Collective Defense

Join Joel Bork, Peter Rydzinski, and Brett Fitzpatrick in a technical breakdown of the Solarigate incident and the recommendations they have for organizations infected.

Joel Bork and Bill Swearingen jump into the latest cybersecurity news which includes the massive insider threat related Twitter Breach, the ongoing threat to Covid Research facilities, the Russian hacking activities, and the indictments the US just released in regards to two Chinese hackers who are hacking for their own personal gain AND for the nation state itself.

Bill Swearingen and Joel Bork jump into a controversial topic - Ransomware. Should you pay it? Should you not? Listen to this episode and you will understand how its not such a simple question to answer!

The Collective Defense Podcast team also goes into some of the newer attacks hitting the market - using significant amounts of off the shelf tools! We also found research showing that eBay is port scanning your device whenever you go to their webpage along with all of the necessary ransomware news - so don't wait - subscribe and dig in!

In this episode - Bill Swearingen and Joel Bork reveal information not just on the most recent ransomeware attacks and the issues surrounding yet another breach, but also talk about multiple pieces of Hidden Cobra malware (North Korean Government APT) that is targeting Financial Institutions - Cryptocurrencies exchanges in particular. In this episode details on how WannaCry was stopped three years ago and some insights into who the hero of the day actually was - Marcus Hutchins.

References:

https://www.us-cert.gov/northkorea

https://www.wired.com/story/confessions-marcus-hutchins-hacker-who-saved-the-internet/

Trish Dixon - VP of Cyber Operations at IronNet cybersecurity walks through the thoughts and tactics she used to secure her remote workforce when she was told to "Take everyone remote!" She shares resources on what your organization can do to better defend their home networks, and her #CollectiveCadence around how TTX's positively impacted her team. Reach out to Trish @ Linkedin.com/in/trishdixon

In this episode of the Collective Defense Podcast we are jumping into honeypots, honeynets, and how emerging threats can be proactively detected with Peter Rydzynski. On the new front we analyzed a number of stories including the most recent Marriott breach, zoombombs and WarDialz, and of course more insecure Wordpress plugins.

Software Mentioned in this episode:

SELKS

https://www.stamus-networks.com/scirius-open-source (https://www.stamus-networks.com/scirius-open-source)

Both live and installable Network Security Management ISO based on Debian

Complete Suricata IDS/IPS ecosystem with its own graphic rule manager

From start to analysis of IDS/IPS and NSM events in 30 sec

Major components:

Suricata

Elasticsearch

Logstash

Kibana

Moloch

Scirius Community Edition

EveBox

Cowrie

https://github.com/cowrie/cowrie (https://github.com/cowrie/cowrie)

Cowrie is a medium to high interaction SSH and Telnet honeypot designed to log brute force attacks and the shell interaction performed by the attacker. In medium interaction mode (shell) it emulates a UNIX system in Python, in high interaction mode (proxy) it functions as an SSH and telnet proxy to observe attacker behavior to another system.

Cowrie is maintained by Michel Oosterhof.

Dionaea

https://github.com/DinoTools/dionaea (https://github.com/DinoTools/dionaea)

This low-interaction honeypot written in C and Python uses the Libemu library to emulate the execution of Intel x86 instructions and detect shellcodes.

In addition, we can say it’s a multi-protocol honeypot that offers support for protocols such as FTP, HTTP, Memcache, MSSQL, MySQL, SMB, TFTP, etc.

Protocols

blackhole

epmap

ftp

http

memcache

mirror

mqtt

mssql

mysql

pptp

sip

smb

tftp

upnp

Logging

fail2ban

hpfeeds

log_json

log_sqlit

Netcat

http://netcat.sourceforge.net/ (http://netcat.sourceforge.net/)

Netcat is a featured networking utility which reads and writes data across network connections, using the TCP/IP protocol.

It is designed to be a reliable "back-end" tool that can be used directly or easily driven by other programs and scripts. At the same time, it is a feature-rich network debugging and exploration tool, since it can create almost any kind of connection you would need and has several interesting built-in capabilities.

It provides access to the following main features:

Outbound and inbound connections, TCP or UDP, to or from any ports.

Featured tunneling mode which allows also special tunneling such as UDP to TCP, with the possibility of specifying all network parameters (source port/interface, listening port/interface, and the remote host allowed to connect to the tunnel.

Built-in port-scanning capabilities, with randomizer.

Advanced usage options, such as buffered send-mode (one line every N seconds), and hexdump (to stderr or to a specified file) of trasmitted and received data.

Optional RFC854 telnet codes parser and responder.

Modern Honey Network

https://github.com/pwnlandia/mhn (https://github.com/pwnlandia/mhn)

MHN is a centralized server for management and data collection of honeypots. MHN allows you to deploy sensors quickly and to collect data immediately, viewable from a neat web interface. Honeypot deploy scripts include several common honeypot technologies, including Snort, Cowrie, Dionaea, and glastopf, among others.

Features

MHN is a Flask application that exposes an HTTP API that honeypots can use to:

Download a deploy script

Connect and register

Download snort rules

Send intrusion detection logs

It also allows system administrators to:

View a list of new attacks

Manage snort rules: enable, disable, download

Today we are jumping into the state of cybersecurity in the healthcare industry during the COVID-19 outbreak with Co-Hosts Joel Bork, and Bill Swearingen.

John Ford is the guest on this podcast, and he is a world renowned CISO in the healthcare industry and shares his valuable insights and knowledge of the inner workings of the healthcare industry as this pandemic evolves.