01. List all listening TCP ports with “netstat -anp tcp” in administrator’s CMD.
02. Find PID associated with open ports requiring inbound connections.
03. Pipe tasklist to find to locate process owner’s name.
04. User wmic to locate full executable paths of all processes you would like to pass Windows firewall.
05. Go to Control Panel, All Control Panel Items and select Windows Firewall.
06. Select Allow an app or feature through WIndows Defender Firewall.
07. Select Allow another app.
08. Copy from command line process’ full path, paste and click Open.
09. Click Add to add the program. Repeat process for all other running processes that are blocked.
Some applications may dynamically assign ports to listen to for inbound connections, adding the program itself will prevent allowing static ports in while blocking all others used by the process.
A critical vulnerability discovered in FortiGate SSL VPN enables hackers to infiltrate vulnerable systems and inject malicious code, even when Multi-Factor Authentication (MFA) is activated.
Following Fortinet product versions are affected and firmware should be updated.
Affected Products FortiOS version 7.2.0 through 7.2.2 FortiOS version 7.0.0 through 7.0.8 FortiOS version 6.4.0 through 6.4.10 FortiOS version 6.2.0 through 6.2.11 FortiOS version 6.0.0 through 6.0.15 FortiOS version 5.6.0 through 5.6.14 FortiOS version 5.4.0 through 5.4.13 FortiOS version 5.2.0 through 5.2.15 FortiOS version 5.0.0 through 5.0.14 FortiOS-6K7K version 7.0.0 through 7.0.7 FortiOS-6K7K version 6.4.0 through 6.4.9 FortiOS-6K7K version 6.2.0 through 6.2.11 FortiOS-6K7K version 6.0.0 through 6.0.14 FortiProxy version 7.2.0 through 7.2.1 FortiProxy version 7.0.0 through 7.0.7 FortiProxy version 2.0.0 through 2.0.11 FortiProxy version 1.2.0 through 1.2.13 FortiProxy version 1.1.0 through 1.1.6 FortiProxy version 1.0.0 through 1.0.7
CVE-2023-27997 denotes a crucial heap buffer overflow vulnerability within Fortinet’s FortiOS SSL-VPN pre-authentication module.
Its exploitation permits an overflow of data from a designated memory block into adjacent blocks in the heap, enabling the execution of arbitrary code and facilitating malicious program activities.
SSL VPNs are typically relied upon for establishing secure connections to private organizational networks and the vulnerability could grant cybercriminals access to any networks and products assumed to be safeguarded.
This vulnerability exploit pre-authentication without privileged credentials allowing attackers to elude interception and escalate likelihood of successful data breach attempts.
Suggested response actions to mitigate the impact of CVE-2023-27997, is to upgrade to the Latest FortiOS Firmware Release and/or disable SSL-VPN on all impacted devices is it is not actively in use.
AnyDesk recently confirmed a cyberattack compromising their production systems, resulting in the theft of source code and private code signing keys. The remote access software, popular among enterprises and threat actors alike, serves 170,000 customers, including notable organizations like 7-Eleven and Samsung.
AnyDesk detected the attack on their servers and enlisted CrowdStrike’s help to respond. While details on data theft remain undisclosed, the company assured users of system safety. They revoked security certificates, replaced compromised systems, and advised users to update to the latest version with new code signing certificates.
Though AnyDesk denies token theft, they revoked web portal passwords and advised users to change them as a precaution. The company replaced stolen code signing certificates, evident in the new software version 8.0.8. The certificate transition ensures continued security for users.
Malicious Android apps on Google Play, disguised as games and trojans, amassed over two million installs. These apps hid their presence by replacing icons with Google Chrome or using transparent images. They generated revenue through intrusive ads.
Four adware (HiddenAds) apps disguised as games:
Super Skibydi Killer – 1,000,000 downloads
Agent Shooter – 500,000 downloads
Rainbow Stretch – 50,000 downloads
Rubber Punch 3D – 500,000 downloads
Additionally, some apps directed users to scams or online casinos. All mentioned apps have been removed, but users who installed them should delete and scan their devices. To avoid such apps, limit installations, read reviews, and verify publishers’ trustworthiness.
Some notable examples of those are:
Eternal Maze (Yana Pospyelova) – 50,000 downloads
Jungle Jewels (Vaibhav Wable) – 10,000 downloads
Stellar Secrets (Pepperstocks) – 10,000 downloads
Fire Fruits (Sandr Sevill) – 10,000 downloads
Cowboy’s Frontier (Precipice Game Studios) – 10,000 downloads
Enchanted Elixir (Acomadyi) – 10,000 downloads
Finally, the antivirus team spotted two Joker family apps on Google Play, which subscribe users to premium paid services:
Love Emoji Messenger (Korsinka Vimoipan) – 50,000 downloads
Current default message size limit on Office 365 is configured at 36MB. The guide from Microsoft on how to increase these limits still points to the old Exchange Admin Center.
Login with your admin credentials, select mailboxes.
Select the user mailbox to increase message size.
Click Mailflow setting and select Message size restriction.
Change the value to your required size in KB. (100MB = 102400KB)
To make changes for all mailboxes, select the checkbox besides Display name and follow the same steps listed above.
Add an additional layer of security to your existing setup by implementing USB FIDO2 compliant security key. Free up your IT resources from having to secure user-owned devices using Microsoft Authenticator app.
