After a two-year break, I am back at the RSA Conference in San Francisco, the international key event for the cybersecurity industry.

Having overcome the typical hurdles of a trip in the COVID era, we found ourselves at the conference with broad smiles, strong handshakes, and lots of lively conversations. Signs that proved this industry’s eagerness to get back on track, and also an optimism that is a far from the current scenario in which the average value of the major cybersecurity indices has fallen by 20% so far in 2022.

Every year that I have attended RSA there has been some new buzzword that becomes a kind of common thread for many companies at the conference and it seems you can’t not mention it if you want to be relevant to your customers. In the past years we have lived through the era of orchestration, SASE, the Human Factor, and so on.

And for this year surely some of us were betting on Zero Trust, which is a topic that is still relevant and has been less present in what I have been able to see of this conference. However, for me, the clear winner for 2022 is XDR.

What is XDR and why is it key to cybersecurity?

XDR stands for Extended Detection and Response. Without simplifying it too much, it has much to do with extending the detection and response tools and processes we had in place to ensure we have no blind spots and that we are much more efficient in our response.

It is therefore an extension of the detection tools beyond the Endpoint (EDR) and SIEM, taking detection to the network (NTA), to Cloud native environments (CSPM), around identity (ITDR), to applications, etc.

Technological convergence and visibility

XDR is along with two other trends that are closely related: first, technological convergence, which has a lot to do with it because it requires solutions that used to be seen separately and now come together to not only improve detection but also response, which traditionally required additional tools to automate and orchestrate, collect and apply intelligence, etc….

Basically, an integrated tool that allows us to achieve that XDR concept in the most efficient and simple way. Whether this convergence is the best option or whether it is the sum of several technologies coordinated by an orchestrator, a SIEM or other tools is a topic that requires more space than this article provides.

Here MSSPs such as Telefónica Tech can play an important role in supporting customers in this transformation process by providing XDR capabilities in both converged and heterogeneous environments.

The other closely related concept that I wanted to mention is Visibility. Another concept that appears recurrently. It is increasingly important for companies.

In order to know where they are, to be able to prioritise, in short, to give better visibility of their risk within their organisation. Many solutions have pushed this attribute and some do it in a specific way, such as ASM (attack surface management) solutions.

Essentially, through automated tools these services provide a clear and fairly comprehensive view of the most important vulnerabilities and areas of exposure and risk and unlike other traditional tools do so from an attacker’s perspective.

These tools could help to start automatic Red Team exercises in a lighter way or supplement existing services or capabilities with such activities on a recurring basis.

Mobile security and the presence of Spanish startups

Moving on, I also wanted to mention the security of mobile phones. I have to say that I didn’t see as much as I expected. It seems that the impact of the security breach of the mobile phones of members of the Spanish government has not had as much impact in the United States, and this was reflected at the fair.

I cannot finish without mentioning some of the startups present in the Spanish hall. Spanish startups that I always try to pay special attention to, as this year they were:

• RedBorder with whom we were able to talk about visibility and XDR on their open and scalable network platform.
• ETHEC who showed us how their company provides greater visibility through their risk assessment platform.
• LEX Program, the legaltech startup that enables real-time compliance with the most common legal requirements in website consent taking through a dynamic platform.

As I said at the beginning, the level of enthusiasm experienced during the fair has been contagious and I am looking forward to continue working with many of the partners and customers with whom we had the pleasure of chatting those days.

Photo: RSA Conference 2022

There is currently a lot of confusion about the terms encryption, encoding, cryptography, hashing and obfuscation techniques. These terms are related to computer security, specifically to the confidentiality and integrity of data or information, except in the case of encryption and obfuscation.

Given the high importance of data and information, which are considered key elements in information systems, it is useful to know which mechanisms are available to protect them and in which cases one or the other should be used.

Cryptography, a methodology for information systems security

Cryptography is part of the field of cryptology, a science that is composed of fields such as cryptanalysis and steganography. Cryptography focuses on the study of the methods used to ensure that a message or information cannot be read by an unauthorised third party, i.e., to guarantee the confidentiality of information.

It is also used to prevent unauthorised access to and use of network resources, information systems, etc.

Cryptography is a methodology whose objective is to provide security in information systems and telematic networks, including among many of its functions the identification of entities, authentication and access control mechanisms to resources, the confidentiality and integrity of transmitted messages and their non-repudiation.

Message encryption

Encryption is a process of transforming data into a format different from the original. It is done using a public method, available to anyone and in most cases using a widely used standard format.

