Month: September 2022

Posted on

Tackle IoT application security threats and vulnerabilities

Vulnerabilities of IoT applications

IoT applications suffer from various vulnerabilities that put them at risk of being compromised, including:

  • Weak or hardcoded passwords. Many passwords are easy to guess, publicly available or can’t be changed. Some IT staff don’t bother changing the default password that shipped with the device or software.
  • Lack of an update process or mechanism. IT admins unintentionally exclude many IoT apps and devices from updates because they are invisible on the network. Also, IoT devices may not even have an update mechanism incorporated into them due to age or purpose, meaning admins can’t update the firmware regularly.
  • Unsecured network services and ecosystem interfaces. Each IoT app connection has the potential to be compromised, either through an inherent vulnerability in the components themselves or because they’re not secured from attack. That includes any gateway, router, modem, external web app, API or cloud service connected to an IoT app.
  • Outdated or unsecured IoT app components. Many IoT applications use third-party frameworks and libraries when built. If they’re obsolete or have known vulnerabilities and aren’t validated when installed in a network, they could pose security risks.
  • Unsecured data storage and transfer. Different data types may be stored and transmitted between IoT applications and other connected devices and systems. All must be properly secured via Transport Layer Security or other protocols and encrypted as needed.

Threats to IoT applications

Threats to IoT applications fall into several general categories: spoofing, information disclosure, distributed denial of service (DDoS), tampering and elevation of service. Attackers typically use these threats as an entry point to a network and then move on to other areas to cause problems, such as stealing data, blocking connections or releasing ransomware.

IoT app threats
Four threats that target IoT app vulnerabilities.

Spoofing threats. Attackers intercept or partially override the data stream of an IoT device and spoof the originating device or system, which is also known as a man-in-the-middle attack. They intercept shared key information, control devices or observe sent data.

Information disclosure threats. Attackers eavesdrop on broadcasts to obtain information without authorization, jam the signal to deny information distribution or partially override the broadcast and replace it with false information. They then threaten to release or sell the data.

Tampering threats. Attackers can gain access to the firmware or OSes of the devices running an IoT app and then partially or completely replace it on the device. They then use the genuine device and application identities to access the network and other connected services. For example, SQL or XML injection attacks and DDoS attacks are tampering threats for IoT apps.

Elevation of privilege threats. Attackers use unsecured IoT apps to change the access control rules of the application to cause damage. For example, in an industrial or manufacturing environment, an attacker could force a valve to open all the way that should only open halfway in a production system and cause damage to the system or employees.

How to protect IoT applications

Protecting IoT applications isn’t a one-and-done activity. It requires planning, action and regular monitoring. Get started with these nine ways.

1. Learn the most likely threats

Threat modeling can identify, assess and prioritize the potential IoT app vulnerabilities. A model can suggest security activities that will ensure IT admins include IoT apps in overall security strategies. The model should continue to evolve and grow to reflect the state of the IoT app accurately.

2. Understand the risks

Not all risks are the same when it comes to IoT apps and an organization. Prioritize risks in order of concern and act accordingly. Many tech teams forget to align the risk with business scenarios and outcomes. A failure or breach in one IoT app may seem innocuous to IT but have serious financial implications for the company.

3. Update apps regularly

IT admins must deploy updates to IoT apps as quickly as possible to ensure the safety of the entire network. Use only approved and authenticated updates and, if updating apps over the air, use a VPN to encrypt all update data streams. Secure public key infrastructures (PKIs) can also authenticate devices and systems.

4. Secure the network

Firewalls, encryption and secure communication protocols protect IoT apps from unauthorized access. Regularly review the various standards, devices and communication protocols used on the network to ensure adequate security. Add IoT apps to any application security testing.

5. Enable strong authorization

Strong password protection is essential for IoT applications and that includes developing a secure password process for those creating passwords. Change the default passwords on IoT devices and apps and ensure they’re changed regularly. Deploying a two- or three-way authentication model with TLS communication protocols reduces the chances that authentication data can be compromised at any point.

6. Secure communication

Encrypting data between IoT devices, apps and back-end systems keeps data safe from attackers. That includes encrypting data at rest and in transit and adopting PKI security models to ensure both senders and receivers get authenticated on the system before transmitting.

