Cybersecurity 🔐 And Much More Newsletter 📪 Vol. 3 Num. 18

15 min readJul 4, 2023

Greetings, friends. 👋

📫 Welcome to my newsletter, if you are not yet subscribed, please do 🥹. It might include books📚, articles ✍️, tech 💻, tips💡, and cool stuff about cybersecurity 🔒.

Enjoy!

What’s Happening

🚨 CISA Added Eight (08) New Vulnerabilities to KEV Catalog

CISA has recently identified Eight new vulnerabilities in its Known Exploited Vulnerabilities Catalog (KEV) [1]:

02 new D-Link vulnerabilities and 06 on Samsung Mobile Devices.

D-Link DIR-859 Router Command Execution Vulnerability (CVE-2019–17621).
D-Link DWL-2600AP Access Point Command Injection Vulnerability (CVE-2019–20500).
Samsung Mobile Devices Out-of-Bounds Read Vulnerability (CVE-2021–25487).
Samsung Mobile Devices Improper Input Validation Vulnerability (CVE-2021–25489).
Samsung Mobile Devices Race Condition Vulnerability (CVE-2021–25394).
Samsung Mobile Devices Race Condition Vulnerability (CVE-2021–25395).
Samsung Mobile Devices Unspecified Vulnerability (CVE-2021–25371).
Samsung Mobile Devices Improper Boundary Check Vulnerability (CVE-2021–25372).

🚨 MITRE Top 25 Software Weaknesses (CWE) for 2023

The Top 25 Most Dangerous Software Weaknesses for 2023 have been published by the Homeland Security Systems Engineering and Development Institute, which is supported by the Department of Homeland Security and run by MITRE. [2]

The National Vulnerability Data (NVD) public vulnerability data is examined for root cause mappings to CWE weaknesses over the past two calendar years in order to determine the CWE Top 25. These flaws cause significant software vulnerabilities. These flaws can frequently be used by an attacker to take over a vulnerable machine, steal data, or stop apps from functioning.

Updated vulnerability information for current CVE records in the dataset that are a part of CISA’s Known Exploited Vulnerabilities Catalog (KEV) is also included in the 2023 CWE Top 25. [3]

The CWE Top 25 should be reviewed by product security response teams and developers, who should then assess the suggested mitigations to choose the ones that are most appropriate for adoption. The CWE program will be releasing a number of other articles in the upcoming weeks that will discuss the CWE Top 25 methodology, vulnerability mapping patterns, and other pertinent data that will demonstrate how vulnerability management is crucial for Shifting the Balance of Cybersecurity Risk.

💬 WhatsApp Upgrades Proxy Protection Feature to Prevent Internet Outages

Updates to WhatsApp from Meta now provide users additional freedom in the type of content that can be shared in discussions.

According to WhatsApp, this includes the ability to transmit and receive files, stickers, GIFs, voice notes, and stickers. BBC Persian was the first to report about the new features.

Other upgrades include shortened procedures to make setup easier and the addition of links that can be shared with others so they can “share functioning/valid proxy addresses to their contacts for easy and automatic installation.” [4]

When connecting to WhatsApp directly isn’t possible, you have the option via the app to connect through a proxy server set up by volunteers and organizations dedicated to helping people communicate securely and freely.

Using a proxy doesn’t change the high level of privacy and security that WhatsApp provides to all users. Your personal messages and calls will still be protected by end-to-end encryption.

🏴 ☠️ North Korean Hacker Group Andariel Strikes with a New Malware

A previously unknown piece of malware named EarlyRat was used in phishing assaults by the North Korea-aligned threat actor Andariel, adding to the group’s extensive toolkit.

In a recent analysis, Kaspersky stated that “Andariel infects machines by executing a Log4j exploit, which, in turn, downloads further malware from the command-and-control (C2) server.” [5]

Andariel, also known as Silent Chollima and Stonefly, is connected to North Korea’s Lab 110, a main hacking organization that also contains APT38 (also known as BlueNoroff) and other subordinate parts that are all monitored under the Lazarus Group banner.

