Fortinet Blog

This is a great writeup. It looks like this driver is being actively used in malware, too: https://www.fortinet.com/blog/threat-research/interlock-ransomware-new…

Since you mention infrastructure, https://www.fortinet.com/resources/cyberglossary/shift-left-security Follow up reading CIS and related reasonings. https://www.cisecurity.org/cis-benchmarks There are also some Linux Plumers, NDC and Devvoxx talks on security.

> Frankly this is absurd. What's absurd is Apple's software sending requests to random and entirely-unvetted servers without even so much as notifying the user, let alone obtaining consent. > Did you know that the file system of your computer contains your personal data, including files you save? Why yes, and that would just so happen to be the reason why I ain't exactly comfortable with closed-source software silently sifting through it and blindly following anything and everything vaguely resembling a URL or encoding thereof. > EDIT: No, that’s not what exfiltration means. You are simply misusing the word. https://www.fortinet.com/resources/cyberglossary/data-exfiltration: "A common data exfiltration definition is the theft or unauthorized removal or movement of any data from a device. Data exfiltration typically involves a cyber criminal stealing data from personal or corporate devices, such as computers and mobile phones, through various cyberattack methods. "Another data exfiltration meaning is data exportation and extrusion, data leakage, or data theft, which can pose serious problems for organizations. Failing to control information security can lead to data loss that could cause reputational and financial damage to an organization." Thanks to this crawler, anyone who sends you even so much as a QR-encoded image of a link will know that it was successfully received, that it was a macOS machine that received it, and quite possibly the public IP address of the…

You only need to decrypt once the payment has been received, so the private key doesn't need to be sent to the infected machine before that. Encrypt/Decrypt, it seems to be a moot point. The "decrypt one file for free" feature seems to be specific to CryptoWall which, some have reported, do not use symmetric encryption like CryptoLocker. CryptoLocker stores symmetric keys for each file on the infected machine, encrypt those with a public key and when the payment is received, send the private key from the C&C Server. I would say it's very unlikely CryptoWall would store remotely a private key per file. That could mean a lot of information to be transferred over the wire. Probably because of using only asymmetric (slow) encryption, CryptoWall apparently only encrypt small files completely, and only a piece of the larger ones. One way the "decrypt one file for free" feature might work is by actually uploading the file (or the the encrypted piece of file) to the C&C Server, decrypting it remotely and sending it back. But the feature is definitely worth investigating. https://blog.fortinet.com/post/cryptowall-another-ransomware-menace http://stopmalvertising.com/malware-reports/cryptowall-behind-the-scen…

Well, that's clearly incorrect: software displaying unsolicited advertisements is called adware, and requires no spying at all. > Spyware is a form of malware that hides on your device, monitors your activity, and steals sensitive information like bank details and passwords [0] > Spyware is loosely defined as malicious software designed to enter your computer device, gather data about you, and forward it to a third-party without your consent. [1] > Spyware is malicious software that secretly monitors your activity and collects sensitive information, like passwords, location data, or browsing habits, without your consent. [2][3] 0: https://www.malwarebytes.com/spyware 1: https://usa.kaspersky.com/resource-center/threats/spyware 2: https://us.norton.com/blog/malware/spyware 3: https://www.fortinet.com/resources/cyberglossary/spyware

SSL is not going away, might as well forget TLS instead. https://www.fortinet.com/resources/cyberglossary/ssl-vpn

Definitions https://csrc.nist.rip/glossary/term/classified_information_spillage “ An air gap involves physically isolating a computer or network from other networks to prevent unauthorized access and data breaches. This method creates a literal "air gap" between the secured network and any other unsecured networks. Air gaps are an isolation method crucial for data integrity and security and can be deployed across various industries.” https://www.fortinet.com/resources/cyberglossary/what-is-air-gap What part of what he communicated is classified and what is everyone basing that on? What says it is ?

Or, worse, I find that most of these are real links from real paypal. https://www.fortinet.com/blog/threat-research/phish-free-paypal-phishi…

Related article: Phish-free PayPal Phishing https://www.fortinet.com/blog/threat-research/phish-free-paypal-phishi…

And "Defense In Depth" - the more layers that bad actors have to avoid/circumvent reduces the chance of their success. see https://www.fortinet.com/resources/cyberglossary/defense-in-depth

I would personally rebrand it or risk the wrath of Ken Xie and the Fortinet line of "Forti{insert solution type here}: https://www.fortinet.com/products

Also F5 or Citrix: some of their core security products had 90s-style C exploits and other signs of development practices well behind the times - roughly at the level of going to surgery and seeing your surgeon not washing their hands in the bathroom. https://www.cisa.gov/guidance-addressing-citrix-netscaler-adc-and-gate… https://www.mandiant.com/resources/blog/session-hijacking-citrix-cve-2… https://www.fortinet.com/blog/threat-research/defending-against-critic… https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-138a

More information here: https://www.fortinet.com/blog/threat-research/malicious-packages-hiddi…

