Overview

The Indian Computer Emergency Response Team (CERT-In) has warned users about five high-severity vulnerabilities in Apex Softcell’s mobile stock trading and back-office platforms.

The 32-year-old private company focuses on products and solutions for capital markets and the financial industry, making any vulnerability potentially critical.

According to the CERT-In advisory published last week, the vulnerabilities affect Apex Softcell LD Geo versions prior to 4.0.0.7 and LD DP Back Office versions prior to 24.8.21.1 and could allow a remote attacker to perform user enumeration, bypass OTP verification, manipulate unauthorized transactions, or gain unauthorized access to sensitive information of other user accounts.

Affected Products and Vulnerabilities

The affected products include Apex Softcell LD Geo versions prior to 4.0.0.7 and Apex Softcell LD DP Back Office versions prior to 24.8.21.1. Several vulnerabilities have been identified but not yet announced, including CVE-2024-47085, CVE-2024-47086, CVE-2024-47087, CVE-2024-47088, and CVE-2024-47089.

CVE-2024-47085: Parameter Manipulation Vulnerability

This vulnerability exists in the LD DP Back Office because of improper validation of the parameters “cCdslClicentcode” and “cLdClientCode” in the API endpoint. Authenticated remote attackers could exploit this vulnerability via the manipulation of parameters in the API request body, leading to the exposure of sensitive information belonging to other users.

CVE-2024-47086: OTP Bypass Vulnerability

Another LD DP Back Office vulnerability, this one caused by improper implementation of an OTP validation mechanism in certain API endpoints, could be exploited by an authenticated remote attacker who provides arbitrary OTP values for authentication, subsequently changing the API response, and bypassing OTP verification for other user accounts.

CVE-2024-47087: Information Disclosure Vulnerability

This vulnerability in LD Geo is due to improper validation of certain parameters (Client ID, DPID, or BOID) in the API endpoint. Authenticated remote attackers could exploit this vulnerability by manipulating parameters in the API request body, leading to sensitive information exposure.

CVE-2024-47088: User Enumeration Vulnerability

This vulnerability in LD Geo is created by missing restrictions for excessive failed authentication attempts on its API-based login. Remote attacks could exploit this by conducting a brute force attack on login OTP, which could lead to unauthorized access to other user accounts.

CVE-2024-47089: Unauthorized Transaction Manipulation Vulnerability

This LD Geo vulnerability is caused by improper validation of the transaction token ID in the API endpoint. Authenticated remote attackers could exploit this by manipulating the transaction token ID in the API request, leading to unauthorized access and modification of transactions belonging to other users.

Users should upgrade Apex Softcell LD Geo to version 4.0.0.7 and Apex Softcell LD DP Back Office to version 24.8.21.1.

Conclusion

Remote attackers could manipulate transactions, bypass authentication, and access sensitive user information, and the implications of these vulnerabilities could be severe. To mitigate these risks, all users of Apex Softcell LD Geo and LD DP Back Office must immediately upgrade to the latest versions—4.0.0.7 and 24.8.21.1, respectively. Proactive measures and timely updates are essential to monitor and secure sensitive financial data as well as maintain the integrity of trading operations.

Mitigation and Recommendations

Users must upgrade to Apex Softcell LD Geo version 4.0.0.7 and LD DP Back Office version 24.8.21.1 to close the identified vulnerabilities.

Ensure that all API endpoints validate input parameters rigorously to prevent parameter manipulation and unauthorized access.

Employ anomaly detection systems to identify unusual patterns, such as excessive failed login attempts, which may indicate brute-force attacks.

Perform periodic security assessments and penetration testing on the trading platforms to identify and address vulnerabilities proactively.

Train users to recognize potential phishing attempts and unauthorized access attempts, reinforcing the importance of strong, unique passwords.

Enforce the principle of least privilege, granting users only the access necessary for their roles, thereby reducing the impact of a compromised account.

Subscribe to security advisories and maintain awareness of newly discovered vulnerabilities related to the software in use to ensure timely responses.

The post Apex Softcell Flaws Could Lead to Unauthorized Transactions, CERT-In Warns appeared first on Cyble.

