Phishing Scams and Social Engineering Tactics

Posted on November 29, 2023November 29, 2023 by Keenan Budd

Social engineering is a popular term in the cybersecurity industry. What is it, though, and why are companies so terrified? It is a type of hacking that induces victims to provide information by tricking and manipulating them. Social engineering tactics have caused a lot of devastation and millions of dollars in losses for firms globally, so corporations have reason to be concerned.

One of the most prevalent sorts of attacks today is phishing. It has earned its success because it scams potential victims using tried-and-true social engineering techniques.

What are these ***Social Engineering Tactics*, and how do hackers use them?**

Let’s look more closely.

Plays on the emotions of people.

People are more likely to act impulsively when terrified, anxious, under pressure, or interested. Hackers rely on this instinctual response to trick victims into disclosing personal information before they consider it. It will already be too late by the time they have collected themselves and grasped the danger.

Creating credibility.

People are quick to believe in organizations that have a good reputation. This encompasses both professional contacts and organizations like banks or suppliers. Hackers can establish a trustworthy image that potential victims will almost certainly believe in by impersonating these organizations.

Social Engineering tactics – Content personalization.

Hackers can create a web of deceit to catch their targets using a wealth of information available in the public domain. It goes beyond merely addressing a target by name. They can bring up a recent concert they went to or a favorite dining establishment. They make a potential victim feel at ease, which lowers their guard and makes them more open to attack.

Using webpages that appear alike.

Hackers frequently send out links to fake login sites that are exact replicas of real ones. Telling you to reset your password because it is about to expire is a common ploy. They provide a link to a fake website where you must submit your information. Although everything appears legitimate, a closer glance at the URL reveals it is a phony link.

Creating scenarios that make people panic.

People rarely think clearly while they are panicking. They will take impulsive actions to leave the dangerous situation as soon as possible. You can bet on them to click the link right away if the hackers threaten to cancel their account if they don’t. This is one of their common social engineering tactics to use against you.

Deliberately spelling words incorrectly.

The common typos and bad grammar found in phishing emails are deliberate. It is their method of avoiding spam filter’ detection. Despite these obvious mistakes, many people are easily fooled since they are not as alert as virus scanners.

Attacking during special occasions and holidays.

During these times, there is a widespread sense of enthusiasm and involvement, and hackers use this to increase the effectiveness of their phishing assaults. Aligning the attacks with these occasions creates the appearance of legality, increasing the likelihood that the targeted person may fall prey.

Malware that spreads through attachments.

Most systems can detect and block malware, but if they introduce dangerous files into the system via phishing, your network defenses will be helpless to stop it. Malicious attachments can do harm after installation, including deleting your files and stealing confidential information.

Acting like senior executives is one of their social engineering tactics.

You don’t ask questions, and you promptly provide any confidential information that your boss demands. After all, a good employee does that, don’t they? Exactly! For this reason, hackers have used a novel strategy to gain quick access to corporate data: they pose as top executives.

Inventing an excuse.

Because the hackers need to gain the trust of their target, these social engineering tactics require a lot of effort and perseverance. They gradually win the victim’s trust, so they may eventually get more information from them.

Final Reflections about Social Engineering Tactics

Since you now understand how hackers employ phishing to practice social engineering tactics, you are prepared to defend yourself from such an assault. However, it is still possible to fall victim despite all knowledge and protective measures. We’ve made an infographic titled “The Top 10 Steps to Take If You Think You’ve Been Hacked” to help with this. This tool is helpful if you believe hackers have compromised you. Right here, you can download it.

Call us for additional details about social engineering or other cybersecurity challenges. We will provide everything you need to strengthen your defense against online threats.

Is Your Company Prepared for a Security Incident?

Posted on October 24, 2023October 24, 2023 by Keenan Budd

Every 14 seconds, a new incident related to cybersecurity occurs. The widespread belief that only large corporations are the targets of hacking attacks couldn’t be further from the truth. Everyone, from large global organizations to small local businesses, might now be a potential target. Because there is no obvious pattern to the attacks, it is difficult to determine who the next victim will be. Every firm needs to have a Plan B in place in case there is a breach in their network security, and they must cope with the aftermath of a security incident.

The Importance of Having a Response Plan in Case of a Security Incident

When confronted with an online threat, having a prepared reaction in the event of a security issue will save you valuable time. The framework for the plan is already in place. You only need to put the plans into action, and there won’t be any need for guesswork or pointless delays that could cost you a lot of money.

Besides preventing more data loss or system damage, minimizing downtime, reducing financial losses, and helping to preserve your reputation among customers and clients, an incident response plan, also known as a data breach response plan, is one name for this type of strategy. Naturally, it also assists your company in regaining its footing as quickly as possible.

The Process of Developing an Emergency Action Plan

Developing a security incident response plan is time-consuming and must be in place before any potential security breach. It is not something that you can delay until the very last minute, even when there is an immediate threat. Therefore, we will outline the primary actions that need to be carried out.

1. Put together a team to deal with the security incident.

Choose knowledgeable people who can start acting immediately in the event of an emergency. Check to see that everyone is aware of the responsibilities they have. When required, seek support from outside sources.

