Matrix Compromised Through Known Jenkins Flaws

Infosecurity Magazine | April 12, 2019

Matrix users are encouraged to change their passwords after an unauthorized actor gained access to the servers hosting Matrix.org. Those using IRC bridging are also encouraged to change their NickServ passwords. An open network for secure, interoperable, decentralized, real-time communication over IP, Matrix is used across instant messaging, VoIP/WebRTC signaling and internet of things (IoT) communication, according to the company’s website. On April 9, 2019, security researcher Jaikey Sarraf alerted Matrix to existing vulnerabilities in Jenkins, which Matrix said it used for continuous integration. “The version of Jenkins we were using had a vulnerability (CVE-2019-1003000, CVE-2019-1003001, CVE-2019-1003002) which allowed an attacker to hijack credentials (forwarded ssh keys), giving access to our production infrastructure.” When Matrix identified that machines had been compromised, the company removed Jenkins and reportedly denied the attacker access to the compromised machines.

Spotlight

Join Allen Downs, Vice President, IBM Business Resiliency Services, and other IBM experts, industry analysts and clients at the Security & Resiliency campus at IBM Think 2019 to learn about new technologies and practices to mitigate cyber risks.

Spotlight

Join Allen Downs, Vice President, IBM Business Resiliency Services, and other IBM experts, industry analysts and clients at the Security & Resiliency campus at IBM Think 2019 to learn about new technologies and practices to mitigate cyber risks.

Related News

SOFTWARE SECURITY

Cowbell Cyber Unveils Cyber Risk Heatmap

Cowbell | May 26, 2022

Cowbell Cyber, the leading supplier of cyber insurance for small and medium-sized businesses (SMEs), announced the availability of its Cyber Risk Heatmap today. The Heatmap—the market's most data-rich and dynamic assessment of cyber risk portfolios—gives rapid insight into the distribution of covered risk across Cowbell's agencies and brokers, insurance and reinsurance partners, and underwriters' portfolios. Cowbell and its partners can now establish a balanced book of business, manage growth for profitability, and reduce the overall risk profile of each portfolio thanks to better visibility. As per a recent Cowbell study, 71% of policyholders want their cyber insurance provider to provide advice to reduce risk exposure. The difficulties of regularly monitoring cyber risk at the portfolio and individual account levels lead to risk selection blind spots. Cowbell proves its creativity by removing these shortcomings at the portfolio level for all stakeholders. As a result, the frequency and severity of reported claims are reduced. Cowbell's continually monitored risk pool currently includes 24 million SMEs, accounting for 75% of the total SME market in the United States. In a world where cyber insurance is becoming harder to obtain due to the volatile nature of cyber risks, Cowbell Cyber Heatmap allows us and our partners to quickly analyze the standing of any insurance book of business. The innovation Cowbell has brought to the cyber insurance landscape has, once again, allowed us to remain steadfast in our approach to properly assess and cover risk in the most rigorous manner." Rajeev Gupta, co-founder, and chief product officer at Cowbell Cyber. The Cowbell Variables underpin the Heatmap, a collection of risk rating factors that analyze the organization's cyber risk in real-time and then match it to the most applicable coverage for the company. Cowbell's Cyber Risk Framework provides the underlying technology, which involves security controls from multiple standards, including the NIST Cyber Security Framework, COBIT, the Payment Card Industry Data Security Standard (PCI DSS), and the most recently revised NIST Cybersecurity Supply Chain Risk Management (C-SCRM) program, augmented by Cowbell's proprietary controls. Cowbell's Cyber Risk Heatmap is free to all of Cowbell's 16,000 agency producers and is constantly updated to incorporate the most recent risk profile data to assure accuracy.