The threat actor is known to engage in cybercrime as an additional source of revenue for the country under sanctions, in addition to undertaking espionage strikes against foreign governments and military groups that are of strategic relevance.

🕵🏻 ♀️ A Spying Mobile App Suffering a Data Breach

LetMeSpy, an Android-based phone tracking tool, has revealed a security flaw that made it possible for an unauthorized person to collect private information related to thousands of Android users.

LetMeSpy stated in a statement on its website that the incident happened on June 21, 2023. “As a result of the attack, the criminals gained access to email addresses, telephone numbers, and the content of messages collected on accounts,” the company noted. [6]

LetMeSpy claimed it alerted law enforcement and data protection authorities as soon as the incident was discovered. Additionally, it is taking steps to pause any activities relating to accounts until further notice. The threat actor’s identity and motivations are currently unknown.

LetMeSpy, created by a Polish business called Radeal, costs $6 for Standard and $12 for Pro monthly subscriptions and enables users to spy on others by simply installing the software on their devices. It is advertised as a tool for employee or parental control, according to a screenshot from December 2013 on the Internet Archive.

😱 New Fortinet Code Execution Vulnerability

In order to resolve a severe security flaw that might allow arbitrary code to be executed, Fortinet updated their FortiNAC network access control product.

The bug, identified as CVE-2023–33299, has a CVSS severity rating of 9.6 out of 10. The issue has been labeled as a Java untrusted object deserialization situation.

“A deserialization of untrusted data vulnerability [CWE-502] in FortiNAC may allow an unauthenticated user to execute unauthorized code or commands via specifically crafted requests to the tcp/1050 service,” Fortinet warned in a warning released last week. [7]

🇨🇳 New Chinese APT Tactics Targeting ICS

Volt Typhoon, a recently identified Chinese nation-state actor, has been found operating in the wild at least since mid-2020, with the hacking team tied to hitherto unseen tradecraft to maintain remote access to targets of interest.

The information is from CrowdStrike, which is monitoring the threat using the alias Vanguard Panda.

The cybersecurity firm noted that the adversary frequently used ManageEngine Self-service Plus exploits to acquire initial access, custom web shells to maintain access, and living-off-the-land (LotL) strategies to migrate laterally. [8]

A cyber espionage outfit from China called Volt Typhoon, also known as Bronze Silhouette, has been connected to network infiltration operations against the American government, the military, and other critical infrastructure groups.

Tom Etheridge, chief global professional services officer at CrowdStrike, told The Hacker News that this adversary “has been known to leverage credentials and living-off-the-land techniques to remain hidden and move quickly through targeted environments.”

Security Bites 🥪

❤️ 🔥 Why I Work in Cybersecurity

In today’s interconnected world, cyber security is a crucial area of study. The importance of cyber security is growing as we rely more and more on modern technologies. Data breaches, ransomware attacks, and other forms of cybercrime that compromise individual privacy are constantly in the news. That’s why I went into the field of cyber defense.

The ever-changing nature of the field is one of the main attractions for me. Professionals in this field must adapt quickly to the ever-changing nature of cyber threats. This calls for not only technical know-how, but also imagination, problem-solving skills, and flexibility.

The sense of meaning I find in my work as a cybersecurity professional is another driving factor. I feel like I’m making a difference in the world by preventing cyber attacks on businesses and individuals. Knowing that my efforts are contributing to people’s sense of safety and security is a tremendous honor.

In conclusion, I’m in this field of employment due of the fantastic people I’ve met. Those who work in cybersecurity are among the most devoted and enthusiastic people I’ve ever met. They are always helping one another out and moving the field forward by pooling their resources and expertise. Being a member of this group and witnessing what we can do as a whole is motivating.

Cybersecurity is an exciting and rewarding industry to work in because of the constant mental and physical challenges it presents. I count myself very fortunate to be included, and I look forward to what the future holds for us.

