Cloud Hosting

Page 1,091«..10 20..1,0901,0911,092 1,093..1,100 1,110..»

DBST: a lightweight block cipher based on dynamic S-box – EurekAlert

July 16, 2023 | Author: admin

image:The encryption of DBST view more

Credit: Higher Education Press Limited Company

Block ciphers, a branch of modern cryptography, are playing a more prominent role in protecting information security as 5G technology develops. Although encryption algorithms of the traditional Feistel structure have great advantages in terms of consistent encryption and decryption, they have poor diffusion effects. Besides, they cannot adapt to the high throughput communication environment and resource-constrained devices. The S-box is the crucial nonlinear component in the block cipher and significantly determines the security of an algorithm. Unfortunately, the vast proportion of S-boxes exist in a static manner, which makes it difficult to effectively resist cryptographic attacks based on specific S-boxes.

To solve the problems, a research team led by Lang LI published their new research in Frontiers of Computer Science (2023, Vol. 17, Issue 3) co-published by Higher Education Press and SpringerNature.

The team proposed a lightweight block cipher based on dynamic s-box named DBST for devices with limited hardware resources and high throughput requirements. The round function of DBST employs a novel generalized Feistel variant structure, which dramatically improves the diffusivity of the traditional Feistel structure. The S-box in the algorithm integrates bit-slice technology with subkeys to create a key-dependent dynamic S-box model that compensates for the shortcomings of static S-boxes.

In the research, they perform security analysis and hardware experiment on DBST. The experimental data demonstrate that the proposed algorithm has high security, high throughput rate and low hardware resources. Furthermore, differential analysis of the S-boxes proves that DBST's S-boxes have fewer differential properties than RECTANGLE's S-boxes.

###

Research Article, Published: 15 June 2023

Liuyan YAN, Lang LI, Ying GUO. DBST: a lightweight block cipher based on dynamic S-box. Front. Comput. Sci., 2023, 17(3): 173805, https://doi.org/10.1007/s11704-022-1677-5

About Frontiers of Computer Science (FCS)

FCS was launched in 2007. It is published bimonthly both online and in print by HEP and Springer. Prof. Zhi-Hua Zhou from Nanjing University serves as the Editor-in-Chief. It aims to provide a forum for the publication of peer-reviewed papers to promote rapid communication and exchange between computer scientists. FCS covers all major branches of computer science, including: architecture, software, artificial intelligence, theoretical computer science, networks and communication, information systems, multimedia and graphics, information security, interdisciplinary, etc. The readers may be interested in the special columns "Perspective" and "Excellent Young Scholars Forum".

FCS is indexed by SCI(E), EI, DBLP, Scopus, etc. The latest IF is 2.669. FCS solicits the following article types: Review, Research Article, Letter.

Frontiers of Computer Science

Experimental study

Not applicable

DBST: a lightweight block cipher based on dynamic S-box

15-Jun-2023

Disclaimer: AAAS and EurekAlert! are not responsible for the accuracy of news releases posted to EurekAlert! by contributing institutions or for the use of any information through the EurekAlert system.

More:
DBST: a lightweight block cipher based on dynamic S-box - EurekAlert

Hunter Biden’s Matryoshka Cell Phone: How the IRS and Frothers … – Emptywheel

July 16, 2023 | Author: admin

Believe it or not, what sent me down the rabbit hole of Hunter Bidens laptop was not the laptop itself.

It was a cell phone.

Or, more specifically, it was two details in purported IRS whistleblower Gary Shapleys testimony. First, after introducing summaries from some Hunter Biden WhatsApp chats summaries that, Abbe Lowell claimed, got the most basic details wrong Shapley explained that the chats didnt come from the laptop itself, they came from a warrant served on Apple for the iCloud backup to which they were saved.

Q Could you tell us about this document, what is it, and how was it obtained

A Sure. So there was an electronic search warrant for iCloud backup, and these messages were in that backup and provided

Q Okay.

A from a third party, from iCloud.

This appears to be the search warrant return obtained again, per Shapleys testimony in August 2020.

For example, in August 2020, we got the results back from an iCloud search warrant. Unlike the laptop, these came to the investigative team from a third-party record keeper and included a set of messages. The messages included material we clearly needed to follow up on.

Shapleys disclosure that there were WhatsApp texts saved to iCloud stunned me. Thats because, for all the material produced from the laptop itself which even frothers have treated as all the content in Hunter Bidens iCloud account I had never seen WhatsApp texts.

Plus, theres a technical issue. WhatsApp texts, like Signal texts, dont automatically back up to iCloud. If one really wants to use their end-to-end encryption to best advantage, one doesnt store them in the cloud, because then the only easy way to get the texts would be directly from someones phone. These texts purported to involve a Chinese national (though, as noted, Lowell says thats false) whose phone would presumably be inaccessible overseas. And at the time the IRS obtained these texts, Hunter Biden didnt know about the investigation into himself. They hadnt seized his phone.

For Shapleys description to be true, then, Hunter Biden would have had to back up the texts to his iCloud. But if he had, they should have shown up on the laptop itself, right along with every other scrap of the Presidents sons private life.

There were crumbs of an explanation for this in Shapleys notes from the October 22, 2020 meeting on the governments treatment of the laptop attributed to Hunter Biden.

In the meeting, Whistleblower X who by his own description saw things online that he hadnt obtained via the laptop directly, even though DOJ warned the agents not to do that kept prodding about whether the investigative team had been provided all the messages on the laptop.

29. SA [Whistblower X] asked if all information on the hard drive had been reviewedthe answer is that they did not look at all of that SA [Whistleblower X] questions if Dillon reviewed all iMessages that wore relevant and not privileged. They would find the answer.

