Maryland's Bug Bounty Program; UN Cybercrime Convention; Microsoft Patch Tuesday

Well-managed bug bounty programs that are run by organizations have a good track record. But 'well-managed' also includes making sure your software inventory, update and configuration management processes are accurate, rapid and thorough. One of the common failings is updating all managed devices when vulnerabilities are found but a full network scan results in only 80% (or less!) of devices found showing up in Active Directory, etc. Another key point: have a plan in place about what to do when a vulnerability is discovered that cannot be fixed.

John Pescatore

'Well-managed' in this case should include a requirement that such activity be conducted under management and supervision and with the permission of the target. The line between research and hacking is thin and obscure. Those incenting such activity have a special responsibility to those that they encourage.

William Hugh Murray

Kudos to Maryland for finding a force multiplier. Note that if you're operating a bug bounty program, you need to be prepared to not only run the program, which can be outsourced, but also to remediate findings, including validation the issue is indeed fixed, which is trickier to outsource.

Lee Neely

Bug bounty programs have proven their worth over the past decade. It's also reassuring to see the concept applied at the State level. My only quibble is to ensure that you've done the basics well (patching, secure configuration, monitoring) before spending precious cybersecurity dollars on finding implementation bugs.

Curtis Dukes

This was prompted after Russia took issue with the existing Budapest Convention, demanding the addition of a framework to address cybercrime. The trick will be the balancing act between processing actual crimes versus criminalizing security research, potentially torpedoing the effectiveness of bug bounty programs such as the success story from Maryland above.

Lee Neely

Drafting legislation that accomplishes its intent while avoiding unintended consequences is difficult. It should be approached with both humility and caution. That is particularly true with Copyright, a law that is arbitrary in both intent and application.

William Hugh Murray

Microsoft vulnerabilities constitute a pervasive and attractive attack surface. The success of Microsoft products makes their quality essential to the security of the world's infrastructure. While patching is an inefficient way to achieve quality, in this case it is also essential.

William Hugh Murray

Can you say 89 fixes? I knew you could. Now make sure that you already sent the notice that you'll be patching and rebooting endpoints this weekend. There are only two zero-day issues identified in this set, but there are three critical flaws, two of which are being exploited in the wild. Of note: CVE-2024-46039, Kerberos RCE flaw, CVSS score 9.8, which is being actively exploited; CVE-2024-49039, Task Scheduler privilege escalation flaw, CVSS score 8.8; CVE-2024-43625, VMSwitch privilege escalation flaw, CVSS score 8.1; and CVE-2024-49019, AD Certificate Services privilege escalation flaw, CVSS score 7.8, all need to be addressed smartly, with the release the list of what's being exploited is going to evolve quickly.

Lee Neely

Recall the reports of Salt-Typhoon breaching systems at AT&T, Verizon and Lumen, specifically targeting the systems U.S. law enforcement agencies use for wiretaps. A focus on proper isolation, multi-factor, and validation of connection requests when paired with updates and a secure configuration goes a long way to make this sort of attack hard to duplicate.

Lee Neely

As of November 13th they claim to be fully staffed to work the incoming CVEs. Hopefully the updated data feeds will facilitate the analysis; it's not clear what it'll take to process the backlog. Their November 15th announcement describes how the incoming data from CNAs and ADPs will need to be enhanced for effective processing, and includes removal of some tags requiring more information. These changes start November 18h and will be reflected immediately in the 2.0 API. The 1.1 legacy feed changes will be staggered over a few days.

Lee Neely

A new twist on what's become referred to as a 'quishing' attack. This one takes a bit more effort as the miscreant must print, place in envelope, and mail (at a cost). Just remember: stop, and think before acting, lest you become a victim.

Curtis Dukes

The QR code leads to a download for the Coper and Octo2 malware, which targets stealing credentials from as many as 383 banking and other mobile apps. Currently the attack only works on Android devices. Remediation included a recommended factory reset of the device. With the prevalence of QR codes and the install being doctored up to mimic the Alertswiss app developed by their Office of Civil Protection, users have to be particularly wary of being fooled. Even so, making sure to only install apps from known vetted app stores is a good first step.

Lee Neely

QR tags have proved their worth, but they constitute the same risk as any other link. Knowledge and trust are crucial.

William Hugh Murray

As a consumer, having options for repair services, including self-service, is a bonus. The trick now will be how to find trained/certified repair technicians with legal copies of the needed tools and supplies. Even so, that won't prevent motivated folks from either going without the proper tools or misrepresenting the tools and parts used. Trust but verify while this gets sorted.

Lee Neely

Umm, ok, now what? Hire a cryptographer to circumvent the technological protection measures? Not sure I would call this a win for the right to repair lobby.

Curtis Dukes

Teixeira is accused of leaking Top-Secret Information. The consequence of loss for Top Secret information is categorized as causing exceptionally grave damage to national security and carries a much more severe consequence than losing Secret information, and your clearance briefing includes terms like Leavenworth and throwing away the key to incentivize proper handling of this type of data. By admitting his guilt his maximum sentence was reduced from 60 to 15 years; his goal had been the lightest possible sentence of 11 years. While most of you don't deal with classified data, have you considered the consequence of loss and consequences for your most sensitive data? (Not just privacy or health data.) Do you have data handling training in your onboarding? How about when staff are granted access to more sensitive data? Verify those briefings are kept current, required and repeated.

Lee Neely

This was a classic case of failure to supervise. While failure to supervise is not a crime, it is subject to discipline. It should be instructive to our audience to know that 15 enlisted personnel (NCOs) and officers faced disciplinary action in this case. Both this case and the Snowden case demonstrated that supervision was not appropriate to the privileges of the perpetrators. Consider the use of Privilege Management software to improve control and accountability.

William Hugh Murray

The unauthorized disclosure of Top Secret' information is considered to cause exceptionally grave damage to the national security. Reality Winters got five years. Chelsea Manning got 35 years (commuted after 7). The words 'exceptionally grave damage' don't seem to mean as much as they used to.

Curtis Dukes

The attack pattern consisted of purchasing purloined credentials then accessing the systems to steal documents, reports, and personal information. While he was smart enough to not attack businesses in his vicinity (Meridian ID), the extortion attempts unwound his attempts at anonymity. Sadly, this sort of attack could have been mitigated by the use of MFA. Reusable credentials need to become a thing of the past.

Lee Neely

While not strictly a cybersecurity problem, swatting is a life and limb risk. So called "swat" teams should act with due caution and the crime should be punished like attempted murder.

William Hugh Murray

Filion now faces a maximum of five years in prison for each of four counts of making interstate threats to injure the person of another state. Expect the state to make an example of Filion to discourage others attempting similar shenanigans.

Lee Neely