Blog – Cyble – ​Read More

In this digital era, cyber threats become increasingly sophisticated, and companies need advanced solutions to protect their digital assets, particularly from the darker corners of the internet. Cyble, a prominent player in the cybersecurity domain, has achieved notable recognition in the G2 Fall 2024 Report. The company has been honored for its excellence in Dark Web Monitoring, earning accolades in the categories of Leadership, Easiest Setup, and Easiest to Use. These accolades solidify Cyble’s position as a leader in the industry and underscore its commitment to providing user-friendly and effective cybersecurity solutions. 

The Significance of G2’s Recognition 

G2 is a globally renowned platform that aggregates user reviews for software and services, providing valuable insights into their real-world applications and performance. To be recognized by G2 is a significant endorsement, as these accolades are based on authentic user experiences and feedback. Cyble’s multiple recognitions in the G2 Fall 2024 Report demonstrate the company’s ability to deliver high-quality and user-centric solutions that meet the evolving needs of businesses in mitigating cybersecurity threats. 

Leadership in Dark Web Monitoring 

Cyble’s recognition as a leader in Dark Web Monitoring is a testament to its comprehensive capabilities and market influence. This accolade is bestowed upon companies that not only offer robust solutions but also exert significant influence and presence in the market. 

Why Cyble Stands Out? 

1. Advanced Threat Detection: Cyble’s Dark Web Monitoring platform is acclaimed for its advanced threat detection capabilities. It continuously scans the dark web for potential threats, ensuring that businesses are promptly informed about any compromised data or emerging risks. 

2. Comprehensive Insights: The platform provides detailed insights into threats, including the source, nature, and potential impact. This helps businesses understand the context of the threats and implement appropriate mitigation strategies. 

3. Proactive Defense: By identifying threats at their source, Cyble enables organizations to adopt a proactive defense strategy, mitigating risks before they escalate into significant security breaches. 

Customer Endorsements 

Users have highlighted the platform’s effectiveness in uncovering hidden threats that standard security measures might overlook. Cyble’s commitment to delivering actionable intelligence allows businesses to stay ahead of cybercriminals, protecting their sensitive information and maintaining their reputation. 

Easiest Setup: Rapid Deployment and Minimal Disruption 

In today’s fast-paced business environment, the ability to quickly deploy and integrate cybersecurity solutions is crucial. Cyble’s recognition for the easiest setup emphasizes its commitment to providing solutions that are not only powerful but also accessible and easy to implement. 

Seamless Integration 

Employing advanced but straightforward integration processes, Cyble ensures that its Dark Web Monitoring platform can be seamlessly incorporated into existing security infrastructures with minimal disruption. This ease of setup is particularly beneficial for businesses that need to quickly fortify their defenses without diverting valuable resources to complex installations. 

User Feedback on Setup Process 

Users have consistently praised Cyble for its user-friendly setup procedures. Key highlights include: 

Quick Onboarding: Businesses can get the platform up and running swiftly, which is crucial for immediate threat monitoring. 

Minimal Technical Hurdles: The setup process does not require extensive technical knowledge or specialized skills, making it accessible to a broader range of users. 

Comprehensive Support: Cyble offers robust support during the setup phase, ensuring users can navigate any challenges smoothly. 

Easiest to Use: Intuitive Design and User-Friendly Features 

In addition to rapid deployment, the usability of cybersecurity solutions significantly impacts their effectiveness. Cyble’s accolade for the easiest-to-use platform reflects its dedication to creating an intuitive user experience that facilitates quick adoption and efficient operation. 

User-Centric Design 

The design philosophy behind Cyble’s Dark Web Monitoring platform focuses on simplicity and functionality. Key aspects of its user-friendly interface include: 

Intuitive Dashboard: The platform’s dashboard is designed to provide a clear and concise overview of threats, making it easy for users to access critical information at a glance. 

Easy Navigation: Navigating through the platform is straightforward, with well-organized sections and clearly labeled features that enable users to find what they need quickly. 

Detailed Reporting: Users receive comprehensive reports that are easy to understand, helping them make informed decisions without the need for extensive technical knowledge. 

Real-World User Experiences 

Users have highlighted several aspects that contribute to the platform’s ease of use: 

Lower Learning Curve: The intuitive design ensures that users can quickly learn to navigate and utilize the platform’s features. 

Efficiency: The streamlined interface allows for efficient threat monitoring and response, saving time and resources. 

Accessible Features: Even users with minimal cybersecurity background can leverage the platform’s full capabilities effectively. 