As Shapley recorded, on February 27, 2020, the forensics people provided all messages from the hard drive of material John Paul Mac Isaac restored from the laptop.

30. 2/27/2020 DE3 with all messages from the hard drive were provided by computer forensics via USB Drive

That production included iPad and MacBook messages, but no iPhone messages.

32. 227 Productions

DE3 USB containing exported messages (ipad and macbook messages) No iphone messages

They didnt get messages off any iPhone until they found a password, conveniently written on a business card, and with that password, were able to get into encrypted iPhone content on the laptop.

Laptop iphone messages were on the hard drive but encrypted they didnt get those messages until they looked at laptop and found a business card with the password on it so they were able to get into the iphone messages [my emphasis]

This still didnt answer my question how was the IRS able to get WhatsApp texts from iCloud when they werent on the iCloud content that appears on the Hunter Biden laptop.

But a detail on the fourth of Guy Dimitrelos reports on Hunter Bidens laptop may explain it.

In his first report, Dimitrelos explained that the 5 million artifacts found on the hard drive were connected to Hunter Bidens iCloud account, which he says was tied to the email [emailprotected]

[snip]

In his fourth report basically 133 pages into his sequential reporting Dimitrelos noted that Hunter Biden had another iCloud account, one tied to one of the emails he identified on page 4 of his report: [emailprotected]

In fact, at least according to the unreliable emails released at BidenLaptopEmails dot com (AKA MarcoPolo), thats the account to which the laptop believed to be the one that ended up at Mac Isaacs shop was registered to,not the [emailprotected] account.

At the Marco Polo site, there are 453 pages of emails from the [emailprotected] account (so around 22650). They include some of the most interesting in the collection, the ones directly with the Biden family and others indicating sensitive travel. There are 269 from the [emailprotected] account (so around 13,450) but its the latter that seems to have been taken over in early 2019. Ive described that the droidhunter88 gmail account effectively took over control of the iCloud account in that period (though I need to go back to the timeline and distinguish which events happened on one iCloud account and which on the other), and I think thats right. But importantly, at times, the RosemontSeneca email is linked into it. That is, a RosemontSeneca email was used on both iCloud accounts.

As to the phone, Dimitrelos describes that he found a phone registered to the [emailprotected] account in an encrypted container in an iTunes backup.

I identified an encrypted container located within Apples MobileSync iTunes default backup folder.

[snip]

I identified the iOS backup to be an iPhone with the phone number below and Apple id of

[emailprotected] which is one of Robert Hunter Bidens iCloud accounts.

Part two of Dimitrelos report described finding passwords for the iTunes account in two places. First, a picture of a partly rumpled lined piece of paper stored in a Hidden Album. This picture included Amazon, WiFi, iTunes, GMail, and Apple ID passwords, all registered to a different Gmail account. And then, associated with an iPad registered to still a third iCloud account, registered to a Gmail account.

The latter shows that Hunter Bidens iTunes password was changed on January 30, 2019, solidly in the middle of the period Ive argued that his account was taken over by the DroidHunter gmail account.

And screencaps in parts two and four of Dimitrelos report show that both the iPad and the iPhone were backed up during this same period, on February 6, 2019. Someone changed the iTunes password, and backed up these two devices, where they were found on the laptop. All in this same period where Hunter Biden seems to have lost control over his laptop.

In part four of Dimitrelos report, he describes that there were, indeed, WhatsApp messages on the iPhone, registered to that entirely different iCloud account, seemingly backed up to iTunes on the [emailprotected] account.

I cant be sure about this, because Im not a forensics expert, both Shapley and Dimitrelos are deliberately unreliable narrators, and even they dont have all the data to understand what went on here. But it appears that the reason why there were no WhatsApp texts on the laptop itself, which had all the content in the [emailprotected] iCloud account, is that they werent used by a device registered to the [emailprotected] iCloud account. They were used by a device registered to the [emailprotected] account, which was (as Shapleys notes reflect) stored in encrypted fashion on the laptop.

Theres one more very important point about this.

The government had a warrant. If they really did find a business card (one not described anywhere Ive seen in Dimitrelos report) with a password, they were able to get the encrypted content (though oftentimes prosecutors will recommend you go back and get a second warrant for that). From there, it seems, the IRS got another warrant for the other iCloud account, the [emailprotected] one. Thats how they got a legally sound copy of the WhatsApp texts in August 2020.

But for people like Rudy Giuliani or Garrett Ziegler or John Paul Mac Isaac, taking a laptop they purport to have been abandoned, and then using a password found on that laptop to access an encrypted container especially one of a different iCloud account is legally another level of conduct.

Update: I screwed up the number of emails; Ive corrected that now.

See the rest here:
Hunter Biden's Matryoshka Cell Phone: How the IRS and Frothers ... - Emptywheel

Tips and tricks to enhance Blockchain Security – Blockchain Council

July 16, 2023 | Author: admin

Encryption techniques are crucial in safeguarding Blockchain transactions, ensuring their confidentiality, integrity, and authenticity. Lets explore fundamental encryption techniques used in the Blockchain: public key cryptography, digital signatures, and hash functions.

Public Key Cryptography

Public key cryptography, also known as asymmetric cryptography, is a vital encryption technique in the Blockchain. It relies on two keys: a public key and a private key. The public key encrypts data, making it unreadable to unauthorized parties. Only the corresponding private key can decrypt the encrypted data, ensuring secure transmission and storage of Blockchain transactions.

Digital Signatures

Digital signatures play a vital role in verifying the identity and integrity of Blockchain messages. A unique signature is created for each message using public key cryptography based on the message content and the senders private key.

Hash Functions

A Hash Function is a powerful tool that transforms any number or string into a compact integer that is the perfect index for your hash table. With a Hash Function, you can quickly and confidently store and retrieve your data.