📱Get Started with Mobile Hacking

Getting Started with Mobile Hacking and Mobile App Pentesting

Mobile devices have become an integral part of our lives, and with that, the security of these devices has become a top priority. As more and more sensitive information is stored on mobile devices, the risk of cyber attacks has increased exponentially. Mobile hacking and mobile app pentesting are crucial skills for any cybersecurity professional. Here are some tips to get started:

1. Familiarize Yourself with the Mobile Landscape

To be an effective mobile hacker, it is important to understand the mobile landscape. Familiarize yourself with mobile operating systems, such as Android and iOS, and mobile app development frameworks, such as React Native and Flutter. Understanding how these systems and frameworks work will give you a better understanding of how to exploit their vulnerabilities.

2. Learn the Tools

There are many tools available to aid in mobile hacking and mobile app pentesting. Some popular tools include:

Burp Suite: A web application testing tool that can also be used for mobile app pentesting. It allows security researchers to intercept and modify HTTP and HTTPS traffic between an app and its server, making it possible to identify potential vulnerabilities and test the app’s security. Burp Suite also has a variety of other features, such as a scanner for automated vulnerability testing, and an intruder tool for brute-force attacks.
Frida: A dynamic instrumentation tool that can be used to analyze and manipulate mobile apps. It allows security researchers to inject custom code into the app at runtime and intercept function calls, making it possible to analyze the app’s behavior and identify potential vulnerabilities. Frida supports both Android and iOS apps.
Drozer: A comprehensive security testing framework for Android. It provides a variety of tools for testing the security of Android apps, including a dynamic analysis tool for analyzing the app’s behavior at runtime, a static analysis tool for analyzing the app’s code, and a vulnerability scanner for automated vulnerability testing.
Cycript: A runtime manipulation tool for iOS. It allows security researchers to inject custom code into an iOS app at runtime and interact with the app’s runtime environment, making it possible to analyze the app’s behavior and identify potential vulnerabilities. Cycript can also be used to automate the testing process.
Cydia: Cydia is a package manager app for iOS devices that allows users to download and install software that is not available through the official App Store. This includes apps, tweaks, and other software that can be used for mobile hacking and app pentesting.
Apktool: Apktool is a tool for reverse engineering Android apps. It can be used to decompile and recompile APK files, allowing security researchers to analyze the inner workings of an app and identify potential vulnerabilities.
Appcrack: Appcrack is a tool for iOS devices that allows users to crack and modify apps. This can be useful for security researchers who want to analyze the inner workings of an app and identify potential vulnerabilities.
Wireshark: Wireshark is a network protocol analyzer that can be used for mobile app pentesting. It allows security researchers to capture and analyze network traffic, making it possible to identify potential vulnerabilities and test the app’s security.
OWASP ZAP: OWASP ZAP is a web application penetration testing tool that can also be used for mobile app pentesting. It allows security researchers to identify potential vulnerabilities in an app by performing a variety of tests, including injection attacks, cross-site scripting, and more.
Tcdump: Tcdump is a command-line tool for capturing and analyzing network traffic. It can be used for mobile app pentesting to identify potential vulnerabilities and test the app’s security.

Make sure to research and experiment with these tools to find the ones that work best for your needs.

3. Practice on Test Apps

To hone your mobile hacking skills, it is best to practice on test apps. There are many vulnerable mobile apps available for testing purposes, such as Damn Vulnerable iOS App and OWASP GoatDroid. These apps provide a safe environment to practice mobile hacking techniques without risking damage to real apps.

Mobile app pentesting is a crucial skill for any cybersecurity professional. Building a mobile app pentesting lab can help you hone your skills and gain hands-on experience with real-world vulnerabilities. Here are some steps to get started:

