• During a House committee hearing on Wednesday, FBI Director Christopher Wray revealed that hackers associated with the Chinese government are strategically poised to launch cyberattacks on vital infrastructure entities within the United States.
• In the same briefing, the FBI and the Department of Justice announced the successful court-sanctioned disruption of a botnet associated with last year’s Volt Typhoon cyber campaign, a detail highlighted in Director Christopher Wray’s testimony. This botnet, known as the KV Botnet, had infected hundreds of small office and home office routers across the United States. The hackers intended to use these compromised routers as a springboard to launch targeted attacks on critical infrastructure provide

Threat is imminent

The recent public briefing by FBI Director Christopher Wray, detailing the cybersecurity threats posed by China, marks a significant departure from the usual narrative and underscores the seriousness of the situation. Traditionally, cybersecurity experts and professionals have shared anecdotal evidence of encounters with Chinese Advanced Persistent Threat (APT) groups, often framing these encounters as battles from which they emerged victorious. However, the detailed disclosure by the FBI Director takes this narrative a step further, highlighting not just the potential but the imminent nature of these threats.

Director Wray’s choice of words, particularly the phrase “when they are ready,” suggests a deliberate intention to convey the inevitability of an attack, rather than its mere possibility. This shift in messaging is critical in understanding the level of preparedness and intent of the Chinese entities involved. The reference to “critical infrastructure” encompasses a broad spectrum of essential services and systems, including financial services, power grids, healthcare systems, public transportation, and supply chains for essential goods such as fuel and food. This wide-ranging definition recalls recent cyber incidents, such as the Colonial Pipeline and JBS meat attacks, which at the time may have seemed like isolated events but, in hindsight, appear to be part of a larger pattern of reconnaissance and preparation.

Director Wray’s briefing can thus be seen as an update on the culmination of years of observation, planning, and potential practice runs by these threat actors, now backed and possibly orchestrated by the Chinese government. The explicit acknowledgment of these threats at such a high level of government communication serves as a clarion call to the cybersecurity community and the nation as a whole, emphasizing the need for heightened vigilance and preparedness against what is being framed not as a possibility, but as an impending certainty.

The Focus On Home and Small Office Routers — A Chilling Reality

The FBI’s emphasis on the widespread nature of attacks on home routers and devices, especially as launchpads for targeting government and corporate networks, underscores a concern many raised during the peak of COVID-19: the unprecedented shift to remote work. With a significant portion of the workforce, including government and private sector employees, accessing company networks from home, often via VPNs, the security vulnerabilities inherent in home networks have come into sharp focus. Unlike the fortified defenses of corporate networks, equipped with advanced firewalls, intrusion detection systems (IDS), and dedicated cybersecurity teams, home networks are comparatively easier targets for cybercriminals.

This vulnerability has not only highlighted the adaptability of cyber attackers, who have increasingly turned their attention to softer targets at the home front, but it also reflects a strategic pivot. Particularly, there’s been a noticeable shift in focus by some state-sponsored actors towards exploiting these home-based vulnerabilities, recognizing the potential for significant breaches through less guarded entry points.

This evolution in cyber threat tactics is both enlightening and concerning. It signals a critical juncture for leaders within the cybersecurity community to amplify our efforts in raising awareness and educating not just organizations but also individuals about the importance of securing home networks. As remote work continues to be a significant aspect of our professional lives, the collective responsibility to fortify these new perimeters against cyber threats has never been more paramount.

The FBI’s emphasis on the widespread nature of attacks on home routers and devices, especially as launchpads for targeting government and corporate networks, underscores a concern many raised during the peak of COVID-19: the unprecedented shift to remote work. With a significant portion of the workforce, including government and private sector employees, accessing company networks from home, often via VPNs, the security vulnerabilities inherent in home networks have come into sharp focus. Unlike the fortified defenses of corporate networks, equipped with advanced firewalls, intrusion detection systems (IDS), and dedicated cybersecurity teams, home networks are comparatively easier targets for cybercriminals.