Securing Blockchain Networks

Blockchain networks face various security challenges and threats that could compromise their functionality and performance. Therefore, securing Blockchain networks is a crucial task that requires the implementation of effective measures and mechanisms. Some of the popular techniques are:

Consensus mechanism

One of the measures for securing Blockchain networks is network consensus protocols, which are the rules and algorithms that govern how nodes agree on the state and history of the Blockchain. Network consensus protocols ensure that all nodes follow the exact version of the Blockchain and prevent malicious nodes from creating forks or altering transactions.

Preventing DDoS attacks

The Blockchain is like a giant ledger that records every cryptocurrency transaction. But sometimes, hackers mess with Blockchain by sending fake traffic or requests to the network. This can slow down, disrupt the network, or even split it into two parts. This is how a distributed denial of service (DDoS) attack occurs, and advanced verification mechanisms should be in place to prevent them.

Prevention against Sybil attacks

Another important step towards securing Blockchain networks is protecting against Sybil attacks, where a malicious node creates multiple fake identities or accounts to gain more influence or control over a network. To protect against Sybil attacks, Blockchain networks can use techniques such as identity verification, reputation systems, or economic incentives.

Hardening Smart Contracts

Smart contracts are self-executing programs that run on a Blockchain and enable trustless and transparent transactions. Smart contracts can automate business processes, enforce rules and logic, and reduce costs and risks. Smart contract security is the collective term for security principles and practices leveraged by exchanges, developers, and users during the creation of smart contracts and interactions with them.

Some common vulnerabilities and best practices for smart contract security are reentrancy, overflow/underflow, and gas limit. They can be easily solved by some best practices available for each, like using the checks-effects-interactions pattern to avoid reentrancy, using the SafeMath library to prevent overflow/underflow and optimizing code for gas efficiency, and using fallback functions to handle errors.

To ensure the security and quality of smart contracts, it is also necessary to conduct auditing and testing before deployment. Auditing is reviewing the code and design of an intelligent contract to identify and fix any errors, bugs, or vulnerabilities. Testing is verifying the functionality and performance of an intelligent contract under various scenarios and inputs. Auditing and testing can be done manually or automatically using various tools and frameworks.

Wallet Security

Blockchain wallets are essential for interacting with Blockchain networks and smart contracts as they store and manage the crypto for the users. There are different types of Blockchain wallets, depending on how they store the private keys that control cryptocurrency access. All these wallets need security measures to prevent any attack or hack. Some of the common types of Blockchain wallets are:

Software wallets

Software wallets are applications that dont need any physical devices to save your information. Software wallets are convenient and easy to use but vulnerable to hacking, malware, or device failure.

Hardware wallets

Hardware wallets are physical devices that store the private keys offline, in a secure chip or memory card. However, hardware wallets can be expensive, lost, or damaged.

Paper wallets

These are printed documents containing private keys or QR codes representing them. Paper wallets are also offline and secure from online threats, but they can be easily destroyed, stolen, or misplaced.

There are other ways to classify Blockchain wallets, like their internet connection. Cold wallets are offline wallets not connected to the internet, such as hardware or paper wallets. Hot wallets are online wallets that are connected to the internet, such as software or web-based wallets. Cold wallets are more secure than hot wallets but are less convenient and accessible.

A third way to classify Blockchain wallets is by the number of signatures required to authorize a transaction. Multi-signature wallets that require multiple signatures to operate provide an extra layer of security and control, as they can prevent unauthorized transactions or require approval from multiple parties.

Secure Key Management

Private critical security protects the secret codes controlling access to cryptocurrencies and Blockchain transactions. Private keys are essential for encryption, decryption, and verification of crypto wallets or user accounts. Private keys should be kept secret and stored securely, as losing or exposing them can result in irreversible loss of funds or identity theft.

Different types of devices can store private keys, depending on their level of security and convenience. Hardware wallets are one of the most popular ways to save cryptocurrency. They are physical devices that store the private keys offline, in a secure chip or memory card. Hardware wallets are considered more secure and trustworthy than software wallets, as they are safe from online attacks and can be used on any computer.

Now, lets look at private key Generation and some storage practices that should be followed.

Key generation

Generate private keys using a secure and random source, such as cryptographic software or hardware. Avoid using weak or predictable sources, such as passwords or phrases.

Key storage

Store private keys in a safe and accessible location, such as a hardware or paper wallet. Avoid storing private keys on devices connected to the internet or shared with others. Backup, private keys in multiple locations and formats, such as paper, USB drives, or cloud storage

Implementing Access Controls

Access control is a core element of security that determines who can access specific data, apps, and resources and in what circumstances. Access control uses techniques such as user authentication and authorization, which verify whether a user can access the information. User authentication verifies that a user is who they claim to be, using various credentials, while user authorization grants or denies access to a user.

When it comes to controlling who can access what in a system, there are different ways to do it. For example, Discretionary access control (DAC), Mandatory access control (MAC), Role-based access control (RBAC), and Attribute-based access control (ABAC). RBAC is the most common one, where users get different levels of access and permissions depending on their roles and rank in the system.

Another popular and efficient way to implement access control is two-factor authentication (2FA), an additional security layer requiring more than one verification method to authenticate a user. 2FA can prevent unauthorized access even if the users credentials are compromised as the user is notified to ensure they are accessing the information.

Auditing and Monitoring Blockchain Systems

Blockchain technology allows entities to store and share transactional information in a controlled and systematic way. However, Blockchain also poses new challenges and risks that require effective auditing and monitoring solutions. Some of the critical aspects of auditing and monitoring Blockchain systems are:

Real-Time Monitoring for Suspicious Activity

Blockchain transactions are recorded in a distributed ledger visible to all participants, but they are not immune to fraud, manipulation, or errors. Real-time monitoring can help detect and prevent potential issues before they escalate or compromise the integrity of the Blockchain system.

