The job of security professionals is to protect customers' assets and, even more, today, customers' data. The security landscape is full of solutions that help to improve security by detecting (and blocking) threats knocking on the organizations' doors. Sometimes, such solutions have side effects that go to the opposite direction and make customers more vulnerable to attacks.
Here is a perfect example of security control that could lead to a critical issue. I was looking for data in VT and launched a retro search based on a simple YARA rule (I was just looking for a simple string). As usual, a retro search generates a lot of noise but I always have a look at all files, just in case... I found several emails (EML files) that contained juicy information (translated, the mail was issued from a German company):
Hello Thomas, the mail (see below) unfortunately did not go through. I uploaded two files to the Owncloud because they were too big. These are stored in folder <redacted> OwnCloud access data:
Guess what? The next three lines of the body contained:
Note: the URL was valid but credentials were of course NOT tested (never try this!)
I found several emails from this company and EML files were submitted always from the same API ID and from Germany. This security control was probably implemented to submit automatically suspicious emails to VT.
When a customer asks me to have a look at their security posture, I always search for leaked data (from leaked databases, from VT, etc). And, most of the time, it works! It's so easy to find valid credentials to connect to an OWA, VPN, or services like, here, an ownCloud instance.
Based on the example above, some good old reminders:
Xavier Mertens (@xme)
Nov 18th 2020
|Thread locked Subscribe||
Nov 18th 2020
10 months ago