7. Secure control applications

Applications and systems that have access to IoT apps should also be secured. When they are secure, it stops the client IoT system from being compromised by outside attacks and prevents it from propagating attacks downstream.

Not applying the same level of security measures to each component of IoT deployments can lead to problems beyond the individual device or application.

 

8. Secure API integrations

APIs are often used to push and pull data between applications and systems. They are another way for attackers to connect to IoT apps and cause problems. Only authorized devices and applications must communicate with APIs, making it easier to detect threats and attacks immediately. IT admins must also use API version management with old or redundant versions identified and removed regularly.

9. Monitor IoT apps

Monitoring IoT apps is the final step in protecting them. Ensure they’re tested and scanned like the rest of the network to get alerts and address IoT security issues quickly.

IoT devices and applications pose a significant risk to organizations today. With hundreds or even thousands of devices connected to an enterprise network, not applying the same level of security measures to each component of IoT deployments can lead to problems beyond the individual device or application.

S.No Vulnerability Exploit
1. Vulnerability is a weakness in a system that can be exploited. Exploit is a tool that can be used to take advantage of a vulnerability.
2. Vulnerabilities can exist without being exploited. Exploits are created through the use of vulnerabilities.
3. Vulnerabilities can be exploited for a variety of purposes. Exploits are often used to execute malicious code.
4. Vulnerabilities can remain open and potentially exploitable. Exploits are often patched by software vendors once they are made public.
5. Vulnerability can allow the attacker to manipulate the system Exploits take the form of software or code which helps us to take control of computers and steal network data
6. Vulnerability can cause by complexity, connectivity, poor password management, Operating system flaws, Software Bugs, etc. Exploits are designed to provide super user-level access to a computer system.

 

Analysis of a cyberattack.

a. Who were the victims of the attacks?
b. What technologies and tools were used in the attack?
c. When did the attack happen within the network?
d. What systems were targeted?
e. What was the motivation of the attackers in this case? What did they hope to achieve?
f. What was the outcome of the attack? (stolen data, ransom, system damage, etc

 

A malware attack is a common cyberattack where malware (normally malicious software) executes unauthorized actions on the victim’s system. The malicious software (a.k.a. virus) encompasses many specific types of attacks such as ransomware, spyware, command and control, and more.

Criminal organizations, state actors, and even well-known businesses have been accused of (and, in some cases, caught) deploying malware. Like other types of cyber attacks, some malware attacks end up with mainstream news coverage due to their severe impact.

There are three main types of malware attack vectors:

  • Trojan Horse: This is a program which appears to be one thing (e.g. a game, a useful application, etc.) but is really a delivery mechanism for malware. A trojan horse relies on the user to download it (usually from the internet or via email attachment) and run it on the target.
  • Virus: A virus is a type of self-propagating malware which infects other programs/files (or even parts of the operating system and/or hard drive) of a target via code injection. This behavior of malware propagation through injecting itself into existing software/data is a differentiator between a virus and a trojan horse (which has purposely built malware into one specific application and does not make attempts to infect others).
  • Worm: Malware designed to propagate itself into other systems is a worm. While virus and trojan horse malware are localized to one infected target system, a worm actively works to infect other targets (sometimes without any interaction on the user’s behalf).

 

Security Operations Center (SOC)

The major elements of a SOC, are people, processes, and technologies.

  • Tier 1 Alert Analyst – These professionals monitor incoming alerts, verify that a true incident has occurred, and forward tickets to Tier 2, if necessary.
  • Tier 2 Incident Responder– These professionals are responsible for deep investigation of incidents and advise remediation or action to be taken.
  • Tier 3 Threat Hunter – These professionals have expert-level skill in network, endpoint, threat intelligence, and malware reverse engineering. They are experts at tracing the processes of the malware to determine its impact and how it can be removed. They are also deeply involved in hunting for potential threats and implementing threat detection tools. Threat hunters search for cyber threats that are present in the network but have not yet been detected.
  • SOC Manager – This professional manages all the resources of the SOC and serves as the point of contact for the larger organization or customer.