2. Always make a copy of your data.

Data is often the target of breaches since the goal is typically to either steal the data, destroy it, or gain unauthorized access for harmful reasons. If something untoward occurs with your data, you should always have a safe backup to fall back on.

3. Keep a close eye on your system.

With vigilant monitoring, it will notify you of online hazards before they become more severe. Systems that manage security information and events, known as Security Information and Event Management (SIEM), as well as big data analytics, can provide timely detection to protect your system and limit damage.

4. Make plans for unforeseen circumstances.

When a security incident happens, these are the steps and procedures that need to be carried out. These would make up a significant portion of the incident response plan that your company has in place. In this section, you are required to provide all the procedures necessary to turn off the system, contain the damage, evaluate it, and alert customers of the situation.

5. Engage in some mock-up exercises.

The act of putting one’s plans and strategies into action differs significantly from simply preparing a response. You are required to not only train your staff on what to do in the event of a security breach but also to do regular simulations of such scenarios. This will hone their replies and teach them to approach the problem with composure, which will be beneficial when dealing with it.

6. Perform checks and updates regularly.

The dangers posed by cybersecurity are evolving. A foolproof method right now may be useless in a few short months. To maintain the usefulness and applicability of your security incident response plan, it is important to check it regularly and change variable parts such as contact details, processes, and technology as required.

Strengthen Your Defenses in the Face of Security Incident

It is critical to be ready to respond in any situation. This step is the tip of the iceberg for your cybersecurity plan. There are many additional ways to strengthen the defenses of your firm, such as by providing regular training to your personnel and raising their awareness about the significance of cybersecurity. You can also impose a stringent Bring Your Own Device (BYOD) policy, tighten the perimeter of your IT infrastructure, and restrict access to sensitive data.

Using privately held technology for professional purposes has given rise to several current security incident concerns. Implementing a detailed Bring Your Own Device (BYOD) policy that includes specific rules, restrictions, and consequences is one way to reduce the possibility of incidents like this. You do not know how to start from scratch when making a policy. We have a BYOD policy template you can download for free and then modify as needed for the requirements of your business. Call us now if you need additional help!

Why It’s Important to Have Cybersecurity Insurance

Posted on October 4, 2023July 8, 2024 by Keenan Budd

The importance of cybersecurity insurance measures cannot be overstated. The transition of organizations into a digital environment coincides with an increase in the sophistication of online attacks. In the past, hackers would target large, high-revenue corporations because these businesses both had significant amounts of money and important information. However, over forty percent of recent cyberattacks were aimed at small enterprises. Even more concerning is that just 14% of these small enterprises are prepared to defend themselves against such an assault.

Purchase of Cybersecurity Insurance is an investment that is both prudent and essential

Businesses are already taking increasingly strict precautions to protect their operations from the dangers posed by Internet activities. Despite your best efforts, malicious software and ransomware could still infiltrate your system, and unauthorized access to your data could still occur. You must purchase a solid cybersecurity insurance policy for your company if you want to shield it from the myriad of consequences that can result from attacks like this.

Even though cybersecurity insurance cannot stop or reverse the effects of cybercrime, it can assist your company during the recovery process if an attack happens online.

Reduce the Risk of Monetary Losses with Cybersecurity Insurance

The costs associated with dealing with the fallout of a cyberattack might be significant. Your company could suffer a loss of millions of dollars because of the attack, depending on how severe it is. You will pay for services such as damage control, damage prevention, and legal representation. A comprehensive plan can cover these costs and a great deal more.

Cover Losses Incurred During Downtime

Again, the speed with which you can get your company back on its feet will be directly proportional to the severity of the crisis. You may get by until your company has fully recovered with the help of insurance while it is rebuilding or when operations are stopped.

Fill the Void in Your General Liability Insurance Coverage

When shopping for a plan for general liability insurance, many owners of businesses make the mistake of assuming that this protects them against cyberattacks. However, this is rarely the case. Even though standard plans might provide some coverage, that protection is rarely sufficient. A standalone cybersecurity insurance policy will provide you with the most comprehensive coverage available for your company.

Help with Recuperation

Today, many cybersecurity insurance policies offer more than just cash help. Many service providers offer a comprehensive recovery package that contains services such as legal representation, damage control for public relations, and computer forensics. You can get each of these services from a different supplier; however, why put yourself through the hassle when you can get them all from the same location?

Cost-Effective Solutions with a High Level of Protection

Insurance companies will typically offer relatively affordable premiums to customers who have an effective cybersecurity strategy in place. The purpose of this is to encourage businesses to place a higher priority on cybersecurity and to develop improved methods. If you want to take advantage of our lower prices, it is in your best interest to increase the amount of protection you have as soon as possible.

Methods That Prove to Boost Online Safety and Security

As most of us know, there are many approaches to improving cybersecurity in the workplace. First, you need to provide frequent training for your staff members. This is because a lack of understanding is still the most common factor that allows hackers to penetrate computer systems. You should also install multi-factor authentication, safeguard your networks, and maintain continuous updates to any anti-malware technologies you use.