An example is the American Standard Code for Information Interchange, known as ASCII. In this standard, alphabetic characters and special characters are converted into numbers. These numbers are known as the “code”.

Encryption is not used for security purposes, as it only transforms the presentation of data from one format to another, without using any key in the process, and using the same method or algorithm to encrypt and decrypt the data or information.

This process was born in response to the need to transmit information over the Internet using standards that would allow the interpretation of the data or information by different environments, programmes and other elements.

Examples of encryption are the use of ASCII, UNICODE, MORSE, Base64 and URLEncoding tables.

Using mathematical functions; hashing

The hash function is the cryptographic process by which a unique string of characters is obtained through a mathematical function. This mathematical function or hash is at the core of the algorithm, which is capable of transforming any arbitrary block of data into a character string with a fixed length.

The length of the resulting string will always be the same size, regardless of the length of the input data, as long as the same hash algorithm is used. Examples of hash functions are MD5, SHA1, SHA-256, etc.

In the following image you can understand how, depending on the input, and according to the hash algorithm applied (in this example SHA1), the digest or output will be in one way or another.

If, for example, we were to use SHA-256, in all the above cases, the output would be of a fixed length, in any case, and independently of the length of the input, of 256 bits and 64 characters, although the digests would be totally different.

To consider that a hash function is secure, it must meet these 3 properties:

• Collision resistance: It must be unfeasible for any two different inputs to produce the same hash as output.
• Pre-image resistance: Must meet the improbability or very low probability of “reversing” the hash function (finding the input from a given output).
• Resistance to second pre-image: Unfeasible to find a collision, i.e., the same hash cannot exist for different inputs.

Hash functions can be used in multiple use cases, some examples include the following:

• Specific searches for information in large databases.
• Analysis of large files and data management.
• In message authentication, digital signatures and SSL/TLS certificates.
• Generation of new Bitcoin addresses and keys in the mining process.

What is data encryption?

Data encryption is the process of converting text or data in readable form into unreadable text or data, known as encrypted output.

Encryption is based on the application of an algorithm using a key or master key that allows the transformation of the structure and composition of the information to be protected, in such a way that, if this information is intercepted by a third party, it cannot be interpreted or understood, i.e., it is unreadable.

When data has been encrypted, only those who have the key that allows decryption will be able to carry out that action, allowing access to the data in a readable format.

Therefore, this mechanism has a focus primarily on protecting confidentiality.

The use of complex cryptographic keys makes such encryption more secure, making it more difficult for cyber-attacks, brute-force or otherwise, to be carried out on them.

The 2 most common encryption methods are symmetric encryption and asymmetric encryption. The names refer to whether or not the same key is used for encryption and decryption:

• Symmetric encryption keys: Also known as single key encryption. Its main characteristic is the use of the same key for both encryption and decryption, making this process more convenient for users and closed systems.

On the other hand, the key must be available to all interested parties and distributed through secure mechanisms. This increases the risk that it could be compromised if intercepted by a third party such as a cybercriminal, unless it is encrypted with an asymmetric key, which is the usual practice. This method is faster than the asymmetric method.

• Asymmetric encryption keys: in this type of encryption, 2 different keys (public and private) mathematically linked together are used. The keys are basically large numbers linked together, but they are not identical, hence the term “asymmetric”.

The owner keeps the private key secret, while the public key is shared among authorised recipients or made available to the general public. The encryption process is therefore carried out with the public key, and the decryption process with the recipient’s private key.

Encryption is used in many cases, some of which include the following:

• Encryption of voice communications.
• Encryption of banking and credit card data.
• Database encryption.
• Digital signatures, for verification of the authenticity of the origin of the information.

Obfuscation

The purpose of obfuscation is to make something more difficult to understand, usually for the purpose of making it more difficult to attack or copy.

This mechanism is commonly used to obfuscate the source code of an application in order to make it more difficult to replicate a given product or function. This mechanism is not a strong security control, but it is a hindrance to making something more unreadable, helping to make reverse engineering more difficult.

It is often reversible, like encryption, using the same technique that was used in obfuscation. Other times it is simply a manual process that takes some time.

Some applications that help with this process, although it is always recommended to do it manually, are JavaScript Obfuscator, and ProGuard.

Featured image: Pexels / ThisIsEngineering.

​​Unpatched vulnerability in PayPal

Security researcher H4x0r-DZ has disclosed an unpatched vulnerability in PayPal’s money transfer service that could allow attackers to trick victims into stealing money by completing targeted transactions through clickjacking attacks.

