Tag Archives: detection

No Boot – No Hacker!

Leave a reply

No Boot – No Hacker! Updated track. It seems that the case with the CrowdStrike BSODStrike incident is coming to a logical conclusion. Why this happened is already more or less clear. All that remains is long legal battles between clients and the vendor. Therefore, I am closing this topic for myself with an updated track made in Suno. It’s in Russian, but subtitles are available on YouTube.

My position is that BSODStrike was not the problems of a specific company, but rather the problems of cloud CyberSecurity services with agents, whose architecture is vulnerable. Such services literally force customers to overtrust them. 🤷‍♂️ I don’t think it’s right to keep silent about this. We need to call for improving the security, transparency and controllability of such services.

It should be understood that this was just a small and relatively harmless failure, but someday we will see a case with a full-scale attack through a hacked cloud vendor. And, as it seems to me, at the moment, on-premise solutions have their advantages.

На русском

Can a Vulnerability Scan break servers and services?

2 Replies

Can a Vulnerability Scan break servers and services? The most serious problem of Vulnerability Scanners is that they are too complex and unpredictable. Usually they don’t affect the target hosts, but when they do, welcome to hell! And if you scan huge infrastructure, tens thousands hosts and more, it’s not “if” the scanner will break the server it’s “when” it will do it.

As a responsible person for Vulnerability Management you will be also responsible for all the troubles that VM product can make in the IT infrastructure. And what will you say to the angry mob of your colleagues from IT and Business when they will be quite curious to know why did the service/server go down after the scan? Actually, it’s not much to say.

Continue reading →

Guinea Pig and Vulnerability Management products

12 Replies

Guinea Pig and Vulnerability Management products. IMHO, security vendors use the term “Vulnerability Management” extremely inaccurate. Like a guinea pig, which is not a pig and is not related to Guinea, the current Vulnerability Management products are not about the actual (practically exploitable) vulnerabilities and not really about the management.

Guinea Pig and Vulnerability Management

Vulnerability should mean something solid and reliable, something that can be practically used by a malicious attacker or penetration tester.

When (so-called) Vulnerability Management vendors start working with indirect information from third-party about potential vulnerabilities in the software, that were possibly exploited by someone in some unknown conditions, or simply distance from responsibility: “we just provide information from the software vendor; software vendor knows better about the vulnerabilities in his own products”, it’s all falling into to the area of fortune telling and counting angels on the head of a pin.

Hardcore process of identifying weaknesses that real-life attackers can use moves to a boring compliance. For example, as PCI DSS requires, there should be no vulnerabilities above medium level (CVSS Base score > 4). At the same time, no one cares how fair this assessment of criticality is or how real these vulnerabilities are. All the analytics build on such formal data loses its sharpness and practical value.

Continue reading →