Policy for Users to Bring Their Own Devices

Bring-your-own-device policies, often known as BYOD policies, can boost the cybersecurity of your firm. Implement these policies in the workplace. For utilizing privately owned devices to access company data and other uses of the device while at work. This policy should clearly outline the duties of your firm and the individual as well.

You may use our BYOD Policy template, which you can get by clicking right here, to ensure that your company’s BYOD policy contains all the components. This can be done by ensuring that you use our template here. You are free to change it in any way you see fit to bring it into line with the activities and objectives of your organization.

A Few Parting Thoughts For Cybersecurity Insurance

A company must take all the steps to improve its cybersecurity. However, regardless of how formidable your defenses may be, you should never allow yourself to become complacent. The best thing you can do to safeguard your company is to be sure it has a cybersecurity insurance plan. Call us now if you have additional questions about Cybersecurity Insurance.

The Biggest Cybersecurity Threats of 2023

Posted on July 24, 2023July 21, 2023 by CT Team

As the world becomes an increasingly tech-reliant place, the threat of cybercrime continues to grow. Cybersecurity threats can come from a variety of places and at various scales. From nation-states and terrorist groups to individual hackers, there’s no end to the possible sources of cybersecurity threats. In this blog, we’ll discuss the common sources and types of cybersecurity threats and break down how you can stay protected in a scary digital world.

Common Sources of Cybersecurity Threats

Cybersecurity threats come from many different sources. They can range from individual attacks to large government-run operations from hostile countries. Here are a few common sources of cybersecurity threats that could impact your organization:

Nation-States: Foreign nations with hostile intentions may use sophisticated technologies to infiltrate local institutions and cause chaos, disrupting communication channels and causing irreversible harm in the process. The potential consequences of such attacks cannot be overstated, and it is up to individuals and organizations to remain vigilant and take proactive measures to safeguard their online assets.
Terrorist Organizations: In the realm of modern warfare, terrorists have devised a new means of destruction – cyber attacks. These attacks are typically aimed at crippling vital infrastructure, wreaking havoc on economies, threatening national security, and even endangering the lives and well-being of innocent citizens.
Criminal Groups: Sophisticated gangs of cybercriminals are exploiting advanced tactics to infiltrate computer systems with the intent of reaping economic rewards. Through a combination of phishing, spamming, and malware, these nefarious organizations are stealing private data, perpetrating online scams, and extorting their victims. Even the most vigilant digital security measures can be compromised, leading to potentially dire consequences for individuals and businesses alike.
Hackers: The threat of individuals targeting organizations through hacking techniques is an ongoing concern. Driven by a variety of motives, including personal gain, financial profit, or political activism, hackers often seek to bring chaos to the digital world. In the quest to improve their skills and reputation within the hacker community, these individuals continually develop new and innovative ways to cause harm to their targets.
Malicious Insiders: Insider threats refer to an enemy within, wreaking havoc from right under the organization’s nose. These sly attackers are individuals who have legitimate access to a company’s assets but choose to abuse their privileges to either steal information or cause damage to the computing systems. Insiders can come in different forms, including employees, contractors, suppliers, or even partners of the target organization, and in some cases, intruders who have hacked into privileged accounts and are masquerading as the account owner.

Common Types of Cybersecurity Threats

As technology and security measures advance, so do the ways in which cybersecurity threats are carried out. Here are some of the most common types of cybersecurity threats in 2023:

Malware Attacks: Malware covers a range of malicious software, including viruses, worms, trojans, spyware, and ransomware, all designed to infiltrate and wreak havoc on computer systems. These dangerous programs can enter your systems through links on untrusted websites or emails or through the download of unwanted software. Once inside, malware can manipulate and block access to important network components, as well as collect sensitive data and even shut down entire systems.
Social Engineering Attacks: Social engineering attacks involve tricking unsuspecting users into letting them in by posing as a trustworthy source. The results can be devastating, leaving the victim with compromised security and potential malware lurking on their device. Some of the most common examples of social engineering attacks include: baiting, pretexting, phishing or spear-phishing, piggybacking, and tailgating.
Supply Chain Attacks: Supply chain attacks are a new and dangerous form of cyberthreat, exploiting legitimate applications to spread malware via source code or update mechanisms. Attackers target insecure network protocols, server infrastructure and coding techniques in order to compromise build processes, modify the software’s source code without detection from vendors and stealthily conceal malicious content.

Cybersecurity Solutions That Work

At FIT Solutions, we understand that the ever-changing landscape of cybersecurity threats can seem daunting. With a wide array of sources and types of threats, it can seem like everyone is out to get you. That’s why you need the team of experts at FIT Solutions on your side. Our cybersecurity solutions will help keep your organization safe and give you the peace of mind you’re looking for. Contact us today to learn more about how we can protect you from cybersecurity threats.

Penetration Testing Explained: Best Cybersecurity Practices

Posted on July 18, 2023March 13, 2025 by CT Team

Penetration testing, also known as pen testing, is an essential cybersecurity practice that involves a skilled professional attempting to uncover and exploit weaknesses in computer systems. This simulated attack is designed to assess the effectiveness of a system’s defense mechanisms and reveal any vulnerabilities that could be exploited by malicious actors. Through pen testing, organizations can stay ahead of security threats and prevent potential attacks.

