This is a story of network segmentation and the impact that seemingly trivial misconfigurations can have for your organization. This is one of those occasions.
This particular pen test asked for goals-based assessment focusing on post-compromise activities — an attempt by the client to discover how vulnerable internal systems were to lateral movement by an attacker who had compromised the domain. Among the goals was a request to attempt to compromise the client’s Amazon Web Services (AWS) infrastructure and a secondary request to access and exploit any systems discovered to contain sensitive or critical operational data .
Read more…
Source: Rapid7
Related:
- How America’s Cargo Ports Defend Against Cyberthreats
July 13, 2022
America’s ports move approximately $5.4 trillion in goods annually, making them a unique target for cybercriminals. Protecting these transportation hubs is essential to preserving the supply chain and keeping the U.S. economy running. More than 500 cyberattacks occurred in the marine industry in 2020, according to the U.S. Coast Guard. These exploits are aimed at both ...
- Defense contractor pays $9m to settle whistleblower’s cybersecurity allegations
July 11, 2022
Aerojet Rocketdyne, which makes propulsion and power systems for launch vehicles, missiles and satellites for NASA and the US military, has agreed to pay $9 million to settle charges it misrepresented its products’ compliance with cybersecurity requirements in federal government contracts. The El Segundo, California-based company has a deep history in American space and military contracting, ...
- How Shady Code Commits Compromise the Security of the Open-Source Ecosystem
July 11, 2022
Traditionally, concerns over open-source code security have revolved around whether or not open-source code could contain vulnerabilities, backdoors, or hidden malicious code. In recent months, however, Trend Micro researchers have observed a growth in a particular trend: Open-source code is being subjected to modifications to its functionality to express political protest. These instances of so-called ...
- Private 5G Network Security Expectations Part 3
July 11, 2022
Trend Micro conducted a survey on private wireless network security in collaboration with 451 Research, part of S&P Global Market Intelligence, in four countries (Germany, the U.K, Spain, and the U.S.) across the manufacturing, electricity, oil and gas, and healthcare industries. Trend Micro have introduced this survey’s findings on the expectations for private 5G security ...
- To stop quantum hackers, the US just chose these four quantum-resistant encryption algorithms
July 6, 2022
The U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) has selected four quantum-resistant cryptographic algorithms for general encryption and digital signatures. NIST, a US standards setting body and research organization within the Department of Commerce, announced the four algorithms after a six-year period assessing potential quantum-resistant (QR) alternatives to today’s cryptographic algorithms for ...
- Apple introduces Lockdown Mode to protect iPhones from state-sponsored hacking
July 6, 2022
Apple announced a new feature for iPhones called Lockdown Mode on Wednesday to protect high-profile users such as politicians and activists against state-sponsored hackers. Lockdown Mode turns off several features on the iPhone in order to make it less vulnerable to spyware by significantly reducing the number of features that attackers can access and potentially hack. Specifically, ...