Pretexting

The attacker will reach out to you under a pretext, which can be very believable depending on how much effort they put into researching you. This pretext can then be used as a hook to verify information they already have, or gain new information. The attackers might also leverage information they previously acquired to give the impression that since they are authorized to know what they already know, they are authorized to know more.For example, knowing about a recent Internet outage at your office, a clever attacker might call you for a follow-up or even show up in person to gain valuable insights into how your network is secured—and where it’s vulnerable.

Diversion

In this tactic, the social hackers will try to intercept data or even money by routing it along routes that they control. These requests could come in the form of a call from the “suppliers,” which will inform you of a change in their bank or email accounts. But it could also be as simple as adding somebody in cc of an email chain. You could for example get an email from a private account with the name of your business partner. Your “business partner” claims they currently can’t access their work email, asking you to resend the budget forecasts or blueprints.

Baiting

The most common version of this tactic can come in the form of a USB stick you find near your car, or a free music in your mailbox. These come pre-filled with malware that infect your computer as soon as you insert the drives. In a well targeted attack, they are custom made for your computer and likely evade common anti-virus software. But baiting can also be much less technical. It could take the form of a free tour during which you are befriended and tricked into revealing sensitive information, or you have your equipment bugged.

Asserting Authority

Especially in large organizations, it can be difficult for each employee to at all times know who they are accountable to. Hackers exploit this by asserting their authority over people and pressuring them into revealing information, making changes to data structures, or giving up access to systems. In security-relevant departments, it is important to develop a clear chain of command, including a limited set of authentication methods (PGP works great for that). The people in that command have to learn to deny requests when they do not come from the appropriate channels or lack proper authentication. Imagine getting a request from someone in an overseas department who claims to have superiority over your boss, asking you for their travel details. Would you give it to them?

Exploiting Kindness

It’s great when people are helpful, and we usually assume that those around us have good intentions. But from a security standpoint, giving strangers the benefit of the doubt can be devastating. An attacker might appeal to your kindness. Often enough, asking for compromising information is all that it takes. Some rare compliments from a contractor can brighten up anybody’s day. So is it too much when they ask for a heads-up on the budget planning? Most likely it is.

Associations

The human mind quickly jumps to conclusions and sides with what is familiar to us. This is why we see the Virgin Mary on toast and that woman standing on Mars. Attackers can exploit that by playing with your associations, making it unclear who is calling you and being vague about what they are talking about. Often enough the attacker doesn’t know themselves who they supposed to impersonate, but the person being hacked fills the gaps for them. Who was that just now on the phone talking about some security audit? Must have been Adam. He always bugs people about that stuff. But if it wasn’t Adam, who did you just gave that password to?

RAT

RAT is a type of malware that controls a system through a remote network connection. While desktop sharing and remote administration have many legal uses, "RAT" connotes criminal or malicious activity. A RAT is typically installed without the victim's knowledge, often as payload of a Trojan horse, and will try to hide its operation from the victim and from security software and other anti-virus software

Datum

Name

Language

Popis

2.2.2017

Víme, jak probíhal útok na ministra Zaorálka. E-maily mu četli celý rok!

CZ

Česká bezpečnostní scéna posledních pár dnů řeší průnik neznámých útočníků do poštovního systému Ministerstva zahraničních věcí. Ačkoliv někteří politici uklidňují veřejnost, že nedošlo ke ztrátě citlivých informací, jiní jsou opačného názoru.

2.2.2017

Útoků na ministerstvo zahraničí si dlouho nikdo nevšiml. Kdo bude dalším cílem?

CZ

Dalším velkým problémem pro Česko mohou být SCADA systémy, které slouží k řízení průmyslových či energetických institucí.

29.12.2016

GRIZZLY
 STEPPE

EN

This Joint Analysis Report (JAR) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). This document provides technical details regarding the tools and infrastructure used by the Russian civilian and military intelligence Services (RIS) to compromise and exploit networks and endpoints associated with the U.S. election, as well as a range of U.S. Government, political, and private sector entities. The U.S. Government is referring to this malicious cyber activity by RIS asGRIZZLY STEPPE.

22.10.2018

Foreshadow v7

CVE 2018-3620

22.10.2018

Foreshadow v6

CVE 2018-3646

15.8.2018

Foreshadow v5
L1 Terminal Fault (L1TF)

Foreshadow is a vulnerability that affects modern microprocessors that was first discovered by two independent teams of researchers in January 2018, but was first disclosed to the public on 14 August 2018.The vulnerability is a speculative execution attack on Intel processors that may result in the loss of sensitive information stored in personal computers, or third party clouds.There are two versions: the first version (original/Foreshadow) (CVE-2018-3615) targets data from SGX enclaves; and the second version (next-generation/Foreshadow-NG) (CVE-2018-3620 and CVE-2018-3646) targets Virtual Machines (VMs), hypervisors (VMM), operating system (OS) kernel memory, and System Management Mode (SMM) memory

15.8.2018

Meltdown v3
Rogue Data Cache Load (RDCL)

Meltdown is a hardware vulnerability affecting Intel x86 microprocessors, IBM POWER processors, and some ARM-based microprocessors. It allows a rogue process to read all memory, even when it is not authorized to do so.

22.10.2018

Spectre-NG

2018-3665 Lazy FP State Restore

22.10.2018

Spectre-NG

2018-3693 Bounds Check Bypass Store (BCBS)

22.10.2018

Spectre-NG v4
Speculative Store Bypass (SSB)

Speculative Store Bypass (SSB)

22.10.2018

Spectre-NG v3a
Rogue System Register Read (RSRE)

On May 21, 2018, Intel published information on the first two Spectre-NG class side-channel vulnerabilities CVE-2018-3640 (Rogue System Register Read, Variant 3a) and CVE-2018-3639 (Speculative Store Bypass, Variant 4), also referred to as Intel SA-00115 and HP PSR-2018-0074, respectively.

22.10.2018

Spectre v2
Branch Target Injection (BTI)

On March 15, 2018, Intel reported that it will redesign its CPUs (performance losses to be determined) to help protect against the Spectre and related Meltdown vulnerabilities (especially, Spectre variant 2 and Meltdown, but not Spectre variant 1), and expects to release the newly redesigned processors later in 2018.On October 8, 2018, Intel is reported to have added hardware and firmware mitigations regarding Spectre and Meltdown vulnerabilities to its latest processors. On October 18, 2018, MIT researchers suggested a new mitigation approach, called DAWG (Dynamically Allocated Way Guard), which may promise better security without compromising performance

15.8.2018

Spectre v1
Branch Target Injection (BTI)

Spectre is a vulnerability that affects modern microprocessors that perform branch prediction.On most processors, the speculative execution resulting from a branch misprediction may leave observable side effects that may reveal private data to attackers. For example, if the pattern of memory accesses performed by such speculative execution depends on private data, the resulting state of the data cache constitutes a side channel through which an attacker may be able to extract information about the private data using a timing attack.

22.8.2018

v.02.08

7.10.2018 20:00

Update09

Update 14.01.2019 12:37:23

10.10.2018 21:20

0000009