To give an example of what this looks like, imagine a high-stakes game of cat and mouse as a bank hires an individual to play the role of a burglar and attempt to break into their building. The ultimate objective is to gain access to the all-important vault. This clever strategy allows the bank to gain valuable insight into exactly how vulnerable their security measures are. If the imitation burglar succeeds, the bank will be able to take immediate action to fortify its defenses and ensure its customers’ assets are protected. This is basically how penetration testing works. Any weaknesses or vulnerabilities discovered are reported, and an organization can then make the necessary changes to its security practices.

Who Performs Penetration Testing?

A pen test can be a crucial step in securing a system, but it’s not just about identifying the obvious vulnerabilities that automated testing could catch. In fact, the most valuable insights come from pen testers who are unfamiliar with the system. Often referred to as ‘ethical hackers,’ these contractors are brought in to identify blind spots. They use real-world techniques that are currently in use by malicious actors to not just identify gaps, but how several seemingly minor vulnerabilities could be linked together to create a much bigger threat. It’s a delicate balancing act – hacking into a system ethically – but the results lead to a more secure environment.

Ethical hacking is more than just a skillset; it’s a diverse and dynamic field that attracts a wide range of experts. Some ethical hackers hold impressive credentials, with advanced degrees and official certifications in pen testing. Yet others come from unconventional backgrounds and learned their skills through trial and error, often by transitioning from the dark side of hacking to the light. However, to find the best ethical hacker for a specific job, it is essential to consider the target company and the objectives of the pen test. In this way, pen testing is both an art and a science, tailored to meet the unique needs of each organization.

How is Penetration Testing Carried Out?

A crucial component of pen testing involves an initial phase of reconnaissance, where a skilled ethical hacker painstakingly collects the raw materials necessary to craft their simulated assault. From there, the emphasis shifts to actively infiltrating and persistently controlling the target system, a feat that demands a diverse arsenal of specialized tools and techniques.

Unleashing a successful hack depends on having the right arsenal, and savvy ethical hackers know how to deploy an array of tools and tactics to uncover vulnerabilities within a network. Whether it’s software programs specifically designed to carry out forceful brute attacks or SQL injections, or small, innocuous-looking boxes that can be plugged into a computer to remotely infiltrate a network, these hackers have at their disposal a diverse range of hardware and software to uncover potential security gaps. But that’s only half the battle. The most experienced ethical hackers understand that human touch can further open doors. Through the use of social engineering techniques, where, for instance, the hacker can send fake emails to employees or even show up at the company disguised as a delivery person or tech support, they exploit the human tendency to trust.

How Can Penetration Testing Help You?

Penetration testing is a powerful tool that can help organizations identify and patch up system vulnerabilities before they are exposed. Investing in proper pen tests now will save you time and money down the road—not to mention give you peace of mind knowing that your sensitive information is secure. With the team at FIT Solutions, you can rest assured knowing you’re getting the absolute best penetration testing services around. For more information about penetration testing or any of the other services we offer, contact us today.

What is Security Information & Event Management (SIEM)?

Posted on July 5, 2023July 10, 2023 by CT Team

In the world of cybersecurity, there’s a powerful ally keeping watch over organizations’ sensitive data – a SIEM tool, or Security Information and Event Management. This advanced solution acts like a security guard, constantly scanning for suspicious activity and alerting teams to potential threats before they can wreak havoc. Using sophisticated AI technology, a SIEM tool automates many of the time-consuming processes of threat detection and response, making it an indispensable tool for modern-day Security Operation Centers (SOCs). With its ability to uncover user behavior anomalies and pinpoint vulnerabilities, a SIEM tool is a game-changing solution for safeguarding against security breaches and ensuring compliance with industry regulations.

SIEM has transformed from basic log management to a robust process that harnesses the potential of AI and machine learning to deliver advanced user and entity behavior analytics (UEBA). It’s like a finely-tuned orchestra, expertly communicating and coordinating data sources to protect against evolving threats. SIEM is also a powerful conductor for regulatory compliance and reporting, ensuring that your organization stays in tune with industry standards.

How Does SIEM Work?

Fundamentally, SIEM solutions are like vigilant guardians, tirelessly collecting, organizing, and analyzing data to detect any signs of danger lurking in the shadows. While some tools may boast unique features, they all share a common purpose – to safeguard against cyber threats and ensure regulatory compliance. While some solutions’ capabilities vary, most offer the same core functionalities:

Log Management: SIEM is a sophisticated system that collects and analyzes vital event data from multiple sources throughout an organization’s network, bringing disparate logs and flow data into one central storage location. By consolidating this information in real-time, IT and security teams can more easily respond to potential security threats. SIEM solutions often incorporate the use of third-party threat intelligence feeds to detect and block new types of attack signatures. Through continuous integration with real-time threat feeds, SIEM becomes a powerful tool in the fight against online security threats.
Event Correlation and Analytics: Event correlation is an integral component of any first-rate SIEM system. Skillfully analyzing complex data sets and event correlation uncovers valuable insights that allow IT security teams to swiftly identify and address possible threats to enterprise security. With the help of advanced analytics, SIEM systems reduce the average time to detect and respond – freeing up valuable time and resources previously dedicated to cumbersome manual tasks associated with deep-dive security analysis.
Incident Monitoring and Security Alerts: SIEM solutions empower organizations to seamlessly manage their on-premise and cloud-based infrastructure. This cutting-edge technology efficiently detects all entities of the IT environment, which enables it to watch out for security incidents in connected users, devices, and applications. Through its exceptional ability to classify abnormal behavior, SIEM technology provides instantaneous alerts and enables administrators to take prompt action to prevent significant security threats. Customizable correlation rules further enhance this process, cementing the efficacy of SIEM solutions in safeguarding critical systems and data.
Compliance Management and Reporting: Sophisticated enterprises use SIEM solutions to navigate the regulatory landscape with ease. By automating the collection and analysis of data, SIEM proves to be an invaluable tool to verify compliance across organizations’ infrastructure. Real-time reports can be generated for various compliance standards, including PCI-DSS, GDPR, HIPAA, and SOX. SIEM lightens the load of security management, detecting possible violations at the earliest stages. In addition, pre-built and ready-to-install apps can generate reports, streamlining the compliance process.

The Benefits of SIEM

It is crucial for organizations of all sizes to be vigilant in detecting and preventing IT security threats. Implementing SIEM can provide numerous advantages by simplifying the security process. The benefits of SIEM include advanced real-time threat recognition, regulatory compliance auditing, AI-driven automation, improved organizational efficiency, detecting advanced and unknown threats, conducting forensic investigations, assessing and reporting on compliance, and monitoring users and applications.

SIEM solutions are a powerful tool for organizations of all sizes to have in their arsenal. For more information on SIEM and other cybersecurity solutions, contact FIT Solutions today.

FIT Solutions and Cardone Ventures Acquire Stryker Networks

Posted on May 22, 2023June 5, 2023 by CT Team

This brand-new joint venture partnership is said to bring massive growth, scaling, and wealth-creation opportunities for all businesses involved.

MIAMI, FL / ACCESSWIRE / May 22, 2023 / Cardone Ventures, co-founded by Grant Cardone and Brandon Dawson, are proud to announce their most recent acquisition of Stryker Networks-a direct result of their partnership with FIT Solutions, owned by Ephraim Ebstein. The goal behind the acquisition is to provide thousands of cyber management operators within their networks with massive opportunities for growth and scaling, thus continuing the national rollout of the 10X Cyber management company.

“Partnering with Grant, Brandon, and the Cardone Ventures team was a no-brainer for me,” says Ephraim Ebstein, founder of FIT Solutions. “I saw the vision they had, the team behind them, and data to back it all up… My team and I are excited to be a part of that story.”

Acquiring Stryker Networks is just the beginning for Cardone Ventures and FIT Solutions. Both businesses understand the importance of bringing value for their customers. With a shared mission and vision, Grant, Brandon, Ephraim, and Mark Greene (owner of Stryker Networks) are ready to do whatever it takes to make their goals a reality.

“Our intention is to disrupt the cyber security space by partnering with business owners like Ephraim and companies like FIT Solutions,” says Brandon Dawson, CEO and co-founder of Cardone Ventures. “This joint venture will help us continue down the path toward building our world-class, national organization.”

Cardone Ventures’ affiliate 10X Cyber and Management Services and its partners are ready to revolutionize the industry and provide massive value to their clients. And with the right foundations in place, there’s no telling how far the teams at Cardone Ventures, FIT Solutions, and Stryker Networks will go.

About Cardone Ventures: Cardone Ventures is a business consulting company founded by Grant Cardone and Brandon Dawson that helps business owners attain their personal, professional, and financial goals. Together, they help business owners experience their company from a 360-degree perspective, including operations, marketing, finance, and people. Cardone Ventures’ focus is to help entrepreneurs grow from $2 million to $500 million+ and 10X all aspects of their business. The brand new Cardone Ventures Scottsdale Headquarters is located at 4800 N Scottsdale Rd. Suite 5500, Scottsdale, AZ 85251. For more information on Cardone Ventures, visit: https://www.cardoneventures.com

About FIT Solutions: FIT Solutions is a leading provider of IT services and solutions. They specialize in Managed IT, Enterprise IT, Cybersecurity, Cloud Services, IT Projects, and Healthcare IT. Their team of certified professionals is dedicated to keeping up with the latest technologies and trends so they can provide the best solutions for their clients. Whether you need Managed IT, Enterprise IT, Cloud Services, Cybersecurity, or Healthcare IT services, FIT has the expertise and resources to help your organization reach its technology goals quickly and cost-effectively. Learn more about each of the individual IT and managed cybersecurity services by clicking here: https://fitsolutions.biz

Contact Information

Jeremy Gabbert
EVP of Revenue and Marketing
[email protected]
503-536-0997

SOURCE: Cardone Ventures

Spring4Shell: Zero-Day Vulnerability in Spring Framework

Posted on March 31, 2022November 29, 2022 by Megan Haley

What Happened?

