Microsoft’s Coco framework: Enhancing cybersecurity on the Blockchain

February 5, 2018February 7, 2018 Ulv Bjørnsson2 Comments

Coco Framework, is NOT a blockchain ledger.

Coco is a blockchain ledger framework.

It leverages a combination of trusted execution environments, advanced cryptography and innovative blockchain-focused consensus mechanisms to enable new ways of utilizing the blockchain. Coco stands for Confidential Consortium.

If you want a deeper dive, I suggest you check out the Coco Framework whitepaper, here.

Additionally, Microsoft offers BaaS (Blockchain-as-a-service) and was chosen by Bankchain which is a platform for banks that want to implement blockchain technology; members include State Bank of India, ICICI Bank, DCB Bank, Kotak Mahindra Bank, Federal Bank, Deutsche Bank and UAE Exchange.

Artificial intelligence and Cloud computing: Real-time fraud detection in online banking application within the cloud

November 24, 2017November 24, 2017 Ulv Bjørnsson3 Comments

Over the last few years, cloud computing has been the buzz. Cloud computing services offer an infrastructure that is highly scalable and supports high-performance computing. With high adoption by businesses of all sizes. Development and deployment of applications within the cloud platform are easy and time to market is done in a fraction of the time.

Artificial intelligence is not a new technology. It has been here for a long time and has helped develop computers and software that perform tasks that are associated with intelligence. Machine learning and deep learning are subsets of artificial intelligence that involve the development of algorithms that learn from data inputs and give intelligent output based on that data and the learned patterns.

A lot of research has been done and still is being done on implementing artificial intelligence into cloud computing. Cloud service providers such as Amazon, Google and Microsoft have already integrated AI into their clouds to improve service delivery. AI brings about capabilities such as machine learning, recognition of patterns and robotics to the cloud. On the other hand, the cloud is able to provide a wide range and large volumes of data since these capabilities are largely dependent on data as input so as to produce the desired output. The cloud also allows the systems to open-access and open-source data which is very crucial in facilitating collaborative learning.

Aww ye, I can now call myself a Certified Ethical Hacker

November 24, 2017February 7, 2018 Ulv Bjørnsson1 Comment

Busy days! Reading, exams, a lot of exciting features coming out into the market from a myriad of different vendors and gigantic leaps being made every day.

I wanted to share the news, I am now a Certified Ethical Hacker!

What does that mean? Just that I now am certified to attest that I have a baseline knowledge when it comes to how to go about penetrating a network or a computer system but with the purpose of finding and fixing security vulnerabilities within an ethical framework.

There is a progression learning track so the next step would be to study to be a Certified Security Analyst or a Licensed Penetration Tester.

To summarize what the CEH exam tests you on it is broken up into these sections:

I. Background

II. Analysis/Assessment

III. Security

IV. Tools/Systems/Programs

V. Procedures / Methodology

VI. Regulation/Policy

VII. Ethics

If you are curious about what the exam objectives are in detail, check out this blueprint.

You can connect with me on Twitter @UlvBjornsson, on this blog, or in the comment section below.

See you around!

Ulv

Microsoft new bug bounty program will pay up to $250,000

August 1, 2017 Ulv BjørnssonLeave a comment

To some it may have passed under the radar, for others it might be of interest.

Microsoft has released a bug bounty program for hackers, white hats, bug hunters and security researchers alike to discover, find and report vulnerabilities to Microsoft to strengthen the Microsoft portfolio.

Microsoft having dominated the market for home users and business computers have long been a favored target for cyber criminals, hobby hackers and other nefarious operatives. Meaning that just a zero-day vulnerability or any breach can cause a crisis like the recent WannaCry ransomware attack.

Microsoft has previously had bug bounty programs, but mostly they have been limited in time, or for specific suites.

WannaCrypt – What is it?

May 16, 2017May 18, 2017 Ulv Bjørnsson2 Comments

What is WannaCrypt?

A large Ransomware campaign that spread across the world.
The attack used a vulnerability that was patched in March 2017 Security Update (MS17-010, SMBv1)
How can I mitigate WannaCrypt?

Timeline

August 2016
The Shadow Brokers attempt to auction NSA tools

Claims they hacked Equation Group, author of Stuxnet and Flame
Auction lists attack-ready code with 0-day exploits and trojans.

September 2016
Microsoft encourages users to stop using SMB1

March 2017
Microsoft releases Security Update to address the MS17-010 for SMB1 vulnerability

April 2017
The Shadow Brokers release the toolbox

Includes SMB (Eternal Blue) and the Trojan Code (Double Pulsar)
Microsoft releases an advisory that no new vulnerabilities are found in Shadow Brokers release

May 2017
WannaCrypt is released by unknown attacker
Which utilizes [ETERNALBLUE] with [DOUBLE PULSAR] and a ransomware payload that demands 300-600 USD in Bitcoins from its infected hosts.

What does WannaCrypt do?

Infects

It attacks through [ETERNALBLUE] if MS17-010 is not installed.
Installs the Trojan if the attack is successful [DOUBLEPULSAR]

Encrypts

Encrypts 179 file types
Shows a message that demands for payment of 300$-600$ in bitcoins to a listed wallet.

Spreads

It scans the local LAN and wider internet for port 445
Attempts to infect over SMBv1 [ETERNALBLUE] if port is open.

Payments

We find references to three different wallets these are:

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn 73 transactions, total of 17460 USD
13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 98 transactions, total of 26570 USD
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw 82 transactions, total of 23450 USD

Which gives the attackers wallet a total of 67480 USD (14:00 GMT 16.05.17)

Curious of how to mitigate it, or want to read how to disable the SMBv1 vulnerability or patch it? Check out my previous article on mitigation.

As always, if you have suggestions on topics you want to read more about, or feedback. Leave a comment or tweet me at UlvBjornsson

WannaCrypt – What can I do to mitigate?

May 15, 2017May 15, 2017 Ulv Bjørnsson2 Comments

Let’s try to reduce the attack vectors, I’ll walk you through the practical remedies and reduction of attack vectors you can do; now.

Turn off SMB 1

Why? Because WannaCry utilizes the exploit, and unless you are on XP or 2003, you have no use for SMB1, and will be using SMB2/SMB3.
To disable SMBv1 on the SMB server, run the following cmdlet:

Windows 8 and Windows Server 2012

Set-SmbServerConfiguration -EnableSMB1Protocol $false

Windows 7, Windows Server 2008 R2 and Windows Vista

Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters” SMB1 -Type DWORD -Value 0 -Force

You can also remove it with “Server Manager” or use this snippet:

Remove-WindowsFeature FS-SMB1

If you want to check whether or not SMB 1.0 is active on your server you can run:

Get-SmbServerConfiguration

As you can see it states that EnableSMB1Protocol is currently True we want to set this to False.

We can accomplish this by running the following snippet:

Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force’ cmdlet, as shown below.

(Force is added to prevent it from pausing for confirmation, and run through.)

Let’s run this again to see if the configuration changed: