a technical preview open to a limited selection of users. Codex powers the functionality of GitHub’s Copilot, a programming assistant available as a plug-in for Visual Studio Code that is able to offer AI-powered autocomplete and code translation on the fly. Its capabilities are still rough around the edges, but they give a good idea of…

Read More

Examining Log4j Vulnerabilities in Connected Cars and Charging Stations

Posted on by Admin
Examining Log4j Vulnerabilities in Connected Cars and Charging Stations

Evidence of attacks using the Log4j vulnerability was also shown in a test that triggered a bug on a Tesla car. For this case, the source does not provide much information on where it was actually executed. Nevertheless, this means that the exploitation of the vulnerability could still have an impact on the user’s privacy and the general security of the car because a back-end compromise could allow attackers to push actions to the car…

Read More
1 … 14 15 16 17 18