InfoSecBulletin Cybersecurity for mankind
BDG e-GOV CIRT’s Cyber Threat Intelligence Unit has noticed a concerning increase in cyber-attacks against web applications and database servers in Bangladesh. Hackers are trying to deface government websites, steal important information, and disrupt online services through DDoS attacks. Organizations are advised to take precautions to protect themselves online.
CIRT identifies top threats and attack trends, including DoS/DDoS attacks, database and software vulnerabilities exploitation, SQL/NoSQL injection attacks, insecure direct object reference (IDOR) vulnerability exploitation, and breaches of compromised organizational databases from web and mobile applications.
Hackers Bypass Gmail MFA With App-Specific Password Reuse
Russia detects first SuperCard malware attacks via NFC
Income Property Investments exposes 170,000+ Individuals record
ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs
CISA Flags Active Exploits in Apple iOS and TP-Link Routers
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online
Canada 2nd largest airlines “WestJet” investigates cyberattack disrupting internal systems
Paraguay 7.4 Million Citizen Records Leaked on Dark Web
High-Severity Flaw in HashiCorp Nomad Allows Privilege Escalation
SoftBank: Over 137,000 personal info leaked
CIRT discovered root causes of attacks on web, mobile applications, and databases. Web and mobile applications face several security issues:
1. Secure coding practices are not followed.
2. Default parameters are used for configuration.
3. Lack of proper authorization and authentication in API development.
4. Absence of error handling capabilities.
5. Weak session management controls.
6. Insecure communication protocols.
7. Default configurations for applications and databases.
8. Negligence in software, OS, and database updates.
9. Insufficient logging and monitoring practices.
10. Weak control over administrative access roles.
11. Lack of website protection measures.
Databases:
1. Database software vulnerabilities being exploited.
2. Attackers exploit remote login to application and database servers, which is enabled for continuous maintenance by vendors, designers, and developers.
3. Threat actors using leaked or exposed administrative credentials.
4. Insufficient authorization, authentication, and user verification, including multifactor authentication (MFA) for administrative access roles.
5. Failure to monitor attack surface and implement continuous remediation strategies.
CIRT suggest some remediation Strategies:
To secure databases and applications:
– Use parameterized queries or ORM frameworks.
– Validate and sanitize user inputs regularly.
– Encode user inputs before displaying them.
– Implement Content Security Policy (CSP).
For database access management (DAM):
– Restrict database access to authorized users.
– Continuously monitor database activities.
For software maintenance:
– Patch software and plugins frequently.
For log monitoring (SIEM):
– Monitor logs for real-time threat detection.
– Detect anomalies and unusual activities.
For web application security:
– Use WAF to safeguard against web threats.
– Deploy anti-DDoS solutions.
Full report here.
