Security Leftovers
-
Sec firm MDSec slams Proofpoint for post on pen-testing framework
European security firm MDSec has taken exception to the release of a blog post by another security outfit, Proofpoint, about its penetration testing framework Nighthawk, accusing the latter of making "unsubstantiated and speculative projections" about the framework.
Nighthawk is an advanced C2 framework similar to Cobalt Strike and Brute Ratel; it can be used by both black hats and red teams and is commercially licensed.
Proofpoint's post said it had identified initial delivery of Nighthawk in September and then investigated the potential of the framework. It pointed out that it did not take very long for such tools to spread to the black hat community after they were released, writing:
"Between 2019 and 2020, Proofpoint observed a 161% increase in threat actor use of Cobalt Strike. This increase was quickly followed by the adoption of Sliver – an open-source, cross-platform adversary simulation and red team platform.
[...]
MDSec was obviously annoyed that Proofpoint had published its post without first speaking to MDSec.
-
Australian cops 'using psyops' in fight against Medibank attackers [Ed: Microsoft Windows TCO]
Australian law enforcement agencies appear to have resorted to psyops in a bid to send a message to network attackers that Australia is not the best place to do business.
A message on a Russian language forum — written in surprisingly good English — called the attack on medical insurer Medibank Group unprofessional and speculated that it might kill off the Australian market for ransomware-as-a-service.
The attackers were castigated for not encrypting the data they gained access to before exfiltrating the same and also criticised for not obtaining persistence within the system attacked.
[...]
"Someone has then negotiated to utilise REvil, a group that was ostensibly 'dismantled' by the FBI/FSB early this year and done nothing officially since and now REvil's Happy Blog Tor site has been magically resurrected on a new onion and Medibank's data posted in chunks, presumably in the hope that Medibank will change its mind."
-
2FA, 3FA, MFA… What does it all mean?
Simply put, authentication is the act of proving you are who you say you are. To gain access to protected information, systems or locations, the user must prove their identity by providing specific access credentials.
The system asks: “Who are you? Prove it.” When the user successfully authenticates (and depending on the permissions associated with their account), the system allows them to perform specific actions, access specific information or specific physical locations.