Read More

PLATFORM SECURITY

ReliaQuest GreyMatter joins Microsoft Intelligent Security Association

ReliaQuest | June 17, 2022

ReliaQuest, a security operations force enhancer, announced today that it has joined the Microsoft Intelligent Security Association (MISA). MISA is an ecosystem of independent software manufacturers and managed security service providers that have linked their products to better guard against an ever-increasing number of threats. "With digital transformation driving migration to Microsoft Azure, it becomes even more critical to have a unified view across an organization’s security infrastructure. Now, with added support for Microsoft Sentinel, Microsoft 365 and Microsoft Defender for Endpoint, ReliaQuest GreyMatter extends visibility across the Microsoft ecosystem. GreyMatter unifies detection, investigation and response to drive security effectiveness and cyber resilience, while allowing the customer to integrate Microsoft Security products at the pace that best suits their organization.” Brian Foster, ReliaQuest Chief Product Officer This partnership makes it simple for Microsoft clients to ingest data and automate activities across any vendor solution, whether on-premises or in one or more clouds. GreyMatter, in conjunction with extensive security operations knowledge, accelerates threat detection and response. This improves the efficiency of current investments, such as the correlation capabilities of Microsoft Sentinel and Microsoft Defender for Endpoint. GreyMatter contextualizes threat research, aggregate customer knowledge, more than 40 open source and commercial security data sources to build a complete, actionable picture of present and upcoming risks. ReliaQuest will continue investing in GreyMatter's integration capabilities with the Microsoft 365 security suite, extending the ReliaQuest aim to "Make Security Possible." Rob Lefferts, Corporate Vice President, Microsoft Defender said that, “Microsoft Intelligent Security Association members, like ReliaQuest, leverage Microsoft’s security products to better defend against cyber security threats with identity and access management, threat protection, information protection and security management.”

Read More

SOFTWARE SECURITY

Bugcrowd Launches Reseller Partnership with SocialProof Security

Bugcrowd | June 27, 2022

Bugcrowd, the market leader in crowdsourced cybersecurity, announced today a strategic reseller collaboration with SocialProof Security, advancing the organization's objective to keep clients ahead of growing cyber threats. As part of the cooperation, Bugcrowd will resell SocialProof Security's services, including social engineering prevention training, protocol and practitioner seminars, and penetration testing. In addition to reselling social engineering services, Bugcrowd continues to innovate and invest in its award-winning Security Knowledge Platform, which provides the most comprehensive suite of security solutions such as bug bounty, vulnerability disclosure programs, attack surface management, and pen testing as a service. Bugcrowd, for example, allows consumers to buy pen tests from a single supplier for any sort of use case, from basic assurance of simple web apps and networks to continuous testing of cloud services and APIs, and now, social engineering. Due to their friendly hacker approach to boosting customer defenses against human-based assaults, SocialProof Security and CEO Rachel Tobac, the market leader in social engineering prevention services, have gained prominence. Twitter, PayPal, Uber, Prudential Insurance, Cisco Systems, WhatsApp, NATO, and the US Air Force are among the noteworthy clients of SocialProof Security. "We are excited to work with Bugcrowd on this reseller partnership as we move forward with our aligned mission to arm organizations with a proactive means to reduce social engineering risk through education, identity verification protocol improvements, technical tools, and measuring those updates with social engineering penetration testing. The majority of cyber attacks now start with some element of social engineering—manipulating people to take actions that could harm organizations. This partnership illustrates the priority Bugcrowd places on actionable and measurable social engineering risk mitigation in a well-rounded security program," said Tobac. "Even with current elevated threat levels, many organizations are surprisingly unprepared for the threats from social engineering attacks, as we repeatedly find low awareness across organizations, outdated or inconsistent identity verification, and limited practitioner skill sets. Fortunately, taking a multidimensional approach that combines prevention training and tools, human-based protocol updates, and pen testing can dramatically reduce the risk of social engineering attacks. We look forward to bringing this innovative solution to market as a part of our services." Ashish Gupta, CEO of Bugcrowd SocialProof specializes in defending against social engineering attacks, in which attackers deceive workers in order to get personally identifiable information (PII), passwords, and unauthorized access to accounts, money, or other sensitive information. Common attack vectors like phishing, impersonation, and pretexting can be used to carry out such manipulation. In fact, respondents to ISACA's 2021 State of Cybersecurity Survey rated social engineering as the #1 cyber threat.

Read More