This vulnerability has not only highlighted the adaptability of cyber attackers, who have increasingly turned their attention to softer targets at the home front, but it also reflects a strategic pivot. Particularly, there’s been a noticeable shift in focus by some state-sponsored actors towards exploiting these home-based vulnerabilities, recognizing the potential for significant breaches through less guarded entry points.

This evolution in cyber threat tactics is both enlightening and concerning. It signals a critical juncture for leaders within the cybersecurity community to amplify our efforts in raising awareness and educating not just organizations but also individuals about the importance of securing home networks. As remote work continues to be a significant aspect of our professional lives, the collective responsibility to fortify these new perimeters against cyber threats has never been more paramount. If the FBI is right it seems the Chinese government has taken advantage of these events and positioned themselves perfectly to take advantage of it. We should all stay tuned.

*CIA* - Confidentiality, Integrity, Availability

*IDS* - Intrusion Detection System

*IPS* - Intrusion Prevention System

*WAF* - Web Application Firewall

*PII* - Personal Identifiable Information

*DoS* - Denial of Service

*DDoS* - Distributed Denial of Service

*DNS* - Domain Name System

*ZTA* - Zero Trust Architecture

*NAT* - Network Address Translation

*CTF* - Capture the Flag

*ACL* - Access Control List

*CDN* - Content Delivery Network

*CVE* - Common Vulnerabilities and Exposures

*RAT* - Remote Access Trojan

*APT* - Advanced Persistent Threat

*ATP* - Advanced Threat Protection

*SSO* - Single Sign-on

*URL* - Uniform Resource Locator

*TLS* - Transport Layer Security

*ARP* - Address Resolution Protocol

*RDP* - Remote Desktop Protocol

*FTP* - File Transfer Protocol

*SFTP* - Secure File Transfer Protocol

*HTTP* - Hypertext Transfer Protocol

*HTTPS* - Hypertext Transfer Protocol Secure

*LDAP* - Lightweight Directory Access Protocol

*MFA* - Multi-factor Authentication

*IAM* - Identity and Access Management

*SIEM* - Security Information and Event Management

*SAM* - Security Account Manager

*MDM* - Mobile Device Management

*XXS* - Cross Site Scripting

*XSRF* - Cross Site Request Forgery

*DRaaS* - Disaster Recovery as a Service

*DLP* - Data Loss Prevention

*TCP* - Transmission Control Protocol

*SNMP* - Simple Network Management Protocol

*L2TP* - Layer 2 Tunneling Protocol

*SOC* - Security Operations Center

*EDR* - Endpoint Detection and Response

*MDR* - Managed Detection and Response

*KMS* - Key Management Service

*TOR* - The Onion Router

*UEBA* - User and Entity Behavior Analytics

*UEFI* - Unified Extensible Firmware Interface

*RFI* - Remote File Inclusion

*SSID* - Service Set Identifier

*LAN* - Local Area Network

*WAN* - Wide Area Network

*VLAN* - Virtual Local Area Network

*PGP* - Pretty Good Privacy

*MiTM* - Man in the Middle Attack

*CA* - Certificate Authority

*MAC* - Mandatory Access Control

*PUA* - Potential Unwanted Application

*ECDH* - Elliptic Curve Deffie-Hellman

*BYOD* - Bring Your Own Device

*GDPR* - General Data Protection Regulation

*ADFS* - Active Directory Federation Service

*EPP* - Endpoint Protection Platform

*DMARC* - Domain Based Message Authentication, Reporting and Conformance

*UAC* - User Account Control

*CLI* - Command Line Interface

By 2025, the global cost of cybercrime is expected to reach $10.5 trillion, an annual rise of 15%, and Gartner forecasts, that 45% of global organizations will grapple with supply chain attacks within the next two years. Add the ongoing global skills shortage, supply chain vulnerabilities, and geopolitical challenges, and you’d be forgiven for feeling concerned about the scale of the task.