On March 30, 2022, we received word through our channels of a remote code execution vulnerability in Spring Framework when a Chinese-speaking researcher published a GitHub commit that contained proof-of-concept (PoC) exploit code.

This uploaded exploit targeted a zero-day vulnerability in the Spring Core module of the Spring Framework. Spring is maintained by Spring.io (a subsidiary of VMWare) and is used by many Java-based enterprise software frameworks. The vulnerability in the leaked proof-of-concept, which appeared to allow unauthenticated attackers to execute code on target systems, was exploited quickly.

What Are We Doing?

1. Actively monitoring public data streams pertaining to this situation. We are also researching with Rapid7’s research team who can confirm the zero-day vulnerability is real and provides unauthenticated remote code execution.

Proof-of-concept exploits exist, but it’s currently unclear which real-world applications use the vulnerable functionality. As of March 31, Spring has also confirmed the vulnerability and has released Spring Framework versions 5.3.18 and 5.2.20 to address it.

It affects Spring MVC and Spring WebFlux applications running on JDK 9+. As additional information becomes available, we will evaluate the feasibility of vulnerability checks, attack modules, detections, and Metasploit modules.

While Rapid7 does not have a direct detection in place for this exploit, they do have behavior- based detection mechanisms in place to alert on common follow-on attacker activity.

2. Informing our SOC Analysts of the investigation and providing them with the necessary briefings to deploy any defenses provided by our partners.

3. Reinforcing our recommendations by communicating the need for layered security and applying rock solid standards provided by public vendor neutral agencies like the Center for Internet Security. The goal of these standards is a stronger, robust layering of protective measures for our FIT clients.

What You Can Do

The vulnerability affects SpringMVC and Spring WebFlux applications running on JDK 9+. As of 10AM, EDT March 31, 2022, CVE-2022-22965 has been assigned to this vulnerability.

Spring has confirmed the zero-day vulnerability and has released Spring Framework versions 5.3.18 and 5.2.20 to address it.

https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement

Evaluate your environment for this vulnerability and patch as needed. We are big fans of the work performed by the Center for Internet Security (CIS). CIS is a nonprofit organization, formed in October 2000.

Its mission is to make the connected world a safer place by developing, validating, and promoting timely best practice solutions that help people, businesses, and governments protect themselves against pervasive cyber threats.

Spring4J would be best mitigated by applying the CIS Controls:

Control 02 – Inventory and Control of Software Assets

Actively manage (inventory, track, and correct) all software (operating systems and applications) on the network so that only authorized software is installed and can execute, and that unauthorized and unmanaged software is found and prevented from installation or execution.

Control 08 – Audit Log Management

Collect, alert, review, and retain audit logs of events that could help detect, understand, or recover from an attack.

Control 12 – Network Monitoring & Defense

Operate processes and tooling to establish and maintain comprehensive network monitoring and defense against security threats across the enterprise’s network infrastructure and user base.

If you have any questions about how to further implement these controls in your environment, FIT Cybersecurity would love to provide guidance and help you improve your security posture.

— The FIT Cyber Team

Serious Cybersecurity Vulnerabilities: Apache Log4j & SMA-3217

Posted on December 16, 2021December 21, 2021 by Megan Haley

UPDATE — 12/18/21

There have been more developments in the ongoing remediation of the Log4j logging library and connected vulnerabilities.

The initial patch, version 2.15.0, that aimed to resolve the remote code execution vulnerability described in CVE-2021-44228 was found to be incomplete and led to the discovery of CVE-2021-45046. Initially thought to be a minor DoS vulnerability, CVE-2021-45046 was assigned a CVSS of 3.7. As of late yesterday, CVE-2021-45046 was elevated to a CVSS of 9 due to newly discovered attack vectors that would allow bad actors to exfiltrate data. A patch was quickly released in version 2.16.0 to remediate it. Earlier this morning, a new flaw was identified in the patch version 2.16.0 that has required a new patch release (version 2.17.0) and a new vulnerability tracking ID of CVE-2021-45105. The identified flaw is a severe DoS vulnerability that would allow bad actors to perpetrate Denial-of-Service attacks against affected assets. CVE-2021-45105 has been assigned a CVSS of 7.5.

The risk with these vulnerabilities not only rests in active use of the Log4j library within production applications developed by your company, but also in several standard workplace applications and solutions that also utilize it. Log4j is one of the most ubiquitous logging libraries and is used in a plethora of applications and solutions. It is likely that some of the applications you use in your environment are affected and therefore vulnerable. These are called nested vulnerabilities as they stem from a utility that is used within standardly deployed applications and are dependent on patch releases from the vendor to remediate.

FIT’s Response:

FIT is continuing to monitor the situation closely and apply patches as they become available. FIT engineering will be reaching out as patches are released to setup emergency patching windows for FIT IT managed clients.

Recommendations:

If you are currently utilizing Log4j in your development or infrastructure, FIT recommends immediately applying the patch in version 2.17.0 (Java 8).

