Proofpoint Blog

Relevant context: The author, Ryan Kalember, is an executive at Proofpoint. His title says "Cybersecurity Strategy", but he's really in marketing and PR. I know Ryan and would say he's a great guy and by far the best marketing executive I've worked with, but marketing is marketing. This piece is marketing. Proofpoint competes with Microsoft in the email security space, less and less effectively as time has gone on. They're partners with CrowdStrike and George Kurtz in the Spectra Alliance [1], and CrowdStrike also competes with Microsoft (in the EPP/EDR space), so it's not surprising to see them team up against a common competitor. All that said, the criticisms of Microsoft aren't without merit. There's definitely some truth to them. 1. https://www.proofpoint.com/us/partners/spectra-alliance

I love crowdsourcing (when it works): the result of the troyan analysis is here: https://www.reddit.com/r/Malware/comments/3h9lkw/trojan_sent_to_dead_p… and a previous one: https://www.proofpoint.com/us/threat-insight/post/You-Dirty-RAT

See this: https://www.proofpoint.com/us/corporate-blog/post/understanding-inform… A quote: TikTok app permissions include personal information and device control First, our researchers examined the permissions TikTok requires on Android and iOS devices following installation. While some of the permissions detailed below are to be expected, all of this is consistent with TikTok’s written privacy policy. However, when you see all that TikTok gathers it can still be of concern. In summary, these permissions allow TikTok to: Access the camera (and take pictures/video), the microphone (and record sound), the device’s WIFI connection, and the full contact list on the device Determine if the internet is available and access it Keep the device turned on and automatically start itself when the device restarts Secure detailed information on the user’s location using GPS and other apps that are running Read and write to the device’s storage, install/remove shortcuts, access the flashlight (turn it off and on), request additional installation packages Our researchers found that TikTok has full access to the audio, video, and address book on the device, which isn’t surprising given that TikTok is an audio-visual app by design. However, the GPS tracking is surprising, especially as TikTok videos don’t obviously display location information. TikTok does call out their collection of location information in their privacy policy. Recap: TikTok does not need…

It looks like this started all the way back in the beginning of last year: https://www.mimecast.com/blog/guide-to-google-dmarc-setup/ This overview also shows other requirements you may have missed: https://www.proofpoint.com/us/blog/email-and-cloud-threats/google-and-… As for DMARC in the headers, I'm pretty sure Google has done that for years when DMARC is being checked (i.e. when it's being offered by the sending domain).

More on this via https://www.proofpoint.com/uk/blog/threat-insight/clipboard-compromise…

Seems to be this Proofpoint blogpost about a phishing campaign: https://www.proofpoint.com/us/blog/cloud-security/community-alert-ongo… being blown out of proportions by a series of obscure news websites exaggerating each other's stories. Edit: for a real interesting Microsoft security disaster (not exploited in the wild AFAIK) check out ChaosDO by Wiz: https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-vulnerabili…

Hey - Managing SPF RFC limits in large environments can be rather challenging - given the limit of 10 entries. (especially before you adopt DKIM) Some vendors such as ProofPoint offer services such as SPF hosting, which allow you to work around this constraint. (https://www.proofpoint.com/au/resources/solution-briefs/proofpoint-hos…

I know of a few companies that front-end their email with ProofPoint [1] but I have no idea how much it costs, probably a lot. It can quarantine anything suspicious. It also lets the admin know who clicked on what links in emails. It rewrites links to its own tracking endpoint It also doubles as a DLP Data Loss Prevention meaning it can be taught to look for organization specific data that should not be in email. It can also give you reports on who is receiving the most abusive emails and may be targeted by attackers. [1] - https://www.proofpoint.com/us

Email has this problem all the time! [1] Real estate companies have to give customers cybersecurity advice [2] because phishers pretend to be the agent and send incorrect addresses for wire transfers. [1]: https://www.proofpoint.com/us/threat-reference/email-spoofing [2]: https://www.rate.com/resources/how-to-avoid-phishing-scams-and-other-a…

Not spy messages, but steganography has been used for malvertizing campaigns, hiding malicious code inside ad images to prevent automated detection by ad networks. See for example https://www.proofpoint.com/us/threat-insight/post/massive-adgholas-mal…

Numbers are a bit loose, but even a Fermi style estimation suggests malware in general is worse than phishing. Phishing is on the order of tens of millions [1] to a few billion [2]. Ransomware alone probably causes upwards of many billions [3]. Equifax breach (XML exploit) alone has cost billions. Heartbleed, spectre, meltdown, those are at least 1B each. [1] https://www.cybersecuritydive.com/news/phishing-cost-enterprise/605110… [2] https://www.proofpoint.com/us/corporate-blog/post/fbi-reports-125-bill… [3] https://cybersecurityventures.com/global-ransomware-damage-costs-predi…

TikTok collects a lot of user data: Geolocation data, including: longitude, latitude, and time zone Device information, including: Android ID, International Mobile Equipment Identity (IMEI), Address Book Access, Device carrier region, Device region, Device type, Device OS version, Device language, Device connection type, and Mobile network code App information, including: App name https://www.proofpoint.com/au/corporate-blog/post/understanding-inform…

>>Neither Apple nor Google have found TikTok problematic enough Security researchers have found it grossly problematic though. 1. https://www.proofpoint.com/us/blog/threat-protection/understanding-inf… 2. https://www.bleepingcomputer.com/news/security/tiktok-flaws-allowed-ha…

In other news, bots have now started using DoH (one via Google's DoH service): * https://www.proofpoint.com/us/threat-insight/post/psixbot-now-using-go… * https://news.ycombinator.com/item?id=20934680

Anyone used the commercial firewall / IP list you can slap on top of pfSense? There is the community version, but then there is also this: https://www.proofpoint.com/us/threat-insight/et-pro-ruleset My understanding is it’s around $900 or so a year for a license. That kind of sucks. But on the other hand I know it’s very easy to install, just a one-liner in the GUI of pfSense (which is how I found out about it).

> Microsoft is the Microsoft of the enterprise security market, more or less. They completely dominate email, largely dominate identity, have a plurality if not a majority on endpoint, but don't compete in network. The most recent figures I’ve seen are that Microsoft has around 25% of the endpoint market[0], which is a plurality because the market is so fragmented. Proofpoint claims around 24% of the email security market[1]. The only security market you can say they “dominate” is identity, if you ignore the MFA market. AD is, at least, almost everywhere. > This was a dedicated effort by CrowdStrike working with analysts back in 2017-2018. That’s one interpretation of events. It’s also completely orthogonal to what I wrote. 0 - https://www.microsoft.com/en-us/security/blog/2024/08/21/microsoft-aga… 1 - https://www.proofpoint.com/us/blog/email-and-cloud-threats/proofpoint-…

> You own your machine but not the text. You don't get to own the text just because you can read it, see if you read this - it is still my text (because I wrote it!). >what would be your opinion if the major websites would put a T&C that you have to enable (Let's say it was safe JS) ads to view content. And how would I know it's safe? I don't even let the closest friends on the wifi because they don't run adblockers on their phone and I don't want my router to get pwned [1] just because someone like Forbes is making a buck using Ads. > Would you still say "it's my machine and I view what I want when I want"? It is still my machine, so long as I physically own it. If I run a virtual machine in the cloud it's not mine you see, because then I'm just renting it. If ad networks want to remove the ability to block ads they would have to own the machines and rent out those computers to users, they are free to do this. [1] https://www.proofpoint.com/us/threat-insight/post/home-routers-under-a…

I'm not a reverse engineer or a white hacker but I like reading about it. Most of the malware is made for Windows OS because of the Windows' enormous market share. Majority of information about Windows malware I get from big computer security companies' research blogs like: https://www.trendmicro.com/en_us/research.html https://www.proofpoint.com/us/blog https://research.checkpoint.com/ https://blog.talosintelligence.com/ https://www.welivesecurity.com/en/ Microsoft also got good security research blog: https://www.microsoft.com/en-us/security/blog/ Majority of the research combes down to researching malware's capabilities regarding malware persistence, anti-VM techniques and anti-debugging techniques. Here is for example good compilation of malware's anti-debugging and anti-VM techniques: https://anti-debug.checkpoint.com/ https://github.com/CheckPointSW/Evasions