New remote execution vulnerability (CVE-2017-7269) was recorded in the National Vulnerability Database for Windows 2003 R2 IIS6 last week. Exploitation of this vulnerability allows a remote attacker to execute code on the vulnerable web server.
Thus, potentially allowing hackers to take over the whole system, install remote control systems and propagate within local network conducting local attacks. Results of the exploitation might be catastrophic for organizations. Microsoft will not provide a patch for this vulnerability, as OS is not officially supported.
WikiLeaks has recently exposed that the CIA possessed the capability to hack into nearly every device you own. With all that we have learned from these leaks, Digital Edge wants to take the time to focus on is the “zero days” concept – which can be simply put as a weakness/hole in a system that allows a hacker to breach it before anyone even knows about this vulnerability. The act of reporting the vulnerability is known as “zero days”.
Once a hole in the system is found, it should be reported immediately, so it can be patched up before it’s exploited.
As many have heard, according to Amazon’s blog post, it was due to a “human error” that on Tuesday, February 28th, that Amazon and over 100,000 of its clients experienced about 4 hours of downtime. It is no secret the tremendous impact that 4 hours of downtime can have on a company, but today, we at Digital Edge want to focus on industry’s uptime standards, quality of the provided services, and some practical suggestions to clients and colleagues.
Amazon promises a 99.95% SLA which, by definition, means that they’re promising an allowed downtime of 4.38 hours a year for clients. There are several issues with this promise. Normally, everything is fine when those 4.38 hours are split in multiple smaller outages. Such long single outage feels painful for everyone.
Digital Edge believes that there much better offers on the market for the same price.
Click here for the full article.
On February 10, 2017, the Department of Homeland Security issued the Enhanced Analysis of GRIZZLY STEPPE Activities.
One of the first detection and prevention recommendations is directly related to Digital Edge’s Log Management Service. Please click here to see DHS recommendation and reference to the full DHS analysis.
Digital Edge felt it was crucial to comment on the recent news regarding the political hacking crisis. Our Security Team wanted to make the efforts of acknowledging the ways of hacking. Hackers that continue to practice have not changed their ways. They use the same methods, techniques and tricks except now everyone knows how to use them. Actual hacking isn’t composed of an actual professional anymore; a child can access codes and hack someone. Whereas, real hackers develop tools, simplify them and sell them to regular people; they don’t actually hack anymore, making the person hacking not the real criminal at hand. It has become nearly impossible to figure out who the hacker is on a technological standpoint nowadays.
However, information securities methods have drastically improved, developed, and are now more advance than ever before. Not only is it easy to identify when someone is trying to hack you, but now it is easy to prevent someone from trying to steal your information. Digital Edge has put in its greatest efforts to create a security system that will protect our clients from any hackers and now we want you to know how to spot and avoid a hacker yourself!
Following a 500 million user account data breach in September, Yahoo has just announced that they have once again suffered another breach of an estimated one billion accounts. Yahoo disclosed in November, that the company was provided with data files from law enforcement claiming to be Yahoo user data. Outside forensic experts, in conjunction with Yahoo, have determined that it is in fact Yahoo user data, that was obtained by an unauthorized third party in August of 2013. The party responsible for the intrusion has not yet been able to be identified. This incident has been diagnosed to be separate from the incident in September 2016.
Yahoo believes that the information that was stolen consists of full names, email addresses, dates of birth, phone numbers, hashed passwords, and possibly security questions and answers as well. Luckily, Yahoo does not store credit card or any other payment information in the system that was affected.
Currently, Yahoo is identifying and notifying potentially affected users and instructing them to change passwords immediately. Additionally, Yahoo is removing all unencrypted security questions and answers from affected users so that hackers cannot use those answers to break into users accounts.
As 2016 comes to a close, it seems to appear to be the “Year of the Breach” with reports of eight major breaches involving well-known companies. Obtaining large amounts of data is key for these hackers, so companies most vulnerable are those which hold a large amount of personal data on their customers, including Social Security numbers, birthdates, home addresses and even medical records.
