Cybersecurity News 

• A newly disclosed UPnP vulnerability, which is tracked as CVE-2020-12695 and is referred to as CallStranger, affects billions of devices can be exploited for various types of malicious activities, including distributed denial-of-service (DDoS) attacks. This vulnerability can also be used for bypassing DLP and network security devices to exfiltrate data and scanning internal ports from Internet facing UPnP devices.
• Security researcher Athul Jayaram is warning that a WhatsApp feature called “Click to Chat” puts users’ mobile phone numbers at risk — by allowing Google Search to index them for anyone to find.
• With the release of the June 2020 Patch security updates, Microsoft has released one advisory for an Adobe Flash Player update and fixes for 129 vulnerabilities in Microsoft products.

Cybersecurity News  

• Chrome software developers announced that starting with Chrome 84, releasing to stable on July 14 2020, sites with abusive permission requests or abusive notifications will be automatically enrolled in quieter notifications UI and notification enrollment prompts will advise users that the site may be trying to trick them.
• Microsoft shared threat data collected on PonyFinal, a Java-based ransomware deployed in human-operated ransomware campaigns. In these types of attacks, adversaries do their homework and choose a strategy and payload based on the target organization’s environment. Human-operated ransomware is not new, but it has been growing popular as attackers try to maximize ransom from individual victims.
• A team of Chinese academics has found a new way to abuse HTTP packets to amplify web traffic and bring down websites and content delivery networks (CDNs).

Cybersecurity News

• The Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the broader U.S. Government have published the top 10 most exploited vulnerabilities from 2016 to 2019 with recommendations for mitigation.
• Israeli researches reveal NXNSAttack, a vulnerability in DNS servers that can be abused to launch DDoS attacks of massive proportions. They say that an attacker using NXNSAttack can amplify a simple DNS query from 2 to 1,620 times its initial size, creating a massive spike in traffic that can crash a victim’s DNS server.
• Cisco Talos researchers said about a new malware, dubbed WolfRAT, that is a new variant of DenDroid, a mobile Remote Access Trojan (RAT) which targets Thai users of Whatsapp, Facebook Messenger, and Line messaging apps on the Android mobile platform.

Cybersecurity News

Cybersecurity News

• Google intends to enforce a new set of rules, which will result in a large number of extensions being delisted. These rules are meant to crack down on a series of practices extension developers have been recently employing to flood the Web Store with shady extensions or boost install counts for low-quality content.
• The threat actors behind the Shade ransomware have called it quits, releasing 750,000 encryption keys on GitHub and publicly apologizing to victims affected by the malware. User “shade-team” posted four files on the code repository, one containing the file keys and four “ReadMe” files with decryption instructions and other information.
• Google Project Zero security researchers have discovered multiple vulnerabilities in ImageIO, the image parsing API used by Apple’s iOS and macOS operating systems.

Cybersecurity News  

• Intel addressed nine security vulnerabilities with the April 2020 Platform Update, all of them being high and medium severity security flaws impacting multiple software products, firmware, and platforms.
• Сybersecurity experts at ReversingLabs revealed over 700 malicious gems — packages written in Ruby programming language — that supply chain attackers were caught recently distributing through the RubyGems repository. The malicious campaign leveraged the typosquatting technique where attackers uploaded intentionally misspelled legitimate packages in hopes that unwitting developers will mistype the name and unintentionally install the malicious library instead.
• A proof-of-concept remote code execution (RCE) exploit for the Windows 10 CVE-2020-0796 ‘wormable’ pre-auth remote code execution vulnerability was developed and demoed today by researchers at Ricerca Security.

Cybersecurity News

• FBI Warns of Teleconferencing and Online Classroom Hijacking During COVID-19 Pandemic and gives some recommendations. The FBI has received multiple reports of conferences being disrupted by pornographic and/or hate images and threatening language. Due to these problems, different companies and organizations decided not to use Zoom. For example, Elon Musk’s SpaceX recently banned its employees from using Zoom, citing “significant privacy and security concerns,” while Taiwan’s cabinet has told government agencies to stop using the app.
• Microsoft announced that its plan to disable the security protocols TLS 1.0 and TLS 1.1 in the company’s browsers has been postponed in light of current global events. Initially the company wanted to disable the security protocols in the first half of 2020 .

Cybersecurity News

• Hackers use authentication tools to deliver NiceRAT malware via botnet.
• XSS flaws in multiple WordPress plugins exploited to deploy malware.
• 361 million stolen accounts leaked on Telegram were added to Have I Been Pwned.
• Google will roll out Chrome’s new extension Manifest V3 next week.
• Cybercriminals attack banking customers in EU with V3B phishing kit.
• SonicWall Capture Labs discovered a remote code execution vulnerability in Atlassian Confluence.
• Microsoft announces first Windows 10 Beta build since 2021.
• A new hacker tool extracts all the data

Cybersecurity News

• Zoom announced a Post-Quantum End-to-End encryption for meetings.
• A spyware app has been found running on computers at several hotels around the US, which is leaking screenshots of guest information to the internet.
• 30+ Tesla cars were hacked using third-party software.

Challenge

The Timber company with several sites uses an outsourced SOC, which, however, is not sufficient and isn’t able to meet all company’s demands. So appeared the need for a cybersecurity software to respond on incidents within the company and control its assets. One of the key requirements for cybersecurity vendors was an experienced team of professional engineers, who could develop and implement an absolutely new business processes.

After a range of meetings and a PoC project, the Timber company has chosen the Defensys SOAR for automation and orchestration.

Implementation

As the first step, Defensys needed to set up the incident handling process considering incident types. Using provided information regarding all existing types, the Defensys’ engineers have designed an incident handling scheme and successfully implemented it.

Incident response now can be conducted in 2 modes: automatically and manually. New incidents coming from firewalls and a SIEM system to the SOAR are classified according to the developed rules.