Fuzzing is a software testing technique which is used to find implementation bugs that can be hacked by using malformed/semi-malformed data injection in an automated fashion. The data injection consists of different permutations of data that are fed into target program until one of these permutations reveals a vulnerability that can be exploited by the cyber criminals.

A fuzzer may try different combinations of attacks on:

• Numbers (signed or unsigned integers, floats, etc.)
• Characters (urls, command line inputs, etc.)
• Metadata (user input text such as id3 tag)
• Pure Binary Sequences

The most common approach for a fuzzing attack is to define a list of ‘fuzz vectors’ (known to be dangerous values) for each type and inject these vectors or their recombination into the program.

Here is a list of common fuzz vectors:

• For Integers: Zero, possibly negative or very big numbers
• For Chars: Escaped, interpretable characters / instructions (ex: For SQL Requests, quotes / commands…)
• For Binary: Random ones
• For Chars: Escaped, interpretable characters / instructions (ex: For SQL Requests, quotes / commands…)

Types Of Fuzzing Attacks:

Application Fuzzing: A web application fuzzer tests for buffer overflow conditions, error handling issues, boundary checks, and parameter format checks. Irrespective of the type of system to be fuzzed, the attack vectors are in it’s Input or Output system. Attack vectors for a desktop app are:

• The UI (testing all the buttons sequences / text inputs)
• The command-line options
• The import/export capabilities

In case of a web app, attack vectors can be found in urls, forms, user-generated content, RPC requests, etc.

Protocol Fuzzing: To launch a protocol fuzzing attack, a fuzzer sends forged packets to the tested application and eventually acts as a proxy to modify requests sent to the server and replay them to find a vulnerability.

File Format Fuzzing: In a file format fuzzing attack, the fuzzer generates multiple malformed samples and opens them in a sequence. When the program crashes, the sample is kept for further investigation. Using a file format fuzzing attack, hackers can attack-

• The Parser Layer (Container Layer): These attacks target file format constraints, structure, conventions, field sizes, flags, etc.
• The Codec/Application Layer: These are lower-level attacks which aim at the program’s deep rooted information.

Centex Technologies provide complete IT security solution to clients. For more information, contact Centex Technologies at (972) 375 - 9654.              

Wireless networks have grown a lot from the first generation (1G) to 4G/LTE networks that offer faster speeds. Now, the stage is being set for 5G that will connect a large number of new devices and sensors with future communication technologies while introducing new capabilities and services.

But with great transformation come great risks! Some security professionals are warning that 5G will also empower the hackers with speed and capabilities to launch high-speed malicious activity across larger number of devices in a short span. A survey indicates that approximately 73% of security professionals have shown high to medium concern on potential impact of 5G on cyber security.

Professionals indicate that 5G will introduce new vulnerabilities in:

• Supply Chain: 5G supply chain will be at risk of vulnerabilities such as malicious software and hardware, counterfeit components, and poor designs, manufacturing processes and maintenance procedures.
• Deployment: 5G is expected to use more information and communication technology components, so improperly deployment, configuration or management of equipment and networks may be at risk of disruption & manipulation.
• Network Security: Since 5G builds upon previous generations, it may be expected to carry forward legacy vulnerabilities such as DDoS attacks, etc.

In lieu of potential 5G risks and vulnerabilities, here are some ways to help you manage 5G security challenges:

• Prioritize Security: Organizations with security-first mindset are prepared to adopt 5G and other emerging technologies. But, also focus on your customers and in case they don’t have a culture that prioritizes security, help them adopt solutions and services that cover all the aspects of cyber security including incident response strategy.
• Deploy Standards-Based Devices: Organizations should focus on helping their customers and employees choose IoT devices that are embedded with in-built security features and meet established industry standards for security. It is important to make sure that the devices are capable of offering protection, detection, and mitigation.
• Adopt Virtualization: A large number of connected devices paired with the speed of 5G can act as a perfect playground for hackers and compound the security issues. Organizations can consider introducing virtualized security controls to help their customers in applying security policies across their environment at a quick speed, while employing automated remediation to help mitigate threats.
• Combine Threat Intelligence With AI: New capabilities of 5G will introduce new types of vulnerabilities and attacks. Organizations should infuse threat intelligence with AI or Machine Learning to immediately identify, detect and response at the point of attack.
• Zero-Trust: Organizations should implement zero-trust security policies. It includes verifying everything including user login, data access, incoming data, outgoing data, access requests, etc. without any exceptions.

