Streamlining Your Netwrok Security - The Need For Regular Vulnerability Assessment- Infographic

The need for regular vulnerability assessment is need for ever business online to provide network security against threats.

Cryptocurrency Mining Malware – 2018’s New Menace!

With digital currency slowly gaining popularity over the past 8 years, the biggest question that arises is, is it a safe investment to make? Cryptocurrency depends on cryptography for distribution and transferring.

The most famous cryptocurrency is Bitcoin, having been declared the ‘best performing currency’ in 2016, having beaten gold in performance.

But as cryptocurrency values increase on a daily basis, so do the security threats. With cyber criminals trying everything in their books to crack digital vaults and steal digital money, it makes one wonder if cryptocurrency mining malware is the new menace and ransomeware to be wary of.

 Recently, in February 2018, cyber criminals used the Australian Government’s website to hack into cryptocurrency accounts. The criminals used more than 4,000 websites to breach security and commit the crime.

What made the scenario worse is that the attackers could have used keylogger to save user login credentials and committed crimes by stealing their accounts and identity.

Ways to Stop Cryto-Mining

There are some ways you can stop crypto-mining and attackers from taking over your computer. Not only individuals, businesses also need to be aware since they are more likely to invest in digital money.

• Use the “No-Coin” Chrome Extension

It’s safe to assume that most businesses use Chrome for browsing. If you do, make sure to install the “no-coin” extension in Chrome

No Coin identifies the different ways websites interact with your browser and stops threats from penetrating through your browser’s security. It also identifies websites with hidden cryptocurrency mining applications.

• Block the Coin Mining Domains in Host Files

You will have to do this manually. You will need to block the coin mining domains in your host files, blocking their access to your browser. When your browser is unable to connect to these files, you will need to redirect the files to 0.0.0.0.

• Use AdBlock

You never know who’s trying to mine your browser and host files. Therefore, use an ad blocker like AdBlock to prevent external threats from taking over your browser’s connection.

If you see those strange click-bait ads pop up often, they are full of malware and crypto-mining applications.

It’s important to keep your organisation safe from such threats. Lean Security helps keep your systems safe, by ensuring that your website & web application security and systems are free of security loopholes!

Feel free to get in touch with us learn more!

Secure Code Review – The Best Practices

Nearly two years ago, a hosting provider deleted his entire company because of a small mistake. The mistake, you ask? A single destructive line of code.

For weeks, you’ve been working on the development of your application, integrating security features where necessary. You are nearing your final deployment date, and you feel that your app is ready to go.

Think again. You might be missing a crucial step in making sure that your app does what you meant for it to do—a secure code review.

Locked and Coded

Simply put, a secure code review is the process to identify and rectify any potential and definite security vulnerabilities in the code, particularly that written at the end-stage of the application life cycle. It serves as a final check of sorts; you need to make sure that all features of your code are functional and devoid of any security flaws.

Here are a few secure code best practice tips to find and overcome any constraints in your app.

¥ Make sure the coding team follows one review checklist

Errors occur when inconsistency exists in a team working on the same application—including project managers, designers, developers and reviewers. It is also important that the entire team participates in creative meetings, and developer and reviewers collaborate to avoid neglecting secure coding practices.

¥ Refrain from pointing fingers at the development team

It’s not uncommon for reviewers to initiate a blame game, singling out developers and breathing down their necks for making the mistakes. This attitude only creates communication barriers between the developers and security reviewers, and ends up affecting the app’s performance.

If a developer is making mistakes, introduce a security education program to minimise risk of code errors in an effective manner. Facilitate their security training in a practical way and work to promote a healthy relationship within the team.

¥ Review code at each significant change

Gone are the days when the only SDLC (software development life cycle) style followed was the waterfall style. A spiral, iterative SDLC is the modern app development team’s ideal working process. After each meaningful change in the code, re-review its security.

It takes one line of code to change the functionality of the entire program. Minimise wasted time and risk of losses by reviewing the app in chunks.

¥ Combine manual and machine code reviews

Automated review tools are pretty awesome, and save time and effort. However, even in this day and age of highly-advanced tech, there’s nothing quite as capable of detecting issues with the logical aspect of the code as the human brain.

That said, the best way to approach secure code review is combining manual review and technological analysis. Utilise your review team’s expertise to test the complex, valuable segments of the application code, and leave the rest to automated tools.

To make sure your application app’s security is completely insusceptible to vulnerabilities, go for professional web application testing services. We offer top-notch vulnerability scanning service for web and mobile applications.

Reach out to us to us learn more!

Common and Deadly Security Mistakes Coders Make

In 2013, when Burger King’s official twitter was hacked and replaced with a bio that led to McDonald’s, the food conglomerate learned the hard way that social media is a double-edged sword.

Pranks like these make headlines.

But the focus is more on the individual responsible than on security gaps that lead to a vulnerable situation in the first place.   

The truth is, most businesses don’t think twice about application vulnerability, which is the real culprit that allows “hacktivists” to penetrate through security systems. It’s because of these subtle errors in programs that let cyber criminals slip in effortlessly between the cracks.

But programmers are also human beings. Even the most experienced coders make mistakes. But these mistakes are often costly and can lead to dangers. Here are common and deadly security mistakes to keep an eye out for:

• Trusting Third-Party Code That Can’t Be Trusted

Professional programmers do not build an app from scratch. They develop apps by imitating code from other developers. This is done through an open source or a third-part software that are used for performing important functions.

These can either be presentations with a license or graphical interference elements, or user encryption and authentication.

However, these third-party services are often full of vulnerabilities that go unnoticed by developers. And what makes the matter worse is that most businesses don’t know which third-party service they have used and whether or not they were checked for security loopholes.

So what is the solution? You can’t expect coders to write programs from scratch. The only solution is to check the guidelines by the International Education Association of Australia for working with third-parties. 

• Keeping Backdoor Accounts

Cisco Systems recently had this problem. They discovered various backdoor accounts that led to security loopholes. Sometimes coders use backdoor accounts or hard-code passwords for testing applications and then forget to take them out.

While most coders believe that nobody will find out about these accounts, the truth is that if they fall into the wrong hands, it will give hacktivists root access to affected routers.

The problem is that many organisations don’t take the initiative to be careful and the password and login for administrative rights are often written into the original frameware of running ICS devices.  

The problem is that so many organisations believe that this helps make their applications more manageable which is a big mistake. You don’t know who will become interested in your application!

• Forgetting to Secure Data

Sans Institute ranks sensitive data exposure as number 8 on its list of 25 dangerous programming mistakes.

In simpler terms, it’s not acceptable to handle sensitive data carelessly and you’re obligated to follow your country’s federal laws regarding vulnerable data. This includes usernames and passwords of employees, as well identification data and anything that can compromise an individual’s security.

Most organisations take the approach of employing encryption into their applications but this is not enough. You’re going to have to use powerful encryption tools that are immune to harmful attacks. Make sure not use reversible ‘symmetric’ algorithms to protect your passwords because this can jeopardise your identification system.

To ensure the safety of your app against loopholes and vulnerabilities, go for professional web application testing services. We offer top-notch vulnerability scanning service for web and mobile applications. Feel free to get in touch with us learn more

A Beginner’s Guide to DDoS Attack and Protection

A Beginner’s Guide to DDoS: Mechanics, Attack Types, and Protection

In the current Australian cyber threat landscape, availability is just as important as confidentiality. While data breaches make headlines, Distributed Denial of Service (DoS) attacks can silently cripple a business, costing thousands of dollars in lost revenue per minute.

For IT managers and business owners, the question isn't just "what is it?"—it is effectively asking, "how do you DDoS proof a network?" To answer that, we must first understand the mechanics of the attack itself.

What is a DDoS Attack?

A Distributed Denial of Service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a targeted server, service, or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic.

Think of it like a physical shop entrance. If one person stands in the doorway (a standard DoS attack), security can easily remove them. But if a large number of people crowd the door simultaneously, blocking legitimate customers from entering, the shop effectively ceases to function.

