eSecurity Planet

FEBRUARY 26, 2024

The fix: System administrators are encouraged to install the Exchange Server 2019 Cumulative Update 14 (CU14), which was issued in February 2024 and enabled NTLM credentials Relay Protection. The problem: CVE-2024-22245 and CVE-2024-22250 put Windows domains vulnerable to authentication relay and session hijack attacks.

Risk 112

Risk Authentication System Administration Ransomware 112

Malwarebytes

JULY 29, 2021

The attack could force remote Windows systems to reveal password hashes that could then be easily cracked. Microsoft quickly sent out an advisory for system administrators to stop using the now deprecated Windows NT LAN Manager (NTLM) to thwart an attack. The authentication process does not require the plaintext password.

Authentication 134

Authentication Passwords Encryption System Administration 134

Security Boulevard

AUGUST 5, 2022

SSH authenticates the parties involved and allows them to exchange commands and output via multiple data manipulation techniques. As Justin Elingwood of DigitalOcean explains , SSH encrypts data exchanged between two parties using a client-server model. The most common means of authentication is via SSH asymmetric key pairs.

Encryption 59

Encryption Authentication System Administration Firewall 59

Security Boulevard

DECEMBER 2, 2022

Secure Shell uses encryption algorithms. In most organization system administrators can disable or change most or all SSH configurations; these settings and configurations can significantly increase or reduce SSH security risks. In May 2019 it was found that Cisco Nexus 9000 series has hardcoded root authorized key.

Risk 64

Risk Authentication Passwords Accountability 64

eSecurity Planet

MARCH 25, 2022

RDP intrusions are typically the result of two attacker methods: brute force authentication attempts or a meddler-in-the-middle (MITM) attack. Remote desktop software’s sensitive influence over other devices means identity and access management (IAM), password security , and multi-factor authentication are critical for risk management.

VPN 119

VPN Software Authentication Encryption 119

SecureList

AUGUST 12, 2021

The final payload is a remote administration tool that provides full control over the victim machine to its operators. Communication with the server can take place either over raw TCP sockets encrypted with RC4, or via HTTPS. The ransomware supports two encryption modes: one generated dynamically and one using a hardcoded key.

Ransomware 136

Ransomware Malware Banking Encryption 136

eSecurity Planet

DECEMBER 3, 2021

lazydocker : A simple terminal UI for both docker and docker-compose : [link] pic.twitter.com/HsK17rzg8m — Binni Shah (@binitamshah) July 1, 2019. Facebook Plans on Backdooring WhatsApp [link] — Schneier Blog (@schneierblog) August 1, 2019. — Jason Haddix (@Jhaddix) July 27, 2019. Brian Krebs | @briankrebs.

Accountability 139

Accountability Cybersecurity Penetration Testing InfoSec 139