Cyble’s accolades in the G2 Fall 2024 Report are a significant milestone, but the company remains focused on continuous improvement and innovation. The cybersecurity landscape is ever-evolving, and staying ahead requires a dynamic and proactive approach. 

Future Enhancements 

Leveraging Advanced Technologies: Cyble is committed to integrating cutting-edge technologies like artificial intelligence and machine learning to enhance its threat detection and analysis capabilities. 

Expanding Regional Focus: The company plans to extend its reach, providing localized and contextually relevant solutions to meet the unique cybersecurity needs of different regions. 

Continuous User Feedback: By actively seeking and integrating user feedback, Cyble aims to refine its products continuously, ensuring they remain effective and user-friendly. 

Conclusion 

Cyble’s multiple recognitions in the G2 Fall 2024 Report for Leadership, Easiest Setup, and Easiest to Use in Dark Web Monitoring highlight its excellence and leadership in the cybersecurity domain. These accolades reflect the company’s commitment to providing high-quality, user-centric solutions that address businesses’ specific needs in protecting against cyber threats. 

By focusing on advanced threat detection, seamless integration, and an intuitive user experience, Cyble ensures that businesses can safeguard their digital assets effectively. As the digital landscape continues to evolve, Cyble’s dedication to innovation and customer satisfaction guarantees that it will remain a trusted partner for organizations seeking robust and reliable cybersecurity solutions. 

The post Cyble Recognized in G2 Fall 2024 for Leadership and Best-in-Class Dark Web Monitoring Setup and Usability  appeared first on Cyble.

Blog – Cyble – ​Read More

Often, malware uses platforms like — Telegram and Discord for data exfiltration. Due to its simplicity and the lack of need for building a server architecture, this exfiltration method has gained significant popularity. However, this very simplicity is also its weakness. 

In this article we’ll show you how to obtain information related to threat actors’ activities using Telegram API, which can help reveal their identity, attribute malware samples to known families or discover new ones.  

Parsing a Telegram Chat  

First, we need to find a relevant malware sample using Threat Intelligence Lookup with the following query: 

TI Lookup reveals a hundred sandbox sessions featuring samples that match our query.

We can select one of them and rerun it with the MITM Proxy feature enabled.

In Telegram, to send a message, two main methods are typically used: 

After turning on the MITM Proxy and starting the sandbox session, we navigate to the HTTP Requests tab, where we can see a request to api.telegram.org. 

Looking at the POST request to /sendDocument, we see that it uses the form-data method for transmission. 

In this case, the bot token can be obtained from the URL of the request, and the chat_id from the body (in the screenshot, it is the first parameter in the body). 

We can also examine the response from the server. It arrives in JSON format and contains a lot of useful information: the chat_id, bot username, bot name/title, chat name, and chat type. 

In this sandbox session, we can see an example of a request to /sendMessage using the GET method, where the data is passed in the query string (url-encoded): 

Using CyberChef, we can decode the query string. Here is what the sent data looks like: 

In this case, the bot token and chat_id are present in the query string. 

Now, let’s use the attacker’s chat_id and bot token. The chat_id can refer to either a group chat or direct messages. First, we check if the bot has a webhook: 

https://api.telegram.org/bot<token>/getWebhookInfo

The presence of a webhook means a high chance of early detection of abuse.

If a webhook is present, we save its data and delete it using /deleteWebhook. 

NOTE! The webhook may have a secret token which could reveal the substitution. 

If there is no webhook, the likelihood of detection is very low.  

Next, you need to:  

Create a Telegram group  

Make yourself anonymous 

And only then add the bot to the group 

Here is how you can create a group using different clients: 

Then the group chat will open, if not – open it manually 

Next, we need to set the Administrators list and change your user settings:

In the opened window, toggle Remain anonymous and click Save. 

If everything is successful, the input field will display the placeholder “Send anonymously.” For Telegram Web, you may need to refresh the page. 

Now, let’s add the bot to the group: 

The bot username can be obtained by calling /getMe.

After adding the bot, the following message will be displayed: 

Next, it is necessary to call the /getUpdates method with the argument offset=-1. 

This will reset the bot’s update history to the most recent update. 

From the data received from the server (see the image above), we take the update_id and chat_id and save them. The chat_id is the ID of the group to which we added the bot. 

Next, we call /getUpdates again with the argument offset=update_id + 1. 

This will completely clear the bot’s update history. After this, if a webhook existed, we restore it using /setWebhook. 

