Sean Kalinich

Black Hat 2023 – Las Vegas, NV – One of my personal focuses is understanding the “Why” behind changes in the threat landscape. In simple terms understanding the Why of something gives you a good understanding of potential pivots and changes. After all a personal Why is what motivates and moves you, it stands to reason that identifying the Why behind threat groups gives you an insight into their motivations and drivers (besides money). With this in mind I sat down with Don Smith, VP of Threat Intelligence, Counter Threat Unit. The same team that identified the abandoned reply URL flaw in Power Platform.

Microsoft has not been having the greatest of months. First it was identified that a stollen MSA signing key was used by a Nation State to access personal and low-side US government tenants (Low-Side it the unclassified side of Government Cloud Computing). This disclosure seems to have focused all of the attention on Microsoft as more and more security researchers are diving into their cloud services. That being said, there are and have always been researchers that keep Microsoft on their Radar, just because there is always something going on there. That is the case of the latest news to hit the street about Entra ID (formerly Azure AD).

Black Hat 2023, Las Vegas – At Black Hat one of my favorite things to do is see what the latest buzzword(s)/phrases are. One of my favorites from this year was “code to cloud” while others focused on the big shiny object that is AI. Fortunately for me, I usually am afforded a chance to talk with amazing technical resources to allow me to continue my mission to cut through the marketing and get to the meat of the technology or issue. This brings me to my conversation with Denis Mandich, co-founder, and CTO of Qrypt, a quantum security company that has an interesting improvement on current methods to generate and provide access to true quantum random numbers (QRN).

Black Hat 2023 Las Vegas – One of the areas I wanted to focus on this year while at both Black Hat and Def Con was to get an understanding of the threat landscape from both an industry and attacker perspective. My conversations (I don’t really do interviews) all included parts that related to the general attack landscape. So, it only made sense that one of my conversations needed to be with ZeroFox For those of you that might not be aware, ZeroFox throws a great Black Hat party… no wait. ZeroFox is an external attack surface management company. If you only think of them in terms of social media intelligence, then you probably need to revisit them.

It used to be a common phrase that the only certain things are Death and Taxes. These days it seems the list has been extended to Death, Taxes, and 0-days in enterprise tools sets. We have seen a number of zero days being abused since the beginning of 2023 such as Barracuda spam filters, MoveIT MFT, Citrix File share MFT, and (the subject of today’s article) Ivanti’s Sentry (the service formerly known as MobileIron). The uptick in exploitation of 0-days is very concerning just on their own, but when looked at as part of a larger effort, it is borderline frightening.

Black Hat 2023 – Las Vegas. Sitting in one of my favorite bars in the Mandalay Bay Shoppes, 1923 Prohibition Bar, I had an opportunity to sit down and talk with Stuart McClure. For those that do not know, I worked at Cylance while Stuart was CEO there and left shortly after Blackberry purchased the company. We spent a few moments talking about the Cylance days and how the concept of Cylance impacted the cybersecurity industry. It was one of those times when the right concept was introduced at the right inflection point and combined with the right team to get it into the hands of the public. From there we moved on to Stuart’s latest endeavor, Qwiet AI.

Wednesday, 16 August 2023 14:38

Hacker Summer Camp 2023 Recap and My Thoughts

Las Vegas – So Black Hat 2023 and Def Con 31 have come and gone, and while the exhaustion that comes from this epic combined event might not be completely gone, I am ready to give my thoughts on the events. Before I get started, understand that this is my personal opinion on the show(s) as well as my general takeaways from them. As always, your milage may vary. Either way, I hope that you enjoy the article below and that your time and camp this year was amazing (mine was). So, let’s get started!

As we head into Hacker Summer Camp in Las Vegas, the emails are already flowing freely into my inbox. Some of them are the regular players that I see every year and others are new. Still more are people that I hear from each year but with new faces to talk to. This is part of what I love about going out to Black Hat, talking new people, talking to well known people in the industry and then getting an understanding of what everyone thinks is the “big thing” for cybersecurity. This year, by far, it is AI and automation.

Hey, remember that supply chain attack on NPM that happened recently? Which one? Yeah, that is sort of the problem with recent supply chain attacks. In particular the ones that are targeting the development pipeline. This is because they are starting to happen so often that they all blur together, yet NPM and other critical components of the development supply chain are still targets for attackers to either get their malicious packages onto development systems, or in the final compiled binary that is then sent out to the general public. To call this problematic is to describe a nuclear bomb as a big firecracker. Ok, soapbox on the importance of SDLC (Software Development Lifecycle) hygiene and security put away for now.

If you look at common attack vectors and especially Initial Access Broker attacks, there are a few parts of the attack chain which stand out. These are the pivot through some form of communication/collaboration app to the phishing landing page. These apps are also often part of insider threats where someone might use their own personal email, OneDrive, or other web/app-based app to exfiltrate information they want outside of an organization. Many companies are very exposed to this either through a lack of tools, skilled staff or being oblivious to the exposure.

Page 2 of 224