Additionally, these vulnerabilities have highlighted the importance of running a full application inventory of your environment and monitoring attack surface lists of affected applications to compare. It is critical to apply patches when available to all affected applications in your environment. The primary attack surface list in use by FIT Cybersecurity is published by Rumble and can be found here – Finding applications that use Log4J (rumble.run). It is updated daily, if not twice daily, and maintains the most complete list of applications affected by these vulnerabilities.

UPDATE — 12/17/21

CVE-2021-44228 & CVE-2021-45046

VMWare is starting to release patches for both vulnerabilities. Please reference this article against your environment to determine what patches are available for your infrastructure: VMSA-2021-0028.3 (vmware.com)

FIT Managed IT clients will be hearing from your engineering team as patches for your environment become available.

FIT Cloud Clients, emergency patches are being applied to your infrastructures this weekend.

Please Note: This is just the first round of patches and not everything has had a patch released yet. We anticipate this process continuing for the next few weeks at least. Depending on your environment, it is very possible you will need several emergency patching windows as more and more patches become available.

UPDATE — 12/16/21

We’d like to provide a status update of where we stand with the remediation efforts of the Log4j vulnerabilities (CVE-2021-44228 and CVE-2021-45046).

CVE-2021-44228

FIT Solutions’ Managed IT clients are 95% patched for on-premise assets that are affected by this vulnerability, and the last 5% are actively being worked on by the engineering team. This vulnerability scope is evolving as new applications and services are identified to be vulnerable. FIT Solutions is actively investigating and monitoring all client infrastructures to identify and address any newly discovered vulnerable systems.

CVE-2021-45046

This new vulnerability that was produced from the remediation of CVE-2021-44228 remains in the monitoring state. A few patches have been released to address this, but a majority of software and solution providers are still working on updated patches to address it. FIT Cybersecurity is actively monitoring the situation and engaging the engineering team as soon as patches become available to implement in client environments.

Updated Recommendation

FIT Cybersecurity is recommending an additional layer of protection that can assist in defending against the Log4j vulnerabilities. If it is possible in the environment, we recommend that Outbound LDAP communications be blocked on the firewall. This will not completely protect your environment from the Log4j vulnerability, but will hamper attempts by bad actors to exploit the vulnerability by utilizing LDAP. FIT Cybersecurity and FIT Solutions will continue to collaborate on monitoring the situation and remediating client environments. If you have any questions or concerns, please do not hesitate to reach out to [email protected].

UPDATE — 12/15/21

A new vulnerability was discovered that impacts all assets affected by the initial Log4j Vulnerability (CVE-2021-44228). This new vulnerability (CVE-2021-45046) is less severe than CVE-2021-44228 coming in with a CVSS score of 3.7 out of 10. Do not let the lower CVSS score fool you, the vulnerability is still something that requires immediate attention.

The initial patch released for Log4j will prevent an attacker from gaining complete control over an affected asset, but that same patch can be abused by attackers resulting in a denial-of-service (DoS) attack on the affected asset. These DoS attacks have the ability to take an affected asset down by flooding the asset with requests at such a volume that the asset cannot handle the load.

Currently, software and solution providers are scrambling to release new patches of their software that address this new vulnerability. Apache, the initial source of both these vulnerabilities, has released a new version of the Log4j logging library that fixes this issue. If you actively use Log4j, please make sure you update your version to 2.16.0 which resolves both vulnerabilities.

Here are some additional resources for more information on the new vulnerability CVE-2021-45046:

Apache’s Fix for Log4Shell Can Lead to DoS Attacks | Threatpost

Second Log4j Vulnerability (CVE-2021-45046) Discovered — New Patch Released (thehackernews.com)

FIT Cybersecurity and FIT Solutions Response

FIT Cybersecurity and FIT Solutions are collaborating actively to patch all FIT Solutions IT clients and advise all cybersecurity clients on next steps. As more patches become available, FIT Solutions will reach out to IT clients for emergency patching windows. It is important to note, about 90% of affected assets from FIT Managed IT clients have been patched with the initial patch or a workaround has been implemented. The remaining 10% are actively being worked on to complete patching of the initial CVE-2021-44228.

UPDATE — 12/14/21

Only about 30% of the software vendors impacted have released patches thus far. We urge decision-makers to approve emergency patching all week if possible as updates come out during the week. Though patching updates can be disruptive to work, the interruption would be far less than that caused by a breach. Our cybersecurity team built custom monitoring alerts to increase threat hunting while we wait for patches to be released. Our team is also trained on emergency response actions to stop the exploit from being leveraged. We are working with all our clients to strategically make plans to minimize risk to their businesses. For users of FIT Cloud, we have applied the work-around fixes to VMware while a patch is being developed to protect the Cloud infrastructure.

INITIAL 12/13/21

Late last week, two vulnerabilities came to light that have made large waves in the cybersecurity space. We wanted to make sure you are informed of these new and potentially dangerous vulnerabilities. FIT Solutions stands ready to assist in any way we can as we go through the remediation of these new vulnerabilities. Please do not hesitate to reach out to [email protected] with any questions or concerns you may have.