Choose Your Platform: The first step in building a mobile app pentesting lab is to choose your platform. There are two primary mobile operating systems: iOS and Android. Each platform has its own unique security features and vulnerabilities, so it’s important to choose the platform that best aligns with your goals and interests.
Set Up Your Environment: Once you have chosen your platform, you will need to set up your environment. This can be done in a number of ways, depending on your budget and resources. Here are some options:
Use a physical device: The most realistic way to test mobile app vulnerabilities is to use a physical device. You can purchase a used device online or borrow one from a friend or family member. This option can be expensive, but it provides the most accurate results.
Use an emulator: Emulators are software programs that simulate a mobile device’s hardware and software. They are often used for development and testing purposes. Emulators are less expensive than physical devices, but they may not provide the same level of accuracy.
Use a virtual machine: Virtual machines are software programs that simulate an entire computer system. You can install a mobile operating system on a virtual machine and use it to test mobile app vulnerabilities. This option is less expensive than using a physical device, but it may require more technical expertise.
Install Pentesting Tools: Once you have set up your environment, you will need to install pentesting tools like the ones we saw earlier.
Test Your Apps: Once you have installed your pentesting tools, you can begin testing your apps. Here are some areas to focus on:
Network security: Test the app’s network security by intercepting and modifying network traffic.
Authentication and authorization: Test the app’s authentication and authorization mechanisms by attempting to bypass login screens and access restricted areas.
Data storage: Test the app’s data storage mechanisms by attempting to access sensitive data stored on the device.
Input validation: Test the app’s input validation mechanisms by attempting to inject malicious code into input fields.

Cryptography: Test the app’s cryptography mechanisms by attempting to decrypt encrypted data.

Learn from Your Results: After testing your apps, it’s important to learn from your results. Analyze the data you’ve collected and identify any potential vulnerabilities or weaknesses in the app’s security. Use this information to improve your testing process and develop new techniques for identifying vulnerabilities.

4. Stay Up-to-Date

The mobile landscape is constantly evolving, and so are the techniques used to hack mobile devices and apps. It is important to stay up-to-date on the latest mobile security trends, vulnerabilities, and exploits. Follow blogs, attend conferences, and participate in online forums to stay informed.

Final Thoughts

Mobile hacking and mobile application penetration testing are required skills for any cybersecurity professional. You can become a proficient mobile hacker and help protect mobile devices and apps from cyber attacks by familiarizing yourself with the mobile landscape, learning the tools, practicing on test apps, and staying up-to-date.

Happy hacking! 🚀

More Resources:

10 best practices for mobile app penetration testing

☁️🔐 Get Started with Cloud Security

Cloud computing has become an integral part of modern business operations. However, as with any technology, there are risks associated with the cloud. Cloud security and cloud pentesting are crucial skills for any cybersecurity professional. Here are some tips to get started:

1. Understand the Cloud Landscape

To be an effective cloud security professional, it is important to understand the cloud landscape. Familiarize yourself with the different types of cloud environments, such as private, public, and hybrid clouds, and the various cloud service models, such as Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). Understanding how these systems work will give you a better understanding of how to secure them.

2. Learn the Tools

There are many tools available to aid in cloud security and cloud pentesting. Some popular tools include:

Amazon Inspector: A security assessment service that helps improve the security and compliance of applications deployed on AWS.
CloudSploit: An open-source security and compliance monitoring tool for AWS.
OpenVAS: A vulnerability scanner that can be used to scan cloud environments for vulnerabilities.
CloudMapper: A tool for visualizing and analyzing Amazon Web Services (AWS) cloud environments
Osquery: An open-source tool for querying operating system data to provide visibility into cloud environments
CloudGoat: A vulnerable-by-design AWS deployment tool for testing and learning cloud security
Scout Suite: A multi-cloud security auditing tool that checks for misconfigurations and other vulnerabilities
Cloud Custodian: A tool for managing AWS accounts to ensure compliance with policies and prevent security incidents
CloudSploit Scanner: A cloud security scanner that checks for vulnerabilities across multiple cloud platforms
Cloud Security Suite: A tool for auditing and hardening AWS environments
Prowler: A tool for auditing AWS configurations and security settings
Lynis: A security auditing tool for Linux and Unix-based systems, including those in cloud environments
CloudTrail: A service that records AWS API calls and events for logging and auditing purposes

Remember to research and experiment with these tools to find the ones that work best for your needs. Happy cloud pentesting and learning journey! 🚀

3. Practice on Test Environments

To hone your cloud security skills, it is best to practice on test environments. Many cloud providers offer free trial periods that allow you to experiment with their services without risking damage to real environments. Use these test environments to practice cloud security and cloud pentesting techniques.