In the digital world, the goal is to send so much "junk" traffic that the server cannot process legitimate traffic, causing the site to slow to a crawl or crash completely.

The Mechanics: How Do You DDoS a Modern Network?

When people search for "ddos attack how to" or "how to dos," they are usually trying to understand the architecture behind these massive assaults.

A standard DoS attack typically comes from a single source. However, a DDoS attack relies on a network of compromised machines, known as a botnet.

1. Recruitment: Attackers infect thousands of vulnerable computers, servers, and increasingly, IoT devices (like smart cameras and routers) with malware.

2. Command and Control (C2): The attacker controls these infected devices remotely.

3. The Attack: The attacker sends a command to the botnet. Suddenly, thousands (or millions) of devices send a request to the attack targets simultaneously.

Because the traffic comes from legitimate devices distributed across the globe, distinguishing the bad traffic from the good is incredibly difficult.

Common Types of DDoS Attacks

Not all attacks are the same. Understanding the types of attack is critical for selecting the right DDoS protection. They generally fall into three categories:

1. Volumetric Attacks

These are the most common. The goal is to consume the bandwidth of the target site.

• UDP Floods: Attackers send vast amounts of UDP packets to random ports on the host. The host checks for the application listening at that port, finds none, and replies with an "ICMP Destination Unreachable" packet, exhausting its resources.

• DNS Amplification: This effectively explains "how to dos" with efficiency. The attacker sends a small request to a third-party server with a spoofed IP address (the victim's IP). The server sends a massive response to the victim, amplifying the traffic volume significantly.

2. Protocol Attacks (State-Exhaustion)

These attacks target the connection state tables in firewalls and load balancers.

• SYN Flood: The attacker sends a succession of SYN requests (the first part of a TCP handshake) in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic.

3. Application Layer Attacks (Layer 7)

These are the most insidious. They don't target bandwidth; they target the web server itself.

• HTTP Floods: The attacker sends what looks like legitimate HTTP requests (e.g., "GET /index.html" or "POST /login"). Because generating the page requires processing power from the server and database, a large number of these requests can crash the database, even with low bandwidth usage.

The Motivation: Why Attackers Do It

Why would someone expend resources to crash your site?

• Extortion: This is rising in Australia. Attackers demonstrate a small attack, then demand a ransom to stop a larger one.

• Smoke-Screening: Attackers use DDoS to distract your security team while they perform a more subtle data breach or injection attack elsewhere.

• Business Competition: Unscrupulous competitors may hire "DDoS-for-hire" services to take your site offline during peak sales periods.

Protection Strategies: How to Defend Your Infrastructure

To mitigate these threats, relying on a simple firewall is no longer enough. You need a multi-layered strategy.

Rate Limiting

Rate limiting restricts the number of network traffic requests a user can make within a specific timeframe. While this helps against simple scripting attacks, it often fails against complex botnets that rotate IP addresses.

Web Application Firewalls (WAFs)

Web Application Firewalls WAFs are essential for stopping application layer attacks. A WAF sits between the internet and your server, inspecting traffic for malicious patterns (like SQL injection or known bot signatures) and blocking them before they reach your database.

Traffic Scrubbing and Cloud Mitigation

For volumetric attacks, on-premise hardware often fails because the pipe simply fills up. Cloud-based DDoS protection services act as a massive filter. They accept all traffic meant for your website, "scrub" the bad requests at their massive data centers, and send only the legitimate traffic to your server.

Understanding "how to dos" or the mechanics of a botnet isn't about learning to hack—it's about learning to survive. As IoT devices proliferate, the scale of distributed denial of service dos attacks will only grow.

Organizations must move beyond reactive measures. You need to baseline your traffic, implement robust WAFs, and regularly stress-test your environment to ensure your defenses actually work when the flood arrives.

Is your infrastructure resilient enough to withstand a DDoS attack? Don't wait for your server to crash to find out. Contact Lean Security today to discuss our stress-testing and web application security services.