Dylan  Iqbal

Dylan Iqbal

1581300041

Modern WebApp Vulnerabilities

With the emerging popularity of bug bounty programs, lesser known and even brand new vulnerability classes are gaining popularity. This talk will give a walkthrough of some of these vulnerabilities, how they occur in modern web applications and how they can be found and fixed.

#web-development #security

What is GEEK

Buddha Community

Modern WebApp Vulnerabilities
Ray  Patel

Ray Patel

1623121500

Most Common Python Vulnerabilities and How To Avoid Them

Everybody knows about Python. It’s now the second-most popular programming language worldwide, having overtaken Java. Not only is it used widely for machine learning and data science, but it’s also easy to learn for beginner programmers because of its easy code syntax, mimicking the English language.![]

With such widespread use, of course, comes increased attacks and threats; malicious attackers are more likely to scope out Python vulnerabilities that they can exploit for numerous applications. If you use many third-party modules like dnspython or pip, or other open-source libraries, you could be introducing security risks to your application. In this article, we will first discuss some issues developers usually neglect and then look into the threats posed by outdated third-party modules.

Common Python Vulnerabilities

Why do they exist?

Example

Patch

#vulnerability #cybersecurity #python #python vulnerabilities #more likely #most common python vulnerabilities

Brain  Crist

Brain Crist

1597892400

Large Orgs Plagued with Bugs, Face Giant Patch Backlogs

Large companies find an average of 779,935 individual security bugs when running routine vulnerability scans; and over the course of six months, an average of 28 percent of those vulnerabilities will remain unmitigated. This leaves many of these organizations in a sitting-duck position for cybercriminals, rearchers said.

That’s according a study from the Ponemon Institute, The State of Vulnerability Management, which surveyed 1,800+ IT professionals at companies with more than 1,000 employees. The survey found that the average backlog of bugs for these companies totals a whopping 57,555 identified vulnerabilities.

Clearly, prioritization becomes critical to vulnerability management in this scenario; however, the survey also found that organizations have difficulty in achieving that. A full 57 percent of respondents said their organizations don’t know which vulnerabilities pose the highest risk to their businesses.

And only a quarter (25 percent) said they’re able to prioritize patching based on which assets are the most important to the business.

About 37 percent of respondents said their primary method for prioritization is the identification of which vulnerabilities are weaponized. This isn’t a bad strategy on the surface given that criminal external attacks were the most common cited root cause of data breaches in the survey (34 percent). External attacks were followed by human error (24 percent), and system glitches and malicious insider threats accounted for the rest.

“Even if they prioritize vulnerabilities accurately, the process of remediation can become a headache as teams try to process the information — who owns the vulnerable asset, is there a patch, what if the patch doesn’t work, when is an appropriate time for patching, etc.,” explained researchers from IBM X-Force, in the report, released Monday. They added, “Every enterprise has an immense amount of data, much of which is siloed, giving each team a different perspective of risk. The fragmented viewpoints prevent seeing the full risk picture, which can also lead to important vulnerabilities being deprioritized or overlooked.”

Only 21 percent of respondents said their organizations are “highly effective” in patching vulnerabilities in a timely manner. According to the research, it can take almost a month (28 days) to patch once a critical or high-risk vulnerability is detected on-premises, and 19 days if it is detected in the cloud.

All of this leaves a broad swath of businesses at risk for compromise from known bugs. And in fact, out of the 53 percent of respondents who said their organizations have had a data breach in the past two years, 42 percent of them said they occurred because a patch wasn’t applied for a known vulnerability.

As to the obstacles to getting on top of vulnerability management, Ponemon found that the use of manual processes for patching remains a bugbear. Half of respondents said their organizations are at a disadvantage in responding to vulnerabilities because they use manual processes; and more than half (53 percent) said that IT staff spends more time navigating manual processes than responding to vulnerabilities.

Also, the survey uncovered that most organizations do not have a single view of the full vulnerability management lifecycle, including exception handling. Only 27 percent of respondents say they have visibility into the vulnerability management lifecycle, making it difficult to ascertain how well their organizations are prioritizing, remediating and patching vulnerabilities.

Then there’s the issue of staffing and the ongoing cybersecurity skills gap: Only about half (49 percent) of respondents said their organizations have enough personnel to patch in a timely manner, while just 41 percent said the IT security team has the necessary patching skills and training to fix vulnerabilities.

“Instead of taking a programmatic approach to vulnerability management, many organizations take an anecdotal approach,” according to X-Force. “They divvy up and plow through an Excel spreadsheet, which may contain thousands to millions of vulnerabilities. The spreadsheet method may work for one team in the organization, but when it’s rolled out across an entire enterprise, chaos can ensue.”

#cloud security #most recent threatlists #vulnerabilities #backlog #cloud patches #data breaches #ibm x-force #patch prioritization #ponemon institute #security bugs #survey #vulnerabilities #vulnerability management

305 CVEs and Counting: Bug-Hunting Stories From a Security Engineer

Larry Cashdollar, senior security response engineer at Akamai, has been finding CVEs since the 1990s, around when MITRE was first being established. Since then, he’s found 305 CVEs – as well as various security findings, such an IoT bricking malware called Silex, and cybercriminals targeting poorly secured Docker images.