5G can be used to garner business growth and profits, provided appropriate security measures are adopted.

At Centex Technologies, we educate our clients on the security challenges of 5G and required measures. To know more, call Centex Technologies at (972) 375 - 9654.

View Full Image

View Full Image

Protecting data is one of the top priorities for an organization as data theft can lead to leaked user credentials, financial loss, etc., among other notable damages. Cybersecurity teams of an organization need to be proactive in protecting the organization’s data to prevent the repercussions.

Here are five data protection steps to protect your business:

• Identify What Needs To Be Protected: When formulating a data protection strategy, it is first important to know what you are protecting. There might be some hidden or lost assets connected to the organization’s network. Employ an IT asset management system and run a discovery of organization’s environment to identify every asset that can be a potential source of vulnerability. Additionally, be aware of any software downloaded by employees on their devices and keep a track of shadow IT. Shadow IT on home computers or remote devices used by employees may pose a threat as these are not managed by IT team of organization. IT teams need to learn about software being used by employees and how to protect it.
  
• Patch & Update: Installing latest updates helps to keep a software protected as the updates contain patches to any vulnerabilities present in previous versions. Unpatched vulnerabilities are a significant problem. A study has indicated that unpatched vulnerabilities account for approximately 60% of all data breaches. Create a well-defined policy to evaluate and schedule updates and patches. This helps in minimizing downtime and increasing protection.
  
• Review The Tools: Efficient integration of information security tools such as antivirus, firewalls, and IDP/IPS into systems can improve data protection. Another important factor is to scale the protection as per the environment, for example consumer grade antivirus software used for securing a home computer would not be effective in case of an organization’s network. Organizations can monitor their environment using a SIEM tool aided by 24/7 security operations center.
  
• Spread Security Awareness: The famous Colonial Pipeline data breach was most likely caused by a phishing email. Employees may act as an entry point for a malware and are often targeted by cyber criminals by sending phishing emails or messages. Phishing emails are designed to look more realistic and the sender’s address is usually spoofed to look like a co-worker’s. It is important to educate employees to be able to identify phishing signs and take the required steps. Organize cybersecurity training at every level of hierarchy to keep employees updated about changing cybersecurity protocols.

Centex Technologies assists organizations in identifying their cybersecurity needs and provides services to strengthen the IT security of its clients. To know more about ways to protect an organization’s data, call Centex Technologies at (972) 375 - 9654.

A hybrid cloud model combines a private cloud with one or more public cloud solutions. In a hybrid cloud model, proprietary software enables communication between distinct services. This type of cloud computing model can help gain security advantage provided some critical challenges are addressed.

Following are crucial cybersecurity risks that need to be identified and addressed before implementing the hybrid cloud model:

• Compliance: A hybrid cloud model involves data movement between high-security private cloud and comparatively less secure public cloud. Such data movement may induce compliance issues and make data vulnerable to breaches. Businesses need to take extra measures to ensure that the hybrid cloud model meets compliance requirements. It may be achieved by ensuring that individual private and public cloud networks meet standard data security norms such as GDPR (General Data Protection Regulation). Also, it is important to make sure that the data transfer mechanisms adhere to regulatory requirements.

• Data Privacy: The essence of hybrid cloud model lies in flexible data movement between public cloud and private cloud. In such movement, there are high chances that the data can fall prey to intruder attacks that challenge the organization’s data privacy rules. Organizations should employ measures such as endpoint verification protocol, robust VPN, and strong encryption policy. These measures help in encrypting and protecting data from security breach incidents.
  