To help prepare for this new era, we’ve identified five key cybersecurity trends we believe will take precedence in the year ahead:

• Zero trust goes mainstream

Zero trust is the gold standard of cybersecurity architecture which emphasizes a shift from traditional perimeter-based security to a model where trust is never assumed, even within the network.

Governments and many companies have already made zero trust strategies mandatory, reflecting the framework’s critical role in combating evolving cyber threats. As attacks increase and grow in sophistication, Zero trust must become more than the gold standard, it must become standard practice. It is, quite simply, the most effective strategy we have, and we expect more widespread adoption in 2024. Learn more about zero trust here.

• Generative AI transforms capabilities

Generative AI is expanding capabilities for both attackers and defenders with myriad applications. If we look at the glass as half full, stretched security teams will feel more supported and empowered than they have in recent years, and we expect organizations in 2024 to explore their transformative impact for compliance, data analysis, and accelerated means of defending against the evolving nature of cyber threats.

At the same time, questions surrounding the ethical use and security of generative AI will be at the forefront of cybersecurity discussions, and the rise of sophisticated AI-driven phishing attacks will be a major concern. There are many unknown unknowns, but there are also many unknown possibilities. Either way, organizations should be exploring generative AI’s security capabilities before threat actors control the playing field.

• Compliance builds transparency and spurs investment

The growth in compliance standards, spearheaded by regulations like the EU Cyber Resilience Act and the Digital Operational Resilience Act (DORA), emerges as a third significant trend. Compliance makes investment in security necessary, with no excuses. With new rules, such as the SEC disclosure requirements in the US coming in last year, companies will have to be far more transparent on company breaches when they occur. With the EU Cyber Resilience Act now agreed upon, manufacturers and suppliers will also have to prioritize cybersecurity throughout the life cycle of hardware and software, as well as supporting businesses and consumers to use technology more securely. All of this sets up 2024 to be a busy year for cybersecurity regulation across the globe.

• Convergence of IT, OT, and IoT Security

Another important trend is the convergence of IT, operational technology (OT), and Internet of Things (IoT) security. This is expected to standardize IP security and place higher demands on production and product security.

As organizations embrace Industry 4.0, there’s a growing emphasis on securing manufacturing processes and IoT devices throughout their lifecycle, and we can expect AI and machine learning to play a crucial role in analyzing the vast amounts of data generated by these interconnected systems.

• When cyber meets quantum

Quantum technology is now advancing faster than expected. Major players like Google and IBM are investing in quantum security to address the challenges posed by quantum computing. Its rapid progress may soon render obsolete the current encryption standards like RSA and ECC, and so the development of quantum-resistant algorithms is therefore becoming a pressing necessity for maintaining data privacy and security in the future.

While it may not take off in 2024, it certainly will in 2025, and as a result we expect quantum security to demand increased attention from cybersecurity professionals this year.

An era of disruption and opportunity

Advances in computing power must be matched by strengthened digital defenses. Beyond AI and ML and zero trust, new threats like quantum promise to upend the very foundation of cybersecurity standards worldwide. All business leaders and technology professionals will be impacted by this approaching milestone, as more and more organizations begin their quantum transition.

The convergence of these trends demands a proactive and adaptive approach from organizations in 2024. Leaders will find a strong defense in zero trust architecture and discover new capabilities in generative AI that will be critical to navigating the evolving cybersecurity landscape. Increasingly stringent compliance standards, driven by global regulations, are not only forcing organizations to invest in cybersecurity, but are also driving transparency, creating a more robust cybersecurity ecosystem at a time when IT, OT, and IoT are converging.

In the face of these challenges, 2024 is not just a year of disruption, but a year of unprecedented opportunity. The path forward may be uncertain, but with the right strategies and technologies in place, organizations can move forward into a new era of cybersecurity resilience with confidence.