Some companies may not understand the implication when using older POP3 and IMAP mail system. Disgruntled employees may remove critical information in their email mailbox and nobody may be aware of it.
Comes Office 365 with it range of data from mailbox, Onedrive, Sharepoint sites and even Teams messages, your retention policy is applied to all users’ content and can be placed indefinitely on legislation hold, making such information available should the need arises.
Access to any mailbox can be simply be assigning access permission instead of copying/moving of email psts all over the place.
Losing your emails due to system failures and crashes will not be an issue as with Exchange email, all is required is just to setup your email account on another system and resync all mailbox to the new device with everything intact.
A large portion of email compromise is due to lack of multilayer authentication. A successful bruteforce attack will enable a hacker unrestricted access to your mailbox thereafter. MFA/2FA allows for an additional layer of security through code verification on an authenticator app on owner’s mobile device.
In traditional Cpanel hosting, 2-factor authentication is only available for webmail access but not within Outlook as there is no native support nor third party application for it yet.
The migration process may be tedious but we are able to provide you the full support required.
Microsoft is discontinuing support for SMS in specific sign-in scenarios. This includes sign-ins from new devices and those that need multi-factor authentication (MFA).
The reason behind this move is to step up security and minimize the chances of unauthorized access.
Typically, the concern arises because employees might not want to use their personal mobile devices to verify their access.
Customers have the option to establish a conditional access policy to reduce the frequency of MFA prompts when they’re in trusted locations. To do this, you’ll need at least one Azure AD P1 (Microsoft Enterprise ID P1), Office 365 E3 Plan, or Office 365 Business Premium subscription.
Another choice is to get a FIDO2 key or a FIDO2-compliant pass for each user. If you encounter any difficulties while setting up MFA using these methods, feel free to reach out to us for assistance.
The typical situation where an email password is compromised is from a successful phishing attempt – password was leaked to a fake Microsoft or Google site after clicking on a suspicious email and authenticating with credentials.
First picture shows a typical phishing email. Subsequent picture shows phisher's destination site when hovering mouse over the link.
The perpetrator will then authenticated and maintain a persistent session on web mail, stealthily monitor your email communications and then get information on the correspondence that you have.
This is particularly damaging if the email account is a business account. It does not matter if you are a trade creditor or trade debtor. Once these details are available to them, they can construct another email engineered to trick either you (posing as your supplier) or to your supplier (posing as you) and request a pending payment to be paid to another bank account due to some banking issues.
A misspelled domain (1 as l or vice versa) or a similar sounding domain will be registered and a fake email account created. It will be so similar to such an extend that other than the domain name, the sender’s name (even case sensitively similar), signature, message content and sentence construct will be exactly the same.
The victim will then be instructed to pay to the scammer’s bank account and may realize only when supplier start asking them for payment.
Some steps that IT administrators can take are:
Enforce Multi-factor authentication for email access using mobile OTP or authenticator apps.
Train users to identify phishing email through phishing simulator (Microsoft or third party) and conduct constant training for new and existing users.
Enforce modern authentication, password strength, complexity and set a password expiry period.
Force sign-out all sessions for each password change to prevent session using cached credential.
For users not accessing email externally, disable Outlook Web Access (webmail), insecure protocol, POP3 and IMAP access.
Monitor Azure AD sign-in logs for suspicious failed or successful sign-ins outside of your geographic location as it may indicate successful phish attempts. If necessary, force password reset and sign-out all sessions.
Tag external emails with warning message and educate users on why an email is tagged as external when it seems to be from someone within the organization and to be cautious of attachments/links within such emails. Explain to users that emails tagged as external are sent from external parties even though it may appears to be from someone within the organization. All such emails especially the later should be handled with caution.
Mobile OS’s default app store like Apple Playstore, Android’s Google Play or Huawei App Gallery published only approved apps that are checked for malicious or suspicious code and it is the safest way to install mobile apps.
Scammers utilizes ads to entice unknowing users to install malicious remote access/control tool through directly downloading to your device, disable security checks, installing and running it.
Enabling 3rd party APK installation permission on an app in android (e.g. Chrome) also risks allowing future drive-by installation of unknown apps that may be contains malicious code as it does not require intervention to download and install malicious program files.
Here are steps to check if any of your installed apps is allowing APK installation from unknown sources on your Android device. My device is a Huawei and it may varies slightly from your mobile brand.
1. Click Settings
2. Scroll through the list for Security option and click on it.
3. Look for More Settings. On some version, there may be an App option which can allow you to toggle and disable install permission directly on each of the installed apps in the list.
3. Click install apps from external sources
4. Scroll through your list of installed apps and look for any that has “Allowed” instead of “No”.
5. Toggle the button off (grey out) to disable it.
Stealing passwords and impersonation are some of their key agendas and with present day’s powerful smartphones, there are no telltale signs of your device being compromised.
To minimize malicious apps from capturing passwords using keylogger programs, you should enable biometric login to your important apps (e.g. bank, government, even SMS) if it is available. Also, turn off data and wifi access when your are charging at night. (reducing availability to unauthorized call home or remote access)
Consider getting a robust antivirus and security tool to protect and actively monitor for suspicious activities on your device.
Consider getting an antivirus program for your PCs and portable devices to monitoring and block any malicious activities.
Dr Web Security Space consist a suite of security tool to protect both your PC and your mobile device using on a single license.
Actively preventing is better than reacting only after suffering financial loss due to compromised account from malwares.
Contact us if you require assessment on business licensing for your environment.