 

SIEM systems are used for collecting and filtering data, detecting and classifying threats, and analyzing and investigating threats.

 

SIEM and security orchestration, automation and response (SOAR) are often paired together as they have capabilities that complement each other.

Metrics or Key performance indicators (KPI) define SOC performance.

five metrics are commonly used as SOC metrics

  • Dwell Time – the length of time that threat actors have access to a network before they are detected, and their access is stopped.
  • Mean Time to Detect (MTTD) – the average time that it takes for the SOC personnel to identify valid security incidents have occurred in the network.
  • Mean Time to Respond (MTTR) – the average time that it takes to stop and remediate a security incident.
  • Mean Time to Contain (MTTC) – the time required to stop the incident from causing further damage to systems or data.
  • Time to Control – the time required to stop the spread of malware in the network.
Posted on

SPF Permerror

A majority of organizations use multiple email service providers and every single one of them requires their own email authentication tools. If your email service provider supports SPF, you will need to include their SPF mechanism in your own SPF record.



 

However, you can run into errors which can result in the non-delivery of your emails. One such error is the SPF Permerror. Today, we will show you how to fix an SPF permerror so your SMTP is secured.

What is an SPF Permerror?

An SPF permerror or ‘SPF Permanent Error’ is one of the most common SPF errors that comes up when the domain’s SPF record could not be properly interpreted resulting in the non-delivery of emails.

An SPF Permerror can occur due to these reasons:

  • If the SPF record has a syntax error
  • If a domain has multiple SPF records
  • If the SPF evaluates more than 10 DNS mechanism lookups in an SPF record

What Is SPF Permerror – “Too Many DNS Lookups”?

This is the most common error out of the three types of SPF permerror. SPF has put several safeguards in place to make sure that you do not have any timeouts issues. An SPF will evaluate 10 DNS mechanisms in an SPF record. They include: a, mx, ptr, exists, include, redirect. If these DNS records exceed more than 10, it will raise an SPF Permerror. When an SPF permerror is raised, you will have to remove a few lookups/mechanisms.

What Does SPF Validation Failed Mean?

An SPF validation error comes up when the Sender Policy Framework (SPF) validation for the sender’s domain is not successful. To prevent these issues, an email admin should make sure that their domain for the domain registrar is set up properly. These are some common reasons an SPF validation error takes place:

  • Multiple SPF Records
  • SPF Validation is Not Available
  • More than 10 DNS Lookups
  • PTR Mechanism Usage
  • Macro is Invalid
  • Multiple Fallback Scenarios

A warning SPF validation failed will be given if your SPF record is not set properly. You can check invalid SPF record examples here.

Office 365 SPF Permerror

To prevent spoofing and get great email delivery, it is advisable to set up SPF in Microsoft (News – Alert) Office 365. To avoid SPF Permerror Office 365, you can go through these points.

  • Only one SPF record is enough for your domain
  • If you have a subdomain, create separate records
  • To avoid getting a permerror, make sure the there are no DNS lookups over 10

An Office 365 SPF permerror can be avoided by following these points. An SPF error such as the SPF permerror and SPF temperror can give you a huge problem for delivering your emails. This way you won’t have any deliverability issues.

How to Fix An SPF Permerror?

SPF Flattening

SPF flattening is a process to flatten order of an SPF record to a flattened record that contains less than 10 DNS lookups/mechanisms. It is also called an SPF record compression. By using a flattened SPF record, you can flatten the number of DNS querying mechanisms/lookups to 1.

The SPF flattening works by removing the ‘a,’ ‘mx,’ and ‘include’ mechanisms to make a simplified SPF record and reduces the amount of DNS lookups. Without doing this, there will be an unnecessary amount of DNS lookups.

Other mechanisms such as ip4 and ip6 are added as they do not use any SPF lookups.

Avoiding Unnecessary ‘include’ Statements

An ‘include’ statement is a mechanism that is used to redirect the DNS lookup to verify authorized IPs of another domain’s SPF record. These ‘include’ statements in the original SPF records will count towards the limit of 10.

Removing Reference to Invalid and Unused Domains

If a domain is unused by you or your partner’s vendor then any ‘include’ statements that redirect the SPF check to a domain. To reduce the number of DNS lookups, you should always make sure that any inactive domains in your SPF record should be removed.