Once the bot has been added, you can use several methods such as /forwardMessage, /copyMessage, /deleteMessage, /getChat, and /getChatAdministrators, which are among the most useful. 

You can experiment with these methods in interactive mode here: https://telegram-bot-api.vercel.app 

We enter the bot token in the token field. 

Next, we call /forwardMessage with the arguments: 

chat_id: the ID of the group chat 

from_chat_id: from the malware request 

message_id: the index of the message in the chat 

We enter the parameters in the corresponding fields (chat_id, from_chat_id, message_id) and click Execute.

As a result, we receive a response in JSON format containing information about the forwarded message. 

You can also do this directly in the browser: 

https://api.telegram.org/bot<token>/forwardMessage?chat_id=<your_chat_id>&from_chat_id=<malware_chat_id>&message_id=<message_id_from_malware>

For demonstration purposes, we will use another bot mentioned earlier. The actual request is: https://api.telegram.org/bot7023899363:AAFEzgbfWzhyE32Lf95TKSRYEYXMd4AfMyk/forwardMessage?chat_id=-1002455457772&from_chat_id=6354844663&message_id=49817 

The server returns data about the forwarded message, similar to the previous example. Here, we can see the message_id (in our group), the sender (from), the original chat (forward_origin, forward_from), and the date the original message was sent as a UNIX timestamp (forward_date). 

The result in the chat: 

How to Copy the Entire Chat 

If you want to copy a chat entirely, you need to understand how message_id works. 

This id is actually the index of the message. 

For private chats and each group (group/supergroup), the indices run in parallel. Message_id for private chats is shared across all chats with users. With each message received from an individual user or sent to an individual user, the message_id increments by one. 

Thus, the first message in a chat with one user might have a message_id of 4096, even though in the context of the chat it should have a message_id of 1. In groups, however, message_id works as expected, starting from 1. 

This can be visualized as follows: 

To determine the type of chat, you can use the /getChat method. 

If it is a group (group/supergroup), there shouldn’t be any significant issues 

If it is a private chat, there is a possibility that the bot has chats with multiple users, and some messages may not be accessible without the IDs of those users.

There is no simple way to retrieve all messages from a chat; some messages may not be accessible to the bot, but it will definitely have access to the messages it has sent.

In the malware request, we can see the message_id of the message from the malware, allowing us to estimate the number of messages. 

Next, we iterate through all messages from 1 to the required number. Telegram allows for a stable rate of 20 requests per minute with short bursts. 

To copy multiple messages at once, you can use /forwardMessages, which allows copying up to 100 messages in a single request. Thus, in one minute, you can stably copy 2000 messages or more if you utilize bursts. 

Using a Python script, we can copy the entire chat

We recommend saving the server responses, as they contain additional data useful for research: the date of the original message, its ID, and the ID of the original chat. 

For more detailed information on the Telegram Bot API, refer to the documentation.

Parsing Discord 

Replicating the same method with Discord is challenging due to the use of webhooks. 

A Discord webhook allows sending messages to a chat for which it was designated. Retrieving a message without knowing the message_id is difficult because Discord uses a snowflake ID, which includes the timestamp of the message and service information for identification. 

The only known message IDs for you will be those you managed to intercept. 

Among the methods that can be executed directly in the browser, there are only two: 

Retrieving webhook data: 

Retrieving a message: 

following sandbox session. 

We once again run it with the MITM Proxy enabled.

Next, we find a request to Discord.  

We copy the request URL. 

By inserting the URL into the browser’s address bar, we can obtain data about the webhook, including its name (name) and the channel it is associated with (channel_id) 

Now, let’s open the server response in the sandbox session. We’ll use the simplified view to find the message ID. 

More useful are the methods that require POST and PATCH requests. 

By sending a request to the previous URL, we can modify the message using PATCH. 

You can also edit the webhook. Similarly, instead of retrieving webhook data using GET, you can use PATCH. 

A POST request to the webhook URL will allow you to send a message. 

For more detailed information, refer to the webhook documentation.

Python Scripts for Parsing Telegram Chats

We have prepared demonstration scripts in Python to make it easier to replicate the techniques shown above. You can find these scripts in our GitHub repo.  

Script 1: prepare_bot.py 

This script allows you to obtain the chat ID of the group to which the bot will be added. The script will warn about the presence of a webhook and offer to delete it. If the bot already has unprocessed updates, the script will offer to delete them. 