• Distributed Denial of Service: DDoS is another serious cyber-attack that can be initiated from multiple sources to target a single location. Since the attack has various source locations, it becomes difficult to trace and detect. This increases the risk factor. To tackle this, organizations need to maintain a strict monitoring system that can track the inflow and outflow of data. It is important to make sure that the monitoring system should be scalable, responsive, and able to handle multi-vector attacks.
  
• Service Level Agreements (SLA): Employing a hybrid cloud solution means handing over data governance and accountability to its public Cloud Service Provider (CSP). If the security of such a public cloud is compromised, it can be a severe issue and may lead to critical data loss. To avoid such issues, be careful while signing Service Level Agreements with the service provider to ensure data confidentiality. Make it a point to understand security limitations and strictly define accountability factors.
  
• Risk Management: Organizations should employ adequate risk management and preventive safety measures to protect their intellectual property from potential risks. Organizations can use tools such as IDS/IPS to scan malicious traffic. Also, maintain a log monitoring system with advanced firewall and security management features.
  
• Data Redundancy: Organizations should adopt a well-defined data redundancy policy to ensure timely backup of critical data. This can be achieved by maintaining multiple data centers. It also helps in continuing business services during data center outages.

For more information on various cloud models, contact Centex Technologies at (972) 375 – 9654

Cyber-attacks have become sophisticated and are now capable of causing long-term effects on organizations. Thus, businesses need to prepare comprehensive cybersecurity policies. The first step to drafting a cybersecurity policy is to be aware of the threats.

Here are the types of cyber-attacks that an organization is most likely to face:

• Brute Force Attack: Under this type of attack, the attackers adopt a trial and error approach to guess the password to a system or user account. They try every possible combination of passwords or passphrases until the account is unlocked. Brute force attacks are expedited by using software or tools that can push many possible passwords in a short time. Some of the tools used by cybercriminals include Aircrack-ng, Crack, Hashcat, Hydra, etc.
  Safety Tips:
• Use complex passwords and change them regularly
• Set a limit on number of login attempts
• Enable captchas
• Employ multi-factor authentication
• Credential Stuffing: Credential stuffing cyber-attack is based on the assumption that users tend to keep the same password across multiple accounts. Attackers use a database of compromised credentials (password breach database available on the dark web containing stolen credentials from data breaches) to gain unauthorized access to an account. The attackers use bots for automating and scaling up the attack. The hacked accounts can be used for financial theft, fraudulent transactions, misuse of stored data, etc.

Safety Tips:

• Employ multi-step login process throughout the organization
• Blacklist suspicious IP addresses
• Use techniques such as device fingerprinting
• Phishing & Spear Phishing: Phishing is one of the most common cyber-attack types. Attackers frame an email that looks legitimate with a seemingly trusted source to trick targets into providing personal details. The emails generally include matters that would require a user to act in a hurry; for example, the email may mention that the user needs to verify his details within a few minutes to avoid being charged a penalty or account suspension by his financial institution. The attackers use technical knowledge in conjunction with social engineering to design a successful phishing attack. Spear phishing is a more targeted attack where the attackers research the target to prepare a more personalized message or email.

Safety Tips:

• Be wary of emails from unknown sources
• Before clicking on a link, hover over it to see the destination
• Pay close attention to email headers
• Malware Attacks: Malware is a broad term representing attacks where malicious software is downloaded on the target device to steal, encrypt, or delete sensitive data for business or financial benefits. Majorly known forms of malware include adware, bots, ransomware, and Trojans.

Safety Tips:

• Use a dedicated tool for adware removal
• Install firewall and keep the system up-to-date
• Perform frequent backup
• Avoid downloads from unknown sources

Centex Technologies is committed to helping clients understand cyber-attacks and formulate an effective strategy to stay protected. For more information, call Centex Technologies at (972) 375 - 9654.

Recent times have been quite eventful for cybersecurity specialists. The world witnessed a number of cyber-attacks; thereby creating a need for adoption of advanced cybersecurity solutions.

