Data Security

Detectify Introduces an Open Source Security Tool for Ethical Hackers

Ugly Duckling, a stand-alone application security tool specially designed for ethical hackers to make it easier for them to share their discoveries, is now available from Detectify, the SaaS security company powered by ethical hackers.

To keep on top of web application security, it's important to find web vulnerabilities as soon as they appear - before attackers exploit them. By offering ethical hackers the tools to build further test modules independently, Ugly Duckling speeds up the integration of vulnerabilities discovered by ethical hackers into automatic security tests on Detectify's platform.

When an ethical hacker discovers a loophole, he or she will create a module as a JSON file and test it in Ugly Duckling to ensure that it works. The JSON file is then implemented on Detectify's platform, allowing thousands of app owners and security teams to access the quality-checked findings. Vulnerability reports submitted to Ugly Duckling can be run live as security checks within 5-10 minutes of submission. It's a win-win situation: security and engineering teams can keep up with the latest exploitable vulnerabilities discovered in the wild, while ethical hackers can get paid more quickly.

To define the vulnerabilities, Ugly Duckling uses a custom JSON-based template format. It detects "stateless" vulnerabilities, i.e., vulnerabilities that can be discovered by analyzing the response to a single HTTP request.

Detectify crowdsources the most latest security research from ethical hackers and distributes it as payload-based tests to security engineers and application owners, allowing them to regularly check their applications for vulnerabilities.

On Github, you can find the Ugly Duckling vulnerability scanning tool, which is open-source and MIT-licensed. The Ugly Duckling web scanner is not limited to ethical hackers in Detectify's Crowdsourced network, but is open for all to use for bug bounty hunting, security research, or penetration testing, in keeping with the company's belief in a collective approach to security.

About Detectify


Detectify believes that everybody should have access to world-class cybersecurity knowledge. Detectify automates the most latest security findings from the world's top ethical hackers and delivers them to security defenders and web application teams. Detectify's security tools, which are driven by a network of hand-picked ethical hackers, check your application outside the OWASP Top 10 and help you keep on top of cloud threats.

Spotlight

Cyber attacks are increasing in volume, sophistication, and severity, and the federal government has taken notice. Now, they’re taking action — most recently in the form of new cybersecurity rules from the Securities and Exchange Commission. In “11 Ways to Streamline SEC Cybersecurity Compliance with Risk Cloud,” we explore a va

Spotlight

Cyber attacks are increasing in volume, sophistication, and severity, and the federal government has taken notice. Now, they’re taking action — most recently in the form of new cybersecurity rules from the Securities and Exchange Commission. In “11 Ways to Streamline SEC Cybersecurity Compliance with Risk Cloud,” we explore a va

Related News

Network Threat Detection

Kyndryl Announces Strategic Global Alliance with Palo Alto Networks to Provide Industry Leading Network and Cybersecurity Services

PR Newswire | October 04, 2023

Kyndryl (NYSE: KD), the world's largest IT infrastructure services provider, today announced a strategic global alliance with Palo Alto Networks to provide end-to-end network and cybersecurity services, including the launch of a new service offering, powered by Prisma SD-WAN for enterprises and Industry 4.0 customers. The alliance brings together Palo Alto Networks industry-leading platform security capabilities with Kyndryl's advanced network security services expertise to design, build, manage, and modernize mission-critical networking for customers across industries. The companies are joining forces to capitalize on emerging opportunities in the SD-WAN infrastructure market that IDC estimates will grow at a compound annual growth rate of 10.1% through 2027. As the demands of enterprise mobility accelerate, enterprises are looking for greater operational agility to support their digital transformation. Businesses need to support the growing number of devices used to access the corporate network and cloud-based applications, while also meeting evolving security and compliance requirements. Kyndryl and Palo Alto Networks are partnering to help businesses deliver consistent security and an enhanced user experience for customers everywhere, and across industries such as services, manufacturing, energy, healthcare, and retail. Kyndryl's new SD-WAN offering, powered by Prisma SD-WAN, will enable customers to transform and modernize their networks and meet the growing bandwidth demands of the proliferation of devices and cloud traffic. The new approach to network connectivity will provide a single pane of glass management to their networks, and simplifies deployment to branch-offices and edge services. By helping customers transition into a flexible and scalable network, Kyndryl will be able to help enterprises build a roadmap and incorporate new security paradigms such as SASE with Kyndryl Consulting services. At Kyndryl, we are at the forefront of helping enterprises with their network transformation to meet the growing trends of remote work, multi-devices usage, and cloud and data access. As organizations move away from traditional hardware-centric models to OPEX consumption models, the need for agile, highly secure and reliable networks is imperative, said Stephen Leonard, SVP of Global Strategic Alliances, Kyndryl. We are delighted to partner with Palo Alto Networks to provide robust and versatile network security services that will provide many benefits to our customers. "Together with Kyndryl, we are enabling enterprises to digitally transform confidently and innovate securely, while reaping the benefits of consolidating disparate security solutions into an integrated, best of breed platform," said Prem Iyer, SVP of Global Ecosystems for Palo Alto Networks. "We are committed to helping our joint customers achieve better security outcomes while protecting the modern connected organization from increasingly sophisticated attacks." The global partnership between Kyndryl and Palo Alto Networks builds on the companies' established collaboration around security services and solutions. In July Kyndryl launched its new Security Operations as a platform (SOaap) solution leveraging Palo Alto Networks Cortex technology to drive operational savings and time-to-value through automation and orchestration. Earlier this year, Kyndryl and Palo Alto Networks, together with Nokia, established an innovation lab in support of joint enterprise customers. By the end of the year, customers will be able to view innovative industrial edge use cases running on cloud, 4.9G/LTE and 5G private wireless connectivity. This will include remote manufacturing process control and real-time analytics on factory production sites, provisioning and management of mobile devices to improve the employee and frontline worker experience for onboarding and communication, and IT and OT security integration for worker safety and operational efficiencies. Kyndryl's industrial edge platform will be integrated with a multi-factor zero trust model built on Palo Alto Networks next-generation firewalls, run on Nokia's MXIE Industrial edge as part of Nokia Digital Automation Cloud (DAC)'s solutions, and with end-to-end managed services provided by Kyndryl. About Kyndryl Kyndryl (NYSE: KD) is the world's largest IT infrastructure services provider, serving thousands of enterprise customers in more than 60 countries. The company designs, builds, manages and modernizes the complex, mission-critical information systems that the world depends on every day. For more information, visit www.kyndryl.com.