After that, you only need to add the bot to the group. The script will restore the webhook if it existed and delete the update about being added to the group. 

As an example, we’ll use the following bot token: 

bot6562806943:AAGufR13-622BXIjHsbpmkQygiIJA1Vo–c 

Once we run the script , the chat ID will be displayed. 

If a webhook is present:

Script 2: forward_message.py 

The next useful script is forward_message.py, which allows forwarding messages from one chat to another. 

The bot must have access to messages from the first chat and must be able to send messages to the second chat. 

You can specify the range of messages to forward, the method for handling HTTP 429 (too many requests), and the frequency of requests. 

All request results will be saved in a separate directory, which can also be reassigned. 

The script writes the launch parameters to the console and the ID of the message it attempts to forward. 

Server responses will be saved in separate JSON files in a specified directory. 

Script 3: forward_messages.py 

The next script is forward_messages.py. Despite the similar name and settings, it has some differences from forward_message.py: 

It forwards up to 100 messages in a single request. 

You do not receive data about the messages. 

Here is how you can use forward_messages.py

Example: 

The script writes the launch parameters to the console, the range of messages it attempts to forward, and the number of messages that were successfully forwarded within that range. 

The server returns only an array containing the IDs of the messages forwarded using the /forwardMessages. 

Malware configs 

For more convenient data extraction, ANY.RUN lets you access malware’s configuration via the MalConf tab (see sandbox session). In this configuration, you can find the token. If there is info about requests in the process memory, their parameters are also displayed.

You can also explore ready-made links for API requests, which you can paste into your browser’s address bar.

The available links for Telegram are: 

Get info about the bot 

Get incoming updates 

Get webhook 

Delete webhook 

Drop incoming updates 

For Discord, malware typically uses webhooks. With a GET request, the only available action is to retrieve information about the webhook itself. 

See another session with an extracted malware config. 

In most cases, the malware retains data about the request and its result in memory, and you can obtain these details from the configuration.  

For Telegram, the most important data are chat_id and token. Thanks to ANY.RUN’s config extraction, you can see the text of the message sent by the malware. 

Malware that uses Discord is often written in Python or JavaScript.  

In most cases, they do not leave complete data about requests in memory. However, if such data remains, you will be able to see it in the MalConf tab. 

We can obtain the message ID, channel ID, sending date, URL for downloading attachments, and other useful information from the server response.

About ANY.RUN  

ANY.RUN helps more than 400,000 cybersecurity professionals worldwide. Our interactive sandbox simplifies malware analysis of threats that target both Windows and Linux systems. Our threat intelligence products, TI Lookup, Yara Search and Feeds, help you find IOCs or files to learn more about the threats and respond to incidents faster.  

With ANY.RUN you can: 

Detect malware in seconds

Interact with samples in real time

Save time and money on sandbox setup and maintenance

Record and study all aspects of malware behavior

Collaborate with your team 

Scale as you need

Request free trial →

Sandbox Sessions Used in Research

Telegram API

POST request to /sendDocument: https://app.any.run/tasks/93e29328-a39a-4769-94d7-44256e1c9cbb

GET request to /sendMessage: https://app.any.run/tasks/861482ae-8f96-41ff-918f-3a642c87db79/ 

Discord API

POST request to webhook URL: https://app.any.run/tasks/189ce54d-7b1a-4d6f-a3ab-c6ea88d1aa5b 

Configurations

Two telegram bots and one discord webhook in one sample: https://app.any.run/tasks/861482ae-8f96-41ff-918f-3a642c87db79?malconf=66e7c1acfec4983250763c78 

Discord webhook and server response: https://app.any.run/tasks/b86b6efc-093b-4418-ab4d-7385e1761bb8?malconf=true 

IOCs 

Statement of Account as of AUGUST 2024SOA.pdf.exe ()

