Highlights of BlueHat Israel 2019
BlueHat Israel covered many interesting talks, covering supply chain attacks, processor flaws and many more.
A vulnerability in Debian’s apt allows for easy lateral movement in data centers
/0 Comments/in Labs /by Daniel GoldbergGuardicore Labs explains the recent vulnerability in the apt package management tool that allows attackers to exploit software installation process to attack Linux servers.
Bread and butter attacks
/1 Comment/in Labs /by Ofri Ziv and Daniel GoldbergGuardicore Labs has uncovered an SSH brute force attack that has stayed under the radar for years. The attack deploys a RAT with DDoS capabilities and a cryptocurrency miner. In this post, we describe the attack, payload and different preventive steps.
What’s New in Infection Monkey Release 1.6
/0 Comments/in Labs /by Ravit Greitser and Daniel GoldbergWe are proud to announce the release of a new version of the Infection Monkey, GuardiCore’s open-source Breach and Attack Simulation (BAS) tool. Release 1.6 introduces several new features and a few bug fixes.
With libSSH, Authentication is Optional
/1 Comment/in Labs /by Daniel Goldberg and Ofri ZivA critical vulnerability (CVE-2018-10933) was disclosed in libSSH, a library implementing the SSH2 protocol for clients and servers. The vulnerability allows an attacker to completely bypass the authentication step and connect to the server without providing any credentials, the worst possible flaw for a library implementing SSH.
Operation Prowli: Monetizing 40,000 Victim Machines
/3 Comments/in Labs /by Ofri Ziv, Daniel Goldberg and Mor MatalonGuardicore Labs has uncovered a previously unknown operation named Prowli, focused on cryptocurrency mining and traffic hijacking. This operation showcases how attackers abuses insecure websites and their visitors by redirecting them to malicious domains.
Azure passwords are still at risk; Infection Monkey can help
/0 Comments/in Labs /by Ravit Greitser and Ofri ZivAs this security flaw still exists and puts Azure environments at risk, we believe it’s important to continuously verify whether your environment is vulnerable. To do that we integrated Azure password harvesting capabilities into the Infection Monkey.
Recovering Plaintext Passwords from Azure Virtual Machines like It’s the 1990s
/3 Comments/in Labs /by Ofri Ziv and Daniel GoldbergWhile researching the Azure Guest Agent, we’ve uncovered several security issues which have all been reported to Microsoft. This post will focus on a security design flaw in the VM Access plugin that may enable a cross platform attack impacting every machine type provided by Azure.
The Next Gen Infection Monkey is Here
/4 Comments/in Labs /by Ravit GreitserWe are pleased to announce a new version of our Infection Monkey open source attack simulation tool with several significant enhancements. We first introduced the Infection Monkey in 2016 and have continuously developed and supported it. Part of what we did came from feedback we received from our community so thanks everyone for contributing!
Something is brewing: A CPU bug risks virtual memory segmentation
/0 Comments/in Labs /by Ofri Ziv and Daniel GoldbergAt any given moment, attack and defense are in a cat and mouse game where each side gains a momentary advantage. What we’ve recently seen over the past few months is a situation where defense is playing catch-up with what appears to be a serious hardware bug.
Current speculations suggest that a serious CPU bug might allow code running in user space to read kernel space memory. Such capability will make it much easier for attackers to exploit other security bugs that exist in the system or read sensitive system data. Another speculative guess suggests that the bug allows one virtual machine an introspection into another virtual machine memory. This attack vector puts in danger virtual environments such as Amazon EC2 and Azure Hyper-V where multiple tenants can co-exist on a single physical machine.