4. Stay Up-to-Date

The cloud landscape is constantly evolving, and so are the techniques used to secure it. It is important to stay up-to-date on the latest cloud security trends, vulnerabilities, and exploits. Follow blogs, attend conferences, and participate in online forums to stay informed.

Final Thoughts

Cloud security and cloud penetration testing are indispensable competencies for any cybersecurity professional. By understanding the cloud landscape, learning the tools, practicing in test environments, and staying current, you can become a proficient cloud security professional and aid in the protection of cloud environments against cyber attacks.

Happy cloud pentesting! 🚀

Additional Resources

My Favorites

Read 📖 about Critical Thinking 🧠

Here are 4 top books for critical thinking along with their author, a summary of the book, and key takeaways:

“Thinking, Fast and Slow” by Daniel Kahneman

Summary: The book explores the two systems of thinking: System 1, which is fast, intuitive, and emotional; and System 2, which is slower, more deliberative, and more logical. The author explains how biases and heuristics can impact our decision-making and how we can improve our critical thinking skills.

Key takeaways:

Understand the differences between System 1 and System 2 thinking
Be aware of the cognitive biases and heuristics that affect our decision-making
Take time to deliberate and use System 2 thinking when making important decisions
Use checklists and other tools to help reduce errors and improve decision-making

“The Demon-Haunted World: Science as a Candle in the Dark” by Carl Sagan

Summary: The book explores the role of science and critical thinking in a world where pseudoscience and superstition are prevalent. The author argues that critical thinking is essential for understanding the world around us and for making informed decisions.

Key takeaways:

Be skeptical of claims that are not supported by evidence
Use critical thinking to evaluate claims and arguments
Understand the scientific method and its importance in advancing knowledge
Be open to new ideas and willing to change your mind based on new evidence

“How to Read a Book” by Mortimer Adler and Charles Van Doren

Summary: The book provides a comprehensive guide to reading and understanding complex texts. The authors explain how to identify the structure of an argument, how to evaluate evidence, and how to engage in critical reading.

Key takeaways:

Understand the structure of an argument and how evidence is used to support it
Learn how to identify key ideas and themes in a text
Use active reading strategies to engage with the material and improve comprehension
Ask questions and challenge assumptions to develop critical thinking skills

“The Art of Reasoning” by David Kelley

Summary: The book provides a comprehensive introduction to critical thinking and argumentation. The author explains how to identify and evaluate arguments, how to use evidence to support a claim, and how to engage in constructive dialogue.

Key takeaways:

Understand the structure of an argument and how to identify its premises and conclusion
Learn how to evaluate evidence and use it to support a claim
Use critical thinking to identify fallacies and weaknesses in arguments
Engage in constructive dialogue by listening carefully and responding thoughtfully to others

Quote of the Week

“ I’ve missed more than 9000 shots in my career. I’ve lost almost 300 games. 26 times I’ve been trusted to take the game-winning shot and missed. I’ve failed over and over and over again in my life. And that is why I succeed.” — Michael Jordan

If you’re interested in starting a career in cybersecurity, watch this one, and don’t forget to 🔥 ***Subscribe to my Youtube Channel*** and leave a comment if there are any topics you’re interested in seeing in my next video.

Check out my other stuff here.

🚨 📢 Apparently, most of you are not interested in subscribing to my youtube channel, Do it Now! 🙈.

References

[1] https://www.cisa.gov/known-exploited-vulnerabilities-catalog

[2] https://cwe.mitre.org/top25/

[3] https://www.cisa.gov/known-exploited-vulnerabilities-catalog

[4] https://faq.whatsapp.com/520504143274092/

[5] https://securelist.com/lazarus-andariel-mistakes-and-easyrat/110119/

[6] https://www.letmespy.com/en/login.html

[7] https://www.fortiguard.com/psirt/FG-IR-23-074

[8] https://www.crowdstrike.com/blog/falcon-complete-thwarts-vanguard-panda-tradecraft/