Cashdollar shares his craziest bug finding stories, including his first flaw (CVE-1999-0765) found during his position as a UNIX Systems Administrator, which accidentally threw a wrench in a demo for a Navy Admiral on the Aegis destroyer class ship.

Beyond his own personal stories, Cashdollar shares the top pieces of advice he would impart on today’s security researchers and those hunting for vulnerabilities. Listen to more on the Threatpost podcast.

For the full podcast, listen below or download here.

Below find a lightly edited podcast transcript.

Lindsey O’Donnell Welch: This is Lindsey O’Donnell-Welch and welcome back to the Threatpost Podcast. I am joined today by Larry Cashdollar, who is the senior security intelligence response engineer at Akamai. Larry has been conducting security research and finding vulnerabilities since 1994. So he can really give a sense of what has changed in the industry in terms of finding and reporting bugs as well as the threat landscape. So Larry, thank you so much for joining me today. How are you doing?

**Larry Cashdollar: **Good. How are you?

LO: I’m good. Good. I know we were just talking about this. But we’re getting some strange weather here in the northeast, very warm for fall.

LC: yeah, it’s been it’s been wacky.

LO: Definitely. Well, so Larry, just to start, can you tell us a little bit about yourself and how you first got into the security space?

LC: So I was studying computer science at the University of Southern Maine back in the 1993 timeframe. And I had a friend who was in the Linux users group back then with me, and he told me that this company was hiring, what they called at the time “internet analysts” to work on security stuff. And I’m like, okay, I like to, you know, I could work there part time, make some money. And the company I joined was a small consulting company in Portland, Maine. And this company did security for a couple of a couple of companies in Southern Maine, but also a large bank that was out of Manhattan. And what we did was we did, we built firewalls or what we called Bastion hosts back then. So we would handle these firewalls. And we would put in rules to allow you know, certain services like pop mail and send mail and web browser, things like that, to occur while keeping the company secure. And build these these systems to keep these companies connected to the internet, but also keeping them secure. And that’s where I first really sink my teeth into the security industry.

#newsmaker interviews #podcasts #vulnerabilities #web security #aegis #akamai #bath iron works #bug bounty #cve #cve-1999-0765 #cve-2000-0588 #cve-2000-0589 #larry cashdollar #midikeys #mitre #patch #podcast #us navy #vulnerability #vulnerability disclosure

Mikel  Okuneva

Mikel Okuneva

1597618800

Netgear Won't Patch 45 Router Models Vulnerable to Serious Flaw

Netgear will not patch 45 router models that are vulnerable to a high-severity remote code execution flaw, the router company revealed last week. However, the company says that routers that won’t receive updates are outdated or have reached EOL (End of Life).

The remote code execution vulnerability in question, which was disclosed June 15, allows network-adjacent attackers to bypass authentication on vulnerable Netgear routers – sans authentication. The high-severity flaw affects 79 Netgear Wi-Fi routers and home gateway models – but Netgear says that 45 of those router models are outside of its “security support period.”

“Netgear has provided firmware updates with fixes for all supported products previously disclosed by ZDI and Grimm,” Netgear said in a press statement. “The remaining products included in the published list are outside of our support window. In this specific instance, the parameters were based on the last sale date of the product into the channel, which was set at three years or longer.”

A full list of the router models that won’t be patched – as well as those that have fixes being rolled out – is available on Netgear’s website.

“When we look at support windows, some of our products last five or six years, while others last only a few years,” David Henry, senior vice president of Connected Home products at Netgear, told Threatpost. “When we launch a product, as it gets old it goes into End of Life (EOL) and we stop building it and wind down [sales into the channel].”

For instance, one such Modem Router that won’t receive an update, the AC1450 series, is as old as 2009. Other router models, while newer, have reached EOL: The R6200 and R6200v2 wireless routers reached EOL in 2013 and 2016, respectively; while the Nighthawk R7300DST wireless router reached EOL in the first half of 2017, said Henry.

Regardless, Henry stressed that customers using both newer and older router models stay updated on security updates, as well as adopting best security practices, including turning off features like remote access or changing admin passwords (which he said is enforced by Netgear).

“I think it is really important that customers are paying attention to the updates we send out quarterly on our products,” said Henry.

The Flaw

According to the Zero Day Initiative (ZDI), which first disclosed the issue, the flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, stack-based buffer. An attacker can leverage this flaw to execute code in the context of root, according to ZDI.

“Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the service to trusted machines,” according to ZDI. “Only the clients and servers that have a legitimate procedural relationship with the service should be permitted to communicate with it. This could be accomplished in a number of ways, most notably with firewall rules/whitelisting.”

#vulnerabilities #web security #flaw #netgear #r6700 #r7800 #remote code execution #router #router flaw #router model #vulnerability

Siphiwe  Nair

Siphiwe Nair

1624113960

Data Analytics: The Holy Grail of the Modern Market Sales

Why data analytics should be used in the modern market?

The majorly used form of artificial intelligence is data analytics in the market space. With start-ups mushrooming and business growing, deployment of data analytics is an indispensible requisite for the modern market. This article is a detailed discussion of this particular matter.

The idea of incorporating data analytics into the market landscape
The question that arises here is ‘HOW?’
How data analytics helps?

#big data #latest news #data analytics #data analytics: the holy grail of the modern market sales #the holy grail of the modern market sales #modern market