I don't know of any one resource that gives a overview of everything, I find that browsing Wikipedia for each topic gives a good overview of each topic though, with the overview being the "Internet Architecture" category: https://en.wikipedia.org/wiki/Category:Internet_architecture Some bookmarks I have regarding BGP and peering that dives into it a bit: - https://www.fortinet.com/resources/cyberglossary/bgp-border-gateway-pr… - https://aws.amazon.com/blogs/architecture/internet-routing-and-traffic… - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configur…

A firewall can be run "in-line" and not have IP addresses on the interfaces. On a Palo Alto firewall this would be a "virtual wire", and "transparent firewall" or "bridging firewall" would be other common terms. Examples: https://docs.opnsense.org/manual/how-tos/transparent_bridge.html https://docs.netgate.com/pfsense/en/latest/bridges/index.html#internal… https://www.fortinet.com/resources/cyberglossary/transparent-firewall

> Native controls aren’t all in some global singleton process windows used to render scrollbars in-kernel (idk if it still does but it even did for 10: https://www.fortinet.com/blog/threat-research/one-bit-to-rule-them-all… )

Deep Packet Inspection: https://www.fortinet.com/resources/cyberglossary/dpi-deep-packet-inspe…

I'm talking about op-sec. Network design is but a single aspect of that, and often doesn't feature at all. I mean this more in the sense described by Wikipedia¹, and not the likes of SecurityStudio²/Fortinet³ (first two search results). ¹ https://en.wikipedia.org/wiki/Operations_security ² https://securitystudio.com/operational-security/ ³ https://www.fortinet.com/resources/cyberglossary/operational-security

Sadly, that's yesterday news. See here: https://security.stackexchange.com/a/249484 > ... a newly discovered ransomware variant exhibits the ability to detect and compromise partitions (including hidden partitions), a behavior not thought to have been seen before in ransomware. with a link to original source: https://www.fortinet.com/blog/threat-research/newly-discovered-functio… quote from that link: > At the time of discovery, FortiGuard Labs researchers believed the ransomware was seeking out partitions to find possible hidden partitions setup by systems administrators to hide backup files. But further analysis confirmed an even more advanced technique. The DarkSide Ransomware variant seeks out partitions on a multi-boot system to find additional files to encrypt.

Sure. Kinda like how storing web templates in files is totally dependent on the people who upload them not putting crypto miners in the linked javascript(s) [1]. Or totally dependent on PAM not having a vulnerability [2]. Or totally dependent on SSH not having a vulnerability [3]. In terms of libraries and utilities I can give PAM and SSH a pass for fixing these things long ago. In the case of restricting a customer's access to the mechanism that renders their thing in favor of the option of "trust this guy who uploads things instead" you've got a much tougher sell about why that's better. 1. https://www.fortinet.com/blog/threat-research/the-growing-trend-of-coi… 2. https://www.cvedetails.com/cve/CVE-2002-1227/ 3. https://www.cvedetails.com/cve/CVE-2002-0083/

Nope, I read the manufacturers published specifications for their equipment and looked up the pricing on publicly accessible websites. https://www.paloaltonetworks.com/products/product-selection https://www.fortinet.com/products/product-compare?cat=ngfw And you can get pricing from any VARs website such as CDW.com Good try though.

As far as I remember, the "DLL hijacking" is a serious issue when the program like Microsoft Word searches for the DLL exactly at the location of the user file to be opened and exactly after the user selects the file: if you e.g. open a .DOC file from the Documents folder and an attacker placed in the Documents folder his own DLL, that DLL would have been then loaded too by some unpatched versions of Microsoft Word. I don't see such a scenario described in this article, so it can be that the issue here has much less potential to be misused? There is also a system-wide solution for all programs at once: SafeDllSearchMode registry entry. https://www.fortinet.com/blog/industry-trends/a-crash-course-in-dll-hi…

I haven't found any real implementations to test (I'd like to). But it seems Fortinet is making bold claims that, on the surface, feel like lip service thus far: https://www.fortinet.com/blog/business-and-technology/tls-is-here-what… Keep in mind this is just TLS1.3 and they make no claims around IETF QUIC / HTTP/3.

If you go to the pool website with the address specified on the botnet you can see how much it was mined. The main article [1] linked on the news said: > The actor has been able to mine about 630 XMR to date, which at the current USD rate is more than $172,000 for just a little more than one year of activity. [1]: https://www.fortinet.com/blog/threat-research/yet-another-crypto-minin…

The information is in the links provided: https://www.alienvault.com/blogs/labs-research/macspy-os-x-rat-as-a-se… https://blog.fortinet.com/2017/06/09/macransom-offered-as-ransomware-a…

Agreed. The researcher's blog post is much more informative: https://blog.fortinet.com/2017/06/09/macransom-offered-as-ransomware-a…

Gemalto: http://www.gemalto.com/readers/tokens.html Safenet: http://www.safenet-inc.com/data-protection/authentication/otp-authenti… Fortinet: http://www.fortinet.com/products/fortitoken/200CD.html

This isn't new, some other guy broke TouchId by making a fake finger from gelatin and soy sauce. http://blog.fortinet.com/iPhone-5s--Basic-Fingerprint-Replication-Meth…

Relatively low-quality gel casts don't seem to work: http://blog.fortinet.com/iPhone-5s--Basic-Fingerprint-Replication-Meth…