Memory corruption vulnerabilities are critical flaws in programs that occur when software improperly manipulates memory. These failures can allow a program to write data to unintended memory locations or access areas of memory that are out of range.
An attacker controlling this data could trigger unexpected behavior on the system, such as causing the program to crash or, in the worst case, gaining full control over the affected system.
In part, this is because initially computer systems were not designed with security in mind, so the memory addresses used by programs and operating systems were static and predictable. This meant that every time a program was run, memory locations, such as the stack, heap, and shared libraries, were always in the same direction.
This predictability made it easier for attackers to exploit memory vulnerabilities, such as buffer overflows and libc return-back attacks, as they could anticipate exactly where the data or code they wanted to manipulate to execute malicious code would be located. In this article, we will look at how the ASLR technique helps combat these vulnerabilities.
The ability to monitor and analyze the behavior of users and entities becomes crucial for early detection and response to potential threats. UEBA solutions identify unusual or anomalous patterns in user behavior, enabling rapid identification of internal threats or external compromises. This post focuses on how UEBA analysis is becoming an essential tool for a cybersecurity strategy, from identifying suspicious behavior to preventing potential security breaches.
In the complex web of network infrastructure, the Internet Routing Registry (IRR) stands out as an essential component, playing an important role in the coordination and security of routing policies. Its benefits are significant in building a cyberspace free of spoofing-type attacks. Knowing how to create and maintain objects in the IRR is essential for operators of Internet infrastructures. This article presents its fundamental elements and the tools that help in its life cycle
The UN R155 and UN R156 regulations are of vital importance for vehicle cybersecurity. From July 2022, all car manufacturers that want to be type-approved must comply with both regulations, but from July 2024 this requirement will be extended to all new vehicles sold in the European Union, regardless of when the manufacturer obtained type-approval. One of the most important aspects of compliance with both regulations is the completion of a cybersecurity risk assessment of the vehicle, including all integrated components of the vehicle's supply chain. On the other hand, it also specifies how to incorporate cybersecurity from design, how to detect and respond to incidents, how to securely update vehicle software, etc.
Babuk Tortilla is a version of the original Babuk ransomware, which emerged after the leak of its source code, and which attracted attention in the cybersecurity landscape due to the intention of being deployed on vulnerable servers.
This article reviews its origin and operation, focusing on its modus operandi and the techniques used to breach the security of data and systems. It also provides key tools and recommendations to identify and neutralize its effect on technological infrastructures, providing users with the necessary knowledge to defend against this significant risk. Understanding how Babuk Tortilla works and its recovery mechanisms is vital.
Since its appearance in 2022, Black Basta has established itself as one of the most dangerous ransomwares in the current landscape, standing out for its ability to carry out double extortion attacks, stealing and encrypting data from its victims. Although it focuses on Windows systems, versions for Linux systems that attack ESXi hypervisors have also been discovered. At the end of December 2023, a renowned ethical hacking lab in Berlin published a decryption tool on GitHub to combat it. Although the group has recently updated its software to fix this flaw, the release of the decryption tool represents a major blow against its operations. In this article, we take a closer look at how this ransomware works, exploring the methods it employs to compromise the integrity of data and systems and presenting the decryption method for its vulnerable version.
LockBit ransomware has rapidly evolved to become one of the most prolific threats of our time. Its technical sophistication, evidenced by the development of tools, such as StealBit, for automated data exfiltration and its adaptation to attack Linux servers, specifically ESXi, demonstrate the advanced adaptability and potential impact on affected organizations.
In addition, the implementation of a ransomware-as-a-service (RaaS) model and double extortion tactics underscore the complexity and coercive nature of their campaigns. The response to this threat, however, has culminated in a collaborative law enforcement effort that has succeeded in dismantling LockBit's infrastructure, leading to the arrest and indictment of several of its operators. In this article we focus on the version of LockBit 3.0, presenting its main features and the current tools for recovering data in case it has been compromised.
Within the framework of RPKI security infrastructures, ROAs are crucial components in the defense of cyberspace, providing authentication and verification mechanisms for routes vital to the security of Internet routing. Despite its undeniable benefits, creating and maintaining ROA has its own set of challenges and considerations. This article explores the relevance of ROAs, examines their inherent challenges, and underscores the importance of secure implementation and management to strengthen Internet resilience.
The changing dynamics of the work environment and the increasing reliance on cloud-based solutions have catapulted Secure Access Service Edge (SASE) systems into the spotlight in the cybersecurity world, offering the possibility of integrating network security and access management into a cloud-based solution, offering flexibility and protection.
This article delves into the architecture and philosophy behind SASE, explaining how it redefines security and access in cloud systems.
The Resource Public Key Infrastructure (RPKI) is essential for Internet routing security, as it provides a method to securely connect IP addresses to autonomous systems (AS) by validating route information.
RPKI effectively prevents BGP Hijacking-type attacks, where potential attackers maliciously redirect Internet traffic. This article aims to explore the design, implementation, and benefits of using RPKI to ensure security and authenticity in Internet routing.