Nice work:

Radio relay attacks are technically complicated to execute, but conceptually easy to understand: attackers simply extend the range of your existing key using what is essentially a high-tech walkie-talkie. One thief stands near you while you’re in the grocery store, intercepting your key’s transmitted signal with a radio transceiver. Another stands near your car, with another transceiver, taking the signal from their friend and passing it on to the car. Since the car and the key can now talk, through the thieves’ range extenders, the car has no reason to suspect the key isn’t inside—and fires right up.

But Tesla’s credit card keys, like many digital keys stored in cell phones, don’t work via radio. Instead, they rely on a different protocol called Near Field Communication or NFC. Those keys had previously been seen as more secure, since their range is so limited and their handshakes with cars are more complex.

Now, researchers seem to have cracked the code. By reverse-engineering the communications between a Tesla Model Y and its credit card key, they were able to properly execute a range-extending relay attack against the crossover. While this specific use case focuses on Tesla, it’s a proof of concept—NFC handshakes can, and eventually will, be reverse-engineered.

Read More

The US Department of Justice (DOJ) unsealed an indictment that charged three Iranian cybercriminals with orchestrating a series of attacks from October 2020 to the present, that resulted in the three being able to access the computer networks of multiple US entities. The three, Mansour Ahmadi, a.k.a. Mansur Ahmadi, 34; Ahmad Khatibi Aghda, a.k.a. Ahmad Khatibi, 45; and Amir Hossein Nickaein Ravari, a.k.a. Amir Hossein Nikaeen, a.k.a. Amir Hossein Nickaein, a.k.a. Amir Nikayin, 30, not only attacked hundreds of victims in the United States, but also entities in Israel, the United Kingdom, Russia, and Iran itself.

To read this article in full, please click here

Read More

This blog was written by an independent guest blogger.

APIs have become a vital part of doing business. Organizations increasingly rely on the use of APIs for day-to-day workflows, particularly as cloud applications become something of a mainstay.

A recent report found that the average number of APIs per company increased by 221% in 2021. Not only are APIs impossible to ignore, but the need to invest in API security cannot be overlooked. The trend in usage is closely followed by opportunists seeking ways to exploit vulnerabilities for their gain.

To ensure adequate security, developers and organizations alike need to understand the risks and design their security strategy to mitigate them. Too often, security approaches are redesigned after a breach or hack occurs. By then, the damage has been done. Being proactive will save organizations time, money, and heartache.

API security risks

As cybercriminals work tirelessly to develop new ways to steal data and harm organizations, the list of threats is seemingly endless. That should not be cause for despair, however. While it can feel overwhelming, IT departments and financial controllers should not let it stunt them into doing nothing.

In this article, we cover the most prominent threats to API security, and ways to employ tactics to protect users, data, and networks.

Software bugs

At a base level, software bugs are an easy point of exploitation for cybercriminals. Application errors will weaken API security, leaving your organization – and your valuable data – vulnerable to attackers.

It’s crucial to have a system in place to regularly check for software updates and patches. Patches function like a software update, plugging potential holes that cyberattackers may use to enter your network or systems.

Ensure you conduct regular vulnerability scans and perform security attacks on your implemented APIs. Of course, identifying these vulnerabilities is only the first step. Organizations must ensure they have a workflow in place to address weaknesses swiftly.

Broken object-level authorization attacks

Another key API security risk is at exposed endpoints that relate to object identifiers. These can be seen as a welcome mat for attackers to enter the endpoints, leaving a wide attack area with access to objects and data.

To mitigate this risk, organizations must implement authorization checks at the object level. Checking every function that accesses a data source through input from users will help protect you from criminal activity. Consider using an API gateway, access tokens, object-level authorization checks, and implementing proper authorization credentials to stay protected.

Misconfiguration

Security misconfigurations are another common threat to API security. This risk is typically enabled through factors such as insecure default configs, misconfigured HTTP headers, unnecessary HTTP methods, or open cloud storage. It is crucial not to rely on default configurations and instead to configure APIs to fit your organization’s specific needs and requirements.

Exposed data

At times, developers leave object properties exposed, leaving it up to organizations to filter data before availing it to end users. While well intentioned, this unfortunately leaves a large amount of data exposed, luring cybercriminals to attack.

Ensure the data exposed through APIs is strictly limited to only the necessary, trusted users. Evaluate access control and ensure you’re deliberate with what is available, and to whom.

Injections

The threat of injections arises when a command or query prompts the relay of unverified or suspicious data. This type of attack can cause the execution of unintended commands or tricks the API into providing unauthorized access.

Injections are a major threat to API security and can prey upon third-party applications in the process. It’s crucial that APIs are designed to be impenetrable. Input validation should be designed to reject unwanted requests for access to data.

Take API security seriously

As the dependence on APIs rises, so too does the risk of attacks from cybercriminals. Organizations must understand the risks and implement security strategies to protect their users and data. Nothing short of constant vigilance will prove reliable for API security. Understanding where threats come from is the best way to proactively act against attackers.

Read More

Experts urge the public not to fall for classic scams

Read More