You can also use these methods to avoid an SPF permerror:

  • Replacing the ‘include’ statement with ip4 and ip6 mechanisms when possible
  • You can remove mechanisms that refer to the same domain
  • Limit the use of PTR mechanisms as its usage can result in numerous DNS lookups
  • Use SPF record checks

You can also know more by referring to the SPF FAQs.

Handling Forged Emails Using SPF

Scammers and spammers forge a lot of emails by using numerous domains and email addresses or even legitimate emails and domains to fool users into believing that the email was from a known entity or a person that they know. An SPF can be used for handling forged email and help detect and reject these forged emails.

The SPF protocol allows a domain to authorize the hosts that will use its domain name. Also, the host can be used to configure and check the authorization. This way, an SPF can reduce the number of forged emails quite significantly.

To Conclude

We hope this article gave you some information regarding how to fix an SPF permerror for better protection of our SMTP. An SPF permerror is an important SPF error that should be resolved as soon as possible. Resolving these errors as soon as possible will give you better SPF authentication and significant rise in email deliverability.

Posted on

Optimize wordpress database


ALTER TABLE wp_usermeta ADD UNIQUE KEY umeta_id (umeta_id);
ALTER TABLE wp_usermeta DROP PRIMARY KEY;
ALTER TABLE wp_usermeta ADD PRIMARY KEY (user_id, meta_key, umeta_id);
ALTER TABLE wp_usermeta DROP KEY user_id;
ALTER TABLE wp_usermeta DROP KEY meta_key;
ALTER TABLE wp_usermeta ADD KEY meta_key (meta_key, user_id);

ALTER TABLE wp_postmeta ADD UNIQUE KEY meta_id (meta_id);
ALTER TABLE wp_postmeta DROP PRIMARY KEY;
#ALTER TABLE wp_postmeta ADD PRIMARY KEY (post_id, meta_key, meta_id);
#ALTER TABLE wp_postmeta ADD KEY (post_id, meta_key, meta_value(64));
CREATE INDEX wp_postmeta_idx_1 ON wp_postmeta (post_id, meta_key, meta_value(64));
ALTER TABLE wp_postmeta DROP KEY post_id;
ALTER TABLE wp_postmeta DROP KEY meta_key;
ALTER TABLE wp_postmeta ADD PRIMARY KEY meta_key (meta_key, post_id);

ALTER TABLE wp_posts ADD KEY posts_key (post_status, post_type);

ALTER TABLE wp_wfIssues ADD PRIMARY KEY (ignoreP);

CREATE INDEX wp_wfissues1_idx ON wp_wfIssues (ignoreP);

CREATE INDEX wp_wfissues2_idx ON wp_wfIssues (ignoreC);

ALTER TABLE wp_terms ADD PRIMARY KEY (term_id);

CREATE INDEX wp_posts_post_modified_gmt_idx ON wp_posts (post_modified_gmt);
— wp_comments
— wp_commentmeta
— wp_posts
— wp_postmeta
— wp_termmeta
— wp_users
— wp_usermeta
— wp_options

delete from wp_comments where user_id = 0;

ALTER TABLE wp_comments ADD CONSTRAINT fk_user_id FOREIGN KEY (user_id) REFERENCES wp_users(id);

delete from wp_usermeta where umeta_id in (
select wp_usermeta.`umeta_id` from wp_usermeta left join wp_users on wp_users.id = wp_usermeta.user_id where wp_users.id is null
);
ALTER TABLE wp_usermeta ADD CONSTRAINT fk_usermeta_user_id FOREIGN KEY (user_id) REFERENCES wp_users(id);

ALTER TABLE wp_termmeta ADD CONSTRAINT fk_termmeta_terms FOREIGN KEY (term_id) REFERENCES wp_terms(term_id);


select wp_usermeta.`umeta_id` from wp_usermeta left join wp_users on wp_users.id = wp_usermeta.user_id where wp_users.id is null


ALTER TABLE wp_term_relationships ADD CONSTRAINT fk_wp_posts_wp_term_relationships FOREIGN KEY (object_id) REFERENCES wp_posts(ID);