Security in Trends

In today’s world technology evolves rapidly. New tools, approaches, and trends seem to come out on almost a daily basis. It’s our duty to keep pace with these changes, adapt to new technologies and apply all our knowledge, skills, and abilities to find and report all vulnerabilities as soon as possible.

With the spread of IoT (Internet of Things) technologies, more devices are exposed every day to the Internet, but they are not necessarily secure. IoT devices provide additional entry points for attackers, giving them a whole repertoire of mechanisms to compromise confidential information.

According to Bank Info Security [1], attackers continue targeting the same IoT flaws reported and disclosed 3 years ago. IoT malware, such as Mirai, keeps growing, escalating and mutating. Your mobile, webcam, router or even your printer can be a target. And these attacks are not particularly difficult to perform; you can even find Youtube tutorials about them.

If you’re part of the industry, you aren’t safe either, since PLCs, SCADA systems, smart sensors, and drives are also IoT devices that can be compromised as a result of a Mirai Botnet attack. This may be discouraging, even more so if we consider that in upcoming years, the amount of IoT devices will increase considerably. We can, however, mitigate some risks now through system hardening, and something as simple as changing the default credentials as well as using secure passwords. All of these can prevent an IoT attack.

Most companies are now migrating to the cloud. The advantages of Infrastructure as Code (IaC) are clear: maintainability, scalability, and pricing, among others. With cloud computing service providers like Amazon Web Services, Digital Ocean or Microsoft Azure with large dedicated teams maintaining their servers, our small infrastructure team seems obsolete in comparison. It’s better to outsource this aspect to bigger companies and stop worrying about physical infrastructure. Well, this is not completely true. We cannot disregard the security aspect; the providers fulfilled their duty, now we must fulfill ours.

According to Ben Morris, of Bishop Fox ^[2], speaking at Defcon Security Conference #27, hundreds of thousands of Amazon Elastic Block Storage (EBS), have misconfigurations that led to sensitive data leakages: passwords, authentication keys, and encryption keys, among others.

And what’s worse is in 2018, more than 70 million records were leaked due to poorly configured AWS S3 buckets ^[3]. The main cause of this kind of vulnerability was again the human factor. A lack of knowledge or negligence regarding infrastructure settings can directly impact your company. A weak AWS configuration can be detected using automated tools. Asserts, a product we used to offer, detected these flaws, using the AWS Cloudtrail module. However, some of the cloud leakages were also caused by hardware vulnerabilities ^[3], such as Spectre ^[4], Meltdown ^[5] or Foreshadow ^[6], that exploit vendor chips' vulnerabilities to gain access to shared memory pools on physical systems. So, it is important to keep up to date with both software and hardware to avoid these kinds of attacks.

At Fluid Attacks, we have all our infrastructure as code. We use AWS as our cloud computing service provider, terraform and docker to configure our infrastructure, and Gitlab as service to regenerate our datacenter on every new version of our products. We implement infrastructure hardening using ephemeral secrets in a serverless approach. At Fluid Attacks, we take security very seriously, since it’s our value promise.

Machine Learning, Neural Networks, and Artificial Intelligence have demonstrated that they have several applications, and cybersecurity is not an exception. This topic has been widely addressed in several blog entries, so instead, let’s discuss Fluid Attacks' opinion about the prospects for Machine Learning in the cybersecurity field

At Fluid Attacks, we do not discourage the use of automated tools in security tests; However, a real security issue comes up when only automated tools are used, since these tools can report false positives. For example, in the case of neural networks, some inputs can fool the entire algorithm. Automated tools also do not have the human malice to correlate vulnerabilities and then create more complex attack vectors. We see machine learning emerging technologies more as tools rather than the holy grail of cybersecurity that will replace human hackers. These tools can help our analysts to decide where to look first, what portions of code may have vulnerabilities and require further attention, or which inputs may not have been properly sanitized.

In today’s world, businesses usually have an online alternative for purchasing or selling products or services. These online alternatives have to be handled with extreme care since most cyberattacks aim to profit from these functionalities. E-commerce attacks come in all shapes and sizes ^[7]: phishing, identity theft, DDOS, credit card frauds, and more.

According to Verizon, in its annual Data Breach Investigations Report ^[8], social engineering is the second most used tactic to extract confidential information. This is worrying because it doesn’t matter how secure an application is if users are fooled into providing access credentials. This, of course, applies to E-commerce as well.