Tag Archive for: Defeat

SATAn Turns Hard Drive Cable Into Antenna To Defeat Air-Gapped Security

/in


It seems like [Mordechai Guri]’s lab at Ben-Gurion University is the place where air-gapped computers go to die, or at least to give up their secrets. And this hack using a computer’s SATA cable as an antenna to exfiltrate data is another example of just how many side-channel attacks the typical PC makes available.

The exploit, deliciously designated “SATAn,” relies on the fact that the SATA 3.0 interface used in many computers has a bandwidth of 6.0 Gb/s, meaning that manipulating the computer’s IO would make it possible to transmit data from an air-gapped machine at around 6 GHz. It’s a complicated exploit, of course, and involves placing a transmitting program on the target machine using the usual methods, such as phishing or zero-day exploits. Once in place, the transmitting program uses a combination of read and write operations on the SATA disk to generate RF signals that encode the data to be exfiltrated, with the data lines inside the SATA cable acting as antennae.

SATAn is shown in action in the video below. It takes a while to transmit just a few bytes of data, and the range is less than a meter, but that could be enough for the exploit to succeed. The test setup uses an SDR — specifically, an ADALM PLUTO — and a laptop, but you can easily imagine a much smaller package being built for a stealthy walk-by style attack. [Mordechai] also offers a potential countermeasure for SATAn, which basically thrashes the hard drive to generate RF noise to mask any generated signals.

While probably limited in its practical applications, SATAn is an interesting side-channel attack to add to [Dr. Guri]’s list of exploits. From optical exfiltration using security cameras to turning power supplies into speakers, the vulnerabilities just keep piling up.

Thanks to [chuckt] for the tip.

[via Bleeping Computer]

 


Source…

Cybersecurity Pros Preach Constant ID Challenging, Attack Readiness To Defeat Threats

/in


A recent gathering of global cybersecurity pros explored the latest attack scenarios hackers use to infiltrate corporate networks. But unlike the hopes of misguided potential victims, no silver bullet or software guarantee will fully protect them.

The RSA Conference (RSAC) presenters focused on the surge in demand for implementing a Zero-Trust philosophy. Presenters urged network managers to educate their employees to spot digital identity proofing. This involves securing the data points needed to feasibly proliferate digital ID proofing solutions.

Another leading cause of network breaches is organizations integrating their on-premises environments into their cloud environment. That makes the cloud prone to various on-premises originated attacks.

“RSA Conference plays a critical role in bringing the cybersecurity industry together. As cyberattacks grow in frequency and sophistication, it is imperative that practitioners and experts across the public and private sector convene to hear unique perspectives to help address today’s biggest challenges,” remarked Linda Gray Martin, vice president, RSA Conference.

The RSAC provides a year-round platform for the community to engage, learn, and access cybersecurity content. That process is available online and at in-person events.

Better cyber protections will only happen with a heightened focus on authentication, identity, and access management along with threat hunting activities, according to the RSAC.

Leading the Charge

Kevin Orr, president of RSA Federal, oversees the deployment of security, especially identity access management tools, to federal and commercial customers. His company has roots in the early days of cybersecurity defenses.

At this year’s RSA Conference and the corresponding Public Sector Day, he had the opportunity to speak with leaders in the government and enterprise cybersecurity space. He discussed his observations on the state of cybersecurity with TechNewsWorld.

RSA Federal is an identity and access management (IAM) solutions firm that began as a cybersecurity section within the Dell computer company. Today, it has contracts with some of the world’s most security-sensitive organizations.

The connection…

Source…

Constant Vigilance Required to Defeat Continually Evolving Phishing Threats

/in


It’s been a year since states first enacted shelter in place orders, most employees began working outside their office networks at home.  In 2020, phishing attacks grew 42%, according to new data in SlashNext’s State of Phishing 2021 report. The average cost of a corporate breach was $2.8 million, making phishing an urgent issue.

What was once spray and pray bulk phishing attacks, easily recognized for their lousy grammar and poor-quality logos, is now replaced by mass quantities of high quality, highly targeted spear-phishing attacks simulating messages from trusted sources.  Bad actors became far more sophisticated at using automation, AI, and behavioral targeting to launch spear-phishing attacks aimed at harvesting our personal and corporate information from the same devices.

Phishing attacks moved faster than defenses, automated across people’s digital footprints.  Short-lived phishing URLs gather valuable personal information and move on within 40-45 minutes to evade detection.  Attacks generating 20,000+ subpages in 36 hours were too fast for human forensics to stop.

One of the most dangerous aspects of all this is that phishing attempts often come from legitimate infrastructures such as Google, Adobe, and Microsoft domain names. Cybercriminals used a variety of strategies to evade traditional phishing defenses, including compromised pages on legitimate infrastructure such as Google, Adobe, or Microsoft domain name, which made them difficult to detect.

Targeting Microsoft Users

Even before the sudden shift to a distributed work environment, Microsoft 365 was a popular phishing target. Instead of being limited to email, bad actors launched attacks on OneDrive, Teams, and other Microsoft communication channels.

These malicious users can be very targeted using specific information relevant to each channel. So, not only have we detected a dramatic increase in attacks targeting Microsoft users, but the success of these attacks has been unprecedented.

Companies rely on first-generation tools to defend against phishing attacks, whether securing their email gateway, proxies, firewalls, or other endpoints. Even some of the newer security solutions have been…

Source…