MD5: ddbaaa52ea1192377573a76e4ac8fb7b

SHA256:  

svchost.exe / Builder.exe 

MD5: 6aba4665085cf92ad3d569a7b37f2b53 

SHA256: 7f158a2e68162d7e882dc389c8c4d8e4dcd1161272fd4ba5a2edd63e31385f69 

Builder.exe 

MD5: 3c168aa3065d0ff315220f060fbae7b3 

SHA256: e72325336065b6a088a43221a4e7da4e86e2c627c2b671c1b05a643dc19e9060 

svchost.exe  

MD5: 50dce71a753bad01a07904f2af283123 

SHA256: 8fb751033d1546ce28f5dcef171857ee879bdd31d76be2ae556f246c258473f3 

csrss.exe 

MD5: 0998890ccf8a3d8702db7a84fe6dd7b3 

SHA256: c33e1408ea96b9ea7a72d44d7742effb4a98776711b7c94c4997a155af61b220 

Stlr.exe 

MD5: 712e31bac690f0f557c37f324cfe541b 

SHA256: 5809167017915ccd66d1fff1c39da41ea43f0dcf0a6b8fd3e5938281a5d78ac4 

The post How to Intercept Data Exfiltrated by Malware via Telegram and Discord appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

The rise of online dating has created a fertile ground for manipulation and in today’s digital world, it’s easy to trust someone that you’ve never met in person, sharing personal details or intimate images before you truly understand who they are. In fact, our recent study reveals that 39% of people aged 25-34 have shared intimate images with someone they’ve never met in real life.

Unfortunately, this openness is often exploited. Whether it’s through intimate image abuse, stalkerware, or deepfakes, online daters are increasingly vulnerable to dangers that weren’t as common just a few years ago. With that in mind, here’s a breakdown of the top three threats to watch out for.

1. Private photos, public nightmares: the growing threat of image abuse

Intimate image abuse (IIA), or “revenge porn” is a harmful form of digital abuse. As sharing intimate images becomes more normalized, many feel secure when trusting partners or online matches with personal photos. In our “Naked Truth” survey of 9,000 people, nearly half reported experiencing or knowing someone who had been affected by Intimate Image Abuse. The issue is particularly severe among younger generations, with 69% of 16-24-year-olds admitting that they’ve been exposed to it. Despite the risks, victim-blaming remains common, with 50% of respondents believing that those who share intimate images are responsible if they’re leaked, reflecting a widespread misunderstanding of consent and privacy.

How to protect yourself:

Think twice before sharing: сonsider the potential consequences of sharing private images and gauge the level of trust with the recipient.
Stay informed: many social media platforms have systems in place to detect and remove non-consensual intimate images. Learn how to report such content.
Manage your passwords wisely: always use a reliable password manager, like Kaspersky Password Manager, to create and store strong, unique passwords for each account. Avoid reusing passwords across multiple platforms, as this can make you more vulnerable to breaches.

2. When your apps spy on you: the threat of stalkerware

Stalkerware is software that secretly tracks a person’s location, messages, and daily activities, often disguised as anti-theft or parental control tools but used for malicious purposes. In 2023, over 31,000 cases of stalkerware were identified globally, a 6% rise from the previous year. Countries most affected include Germany, France, and the UK. Many victims are unaware they’re being monitored due to the hidden nature of these apps. Beyond stalkerware, tools like GPS tracking and social media are also being misused, with 34% of people admitting to checking their date’s profiles as “due diligence.”

How to protect yourself:

Be vigilant: look for signs of stalkerware on your device, such as unusual battery drain, apps you don’t recognize, or sudden permission changes.
Avoid tampering with stalkerware: if you believe stalkerware is on your device, do not attempt to erase or disable it on your own. This could tip off the perpetrator or delete important evidence that could be used in legal action. Instead, contact a local support organization or consult the Coalition Against Stalkerware for expert help.
Update your privacy settings: regularly review app permissions and adjust privacy settings to minimize the risk of being monitored.

3. Deepfake threats: when what you see isn’t real

Deepfakes use artificial intelligence (AI) to create hyper-realistic fake images, videos and even audio recordings. Once dismissed as low-quality, easy-to-spot tricks, deepfakes have now evolved to become incredibly convincing. Open-source tools have made it easy for anyone with basic tech skills to create deepfakes, making this technology a growing concern in online relationships.

While celebrity deepfakes were the first to capture the public’s attention, ordinary individuals are now victims of this technology. In romantic contexts, deepfakes can be used to create fake compromising images or videos. These materials are then used for blackmail, with perpetrators threatening to release the content unless their demands are met.

How to protect yourself:

Know the warning signs: be cautious if someone makes threats involving compromising media. They could be using deepfake technology.
Report deepfakes: many platforms now use AI detection tools to flag and remove deepfake content. If you are targeted, report the content to the platform.
Stay informed: awareness is key. Educate yourself about deepfake technology and its potential misuse in online dating.