COPIED

Credits and research goes to

AUTHOR: Geert van der Linden

#EDR: An Endpoint Detection and Response (EDR) solution protects organizations by continuously monitoring and analyzing endpoints (devices like computers, servers, and mobile devices) for signs of malicious activities or security breaches. It provides several key protections:

#Threat_Detection: EDR solutions use advanced techniques to detect unusual or suspicious behavior on endpoints, such as unauthorized access attempts, file changes, or abnormal network activities.

#Incident_Response: When a potential threat is identified, EDR systems can trigger immediate responses, such as isolating the compromised endpoint, blocking malicious processes, or quarantining files.

#Forensics_and_Investigation: EDR captures detailed information about security incidents, allowing security teams to investigate the root cause of an attack, understand its scope, and determine the extent of damage.

#Threat_Intelligence: EDR solutions often integrate with threat intelligence feeds, keeping them updated with the latest information about known threats, attack patterns, and vulnerabilities.

#Behavioral_Analysis: EDR systems use behavioral analysis to establish a baseline of normal activity on each endpoint. Deviations from this baseline can indicate potential threats or compromise.

#Realtime_Monitoring: EDR continuously monitors endpoints in real time, helping to identify and respond to threats as they occur, reducing the time it takes to detect and mitigate breaches.

#Automated_Responses: EDR solutions can automate certain responses to detected threats, minimizing manual intervention and speeding up incident containment.

#Patch_Management: Some EDR solutions offer patch management capabilities, ensuring that endpoints are up to date with the latest security patches, reducing vulnerabilities.

#Compliance: EDR solutions can assist organizations in meeting regulatory compliance requirements by providing detailed audit logs and evidence of security measures.

#Visibility and Reporting: EDR offers insights into the overall security posture of an organization, helping security teams understand the types of threats faced and improving decision-making.

Overall, #EDR solutions play a critical role in enhancing an organizations cybersecurity posture by providing proactive threat detection, rapid incident response, and detailed analysis of security incidents across all endpoints

2️⃣File | Hash | Search | Analysis | Sandboxing
🌀1. File Extension >>https://filesec.io/#
🌀2. LOLBAS >>https://lnkd.in/dDa8XgiM
🌀3. GTFOBins >>https://lnkd.in/dRVzVz87
🌀4. File Hash Check >> https://lnkd.in/gNqxtn4d
🌀5. Hash Search >> https://lnkd.in/eMjdTB2t
🌀6. Hash Search >> https://www.malwares.com/
🌀7. MetaDefender >> https://lnkd.in/e6r4mGv5
🌀8. Kaspersky Threat Intel. >> https://lnkd.in/eSNMn7au
🌀9. Cuckoo Sabdbox >> https://cuckoosandbox.org/
🌀10. AnyRun >> Online sandboxing >> https://any.run/
🌀11. Hybrid-Analysis >> https://lnkd.in/gaRGY8kB
🌀12. Joe Sandbox >> https://lnkd.in/gTJJ9GiC
🌀13. VMRay Sandbox >> https://www.vmray.com/
🌀14. Triage >> http://tria.ge/
🌀15. Browser Sandbox >> https://lnkd.in/gjA-QqdX

3️⃣ File hash
🌀HashTools> Windows > https://lnkd.in/gTjru2RQ
Powershell :
🌀Get-FileHash -Path C:\path\to\file.txt -Algorithm MD5
Get-FileHash -InputObject “This is a string” -Algorithm MD5
🌀QuickHash > MacOS > https://lnkd.in/gZc8FYpU
Terminal: shasum -a 256 filename

4️⃣Find Suspicious Artifacts | Reverse Engineer | Debug Files
🌀1. PeStudio: https://lnkd.in/gjYKbyge
🌀2. CFF Explorer: https://lnkd.in/ggTCTeAi
🌀3. DocGuard files: https://www.docguard.io/
🌀4. File Scan: https://lnkd.in/ejBt5R7C
🌀5. Ghidra >> https://ghidra-sre.org/
🌀6. IDA Pro >>https://lnkd.in/eWA9MnMY
🌀7. Radare2/Cutter >>https://lnkd.in/gV4k5Gsw
https://lnkd.in/gdb3MQn2

