CVE-2019-5533

In VMware SD-WAN by VeloCloud versions 3.x prior to 3.3.0, the VeloCloud Orchestrator parameter authorization check mistakenly allows enterprise users to obtain information of Managed Service Provider accounts. Among the information is username, first and last name, phone numbers and e-mail addre...

Authorization

In VMware SD-WAN by VeloCloud versions 3.x prior to 3.3.0, the VeloCloud Orchestrator parameter authorization check mistakenly allows enterprise users to obtain information of Managed Service Provider accounts. Among the information is username, first and last name, phone numbers and e-mail addre...

How MSPs can become Managed Detection and Response (MDR) Providers

Managed detection and response MDR is one of the fastest-growing segments in the cybersecurity market. ESG research from April 2019 reveals that 27% of organizations are actively pursuing an MDR project, while another 11% plan to pursue an MDR project in the future. Cynet now enables service...

McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service - Crescendo

McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – Crescendo By Jessica Saavedra-Morales · October 20, 2019 Episode 4: Crescendo This is the final installment of the McAfee Advanced Threat Research ATR analysis of Sodinokibi and its connections to GandGrab, the most prolific...

A week in security (October 7 – 13)

Last week on Malwarebytes Labs, we peered into the possible future of cybersecurity insurance, described the process for securing today’s managed service provider, and provided an in-depth explainer on the business espionage tactic known as “war shipping.” Further, in considering the intersection...

Securing the managed service provider (MSP)

Managed service providers MSPs have been a boon to midsize enterprise. They allow for offloading technical debt to an agent with the skills and resources to manage it, thereby giving an organization room to focus on growing a business, rather than the particulars of infrastructure. For a long...

WebARX — A Defensive Core For Your Website

Estonian based web security startup WebARX, the company who is also behind open-source plugin vulnerability scanner WPBullet and soon-to-be-released bug bounty platform plugbounty.com, has a big vision for a safer web. It built a defensive core for websites which is embedded deep inside the...

The vulnerability of Azure Active Directory (AAD) for managing authentication and access to Windows operating systems allows a perpetrator to gain access to a user account.

The vulnerability of Azure Active Directory AAD for managing authentication and access control on Windows operating systems is related to errors in processing MSA Managed Service Accounts cookie files. Exploiting this vulnerability could allow a malicious actor to gain access to a user account...

New Session Added: CISA Awareness Briefing on Chinese Malicious Cyber Activity

The Cybersecurity and Infrastructure Security Agency CISA has added an additional session to the virtual awareness briefing on Chinese malicious cyber activity targeting managed service providers. The briefing will be held on Thursday, February 14, 2019, from 1-2 p.m. ET. The briefing will provid...

CISA Awareness Briefing on Chinese Malicious Cyber Activity

The Cybersecurity and Infrastructure Security Agency CISA will conduct a series of virtual awareness briefings on Chinese malicious cyber activity targeting managed service providers MSPs. Briefings will be held from 1–2 p.m. ET on the dates listed below: Wednesday, February 6 Friday, February 22...

China's APT10

Wired has an excellent article on China's APT10 hacking group. Specifically, on how they hacked managed service providers in order to get to their customers' networks. I am reminded of the NSA's "I Hunt Sysadmins" presentation, published by the Intercept. EDITED TO ADD 1/5: Another article on the...

US Indicts Two Chinese Government Hackers Over Global Hacking Campaign

The US Department of Justice on Thursday charged two Chinese hackers associated with the Chinese government for hacking numerous companies and government agencies in a dozen countries. The Chinese nationals, Zhu Huaknown online as Afwar, CVNX, Alayos and Godkiller and Zhang Shilong known online a...

Philips iSite and IntelliSpace PACS

1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION: Low skill level to exploit Vendor: Philips Equipment: iSite and IntelliSpace PACS Vulnerability: Weak Password Requirements 2. RISK EVALUATION Successful exploitation of this vulnerability may allow an attacker with local network access to impact...

September 28, 2017—KB4038801 (OS Build 14393.1737)

None None...

September 12, 2017—KB4038783 (OS Build 10586.1106)

None None...

Choose Your Own Infosec Adventure

I often reflect on how difficult choices in our industry can be. Do we invest more in prevention, detection or response? Do we automate or add more staff? Do we use a managed service or keep it in house? These represent some of the strategic decisions defenders are faced with on a yearly basis...

The Wrong Way to Pick a Security Vendor

For a number of years, we've worked with and supported our Managed Service Provider MSP partners at Trend Micro and I've seen and heard a lot in that time. Over time, we’ve noticed a few trends when it comes to MSPs choosing a security vendor to partner with, and in an effort to save you some...

Five Mistakes I Bet You Are Making with your Managed Services business

As a managed service provider, your customers have entrusted you to manage their IT infrastructure and their security so it’s important that you are making the right choices to secure their environments and keep cyber criminals at bay. In my years of working with our Managed Service Provider...

What to Consider When Choosing a Security Vendor

Picking a security vendor for your managed service business should be about business model alignment, not product cost. If you’re a seasoned managed service provider MSP, you are already very familiar with the benefits of the pay-as-you-go business model. In fact, it’s most likely how you sell yo...

Protecting Your Small Business From WannaCry

May 12, 2017 saw the world’s first ever worm-based ransomware attack, WannaCry. Typically ransomware spreads via email as spam and phishing attacks, and relies on human intervention to initiate the infection. However, WannaCry is different in that it combines ransomware with a recently published...