This technique allows an attacker to trick a user into clicking on seemingly harmless elements of a web page for fraudulent purposes: downloading malware, redirecting them to malicious websites, or revealing sensitive information.

The researcher discovered that a paypal[.]com/agreements/approve endpoint, designed for billing agreements, and which should only allow tokens of the type billingAgreementToken, actually allowed another type of token to be received.

This would allow an attacker to include a specific iframe, which causes a victim logged into the website to transfer their funds to a PayPal account controlled by the attacker simply by clicking a button.

The researcher has decided to publish the proof of concept, after reporting the flaw to the company last October 2021 without having received any compensation or fix for this flaw from PayPal.

More info: https://medium.com/@h4x0r_dz/vulnerability-in-paypal-worth-200000-bounty-attacker-can-steal-your-balance-by-one-click-2b358c1607cc

* * *

Predator spyware distributed through 0-days exploitation

Researchers from Google’s Threat Analysis Group (TAG) have revealed details on the use of new 0-days in Chrome and Android for the distribution of spyware known as Predator, a commercial cyber-espionage tool developed by Cytrox. The researchers report three separate campaigns.

The first campaign was detected in August 2021 and exploited a vulnerability in Chrome to redirect to SBrowser (CVE-2021-38000 CVSSv3 6.1). The second campaign started in September 2021 and exploited several vulnerabilities in Chrome to escape the browser sandbox (CVE-2021-37973 CVSSv3 9.8 and CVE-2021-37976 CVSSv3 6.5). Lastly, the third campaign dates from October 2021 and involves the use of 0-days in Chrome and Android (CVE-2021-38003 CVSSv3 8.8 and CVE-2021-1048 CVSSv3 7.8).

Despite exploiting different 0-days, the base of the campaigns was the same. The attackers distributed “one-time link” links (valid only once and expiring after 24 hours) by spoofing URL shortening services to Android users via email, from which they distributed the exploits.

The aim of the campaigns was to distribute the Android malware called ALIEN, which subsequently downloaded the Predator spyware. Regarding the attribution of the campaigns, the researchers suggest that the actors behind the campaigns are backed up by governments, and they particularly point to at least those of Egypt, Armenia, Greece, Madagascar, Côte d’Ivoire, Serbia, Spain and Indonesia. Their conclusions are in line with investigations carried out by CitizenLab in December 2021.

More info: https://blog.google/threat-analysis-group/protecting-android-users-from-0-day-attacks/

* * *

​​​​​​​​Distribution of Cobalt Strike via fake PoCs

Cyble security researchers have discovered that threat actors have reportedly used fake proof-of-concepts for two recent Windows vulnerabilities to infect their victims with Cobalt Strike. The attackers posted malicious PoCs on GitHub for the remote code execution vulnerabilities CVE-2022-24500 and CVE-2022-26809, both of which were fixed by Microsoft last April.

The two repositories belonged to the same GitHub user, named “rkxxz”, whose account and repositories have now been removed. The target of this type of practice, which is becoming increasingly common, tends to be individuals involved in information security.

According to Cyble’s analysis, the malware used in this campaign is a .NET application that displays a fake message about the attempted exploitation of the vulnerability and then executes PowerShell commands to download the Cobalt Strike beacon.

More info:  https://blog.cyble.com/2022/05/20/malware-campaign-targets-infosec-community-threat-actor-uses-fake-proof-of-concept-to-deliver-cobalt-strike-beacon/

* * *

​​​​0-day vulnerability in Tails

Tails has issued a security advisory warning that a vulnerability has been found in its Tails 5.0 version which could affect users who use the Linux distribution to access the Tor browser.

For this reason, they recommend not to use Tor until May 31st, when the update to version 5.1 will be released. This bug is related to the security advisory issued by Mozilla, which fixed two critical vulnerabilities affecting its Thunderbird email manager and Firefox browser. These flaws were classified with the identifiers CVE-2022-1529 and CVE-2022-1802 and were related to a bug in the JavaScript engine, which is also used by Tor.

Tails states that, if exploited, it could allow an attacker to obtain confidential information such as passwords, private messages, among others, although the encryption of connections used by Tor to maintain user anonymity would not have been affected.

Tails recommends rebooting the system and claims that Mozilla has detected activity related to the exploitation of these flaws.

More info: https://tails.boum.org/security/prototype_pollution/index.en.html