InfoSecBulletin Cybersecurity for mankind
BDG e-GOV CIRT’s Cyber Threat Intelligence Unit has noticed a concerning increase in cyber-attacks against web applications and database servers in Bangladesh. Hackers are trying to deface government websites, steal important information, and disrupt online services through DDoS attacks. Organizations are advised to take precautions to protect themselves online.
CIRT identifies top threats and attack trends, including DoS/DDoS attacks, database and software vulnerabilities exploitation, SQL/NoSQL injection attacks, insecure direct object reference (IDOR) vulnerability exploitation, and breaches of compromised organizational databases from web and mobile applications.
Delay patching leaves about 50,000 Fortinet firewalls to zero-day attack
Daily Security Update Dated: 21.01.2025
126 Linux kernel Vulns Allow Attackers Exploit 78 Linux Sub-Systems
CERT-UA alerts about “security audit” requests through AnyDesk
Oracle Critical Pre-Release update addressed 320 flaw
OWASP Reveils Top 10 Smart Contract Vulnerabilities for 2025
Multiple Azure DevOps Vulns Allow To Inject CRLF Queries & Rebind DNS
Intel holds 22 employees from one Bangladeshi University
VPN Surge 1500% in USA after TikTok Shut Down
MITRE Launches D3FEND 1.0; The Milestone for Cybersecurity Ontology
CIRT discovered root causes of attacks on web, mobile applications, and databases. Web and mobile applications face several security issues:
1. Secure coding practices are not followed.
2. Default parameters are used for configuration.
3. Lack of proper authorization and authentication in API development.
4. Absence of error handling capabilities.
5. Weak session management controls.
6. Insecure communication protocols.
7. Default configurations for applications and databases.
8. Negligence in software, OS, and database updates.
9. Insufficient logging and monitoring practices.
10. Weak control over administrative access roles.
11. Lack of website protection measures.
Databases:
1. Database software vulnerabilities being exploited.
2. Attackers exploit remote login to application and database servers, which is enabled for continuous maintenance by vendors, designers, and developers.
3. Threat actors using leaked or exposed administrative credentials.
4. Insufficient authorization, authentication, and user verification, including multifactor authentication (MFA) for administrative access roles.
5. Failure to monitor attack surface and implement continuous remediation strategies.
CIRT suggest some remediation Strategies:
To secure databases and applications:
– Use parameterized queries or ORM frameworks.
– Validate and sanitize user inputs regularly.
– Encode user inputs before displaying them.
– Implement Content Security Policy (CSP).
For database access management (DAM):
– Restrict database access to authorized users.
– Continuously monitor database activities.
For software maintenance:
– Patch software and plugins frequently.
For log monitoring (SIEM):
– Monitor logs for real-time threat detection.
– Detect anomalies and unusual activities.
For web application security:
– Use WAF to safeguard against web threats.
– Deploy anti-DDoS solutions.
Full report here.