5️⃣Monitor System Resources | Detect malware
🌀Process Hacker >> https://lnkd.in/gxV3PAnG
🌀Process Monitor >> https://lnkd.in/gPqzyB7K
🌀ProcDot >> https://www.procdot.com/
🌀Autoruns >> https://lnkd.in/gkZqkZrd
🌀TcpView >>https://lnkd.in/gQZM_SJz

6️⃣Web proxy
🌀Fiddler >> https://lnkd.in/gnJ9BvFN

7️⃣Malware Samples — Abuse.ch
🌀MalwareBazaar ==> https://bazaar.abuse.ch/
🌀FeodoTracker ==> https://lnkd.in/gyN_diCQ
🌀SSLBlacklist ==> https://sslbl.abuse.ch/
🌀URLHaus ==> https://urlhaus.abuse.ch/
🌀ThreatFox ==> https://lnkd.in/gB2gDZUd
🌀YARAIfy ==> https://yaraify.abuse.ch/

1. Security Analyst: Monitors and analyzes security alerts to identify and respond to potential threats.

2. Ethical Hacker (Penetration Tester): Tests systems for vulnerabilities by simulating cyberattacks to find weaknesses that could be exploited by malicious hackers.

3. Security Engineer: Designs, implements, and maintains security systems and protocols to protect networks, applications, and data.

4. Security Consultant: Offers expert advice to organizations on improving their cybersecurity posture, recommending strategies and technologies.

5. Incident Responder: Investigates and manages security breaches or incidents, mitigating the impact and preventing future occurrences.

6. Security Architect: Designs the overall security structure of an organization’s IT environment, ensuring all components work together securely.

7. Security Manager/Director: Oversees the cybersecurity program, manages teams, and develops policies and procedures to ensure a strong security framework.

8. Compliance Officer: Ensures the organization follows relevant laws and regulations related to cybersecurity and data protection.

9. Threat Intelligence Analyst: Gathers and analyzes information about potential threats and vulnerabilities to help organizations prepare and defend against cyberattacks.

10. Cryptographer: Develops encryption algorithms and techniques to secure sensitive data and communications.

11. Forensics Expert: Investigates cyber incidents, collects evidence, and analyzes data to understand how breaches occurred and who is responsible.

12. Security Auditor: Evaluates an organization’s security measures and practices to identify weaknesses and ensure compliance with security standard.

13. Application Security Specialist: Focuses on securing software applications by identifying and addressing vulnerabilities in code and design.

14. Network Security Engineer: Specializes in securing an organization’s network infrastructure, including firewalls, routers, and switches, to prevent unauthorized access and attacks.

15. Identity and Access Management (IAM) Specialist: Manages user access to systems and data, ensuring only authorized individuals have appropriate permissions.

16. Security Operations Center (SOC) Analyst: Monitors real-time security alerts, investigates incidents, and coordinates responses to security threats.

17. Malware Analyst: Analyzes and dissects malicious software to understand its behavior and develop strategies for detection and removal

18. IoT Security Specialist: Focuses on securing Internet of Things (IoT) devices and networks, which are often vulnerable to attacks due to their interconnected nature

19. Industrial Control Systems (ICS) Security Specialist: Focuses on securing critical infrastructure systems, such as power plants and manufacturing facilities, from cyber threats

20. Other like Data privacy, GRC, etc

🔐1. Intro to Information Security by Udacity: [https://lnkd.in/ggdYxnUp](https://lnkd.in/ggdYxnUp)
🔐2. Network Security by Udacity: [https://lnkd.in/gSHx2tJQ](https://lnkd.in/gSHx2tJQ)
🔐3. Introduction to Cybersecurity: [https://lnkd.in/ghQY8cKA](https://lnkd.in/ghQY8cKA)
🔐4. Cybersecurity Essentials: [https://lnkd.in/gZe6bf-t](https://lnkd.in/gZe6bf-t)
🔐5. Networking Essentials: [https://lnkd.in/gjipDpgG](https://lnkd.in/gjipDpgG)
🔐6. NSE 1,2 & 3: [https://lnkd.in/gsQJhn2a](https://lnkd.in/gsQJhn2a)
🔐7. Information Security by OpenLearn: [https://lnkd.in/gvfghKNs](https://lnkd.in/gvfghKNs)
🔐8. Network Security by OpenLearn: [https://lnkd.in/gS2KWNfN](https://lnkd.in/gS2KWNfN)
🔐9. Risk Management by Open Learn: [https://lnkd.in/gGPTDU2g](https://lnkd.in/gGPTDU2g)
🔐10. Certified in Cybersecurity℠ - CC: [https://lnkd.in/gW3w8Jqu](https://lnkd.in/gW3w8Jqu)
🔐11. CCNA Security Courses: [https://lnkd.in/gfby3CR2](https://lnkd.in/gfby3CR2)
🔐12. Network Defense Essentials (NDE): [https://lnkd.in/g6mRKt2t](https://lnkd.in/g6mRKt2t)
🔐13. Ethical Hacking Essentials (EHE): [https://lnkd.in/gRBGCud7](https://lnkd.in/gRBGCud7)
🔐14. Digital Forensics Essentials (DFE): [https://lnkd.in/gPrkYcDH](https://lnkd.in/gPrkYcDH)
🔐15. Dark Web, Anonymity, and Cryptocurrency: [https://lnkd.in/gUrCCGdf](https://lnkd.in/gUrCCGdf)
🔐16. Digital Forensics by Open Learn: [https://lnkd.in/gdv8emgt](https://lnkd.in/gdv8emgt)
🔐17. AWS Cloud Certifications (Cybersecurity): [https://lnkd.in/gaDGWdkm](https://lnkd.in/gaDGWdkm)
🔐18. Microsoft Learn for Azure: [https://lnkd.in/gDpkXiik](https://lnkd.in/gDpkXiik)
🔐19. Google Cloud Training: [https://lnkd.in/get8rnkh](https://lnkd.in/get8rnkh)
🔐20. Android Bug Bounty Hunting: Hunt Like a Rat: [https://lnkd.in/gMNT8saN](https://lnkd.in/gMNT8saN)
🔐21. Vulnerability Management: [https://lnkd.in/gvNKJnni](https://lnkd.in/gvNKJnni)
🔐22. Software Security: [https://lnkd.in/gG4P5bkn](https://lnkd.in/gG4P5bkn)
🔐23. Developing Secure Software: [https://lnkd.in/gQRwTzKU](https://lnkd.in/gQRwTzKU)
🔐24. PortSwigger Web Hacking: [https://lnkd.in/eEa-fNfu](https://lnkd.in/eEa-fNfu)
🔐25. RedTeaming: [https://lnkd.in/et_T2DEa](https://lnkd.in/et_T2DEa)
🔐26. Splunk: [https://lnkd.in/et5bkjeY](https://lnkd.in/et5bkjeY)
🔐27. Secure Software Development: [https://lnkd.in/ebGpA4wG](https://lnkd.in/ebGpA4wG)
🔐28. Maryland Software Security: [https://lnkd.in/e3z4zFmJ](https://lnkd.in/e3z4zFmJ)
🔐29. Stanford Cyber Resiliency: [https://lnkd.in/eg9BM5Bv](https://lnkd.in/eg9BM5Bv)

Thank you A.K.M. Mohiuddin ,CISA, CEH, ECSA, CHFI, CSA(SOC) for sharing these links. Full credit goes to original author.

