Category Archives: Security

Cyber Security Analytics and “AI”

The latest craze in computing is “AI”, which I have placed in quotes to emphasize that these are neural networks not what a science fiction fans would recognise as an Artificial Intelligence, like Data from Star Trek or C3PO from Star Wars. These neural networks rely on being pre-trained by content such as text to learn natural languages, code bases to understand how to code in a language or images in the case of Midjourney. This means the product is always limited by the available content it has access to.

What does this mean for the Security Analysts and Engineers?

Well, we are seeing Microsoft already announcing its Microsoft Security Copilot program and I see this as the future of of security analytics. What we will be seeing in the short term is AI will be used as a force multiplier for security teams and attackers alike. This means that organizations that do not innovate and adopt AI assisted analytics will be behind the curve in detection and protection from cyber attackers. Engineers will benefit because they will no longer have to spend hours learning a new query language or scripting language for one platform of limited use, instead, they can apply their knowledge of what they are looking for and have it converted into the syntax of the necessary language for scripting or queries.

Will coding jobs go away?

In short, no, I do not see that happening, the opposite will be the case. AI will be an amazing tutor for learning programing, and computer science in general. It will elevate the capabilities of software development teams in many ways from ideation to debugging. Using GPT-4 reminds me of when I got together with my class in our first programing class, problem solving concepts with C++. The start of the class was pseudocode and UML diagrams. This let us discuss logic and the development process without having to dive into the intricacies of C++. This is where I see AI assisting, as a tutor for the student.

To Bard or not to Bard…

Some of my first attempts at leveraging AI were dismal failures. On the first week that Bard became available to code with I asked it to write a python program for me that solves pi to 10 places. It could not do so, not only did the code not work due to a divide by zero fundamental flaw, but, the language model explanation of what the code was even doing was flat out wrong.

GPT-4…

Chat GPT was closer, but out of the box it had a syntax error on the if statement regarding precision. Python does not let you start a variable name with a number.

But, I thought GPT-4 could do better, so, I gave it a thumbs down and told it there was an error with the code. It came back with corrected code that does now function and it is more or less correct, the last digit is rounded which I would not do but i’ll take it.

And so…

Not sure what is next, but to keep following the progress of these different “AI” systems, just like the watershed moments of Electricity, Assembly lines and mass production, The automobile and the computer; AI will be disruptive and life changing, but not likely life ending.

The rise of AI?

Artificial intelligence (AI) is rapidly changing the world, and the field of cybersecurity is no exception. AI is being used to develop new tools and techniques for detecting and preventing cyberattacks, but it also poses new risks.

One of the biggest risks of AI is that it can be used to create more sophisticated and powerful cyberattacks. For example, AI can be used to develop malware that is better at evading detection, or to launch denial-of-service attacks that are more difficult to mitigate.

Another risk of AI is that it can be used to automate cyberattacks. This means that attackers will no longer need to be skilled in coding or hacking in order to launch successful attacks. Instead, they can simply use AI-powered tools to do the work for them.

Finally, AI can be used to create new types of cyberattacks that are not possible with traditional methods. For example, AI can be used to generate deepfakes, which are videos or audio recordings that have been manipulated to make it appear as if someone is saying or doing something they never actually said or did. Deepfakes could be used to spread disinformation, damage someone’s reputation, or even influence elections.

In order to mitigate the risks of AI, organizations need to take a number of steps, including:

  • Investing in AI-based security tools and techniques.
  • Training employees on how to spot and report cyberattacks.
  • Implementing strong security measures, such as firewalls and intrusion detection systems.
  • Conducting regular security audits.
  • Working with law enforcement to investigate and prosecute cyberattacks.

By taking these steps, organizations can help to protect themselves from the risks of AI-powered cyberattacks.

Here are some additional tips for mitigating the risks of AI in cybersecurity:

  • Use AI-powered tools to monitor your network for suspicious activity.
  • Keep your AI systems up to date with the latest security patches.
  • Use strong passwords and multi-factor authentication.
  • Be careful about what information you share online.
  • Be aware of the latest phishing scams and other social engineering attacks.
  • Educate your employees about cybersecurity best practices.

By following these tips, you can help to keep your organization safe from the risks of AI-powered cyberattacks.