Read More

Enterprise Security

Honeywell Uses Quantum Computing Encryption to Protect Utility Data

Honeywell | September 11, 2023

Honeywell has announced that it's the first company to incorporate quantum-computing-hardened encryption keys into smart utility meters, protecting end-user data from advanced cybersecurity threats. Quantinuum's Quantum Origin provides an advantage over conventional solutions by generating keys with quantum-computing-enhanced randomness. Honeywell's new Smart Energy and Thermal Solution products powered with Quantum Origin are now available to North American and European customers. Honeywell recently made a groundbreaking announcement that it is the first company to incorporate quantum-computing-hardened encryption keys into smart utility meters, a move that provides advanced protection for end-user data against cyber threats. To achieve this, Honeywell will leverage Quantinuum's Quantum Origin technology to not only enhance data security but also contribute to building greater reliability and trust in the evolving utility sector. The enhanced security utility meters establish a new standard for safeguarding against data breaches and ensuring the uninterrupted operation of water, gas, and electricity utility infrastructure for both commercial and residential applications. Quantinuum's Quantum Origin provides an advantage over conventional solutions by generating keys with quantum-computing-enhanced randomness, thereby rendering them truly unpredictable and substantially enhancing the data security of utilities' end users. No other organizations in the smart meter market presently offer quantum-hardened encryption protection. The incorporation of this technology into Honeywell's Smart Energy and Thermal Solutions' products will assist in addressing the industry's expanding data security requirements, especially as they pertain to critical infrastructure. President of Smart Energy and Thermal Solutions at Honeywell, Hamed Heyhat, said, By integrating Quantinuum's quantum-computing-hardened encryption technology into our smart meters, we are advancing data security for our customers and helping to shape the dialogue on how the utility industries should approach cybersecurity in the quantum era. [Source – Cision PR Newswire] Hamed Heyhat emphasized the significance of continuous innovation in enabling customers to stay ahead of the ever-changing threat landscape. It was noted that such a level of protection is crucial in our progressively digital and interconnected world. Tony Uttley, President and COO of Quantinuum, mentioned, Our work with Honeywell demonstrates the importance of using the power of today's quantum computers to create a more resilient cyber infrastructure to better protect customers. [Source – Cision PR Newswire] Smart Energy and Thermal Solution products from Honeywell with Quantum Origin are now available to North American and European customers. The collaboration will strengthen Honeywell's position as an industry-leading provider of innovative and secure solutions for the utilities industry.

Read More

Software Security

Palo Alto Joins Telstra as the First Sole Cyber Security Vendor

Palo Alto | September 22, 2023

Palo Alto Networks has announced a strategic partnership with the largest telecommunications company in Australia, Telstra. This signifies Palo Alto Networks' commitment to delivering an expanded portfolio of cybersecurity solutions and services to meet the needs of Telstra's extensive business clientele. The partnership strengthens the existing 10-year relationship between Palo Alto Networks and Telstra. Palo Alto Networks, a global cybersecurity company, has announced teaming up with Telstra, Australia's largest telecommunications company, to offer an enhanced range of cybersecurity solutions and services to Telstra's business clients both in Australia and around the world. This collaboration marks a significant milestone, as Palo Alto Networks becomes the first dedicated cybersecurity company to be recognized as a technology alliance partner for Telstra's enterprise customer segment. Telstra serves customers in over 200 countries and territories. Telstra's technology alliance partners collaborate to create and provide comprehensive services encompassing connectivity, voice, and professional services. These services are designed to assist businesses of all sizes in addressing their challenges and capitalizing on opportunities. Regional Vice President for Australia and New Zealand of Palo Alto Networks, Steve Manley, stated, This new alliance with Telstra reinforces Palo Alto Networks’ position in the Australian market as the leading cyber security vendor to leading telecommunications carrier in Australia. It also reinforces our increased commitment to offering industry-leading joint solutions with one of the country’s most trusted managed service providers. Together, Palo Alto Networks and Telstra will collaborate to offer businesses with best-of-breed cyber security solutions to help keep them safe in a rapidly changing market landscape. [Source – Web Wire] This new partnership further solidifies the long-standing 10-year relationship between Palo Alto Networks and Telstra. It also builds upon previous agreements that expanded Telstra's SecureEdge portfolio with offerings like SecureEdge Cloud for business clients and Sovereign SecureEdge for the Australian government and agencies, both powered by Palo Alto Networks' advanced cloud-based security services. David Burns, Enterprise Group Executive at Telstra, said, Cyber security has become one of the top concerns among businesses worldwide, including here in Australia, and especially in the wake of a no. of high-profile cyber breaches. We’re now seeing the industrialization of cybercrime and the scale of threat continues to evolve and grow. As a result, we all need to be constantly changing, adapting, and looking at new technologies that can assist protect us and our customers’ data. As a leading provider of network, managed, and professional services, this new alliance between Telstra and Palo Alto Networks further boosts our capabilities to help customers protect their organizations and data from evolving cyber threats. [Source – Web Wire]

Read More