Blockchain Analytics and Forensics

Blockchain analytics can help auditors gain insights into the behavior, trends, and patterns of the Blockchain participants and identify any gaps, errors, or inconsistencies in the data generated during the transactions on the Blockchain. Blockchainforensicscan help auditors trace specific transactions origin, destination, and history and verify their validity and authenticity.

Security Audit and Compliance

Blockchain systems are designed to be secure and resilient but not invulnerable to cyberattacks or human errors. A security audit should include mining pool monitoring, intelligent contract verification, private essential storage practices, and routing attack prevention.

Protecting Against 51% Attacks

A 51% attack seriously threatens any Blockchain network that relies on a proof-of-work consensus mechanism. They can prevent new transactions from being confirmed, reverse previous transactions, and double-spend their coins. Blockchain networks must adopt various measures to protect against 51% of attacks.

Some Blockchain networks use alternative consensus algorithms more resistant to 51% attacks than proof-of-work. This makes it more costly and risky for attackers to acquire a majority stake in the network. Other algorithms, such as proof of authority or reputation, rely on trusted or reputable nodes to validate transactions. In contrast, others implement additional security measures to deter or mitigate 51% of attacks. For example, Bitcoin has checkpoints, fixed points in the Blockchain history that any attacker cannot change.

51% of attacks are a significant challenge for Blockchain security and trust. However, they are not impossible to prevent or overcome. Using appropriate consensus algorithms and security measures, Blockchain networks can reduce the risk and impact of 51% of attacks and ensure their integrity and reliability.

Privacy and Anonymity in Blockchain

Privacy and anonymity are often called the backbone of Blockchain, but several necessary steps must be taken to ensure privacy and security.

Challenges and Risks of Privacy

Even the consensus mechanisms that ensure privacy can often be complex, like proof of work. The process of verification using a consensus mechanism consumes a lot of energy and resources, making it vulnerable to 51% attacks, where a group of miners or hackers can control most of the networks hashing power and manipulate the Blockchain.

Privacy-Enhancing Techniques

To overcome the challenges and risks of privacy, some Blockchain networks use alternative consensus mechanisms or additional security measures that enhance privacy. Some networks also use zero-knowledge proofs, cryptographic techniques that enable verification without disclosing data.

Anonymous Cryptocurrencies

Different cryptocurrencies are made to maintain and ensure that their owners identities are not disclosed to any hacker. This is done by using advanced smart contract techniques or security measures.

Securing Blockchain Interactions

Blockchain interactions are limited to transactions within the Blockchain network and involve interactions with external systems, such as IoT devices, web services, or other Blockchains. These interactions pose various security challenges and risks, such as:

Secure Blockchain Integration with External Systems

Blockchain networks must communicate and exchange data securely and reliably with external systems. But these external systems are often prone to different attacks and vulnerabilities. Blockchain networks can implement security measures, such as two-factor authentication, allowing listing, encryption, and digital signatures, to ensure the authenticity and integrity of the data and devices.

Oracles and Data Feeds

Oracles are intermediaries that provide external data or services to smart contracts running on a Blockchain network. But, oracles may also introduce security risks like data manipulation, conspiracy, or corruption. Thus Blockchain networks must use trusted or decentralized oracles that provide verifiable and tamper-proof data feeds.

Interoperability and Cross-Chain Security

Interoperability is the ability of different Blockchain networks to communicate and exchange value. Blockchain networks must use interoperability protocols or platforms to ensure cross-chain transactions security and consistency.

Education and Training for Security Awareness

Increasing awareness is one of the best ways to increase the implementation of different Blockchain security measures. Security awareness can be enhanced through various education and training initiatives, such as:

Promoting Security Culture in Blockchain

A strong security culture where everyone believes in the importance of security can foster a mindset among Blockchain users and developers, supporting security education, resources, and participation as part of an organizations culture and values.

Training Resources and Certifications

Training resources and certifications can help Blockchain users and developers acquire the knowledge and skills to secure Blockchain systems and mitigate security risks. Various training resources and certifications can help you understand Blockchain security, such as online courses, books, and seminars. You can also check out our courses, where we have discussed all the best tips and tricks to maintain security on a Blockchain network in great detail. These courses can help you to grow into a professional that understands the importance of Blockchain security and its implementation.

Building a Security-Focused Community

Building a security-focused community can help Blockchain users and developers share their experiences, insights, and best practices on Blockchain security. A security-focused community can also provide peer support, feedback, and collaboration opportunities for Blockchain security projects and initiatives.

Conclusion

We have discussed all the essential security measures from access control, securing wallets, maintaining privacy, and more in this blog and different tips related to them that you can utilize to secure the working of your organization. The importance of Blockchain security should be addressed at any cost by organizations, as it can lead to vulnerabilities and hacking attacks in the long term. By learning about the best practices, individuals can increase their opportunities in the field and help organizations to reach their goal of secure and transparent services.

Frequently Asked Questions

See the article here:
Tips and tricks to enhance Blockchain Security - Blockchain Council

What Is API Security & How Do You Achieve It? 10 Essential … – Hashed Out by The SSL Store

July 16, 2023 | Author: admin

Salts research shows that 17% of organizations have experienced a breach resulting from an API security gap. Dont become one of them.

Data from Salt underscores why API security (i.e., application programming interface security) is so important. The firms State of API Security Report Q1 2023 observes a 400% increase in unique attacks on its customers compared to the previous six months, with 31% experiencing sensitive data exposure. One result of this is that API security is no longer seen as simply an engineering concern: It is now increasingly on C-level executives radar.

Twitters 2022 API security breach serves as just one example of the dangers relating to API vulnerabilities. A security vulnerability first disclosed in December 2021 resulted in hackers stealing data belonging to over 5.4 million Twitter users. They released the data on the dark web in July 2022, causing the company plenty of embarrassment and reputational damage.

If your organization doesnt want to follow in Twitters footsteps, its time to focus on API security. This article provides an overview of 10 important API security methods to know and implement within your organization.

Lets hash it out.

API security refers to the holistic approach you take to keep your APIs safe against malicious attacks. It encompasses a wide range of security practices, tools, documentation, and procedures all designed to ensure that businesses can prevent API attacks and mitigate any damage when such attacks do take place.

The use of APIs in public and private sectors has exploded in the past few years. These interfaces now underpin vital IT infrastructure around the globe and can be found in the digital environments of everything from financial and government organizations to healthcare services. Given their popularity and widespread usage, its time to put application programming interface security under the microscope.

Given that APIs expose data and application logic, API security has become hugely important to businesses. From a technical perspective, web API security largely involves (although its not limited to):

When it comes to security vulnerabilities, OWASP is a highly regarded authority for software and web application security environments, including APIs. Its top 10 lists consider vulnerabilities, attack scenarios, and prevention methods. OWASP recently shared its Top 10 API Security Risks 2023, the order of which was as follows:

Given the breadth of these vulnerabilities, it is perhaps unsurprising that 80% of organizations report that ensuring API security is a challenge with 36% reporting API security as a significant issue.

When it comes to defending themselves against the above vulnerabilities, businesses exposing their APIs are not without a decent armory of resources. Lets take a look at some handy tools and techniques you can include in your arsenal.

1. Use Well-Established Standards for Access Control & Access Management

Using well-established standards for authorization and authentication flows is an important way to try to avoid security issues while ensuring it is still easy for authorized users to consume your API. Some important aspects of identity and access management practices include:

Implementing OAuth and OpenID Connect may help meet your needs in this respect.

2. Always Use TLS Encryption (HTTPS)

TLS encryption secures your data in transit using encryption (this enables a secure HTTPS connection, otherwise known as HTTP over TLS). Using TLS means that the messages flowing through your API to your server will be securely encrypted and, thus, secure from the prying eyes of malicious actors.

(This way, if they do intercept your data, all theyll see is a bunch of gibberish. They wont be able to decrypt the data without having access to the secret key.)

You can enable HTTPS encryption by installing an SSL/TLS certificate thats issued by a publicly trusted certificate authority (CA) onto your web server. These certificates come in three validation levels (domain validation, organization validation, and extended validation) and provide assurance that the websites digital identity is authentic.

3. Enable Mutual Authentication

Using mutual authentication is another important way to address API security. You can use public key infrastructure (PKI)-based client authentication certificates and mutual TLS authentication using policy expressions to ensure that both the server and client certificates properties match pre-defined values.

4. Validate and Sanitize Inputs

For interaction with third-party APIs, the emphasis should be on input validation and sanitization:

When implemented correctly, validation and sanitization can help avoid SQL injection attacks (these are where a cybercriminal injects malicious SQL commands into API requests that can steal, manipulate, or delete data).

Check out OWASPs Input Validation Cheat Sheet to learn more about how to perform input validation.

5. Implement Rate Limiting

Rate limiting, along with quotas and throttling, can help to reduce your organizations vulnerability to DDoS attacks. Rate limiting controls the amount of traffic that can access your API at any given time, meaning that bad actors cant overwhelm it and knock your service offline. Think of it as something akin to a funnel channeling water; a lot of traffic comes in on one end but gets funneled down to a smaller amount on the other. This prevents too many calls from coming in simultaneously and overwhelming your system.

You can set API rate limits in several ways based on the number of requests you want to receive in a set period, and whether theyre authenticated or unauthenticated calls. For example, you can set it to limit client calls to your API to one per second, or maybe 100 per minute.

Any decent API management solution should offer rate limiting so that you can easily defend against such attacks.

6. Focus on Regulatory Security Requirements

API security requires a multi-layered approach that accounts for varying requirements, including differing regulatory obligations. A business focused on anti-money laundering (AML) compliance, for example, will have a different focus than a company aiming to meet its security obligations under the Health Insurance Portability and Accountability Act (HIPAA) or Payment Card Industry Data Security Standards (PCI DSS).

Yet, whether its the implementation of an AML compliance program, the protection of patient data, or anything else related, there are certain API security best practices that apply.

Key to this is ensuring that API security is addressed as part of an overarching cybersecurity strategy that adheres to industry standard best practices (relating to PKI certificate management, key management, and so on). For example, always ensure that youre storing your API keys (and other cryptographic keys) securely outside of your application (i.e., dont embed it in its code or source tree).

Many organizations opt to use a key vault, physical hardware storage module (HSM), or a trust management solution.

7. Take a SecDevOps Approach

Another way that you can boost the security of your APIs is to shift left that security i.e., move it to an earlier stage of the development timeline within the development lifecycle. Instead of designing and building an API and then implementing security testing using the traditional DevOps or DevSecOps approach, shifting security left as part of a SecDevOps philosophy supports the implementation of security testing as a fundamental part of the build process.

This way, API security is an integral part of the process throughout and isnt regarded as an afterthought.

8. Use a Secure API Gateway

Taking advantage of evolving API management tools can also help improve your API security. For example, using API gateways means that organizations can implement robust security at the gateway level, rather than leaving it to individual teams to determine and implement security mechanisms. Think of it as the gatekeeper that restricts or permits access to your applications and data.

Implementing full lifecycle API management via a product such as Tyk API Gateway, for example, supports standardization across a companys APIs.

9. Get into the Zero Trust Mindset

A zero trust security mindset and model is another way to enhance your API security. Its all about verifying everything automatically and trusting nothing within your network and other systems. This requires continuous authentication throughout a connection.

Adoption of zero trust security is growing rapidly, with the zero trust security market expected to achieve a compound annual growth rate (CAGR) of 17% between 2023 and 2028. Zero trust is a boon for security because no users or devices are trusted by default; rather, they have to be verified every time, even if they were previously trusted.

10. Take a Robust Approach to Testing

Finally, its essential that organizations re-check their API security after patches and bug fixes are implemented. (Applying patches can fix some issues but also create others.) You can use automated testing to do so on your site, but manual oversight is a must as well. Implementing regular penetration testing is also important.

Dont have the internal resources to handle such tasks? You could hire a third-party firm to perform this important function to discover any security vulnerabilities that your API may have. This way, you can discover what vulnerabilities you have rather than leaving them exposed and at risk of exploitation by a hacker.

Cybersecurity is top of mind for many businesses. 2022 was a difficult year for businesses and consumers alike when it came to security, emphasizing the importance of preparing for a future of better API security.

Thankfully, as API security threats grow, so, too, does our understanding of how to combat them. Between zero trust methodologies, shifting security left in the API design process, and baking security into API management processes and architectures, organizations can have the knowledge and tools they need to prepare for a more secure future for application programming interfaces.

Continue reading here:
What Is API Security & How Do You Achieve It? 10 Essential ... - Hashed Out by The SSL Store

Critical Security Flaws Uncovered in Honeywell Experion DCS and … – The Hacker News

July 16, 2023 | Author: admin

Jul 14, 2023THNVulnerability/ Cyber Threat

Multiple security vulnerabilities have been discovered in various services, including Honeywell Experion distributed control system (DCS) and QuickBlox, that, if successfully exploited, could result in severe compromise of affected systems.

Dubbed Crit.IX, the nine flaws in the Honeywell Experion DCS platform allow for "unauthorized remote code execution, which means an attacker would have the power to take over the devices and alter the operation of the DCS controller, whilst also hiding the alterations from the engineering workstation that manages the controller," Armis said in a statement shared with The Hacker News.

Put differently, the issues relate to lack of encryption and adequate authentication mechanisms in a proprietary protocol called Control Data Access (CDA) that's used to communicate between Experion Servers and C300 controllers, effectively enabling a threat actor to take over the devices and alter the operation of the DCS controller.

"As a result, anyone with access to the network is able to impersonate both the controller and the server," Tom Gol, CTO for research at Armis, said. " In addition, there are design flaws in the CDA protocol which make it hard to control the boundaries of the data and can lead to buffer overflows."

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), in an advisory of its own, said seven of the nine flaws carry a CVSS score of 9.8 out 10, while the two others have a severity rating of 7.5. "Successful exploitation of these vulnerabilities could cause a denial-of-service condition, allow privilege escalation or allow remote code execution," it warned.

In a related development, Check Point and Claroty uncovered major flaws in a chat and video calling platform known as QuickBlox that's widely used in telemedicine, finance, and smart IoT devices. The vulnerabilities could allow attackers to leak the user database from many popular applications that incorporate QuickBlox SDK and API.

This includes Rozcom, an Israeli vendor that sells intercoms for residential and commercial use cases. A closer examination of its mobile app led to the discovery of additional bugs (CVE-2023-31184 and CVE-2023-31185) that made it possible to download all user databases, impersonate any user, and perform full account takeover attacks.

"As a result, we were able to take over all Rozcom intercom devices, giving us full control and allowing us to access device cameras and microphones, wiretap into its feed, open doors managed by the devices, and more," the researchers said.

Also disclosed this week are remote code execution flaws impacting Aerohive/Extreme Networks access points running HiveOS/Extreme IQ Engine versions before 10.6r2 and the open-source Ghostscript library (CVE-2023-36664, CVSS score: 9.8) that could result in the execution of arbitrary commands.

Shield Against Insider Threats: Master SaaS Security Posture Management

Worried about insider threats? We've got you covered! Join this webinar to explore practical strategies and the secrets of proactive security with SaaS Security Posture Management.

"Ghostscript is a widely used but not necessarily widely known package," Kroll researcher Dave Truman said. "It can be executed in many different ways, from opening a file in a vector image editor such as Inkscape to printing a file via CUPS. This means that an exploitation of a vulnerability in Ghostscript might not be limited to one application or be immediately obvious."

Security shortcomings have also been made public in two Golang-based open-source platforms Owncast (CVE-2023-3188, CVSS score: 6.5) and EaseProbe (CVE-2023-33967, CVSS score: 9.8) that could pave the way for Server-Side Request Forgery (SSRF) and SQL injection attacks, respectively.

Rounding off the list is the discovery of hard-coded credentials in Technicolor TG670 DSL gateway routers that could be weaponized by an authenticated user to gain full administrative control of the devices.

"A remote attacker can use the default username and password to login as the administrator to the router device," CERT/CC said in an advisory. "This allows the attacker to modify any of the administrative settings of the router and use it in unexpected ways."

Users are advised to disable remote administration on their devices to prevent potential exploitation attempts and check with the service providers to determine if appropriate patches and updates are available.

Read this article:
Critical Security Flaws Uncovered in Honeywell Experion DCS and ... - The Hacker News

Gas Token Scam: Exploiting Binance Smart Chain’s Refund Feature – BeInCrypto

July 14, 2023 | Author: admin

Security researchers have identified a gas token scam targeting users of Binance Smart Chain (BSC).

The attack vector takes advantage of so-called gas tokens intended to help users save on gas fees. Although not the first time it has been observed, the attack has reemerged in response to the recent Multichain exploit.

