My information Resource (blog.mir.net)

The security features of modern PC hardware are enabling new trust
boundaries and attack resistance capabilities unparalleled in software
alone. These hardware capabilities help to improve resistance to a wide
range of attacks including physical attacks against DMA and disk
encryption, kernel and remote code exploits, and even application
isolation through virtualization.

In this talk, we will review the metamorphosis and fundamental
re-architecture of Windows to take advantage of emerging hardware
security capabilities. We will also examine in-depth the hardware
security features provided by vendors such as Intel, AMD, ARM and
others, and explain how Windows takes advantage of these features to
create new and powerful security boundaries and exploit mitigations.
Finally, we will discuss the new attack surface that hardware provides
and review exploit case studies, lessons learned, and mitigations for
attacks that target PC hardware and firmware.

Link to Video

Many recent cyberattacks have been confirmed in which malware infects a
host and in turn spreads to other hosts and internal servers, resulting
in the whole organization becoming compromised. In such cases, many
points need to be investigated. Accordingly, an approach for quickly and
thoroughly investigating such critical events, ascertaining the overall
picture of the damage as accurately as possible, and collecting facts
necessary for devising remedial measures is required.

While the configuration of the network that is targeted by an attack
varies depending on the organization, there are some common patterns in
the attack methods. First, an attacker that has infiltrated a network
collects information of the host it has infected using “ipconfig”,
“systeminfo”, and other tools installed on Windows by default. Then,
they examine information of other hosts connected to the network, domain
information, account information, and other information using “net” and
other tools. After choosing a host to infect next based on the examined
information, the attacker obtains the credential information of the
user using “mimikatz”, “pwdump”, or other password dump tools. Then, by
fully utilizing “net”, “at”, or other tools, the attacker infects other
hosts and collects confidential information.

For such conventional attack methods, limited set of tools are used in
many different incidents. The many points that need to be investigated
can be dealt with quickly and systematically by understanding typical
tools often used by such attackers, and what kind of and where evidence
is left.

For such use of tools, the Japan Computer Emergency Response Team
Coordination Center (JPCERT/CC) extracted tools used by many attackers
by investigating recently confirmed cases of targeted attacks. Then, a
research was conducted to investigate what kind of logs were left on the
server and clients by using such tools, and what settings need to be
configured to obtain logs that contain sufficient evidential
information. This report is a summary of the results of this research.
The details of traces (event logs and forensic architecture) generated
upon execution of the tools are compiled in “Tool Analysis Result Sheet”
and published on GitHub.

Tool Analysis Result Sheet
https://jpcertcc.github.io/ToolAnalysisResultSheet/

https://jpcertcc.github.io/ToolAnalysisResultSheet/

https://github.com/JPCERTCC/ToolAnalysisResultSheet

We hope this document is useful in incident investigation.
Article was copied from the Japan Computer Emergency Response Team Coordination Center

Earlier this week Cisco revealed a major vulnerability affecting devices configured with their WebVPN clientless VPN software. This VPN software is featured in the Secure Sockets Layer (SSL) of numerous Cisco hardware devices. Companies around the world use WebVPN so that their employees can connect to the corporate intranet from the outside. The successful exploitation of this vulnerability could have potentially devastating consequences for an organization.
When WebVPN functionality is enabled, devices are vulnerable to a flaw that allows hackers to “double-free” memory on the system. To accomplish this, an attacker submits custom crafted XML messages to the WebVPN interface of the target device. The messages instruct the system to free a specific memory address multiple times, which may lead to memory leakage, giving an attacker the power to write malicious commands to memory. With this power an attacker has the ability to execute arbitrary code, monitor traffic, and corrupt memory. This flaw can even be exploited for the purposes of a DDoS attack by forcing the system to continuously reboot itself.

Link: http://securityaffairs.co/wordpress/68424/security/cisco-asa-critical-flaw.html

Sources:
• https://arstechnica.com/information-technology/2018/01/cisco-drops-a-mega– vulnerability-alert-for-vpn-devices/
• http://searchsecurity.techtarget.com/news/252434117/Critical-Cisco-ASA– vulnerability-patched-against-remote-attacks

Source CIP report

This is a summary of a blog post on Microsoft site the full article can be found here.

Servicing extensions for Windows 10

• Office 2019 will ship in H2 of 2018. Previews of the new apps and servers will start shipping in the second quarter of 2018.
• Office 2019 apps will be supported on:
  • Any supported Windows 10 SAC release
  • Windows 10 Enterprise LTSC 2018
  • The next LTSC release of Windows Server
• The Office 2019 client apps will be
  released with Click-to-Run installation technology only. We will not
  provide MSI as a deployment methodology for Office 2019 clients. We will
  continue to provide MSI for Office Server products.

In honor of Data Privacy Day – an international effort held annually on Jan. 28 to generate awareness about the importance of respecting privacy, safeguarding data and enabling trust – the National Cyber Security Alliance (NCSA) hosted a daylong event streamed live from LinkedIn’s offices in San Francisco, CA, on Thursday, Jan. 25. The event showcased fast-paced, cutting-edge discussions and TED-style talks with leading experts focusing on what businesses and consumers must know about privacy.

The day’s discussions focused on the following privacy hot topics:

• Looking Into a Crystal Ball: What Your Data Says About You
• Five Things You Can Do to Manage Your Privacy Now
• What You Should Know About the Internet of Me and Your Privacy
• Tracking My Location – Business Uses and Consumer Choices
• Staying Competitive – Why Privacy Is Good for Your Business
• The Problem With Your Online Privacy
• Balancing Act: Privacy and Innovation
• What’s an Algorithm Got to Do With It?

Missed the event? Check out the full video here – and the full event recap, including photos, here. 

Tax Identity Theft Awareness Week is January 29 to February 2, and many
federal agencies are offering information and resources to help consumers learn
to protect themselves from tax-related identity theft and Internal Revenue
Service (IRS) imposter scams.

NCCIC/US-CERT
encourages consumers to review IRS publication Taxes.Security.Together.
and NCCIC/US-CERT Tip Preventing
and Responding to Identity Theft. Users can also participate in a series of
free
webinars and chats on avoiding tax identity theft, hosted by the Federal
Trade Commission, IRS, Department of Veterans Affairs, and others

Apple has released security updates to address vulnerabilities in multiple
products. An attacker could exploit some of these vulnerabilities to take
control of an affected system.

NCCIC/US-CERT encourages users and administrators to review Apple security pages
for the following products and apply the necessary updates:

• Safari
  11.0.3
• watchOS
  4.2.2
• iOS
  11.2.5
• macOS
  High Sierra 10.13.3, Security Update 2018-001 Sierra, and Security Update
  2018-001 El Capitan
• tvOS
  11.2.5

• Phase 1: Threat actor targets employee(s) via phishing campaign
• Phase 2: An employee opens the attack email which allows the threat
  actor access to load the malicious payload or compromise the user
  identity
• Phase 3: The workstation is compromised, threat actor persists malware, threat actor gathers credentials
• Phase 4: Threat actors use stolen credentials to move laterally and
  gain unsolicited access and compromise key infrastructure elements
• Phase 5: Threat actors exfiltrate PII and other sensitive business data

There is a great article on this topic here