#freecourses #cybersecurity #cybsersecuritycourses

Information Security Fundamentals
📕 ISO 27000:2018: Information technology — Security techniques — Information security management systems https://lnkd.in/eJmsk64u
📕 BSI Standard 200–1: Information Security Management Systems (ISMS) https://lnkd.in/eeGvJrTp
📕 NIST SP 800–31 Information Security https://lnkd.in/eJuimHUj

Control Frameworks
📕 NIST SP 800–53 Security and Privacy Controls for Information Systems and Organizations https://lnkd.in/eRskaGsv
📕 NIST SP 800–53b Control Baselines for Information Systems and Organizations https://lnkd.in/e-Ahz-Ve
📕 PCI DSS 4.0 https://lnkd.in/etWc9FGP
📕 CIS Critical Security Controls v8 https://lnkd.in/eZPPcQeD

Risk Management
📕 ISO 31000:2018 Risk Management — Guidelines https://lnkd.in/e4s3ZQt9
📕 BSI Standard 200–3: Risk analysis based on IT-Grundschutz https://lnkd.in/egEraFQ6
📕 NIST SP 800–161 Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations https://lnkd.in/edfrmdSe
📕 NIST SP 800–30 Guide for Conducting Risk Assessments https://lnkd.in/efvrEgV2
📕 NIST Risk Management Framework https://lnkd.in/e756dYuT
📕 NIST Cybersecurity Framework https://lnkd.in/eJnkFQ93

Audit
📕 NIST SP 800–53A Assessing Security and Privacy Controls in Information Systems and Organizations https://lnkd.in/eiwp-XNz
📕 ISACA IT Audit Framework 4th https://lnkd.in/e4-waQf4

Business Continuity Management
📕 ISO 22301:2019 Security and Resilience — Business Continuity Management Systems https://lnkd.in/e97bH9QG
📕 BSI-Standard 200–4: Business Continuity Management https://lnkd.in/e2duXVBh

Full credit to post goes to Aron Lange. :) Thank you for curating such a wonderful list of resources.

Full credit to post goes to David Meece COPIED from LINKEDIN POST

🔺Helping you to discover your personal brand and giving advice on how to break into cybersecurity.
🔺Providing top resources and helping you leverage LinkedIn to help you find the next position in your career
🔺On a “Mission” to help 50,000 folks “Break into Cybersecurity” around the world!

CVE-2023–29389

Published on: Not Yet Published

Last Modified on: 04/05/2023 05:35:00 PM UTC

CVE-2023–29389

The following vulnerability was found:

Toyota RAV4 2021 vehicles automatically trust messages from other ECUs on a CAN bus, which allows physically proximate attackers to drive a vehicle by accessing the control CAN bus after pulling the bumper away and reaching the headlight connector, and then sending forged “Key is validated” messages via CAN Injection, as exploited in the wild in (for example) July 2022.

• CVE-2023–29389 has been assigned by

• cve@mitre.org to track the vulnerability

CVE References

Description Tags ⓘ Link CAN Injection: keyless car theft | Dr. Ken Tindell kentindell.github.io
text/html

MISC kentindell.github.io/2023/04/03/can-injection/Can Injection: keyless car theft | Hacker News news.ycombinator.com
text/html

MISC news.ycombinator.com/item?id=35452963

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to comment@cve.report.

There are currently no QIDs associated with this CVE

There are no known software configurations (CPEs) currently associated with this CVE

No vendor comments have been submitted for this CVE

Social Mention

@CVEreport CVE-2023–29389 : Toyota RAV4 2021 vehicles automatically trust messages from other ECUs on a CAN bus, which allows… twitter.com/i/web/status/1… 2023–04–05 16:05:33

/r/netcve CVE-2023–29389 2023–04–05 17:20:06

/r/Team_IT_Security CVE-2023–29389 2023–04–05 18:26:12

© CVE.report 2023

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user’s risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE’s CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report

TikTok has been fined £12.7m for illegally processing the data of 1.4 million children under 13 who were using its platform without parental consent, Britain’s data watchdog said.