The latest gas token scam appears to have arisen in response to various security tools prompting their users to revoke any unsolicited transactions. These prompts were issued in response to the recent Multichain bridge attack that stole around $126 million in crypto assets.

After news broke that Multichains Fantom bridge had been compromised, Multichain urged users to revoke all contract approvals related to the cross-chain bridging protocol.

Following the announcement, security tool developers moved quickly to minimize their users exposure to risk. For example, the browser extension Revoke Cash recommended users revoke all Multichain approvals, as did the Rabby crypto wallet.

While developers issued such warnings to help protect users from potential threats, at least one hacker has taken advantage of the wave of revocations.

As the twitter user blanker.Eth first identified the scammer deployed a fake ERC-20 token on BSC that steals funds when users revoke the contract.

By using a fake contract, the scam minted CHI in victims wallets before transferring it to another address. But what exactly is CHI? And how was it used to bypass wallet defenses and steal crypto?

Developed by the team behind the 1inch DeFi protocol, CHI is what is known as a gas token.

The concept was originally developed to help Ethereum users lock in low gas prices to use later when they rose. Such tokens used a feature built into Ethereum that refunded gas fees when clearing storage. That is until a 2021 update made gas tokens redundant on the Ethereum mainnet by voiding the refund feature they exploited.

However, certain blockchains, including BSC, still implement the protocols deployed gas tokens. Whats more, other Ethereum-based blockchains could also be vulnerable to the attack. Although there is no evidence to suggest they are currently being exploited in this way.

Unfortunately, for BSC, the weakness appears to be a recurring issue. For example, BlockSec identified a similar scam back in January. And as long as the refund mechanism that gas tokens use remains in play, malicious actors will likely continue to exploit them.

After they were alerted to the latest threat, the developers behind Revoke Cash and Rabby moved quickly to respond.

Revoke Cash added a feature that disables revoking approvals if gas fees exceed a certain threshold. Rabby has implemented similar precautions.

In adherence to the Trust Project guidelines, BeInCrypto is committed to unbiased, transparent reporting. This news article aims to provide accurate, timely information. However, readers are advised to verify facts independently and consult with a professional before making any decisions based on this content.

See the original post here:

Gas Token Scam: Exploiting Binance Smart Chain's Refund Feature - BeInCrypto

Crypto Strategist Says Binance Coin (BNB) and Bitcoin Cash (BCH) Flashing Bullish Signals Here Are His Targets – The Daily Hodl

July 14, 2023 | Author: admin

A widely followed crypto strategist is bullish on two popular altcoins amid relatively calm price action for the markets.

Starting with Binance Coin (BNB), the pseudonymous analyst Kaleo tells his 593,300 Twitters followers that the native token of the Binance Smart Chain is a bargain at a price of below $250.

According to Kaleos charts, BNB could revisit the $300 price level and potentially hit the April high of slightly above $340 sometime in the last four months of 2023.

BNB back to $300

But you wouldnt bullieve it.

BNB is trading at $248 at time of writing.

The pseudonymous crypto strategist says that Binance is currently receiving little attention but that will change once it surges.

The funny thing is no one is talking about BNB right now but, when it finally does take off here in a bit its big enough that EVERYONE will be.

And everyone will talk about how obvious it was in hindsight.

But somehow it isnt obvious now.

Next up is Bitcoin Cash (BCH). Kaleo says that when paired against Bitcoin (BTC), Bitcoin Cash possesses more upside potential.

After sitting on the sidelines for a few days, I punted another BCH long.

Really like the way its looking vs. BTC here for the potential of seeing one last leg higher.

Bitcoin Cash is trading for 0.00926000 BTC ($218.19) at time of writing. The 15th-largest crypto asset by market cap has surged by around 140% in less than a month from a June low of 0.00386000 BTC ($117.21).

Generated Image: Midjourney

Excerpt from:

Crypto Strategist Says Binance Coin (BNB) and Bitcoin Cash (BCH) Flashing Bullish Signals Here Are His Targets - The Daily Hodl

Heres When the Binance BNB Chain Will Hard Fork and Why – CryptoPotato

July 14, 2023 | Author: admin

On July 12, BNB Chain announced that the mainnet blockchain is expected to have a scheduled hard fork upgrade at block height 328,088,888.

Considering the current speed of block generation, the hard fork is forecast to occur on July 19, it added. BNB Chain was formerly known as Binance Smart Chain (BSC).

The hard fork has been dubbed Zhang Heng after a Chinese polymathic scientist and statesman who lived during the Han dynasty.

The upgrade will introduce BEP-255, which proposes implementing on-chain asset reconciliation on BNB Beacon Chain to improve security.

It explained that user balance changes are tracked in each block and will be reconciled to identify issues before adding:

When there are reconciliation errors, the blockchain will panic and stop producing new blocks.

There is also a bug fix for a security issue called Rogue Key Attack, it noted.

The team explained that no action needs to be taken by BNB holders, but full node operators need to switch to v0.10.16.

Last month BNB Chain went through another hard fork called Luban which introduced three evolution proposals (BEPs).

According to DeFiLlama, BNB Chain is the third largest in terms of total value locked with $3.3 billion. There are 626 protocols running on the network, which has around 1.38 million active users, it added.

However, BNB Chain TVL has declined by almost 30% since the beginning of this year. Additionally, it is down 85% from its all-time high of $22 billion in May 2021.

The largest protocol on the network is the PancakeSwap DEX which has almost half of the total value locked.

BNB prices are down 2.3% on the day to trade at $243 at the time of writing. The asset surged 6% on July 10 as users loaded up on BNB to partake in the Arkham token sale, which begins on Binance Launchpad on July 17.