Unsafelinks

Microsoft Safelinks is both good and bad. The good lies in that users are provided with improved protection because Microsoft is resolving the link ahead of time and determining to the best of their ability weather it is a malicious site.

The bad is that the hyperlink is almost unreadable to the common person. The obfuscated links look something like this.

https://na01.safelinks.protection.outlook.com/url=
https%3A%2F%2Fyugecyber.com%2F&
data=02%7C01%7C****_*******%40*******.com
%7C3a2a5ba689234a5dfe6b08d65a38d61f
%7C94a74758f2ff413c9f705725701b8d02
%7C0%7C0%7C636795597490344404&s
data=QFY6Fsvgw%2FrqCB1cq%2BQPc8CYUy7t7OYNRr2lixcgKXU
%3D&reserved=0

Most of this here is junk. This junk relates to Microsoft’s classification of the hyperlink and is really only useful to them. When I first saw all of this I over complicated the whole thing. It was not until I was researching LogRhythm’s Phishing Intelligence Engine and dug into their de-obfuscation of these links that it became clear to me to just throw most of this out and to look for the encoded url. So i dug into this some more and wrote this little python script to clean up the mess for me.

https://github.com/nayra42/unsafelinks/blob/master/unsafelinks.py

Sextortion

There is a new email extortion phish on the rise. This new scheme involves the attacker scraping the internet for lists of compromised email address and passwords. They then are sending out a scripted email that claims that the attacker has a compromising video of you and your computer activity. They also list a password that they have obtained that is associated with the email address. The attacker then says they will send the video they have to your friends and family if you do not pay them a not insignificant amount of money via BitCoin.

This type of extortion scam is nothing new, however, the inclusion of a utilized password can make it seem more legitimate than an email with threats and no proof.​​

 

The best way to guard against these extortion scams is to :

  • Use a password manager like 1Password or LastPass.
  • Use an Antivirus software like BitDefender or ESET (heck even windows defender)
  • Never re-use passwords on other sites
  • Change your password when compromises are anounced
  • Check haveibeenpwned.com This site is ran by Troy Hunt, a security researcher who maintains databases of breaches and the info in them. He provides this as a free service for users to find out if they are compromised.
  • Never open email attachments from people you do not know, even if you do know them call them or send them a text to verify
  • Use a web cam cover on webcams not in use or turn them off

If you think that some one has personal information on you and is extorting you and you and you are in the USA then you can always contact 1-800-CALL-FBI.

 

I got some stuff from here – https://krebsonsecurity.com/2018/07/sextortion-scam-uses-recipients-hacked-passwords/​

Freakout?

So, I am sitting here while the whole world freaks out about Specter and Meltdown.  Are these bad?  Absolutely.  But running around and patching all the things before evaluating what the patches are doing doing and if they are going to impact systems is not the right move.  Intel in my opinion is fumbling the entire Meltdown issue.  However, Specter still exists and it is not going anywhere folks.

The CVEs that are tied to Meltdown and Specter are CVE-2017-5752, CVE-2017-5715, and CVE-2017-5754.

For right now the stance I am taking in my home environment is to accept Windows and Linux updates as they come.  If and when Firmware updates are published for my homelab servers (old 10 series Dell servers) I will evaluate weather I will be updating.  Same goes with any of my Hypervisors.

Their are already POCs out for Meltdown and Specter, so, it is a real world threat.

I guess I really don’t know what to say other than read, research and understand the implications that Meltdown and Specter will have on your work and home environment.  Specter and Meltdown are going to be around for decades and we are going to need to patch when possible and harden when not.

 

DEF CON 25: Or how I learned to embrace the villages and ignore the talks.

DEF CON 25 was only my second time at ‘CON.  I still felt like a n00b and still know nothing.  But, I came to the realization that these past two years I did ‘CON wrong.  I once again went to way too many talks.  Once again, I tried to plan too much ahead of time.  Once again, I spent way too much time in lines.  But, What I did do was talk to more people, not stress going to all the talks I wanted to and did not stay out way too late Friday night.

For the next time, when ever that is, I need to participate in villages and challenges to get the true essence of DEF CON.  The talks are available later and are just as good to digest later.  I am still just not sure what I want to focus on.  Maybe packet hacking village, that seems like the easiest to jump into.  I am also interested in the darknet competition.