Apache Log4j Logging Library Vulnerability | CVE-2021-44228 | CVSS 10.0

The Apache Log4j vulnerability was released late on Friday, December 10, and has a large attack surface with potentially dangerous effects. This vulnerability allows attackers to gain complete control of affected systems. The Log4j logging library is widely used and can be found in different services from Apple, Twitter, Steam, Tesla, Elastic Search, and more. Ranking as a CVSS 10.0 out of 10, this vulnerability poses a significant threat to those that utilize or interact with the Apache Log4j Logging Library, and it is already being exploited in the wild.

This is a high criticality vulnerability and deserves your immediate attention. Recommended remediation is to immediately upgrade any direct use of the Log4j library to log4j-2.15.0.rc2. Log4j is also utilized in several tools for logging, monitoring, alerting, and dashboard solutions. This means the issue may not be that you are directly using the library, but your tools are, which would also leave you vulnerable. In these instances, update your tools to the latest version and monitor their publishers’ releases to ensure you update to the release meant to fix CVE-2021-44228.

Log4j is also a dependency in large number of applications for business and personal use. In these circumstances, we must wait for the application provider to update the Log4j library. With the intense scrutiny and attention this vulnerability has received, we anticipate patching within the next couple days if the issue has not been patched already.

If you are not sure if you or one of the tools you utilize use Log4j, Huntress has come out with a utility to check if you are vulnerable – Huntress – Log4Shell Tester

Here are some additional resources for CVE-2021-44228:

Critical RCE Vulnerability: log4j – CVE-2021-44228 (huntress.com)

Security warning: New zero-day in the Log4j Java library is already being exploited | ZDNet

NVD – CVE-2021-44228 (nist.gov)

SMA-3217 – SMA100 Unauthenticated Stack-based Buffer Overflow| CVE-2021-20038 | CVSS 9.8

The Unauthenticated Stack-based Buffer Overflow vulnerability is significant but in much smaller scope than the Log4j vulnerability. Affecting SMA 100 series appliances, this vulnerability can allow an unauthenticated attacker to execute commands as the nobody user, giving complete control of the device to the attacker.

Currently, there are no reports of this vulnerability being exploited in the wild, but it still warrants patching if you utilize any of these appliances. A patch has already been deployed by SonicWall and is readily available to all organizations that utilize these appliances. Our remediation recommendation is to immediately apply this patch to all affected SMA appliances.

Here are some more resources for CVE-2021-20038:

Security Advisory (sonicwall.com)

NVD – CVE-2021-20038 (nist.gov)

Patch Now: Sonicwall Fixes Multiple Vulnerabilities in SMA 100 Devices | Rapid7 Blog

FIT Cybersecurity & FIT Solutions Response

FIT Cybersecurity already has monitoring deployed to watch for Log4j exploitation attempts and is closely monitoring all logs for evidence of these attempts on our clients. We are collaborating with the engineering teams for FIT Solutions customers to ensure any available patches are applied to your environment immediately.

We are ready to assist and answer any questions you may have concerning these vulnerabilities.

Should I Lease Multiple Domains for Cybersecurity?

Posted on December 7, 2021 by CT Team

Recently we hosted a webinar on Phishing & Whaling—How to Protect Yourself and Your Team. Melinda, one of our Solutions Executives, and Stormy, from our vCISO team, shared real-life examples and valuable insights to help educate business owners on the threats they face on a daily basis.

As Stormy explained examples of whaling attacks, one of our audience members posed an intriguing question: if cybercriminals are purchasing lookalike domains in order to phish you, would leasing multiple domains help prevent that?

Stormy’s answer? Both yes and no. Let’s get a little more context.

THE THREAT

One common scheme used in phishing attacks is domain spoofing, where a criminal leases a domain that is very similar to yours. For example, if your website is www.LawFirmABC.com, the attacker might lease www.LawFlrmABC.com, swapping the I for an L. Then he sets up an email address at that domain and sends an email to one of your team members posing as an employee. The swapped letter is easy to miss during a quick scan of an email that otherwise looks legitimate.

THE PROPOSED SOLUTION

Given that this scheme relies on the domains being fairly similar, the concept is that if you’re leasing multiple lookalike domains, you’ll keep them out of criminal hands and protect your organization against this type of attack.

In theory, yes, this could help. In fact, large companies like Google do this for this exact reason. When our own team uses domain spoofing during a social engineering campaign for a client, we turn any lookalike domains we leased over to the client’s control after the campaign ends. However, leasing multiple domains is not enough.

THE BETTER SOLUTION

In practice, this defense isn’t really practical; there are too many possible combinations to feasibly lease them all. Plus, it could lull your team into a false sense of security. The money you might spend leasing those domains would be better invested in cybersecurity awareness training for your employees. Staying alert and on guard at all times is vital to maintaining your organization’s security.

FIT Cybersecurity provides cybersecurity education and social engineering campaigns to organizations across all industries. If you’d like to test your company’s defenses or your team’s awareness of common cybercrime tactics, give us a call today at 888-683-6573 or contact us here.

What are these Social Engineering Tactics, and how do hackers use them?