The information commissioner said the China-owned video app had done “very little, if anything” to check who was using the platform and remove underage users, despite internal warnings the firm was flouting its own terms and conditionsOur findings were that TikTok were not doing enough to prevent under-13s accessing their platform, they were not doing enough when they became aware of under-13s to get rid of them, and they were not doing enough to detect under-13s on there,” John Edwards told the Guardian on Tuesday. “They assure us that they are now doing more.”

The fine from the Information Commissioner’s Office (ICO) comes weeks after the app was banned from UK government phones amid security concerns. It is fast becoming a flashpoint for the UK’s handling of big tech and Chinese influence.

After the announcement of the fine, one of the largest the watchdog has given, Rishi Sunak was accused of moving too slowly in taking action against TikTok – and was called “naive for assuming TikTok could ever regulate itself”.

UK data protection law does not have a strict ban on children using the internet but requires organisations that use the personal data of children to obtain consent from their parents or carers.

TikTok itself bans those under 13 in its terms and conditions. The failure to enforce age limits led to “up to 1.4 million UK children” under 13 using the platform as of 2020, the ICO estimated.

“There was a whole bunch of stuff that they could have been doing that they weren’t,” Edwards said. “All that was required was a self-certification that the applicant was over 13, by clicking a box with no verification, with no extra checks. We understand that there are now significantly more checks and balances in place to detect that kind of thing.”

Edwards added: “There are laws in place to make sure our children are as safe in the digital world as they are in the physical world. TikTok did not abide by those laws.

“As a consequence, an estimated 1 million under-13s were inappropriately granted access to the platform, with TikTok collecting and using their personal data. That means that their data may have been used to track them and profile them, potentially delivering harmful, inappropriate content .

TikTok should have known better, TikTok should have done better. They did not do enough to check who was using their platform or take sufficient action to remove the underage children that were using their platform.”

The ICO’s investigation found that concern was raised internally but that TikTok did not respond “adequately”.

In a statement, a TikTok spokesperson said: “TikTok is a platform for users aged 13 and over. We invest heavily to help keep under-13s off the platform and our 40,000-strong safety team works around the clock to help keep the platform safe for our community.

“While we disagree with the ICO’s decision, which relates to May 2018 to July 2020, we are pleased that the fine announced today has been reduced to under half the amount proposed last year. We will continue to review the decision and are considering next steps.”

TikTok emphasised that it had changed its practices since the period the ICO investigated. Now, in common with social media peers, the site uses more signals than a users’ self-declared age when trying to determine how old they are, including training its moderators to identify underage accounts and providing tools for parents to request the deletion of their underage children’s accounts.

The accusations also pre-date the introduction of the ICO’s “age appropriate design code”, which specifies an even stricter set of rules that platforms are expected to follow when handling the personal data of children. That code also makes it more explicit that platforms cannot argue ignorance over the ages of younger users as a defence for failing to treat their personal data carefully.

“We will be looking at other providers of services likely to be accessed by children and checking the ways in which they’re doing age verification,” Edwards said.

In 2019, TikTok was hit with a $5.7m fine by the US Federal Trade Commission for similar practices. That fine, a record at the time, was also levied against TikTok for improper data collection from children under 13. At the time the company committed to improving its practices and said it would begin keeping younger users in “age-appropriate TikTok environments”, where those under 13 would be pushed into a more passive role, able to watch videos, but not post or comment on the platform.

John Hayes, a Conservative MP who pushed Sunak to toughen up the online harms bill, warned the government it would be forced to return to the issue of regulation “time and again because the idea that companies like TikTok will ever regulate themselves is for the birds”Labour has accused the government of failing to protect children online. Alex Davies-Jones, the shadow digital and tech minister, said: “Ministers have been passing the buck and platforms have been acting with impunity.”

She added: “The government and tech companies have a clear responsibility to ensure young people are safe online and this episode shows they are failing that duty. Labour has long campaigned for stronger protections online and if this government fails to act the next Labour government will.”