Here is a brief description about some significant breaches that happened recently:

• SolarWinds: In this attack, hackers were able to successfully compromise the infrastructure of a company named SolarWinds. The company produces a network and application monitoring platform known as Orion. After compromising the company’s infrastructure, the attackers used their access to distribute compromised version of the software to the users including 425 of Fortune 500 companies, top ten telecommunication companies of US, top five US accounting firms, hundreds of colleges worldwide, etc. Malware infected version of Orion was used to successfully breach a cyber-security company known as FireEye. Another malware known as Supernova also used the compromised Orion version as the delivery method to infect its victims.
• Software AG: Software AG is the second largest software vendor in Germany and seventh largest in Europe. It was hit by Clop ransomware attack in October 2020. The attackers demanded $23 million as ransom.
• Sopra Steria: It is a European IT firm that provides an array of IT services, including consulting, systems integration, and software development. In October 2020, the company was attacked by a new version of Ryuk ransomware.
• Telegram: A group of hackers that had access to the system used for connecting mobile networks across the world were able to gain access to Telegram messenger and email data of high-profile individuals in the cryptocurrency business.

Formulating new cyber security strategies and updating existing protocols is necessary for staying protected against cyber-attacks. A great way to do so is to observe the cyber-attacks and understand the new techniques being used. Recent cyber-attacks have shown that ransomware and social engineering attacks are gaining momentum. In terms of defensive actions, SolarWinds attack has indicated that third party risk management needs to be prioritized. Protecting remote endpoints and workers has emerged as next priority. Automated response systems should be used to improve the response time for preventing lateral infections through the network.

Centex Technologies provides cybersecurity solutions to businesses. For more information, call Centex Technologies at (972) 375 - 9654.

A ransomware is a malicious program that infects a target device and gains control. The program encrypts files and blocks the user access to the infected data (or system) until the targeted organization pays the ransom to the attackers. Although the instances of ransomware attacks have gained momentum lately, it is actually a primitive cybersecurity threat.

Here is a brief account of history of ransomware:

• First Ransomware: The first known ransomware attack was recorded in 1989. The attack was carried out by Joseph Popp, an AIDS researcher. He distributed 20,000 floppy disks containing a malicious program to AIDS researchers across 90 countries. He made pretence that the floppy disks contained a survey program. It was a basic ransomware attack and since then ransomware attacks have evolved and have acquired an array of advanced features.
• Locker Ransomware: In 2007, a new category of ransomware malware appeared. It was known as Locker Ransomware. This type of ransomware did not encrypt files; instead it locked the victim out of the device preventing him from using it. Another ransomware that operated on this technique is known as WinLock. The ransomware employed worms such as Citadel, Lyposit, and Reveton for displaying a fine message from a law enforcement agency. The ransomware demanded $10 as ransom in exchange for the unlocking code.
• Scareware: After a few years, the attackers changed their strategy. They started capitalizing on the fear of ransomware by spreading fake applications and antivirus programs. In these types of ransomware attacks, the malicious applications attack a target device and display a pop up message saying that the device has been infected with viruses. The message encourages the victim to visit a website and pay for antivirus software for fixing the problem. The link mentioned in the message redirects the user to a malicious website designed to look authentic and legitimate. After a few years, cyber criminals understood that they can compromise any website instead of designing fake websites. They switched to automated ransomware attacks the included phishing emails as vectors.
• Crypto Ransomware: In 2013, first cryptographic ransomware emerged. It was known as CryptoLocker. It was launched by Gameover ZeuS bot and was sent as an email attachment. Once downloaded, the ransomware encrypted the files on the device and demanded a bitcoin payment for unlocking the files.
• Ransomware-As-A-Service: It is the latest step in the evolution of ransomware. It first appeared in 2015 with the Tox toolkit launch. This gave beginner cybercriminals a chance to develop custom ransomware tools with advanced capabilities.

Centex Technologies offers cybersecurity solutions to businesses. For more information on, call Centex Technologies at (972) 375 - 9654.

View Full Image