Cyber Creatures

In the ever-evolving landscape of cybersecurity, identifying and mitigating vulnerabilities is crucial for maintaining a strong security posture . Vulnerability Assessment and Penetration Testing (VAPT) is an effective method for uncovering security weaknesses that could be exploited by attackers . This article will explore the top 10 vulnerabilities commonly discovered through VAPT and provide strategies for mitigating them. Additionally , we will highlight how Indian Cyber Security Solutions (ICSS) can assist you in strengthening your cybersecurity defenses through our comprehensive VAPT services . 1. SQL Injection What is SQL Injection? SQL Injection occurs when attackers exploit vulnerabilities in an application's database layer by inserting malicious SQL code. This can lead to unauthorized access to sensitive data. Mitigation Strategies Use parameterized queries and prepared statements. Implement input validation and sanitation. Regularly update and patch database manage...

The hacktivist group Head Mare has leveraged a vulnerability in WinRAR to infiltrate and encrypt systems running on Windows and Linux . This group, active since the onset of the Russo-Ukrainian conflict , has primarily targeted organizations in Russia and Belarus . Their attacks are characterized by sophisticated techniques that focus on causing maximum disruption. The Vulnerability: CVE-2023-38831 According to the Secure List report , the vulnerability exploited by Head Mare, identified as CVE-2023-38831 , resides in WinRAR , a popular file archiver utility. This flaw allows attackers to execute arbitrary code on a victim’s system through specially crafted archive files . By exploiting this vulnerability, Head Mare can more effectively deliver and conceal its malicious payloads. How the Exploit Works When a user attempts to open a seemingly legitimate document within a compromised archive , the malicious code is executed , granting the attackers access to the system . Verdicts ...

CrowdStrike is a leading EDR solution , used across a wide range of systems including point-of-sale terminals and ATMs . What’s the Hype about? On July 19, 2024, CrowdStrike rolled out a faulty sensor configuration update for Windows systems , causing widespread system crashes and the notorious “ blue screen of death ” ( BSOD ). This issue affected Windows hosts with Falcon sensor versions 7.15 and 7.16 , while Mac and Linux systems remained unaffected . Although this is not a security breach or cyber-attack , it is a significant complication arising from a routine software update . The incident is expected to be one of the largest ‘cyber’ events ever in terms of its impact. A diverse range of sectors, including airlines, financial institutions, food and retail chains, hospitals, hotels, news organizations, railway networks, and telecom companies, have been hit . Consequently, CrowdStrike’s shares dropped by 15% in U.S. premarket trading . What’s the technicality behind it?...

On Friday, the nonprofit group Health-ISAC (Information Sharing and Analysis Center) issued an alert about the group, saying that Russia-linked Black Basta has ‘ recently accelerated attacks against the healthcare sector. ’ A cyberattack that affected clinical operations at St. Louis-based Ascension health system was perpetrated by Russia-linked ransomware group Black Basta, according to a report . CNN, citing four sources, reported Friday that the group was responsible for the data breach at Ascension Wednesday. On Friday, the nonprofit group Health-ISAC (Information Sharing and Analysis Center) issued an alert about the group, saying that Black Basta has “ recently accelerated attacks against the healthcare sector. ” CRN has reached out to both Ascension and the U.S. Department of Health and Human Services, which has been aware of the group and issued its own alert in March 2023. HHS said that Black Basta was initially spotted in early 2022, known for its double extortion attack. The...

Threat actors have been observed leveraging the QEMU open-source hardware emulator as tunneling software during a cyber attack targeting an unnamed " large company " to connect to their infrastructure. While a number of legitimate tunneling tools like Chisel, FRP, ligolo, ngrok, and Plink have been used by adversaries to their advantage , the development marks the first QEMU that has been used for this purpose. " We found that QEMU supported connections between virtual machines: the -netdev option creates network devices (backend) that can then connect to the virtual machines, " Kaspersky researchers Grigory Sablin, Alexander Rodchenko, and Kirill Magaskin said. " Each of the numerous network devices is defined by its type and supports extra options ." In other words, the idea is to create a virtual network interface and a socket-type network interface , thereby allowing the virtual machine to communicate with any remote server . The Russian cyber...

A new tool dunned BlueDucky , automating the exploitation of a critical Bluetooth pairing vulnerability that allows for 0-click code execution on unpatched devices . This revelation comes on the heels of Marc Newlin’s January 2024 publication of a proof of concept script , which targets a Bluetooth vulnerability identified as CVE-2023-45866 . The vulnerability, as detailed by Newlin, enables attackers to inject keystrokes into any Android and Linux device within Bluetooth range without the need for pairing , by masquerading as a Bluetooth keyboard . The exploit tool , dubbed “hi_my_name_is_keyboard,” was initially designed to demonstrate the feasibility of such an attack . The mobile hacker team successfully compromised a range of devices , including Android smartphones, Google Chromecast TVs, Meta Quest 3, and Linux-based smart TVs . However, the original script required users to manually discover and enter the MAC address of the target Bluetooth device and modify ...

Hello everyone, hope you all are doing good. Today I have two interesting topics for you. Open Redirection (also known as URL Redirection) and Broken Link Hijacking . I have selected two vulnerabilities because they are not that complex and need very little explanation . So, let us dive into our maze and learn how to find them.   What is URL URL simply stands for Uniform Resource Locator . It is a kind of address for a particular web page , and no two web pages can have the same URL . There can be more than one URL in a web application and each URL points to a web page . Here this web page is made up of HTML, CSS, and any programming language of choice and is hosted on a web server . Now if the URL is not pointing to anything then it has no page attached to it to show us. URL Redirection So, now you may understand what URL Redirection could be. We just make the URL of a web page redirect to the page that it is not destined for. Let me put this simply. Think of a URL a...