However, BNB has lost 21% since the SEC sued Binance in early June. The exchange token, which the regulator alleges is a security, is also down 64.5% from its May 2021 all-time high of $686.

Multichain, Missing $120 Million Of Cryptocurrencies And Its CEO … – Forbes

July 14, 2023 | Author: admin

Computing and malware concept. Hacker using computer with digital business interface. Double exposure

Its software malfunctioning and CEO missing, moribund blockchain bridge Multichain suffered the additional indignity of a $120 million hack and announced that it would not resume operations.

The team behind the bridge announced in late May that it was unable to contact its CEO and co-founder, who goes by the single name Zhaojun, after rumors of his arrest in China appeared on Twitter. Zhaojun, who founded the company alongside DJ Qian, held the only access codes required to fix technical issues with the protocol.

Multichain said it was experiencing unusual activity on Thursday evening and added that assets had been moved to an unknown address abnormally. Blockchain security firm Peck Shield found that the stolen funds included several stablecoins, including tether, Circles U.S. dollar coin (USDC USDC ) and dai and tokens like chainlink (LINK LINK ), wrapped bitcoin and wrapped ether, the latter two of which are versions of those coins that represent the value of each coin in a different chain. The funds were transferred into six different addresses, three of which were subsequently blacklisted by Circle, according to PeckShield.

The cross-chain bridge connects blockchains, including Ethereum ETH , Bitcoin and even Dogechain to each other. Most impacted were tokens going from the Fantom FTM blockchain into either Ethereum or the Binance Smart Chain. That liquidity pool on the Mulitchain bridge suffered the largest exploit as about $118 million were transferred out of it. Transfers out of the Dogechain and Moonriver blockchains also were affected.

Multichain currently has $1.26 billion worth of cryptocurrencies locked into its system, according to DeFi Llama. All bridge transactions are currently stuck on source chains as the company halted operations. Multichain did not respond to Forbes request for comment.

Previously known as Anyswap, Multichainwas first hacked in 2021 when attackers siphoned $8 million worth of stablecoins out of the protocol. The road for the bridge protocol has not been easy since. In May, days before Multichain announced it could not reach Zhaojun, Binance said it would halt deposits into Binance Smart Chain from 10 Multichain-associated bridged tokens after users reported delayed and stuck transactions.

Binance CEO Changpeng Zhao, said that the latest hack did not impact Binance users, citing Mays decision to close deposits and adding in a Tweet that the exchange had already swapped all assets associated with Multichain bridges

Multichains token is down 6% to $2.81 a piece since the hack was first reported by the team. It traded above $7.50 in the days before the company lost contact with Zhaojun.

Cross-chain bridges were a once-popular way to connect two blockchains. The bridge would hold the token from one chain and create a wrapped token of the second chain, each transaction temporarily worth double. The high amount of liquidity held in bridge protocols make them extremely susceptible to hacks, and in 2022 accounted for nearly $2 billion worth of stolen funds,70% of all crypto hacks in the year.

Interested in reading more? Subscribe to Forbes CryptoAsset and Blockchain Advisor here.

Read the original here:

Multichain, Missing $120 Million Of Cryptocurrencies And Its CEO ... - Forbes

Discover Emerging Opportunities With BNB Chain And Uwerx(WERX) – The Portugal News

July 14, 2023 | Author: admin

Over the past few years, presale events have been gated for specific users, and not many crypto enthusiasts have been lucky to make money out of it. Presales have great precedents in the market because they are the least risky opportunity in a market known for high risks and volatility. Uwerx has some excellent prospects toward launch, and being a massive utility project, there are some exciting trends to watch out for.

However, lets discuss some available opportunities with the BNB Chain first.

BNB Chain is a network powered by the utility token of the Binance centralized exchange Binance Coin (BNB). The network has some affiliations with the exchange, but Binance tries to establish that its an entirely separate entity in a bid to differentiate the decentralized platform. BNB Chain was formerly called the Binance Smart Chain, and its an EVM chain that offers more scalable options to Ethereum.

It was the rave of the market in the 2021 bull market as users migrated from Ethereum (ETH) to the more scalable BNB Chain. Most existing projects bridged their networks to BNB Chain to allow cheaper access to their ecosystem. The network is one of the many values built around the BNB token, although activity has been somewhat low recently. You can expect excitement in the bull market when the demand for alternative EVM networks rises.

BNB Chain has scheduled an upgrade called the Luban hard fork, and its targeted at improving security on the network, which is a necessary feature in the landscape. With the BNB Chain at the top of the market, you can always bet on it to benefit from price uptrends in the next few months.

As Uwerx releases more pages and sections of its platform in its alpha phase, users have scurried to get the last bit of WERX tokens available on the Stage 5 presale. A price increase is imminent, so why not get the cheaper tokens in the current round? Uwerx released additional pages from its platform, like the login and signup, job creation page, contract initiation, activity dashboard, and many others.

This is in preparation for its beta launch, where users can test the network and provide feedback on Uwerx. These released features appear intuitive, and despite being a Web3 platform, it makes it easy for users to get used to the functionalities like its an existing platform.

Uwerx introduces several new features users are looking to adopt, and its competitive edge is a huge advantage for its long-term vision in the gig market. WERX is the native token for governance and utility, selling for $0.05245 on presale.

With price predictions at $3, this is a potential 100x profit and is the least you can make from the presale. Enter the WERX presale now and claim a 15% bonus.

Presale: invest.uwerx.network

Telegram: https://t.me/uwerx_network

Twitter: https://twitter.com/uwerx_network

Website: https://www.uwerx.network

Go here to see the original:

Discover Emerging Opportunities With BNB Chain And Uwerx(WERX) - The Portugal News