DriveByte Blog
In our blog, we report on the latest news from the field of IT security. Stay up to date and get exclusive information on how you can protect yourself from cyber attacks and keep your data safe.
Inteset Secure Lockdown Multi Application Edition - Vulnerabilities and Hardening Measures
During a security audit for a customer, Raphael Kuhn from DriveByte GmbH discovered several vulnerabilities within inteset Secure Lockdown Multi Application Edition. In this article he discloses the bugs as well as some hardening measures that can be taken to avoid them being exploited.
LiveConfig Advisory (CVE-2024-22851)
During a security audit for a LiveConfig customer, Raphael Kuhn from DriveByte GmbH discovered a so-called Unauthenticated Path Traversal vulnerability in LiveConfig up to version 2.5.1.
Simple yet effective. The story of some simple bugs that led to the complete compromise of a network
By spying on the process creation of a UCS connected server with extensive permissions, it was possible to gather a large amount of LDAP data. This data includes different credentials and other authentication information. The vendor responded extremely professional and fixed the issues very quickly. He did not only fix the script where we found the issue, but also checked their code base for similar problems and fixed them as well.
Iranian Cyber Attack on Israel
Life momentarily came to a halt in the Israeli cities of Jerusalem and Eilat as air raid sirens were triggered, despite there being no projectile in motion. The Israeli military announced that they suspect the false alarm to have been triggered by a cybersecurity attack at the municipal levels, not via military systems. Iran is suspected to have triggered the air raid sirens in Israel, a reminder of their growing cyber warfare capabilities.
Windows 11 and a Zero-Trust Core Part 1
The need for modern security principles and end-to-end protection is as important as never and therefore Windows 11 was built on a principle of Zero-Trust. The Zero-Trust model reminds of the Presumption of Guilt within Law: a defendant is guilty until proven innocent. In computers, this would mean that no device or user can have access until security and integrity is proven. Microsoft has also improved baselines by raising the requirements for both hardware and software to ensure a baseline protection from “chip to cloud”.
Ransomware: Definition, FAQs and Prevention
Ransomware, from the English "ransom software", is classified as aggressive malware that encrypts hard drives of PCs and other devices and locks out users until a ransom is paid. The classic consequences of a ransomware attack include downtimes and data theft.
SRH Target of Hacker Attack
Once again, the inferior and substandard security posture of German SMEs is punished! The educational and health conglomerate SRH has become a victim of a cyber-attack. National facilities are affected, including ones in Heidelberg and Neckargemünd.
Phishing: What it is and how you can prevent it
hishing represents a criminal conduct, a subcategory of Social Engineering. A Phishing attack targets unsuspecting employees or persons and urges them to share sensitive and personal information like usernames, passwords and credit card information via trustworthy looking emails that are sent to millions of users and which evade common spam filters.
Cyber Attacks on Parliamentarians: Government criticizes Russia
The upcoming German "Bundestagswahl" (parliamentarian Election) was shocked once more, for it has been the third time it was a victim of cyber-attacks. National intelligence and security agencies are reporting numerous foreign intelligence agency attacks on German parliamentarians. The German federal government is formulating concrete accusations against hacker groups with alleged ties to Russia which have been suspects of said cyber-attacks. Findings and insights have been uncovered that tie the Ghostwriter group and their activities to the Russian government and specifically the military intelligence agency GRU, so a speaker of the German State Department.