Tag Archive for: APIs

Week in review: MS Exchange zero-days exploited, AD attack paths, developing secure APIs

/in


OPIS

SpyCast: Cross-platform mDNS enumeration tool
SpyCast is a cross-platform mDNS enumeration tool that can work either in active mode by recursively querying services or in passive mode by only listening to multicast packets.

Attackers use novel technique, malware to compromise hypervisors and virtual machines
Unknown attackers wielding novel specialized malware have managed to compromise VMware ESXi hypervisors and guest Linux and Windows virtual machines, Mandiant threat analysts have discovered.

To encrypt or to destroy? Ransomware affiliates plan to try the latter
Researchers from Symantec, Cyderes and Stairwell have recently analyzed a new version of the Exmatter data exfiltration tool and have spotted a new capability: data corruption.

MS SQL servers are getting hacked to deliver ransomware to orgs
Cybercriminals wielding the FARGO (aka Mallox, aka TargetCompany) ransomware are targeting Microsoft SQL (MS SQL) servers, AhnLab’s ASEC analysis team has warned.

3 ways to gauge your company’s preparedness to recover from data loss
Where you store your data backup is nearly as important as creating copies in the first place. Storing your data in the cloud does not mean it is secure.

Two Microsoft Exchange zero-days exploited by attackers (CVE-2022-41040, CVE-2022-41082)
Attackers are leveraging two zero-day vulnerabilities (CVE-2022-41040, CVE-2022-41082) to breach Microsoft Exchange servers.

Phishing attacks skyrocketing, over 1 million observed
The APWG’s Phishing Activity Trends Report reveals that in the second quarter of 2022, the APWG observed 1,097,811 total phishing attacks — the worst quarter for phishing that APWG has ever observed.

RCE in Sophos Firewall is being exploited in the wild (CVE-2022-3236)
Sophos has patched an actively exploited remote code execution vulnerability (CVE-2022-3236) in its Firewall solutions, and has pushed the fix to customers who have automatic installation of hotfixes enabled.

The various ways ransomware impacts your organization
Despite increased investment in tools to fight ransomware, 90% of organizations were affected by ransomware in some capacity over the past 12 months, according to SpyCloud’s 2022 Ransomware Defense…

Source…

Citizen Developers and Securing APIs

/in


Microsoft Build is where we get to explore the latest innovations in code and application development. This time around there were 55 sessions dedicated to Microsoft’s approach to low-code, including a keynote on day two with Julie Strauss and Karuana Gatimu. Organizations are increasingly adopting low code application platforms to fuse the worlds of citizen developers, professional developers, and the other parties instrumental in building and using applications. The goal is to quickly deliver new solutions and modernize business capabilities.

So what is low-code?

Cybersecurity Live - Boston

Low-code is a visual approach to software development. Rather than writing code, it allows you to essentially drag and drop objects and connections using a graphical user interface (GUI). It effectively abstracts the code from the application builder to significantly lower the barrier to entry. Gartner predicts 70% of new applications developed by enterprises will use low-code or no-code technologies by 2025. Up from less than 25% in 2020. 

Whereas 3rd party software can only be customized so much, low code applications are more closely aligned with an organization’s existing business processes. The starting point for low code applications is usually the process you are trying to automate, not the functionality of the software suite you purchased from your vendor.

Though low-code and no-code modular approaches allow professional developers to quickly build applications, more often we talk about low-code in the context of citizen developers. These developers could be business analysts, office administrators, small-business owners and others who are not actual software developers to build and test applications, because it requires little to no knowledge of traditional programming languages.

How the low-code revolution began

According to Microsoft, fundamental shifts drive this change in enterprise application development. It is described in 4 waves by Microsoft Corporate Vice President for Business Applications, Charles Lamanna;

Wave number 1: The changing workforce

There are people entering the workforce today who have grown up with high expectations of applications and application consumption. Traditional…

Source…

Insecure APIs Threaten Mobile App Security – What To Do

/in


For most mobile apps, it’s not much of an exaggeration to describe them as a collection of APIs all tied together with a wrapper.

 

In fact, without connectivity, many mobile apps can’t function at all, because they depend on APIs to connect to back-end services. And that’s a big problem for developers, because, unfortunately, these APIs are frequently insecure — even in very sensitive apps.

 

A study of banking, fintech and cryptocurrency exchanges found that practically every single one of the mobile apps researchers reverse engineered contained hardcoded API keys and tokens. The exact number was a whopping 99%!  This includes usernames and passwords to third-party services.  

 

Worse yet: All the APIs tested had vulnerabilities that enabled researchers to change PIN codes and transfer funds in and out of accounts. And if apps that control end-users’ money are this insecure, the situation is not going to be any better for apps that work with far less sensitive data and assets than people’s bank accounts.

 

Certainly, cybercriminals are paying attention.

 

By this year in 2022,Gartner predicts APIs will become the largest attack vector. It stands to reason. API keys in mobile apps and code repositories provide hackers with the means they need to attack back-end servers and access valuable assets, such as customer accounts and production servers.

 

But securing APIs is not simply a matter of willpower. Developers haven’t neglected API security because they are lazy or unconcerned. API security is complex, difficult and time-consuming. It requires highly specialized skills that are in short supply. And while much of the DevOps cycle is automated, mobile API security implementation is largely manual.

 

Simply put, in the aggressive mobile app marketplace, publishers must churn out new apps and features at a rapid pace to remain competitive. Implementing strong API security would substantially extend development cycles and break budgets.

 

A recent global survey of 10,000 mobile consumers found that a solid majority (63%) value security and malware protection of equal or even greater importance than they do features.  This shows…

Source…