Digital Edge’s Security Operation Center (SOC) protects your organization’s intellectual property and sensitive data. Digital security threats are real and it is better to be able to detect and respond to them as quickly as possible. It is difficult for organizations without a comprehensive incident-handling capability to create a proactive SOC team. These capabilities have to include tools and processes that enable centralized security threat visibility, instant alerting, and efficient troubleshooting. Digital Edge’s SOC is ready to deliver those capabilities and provide security coverage for your organization today.
For more information on this new Yahoo hack, and tips to help keep your password safe and secure, please click here.
Automated Event Log Management Solutions are used to facilitate the most difficult job in any compliance process. Regular review and correlation of event data through merging and archiving of events from multiple systems and separation of the most critical 1% of activities from useless 99% of noise. From the compliance perspective, event log management is: Collection (Consolidation), Archiving (Retention), Audit Reporting, and Monitoring (Alerting).
On September 20th, 2016, Digital Edge released an article on Log Management Laws and Regulations. Click here to view a little “Cheat Sheet" on the Event Log Retention Requirements that are mandated by major compliance regulations.
On Tuesday, August 16, Digital Edge passed the International Organization for Standardization’s (ISO) Quality Management Surveillance Audit using the 9001:2008 framework. ISO is an independent, non-governmental international organization with a membership of 163 national standard bodies. ISO is credited for publishing more than 2100 international standards, covering almost every industry, from technology, to food safety, to aviation and healthcare.
Digital Edge’s Security Team assists clients with cyber security forensics and often hears the question – “what is the proper way to report to law enforcements?” As a company, we aim to aid our clients in informing them on the right steps to take when dealing with a cyber-incident. There is a growing number of cyber networks that were seriously attacked and this is not a matter to be taken lightly. This is why Digital Edge feels it is important to know the right procedure. These incidents can result in serious consequences with the capability of causing lasting harm. By reporting these incidents, the government can assist them with agencies that can investigate the incident, lessen the consequences, and help avoid these cyber incidents in the future.
Please click here for more information.
Digital Edge’s Security Team is monitoring the situation with TeamViewer hacking allegations. The news broke last week – some TeamViewer users complained that intruders gained access to their computers through TeamViewer program.
TeamViewer denied any hacking allegations but shortly following, its service was knocked off by a DDoS attack aiming DNS services, leaving more questions to TeamViewer’s Security Team.
1. Even though the situation is still not clear, the Digital Edge Security Team sides with security expects blaming a BackDoor Trojan discovered in May of 2016. The signature for the Trojan was added on 05/26/2016. The version of Trojan - BackDoor.TeamViewer.49 utilizes TeamViewer as its backdoor implementation and is delivered by Trojan.MulDrop6.39120 through Adobe vulnerability. Even though the Trojan is supposed to hide the TeamViewer interface and use its functions in the background, we believe that mutation of the virus (the virus uses advanced hiding techniques) can create an unpredicted effect on the systems with legitimately installed TeamViewer causing effect described by users that reported the compromise.
Please click here for more details.
As a result, we do believe that it is safe to use TeamViewer, unless your system does not have updated antivirus and does not have all latest patches installed. By saying that, the Digital Edge team urges to cautiously use this product, as there is no confirmation from TeamViewer’s Security Team or reputable security companies that our analysis is correct
2. Digital Edge security team has contacted all clients using TeamViewer and discussed preventive measures.
3. If you are using TeamViewer please click here to see our advice how to verify that your TeamViewer was not hacked.
If you feel that you need assistance from the Digital Edge Security team please contact Danielle Saladis at dsaladis@DIGITALEDGE.NET.
Digital Edge is committed to providing the highest levels of security within all the IT infrastructure environments under its care. In order to achieve this utmost goal for all of our clients, we continuously maintain vigilance both on the productive side of IT as well as on its destructive side. We thus send out news and security bulletins such as this one from time to time to ensure that our clients are informed and educated on any important developments in IT security and are fully aware of what we are doing to ensure that we and our clients are always at the Cutting and at the Digital Edge of technology.