Building a Safer Digital Space: A Call for Education

Education is key to reducing online dating risks. Consent in the digital world must be ongoing, not a one-time agreement. 30% of men believe receiving an intimate image means they own it, highlighting a serious issue around digital privacy. Targeted education for boys and men is crucial to address intimate image abuse, stalking, and harassment. As technology reshapes relationships, we must stay informed and vigilant to protect against growing threats like image abuse, stalkerware, and deepfakes.

By understanding these risks and taking steps to protect ourselves, by Installing a comprehensive security solution such as Kaspersky Premium, you can help protect your devices from threats like stalkerware and other malware.

For more details, read our report and safe dating guide.

Kaspersky official blog – ​Read More

Overview

The Cybersecurity and Infrastructure Security Agency (CISA) has highlighted a vulnerability in Versa Networks’ Versa Director, a centralized management platform for Secure SD-WAN and SASE solutions. This vulnerability, identified as CVE-2024-45229, stems from improper input validation and affects various versions of the software. Organizations using vulnerable versions of Versa Director are urged to take immediate action to protect their network security.

Versa Director plays an important role in orchestrating and managing network and security policies across diverse locations. Its REST APIs facilitate automation and streamline operations through a unified interface, allowing IT teams to configure and monitor their network systems efficiently. However, the recent vulnerability exposes critical weaknesses that could compromise its effectiveness and, more importantly, the security of the organizations utilizing it.

The identified flaw involves improper input validation in certain APIs that do not require authentication by design. For Versa Directors connected directly to the Internet, attackers could potentially exploit this vulnerability by injecting invalid arguments into a GET request. This could expose authentication tokens of currently logged-in users, which can then be used to access additional APIs on port 9183. Importantly, this exploit does not reveal usernames or passwords, but the implications of token exposure could lead to broader security breaches.

Affected Versions and Severity Assessment

The vulnerability identified in Versa Director, tracked as CVE-2024-45229, highlights critical security risks that organizations must address promptly. This flaw arises from improper input validation in certain REST APIs, which are integral to the platform’s operation. As a centralized management solution for Secure SD-WAN and SASE, Versa Director plays a vital role in orchestrating and managing network and security policies across various locations. The implications of this vulnerability can impact the security and functionality of network operations for affected organizations.

The vulnerability affects multiple versions of Versa Director, specifically those released prior to September 9, 2024, including 22.1.4, 22.1.3, and 22.1.2, along with all versions of 22.1.1, 21.2.3, and 21.2.2. The CVSS score assigned to this vulnerability is 6.6, indicating a high severity level. The flaw primarily stems from certain APIs that, by design, do not require authentication. These include interfaces for logging in, displaying banners, and registering devices.

When Versa Directors are directly connected to the Internet, attackers can exploit this vulnerability by injecting invalid arguments into a GET request. This exploitation can lead to the unauthorized exposure of authentication tokens belonging to currently logged-in users. While this flaw does not compromise usernames or passwords, the exposure of these tokens can allow attackers to access additional APIs. Such unauthorized access could facilitate broader security breaches, potentially impacting sensitive data and operational integrity.

Conclusion

The vulnerability discovered in Versa Director represents a serious security risk, particularly for the instances exposed to the Internet. As the management platform plays a crucial role in network operations, organizations need to prioritize patching and security enhancements. The CISA advisory highlights the importance of being proactive in addressing vulnerabilities, as failure to do so could lead to severe consequences, including data breaches and operational disruptions.

Mitigation and Recommendations

Implement the latest patches provided by Versa Networks immediately.

Upgrade from version 22.1.1 to 22.1.3 and from 21.2.2 to 21.2.3 for comprehensive protection.

Critical systems are isolated through network segmentation to limit potential attack surfaces.

Using Web Application Firewalls (WAF) or API gateways to block access to vulnerable URLs.

Utilizing advanced Security Information and Event Management (SIEM) systems to detect unusual activities.

Regularly reviewing logs and alerts for real-time threat identification.

Uncover weaknesses in the network infrastructure.

Remediate vulnerabilities before malicious actors can exploit them.

The post Critical Vulnerability Discovered in Versa Director: What Organizations Need to Know appeared first on Cyble.

Blog – Cyble – ​Read More