5 ways hackers hide their tracks
5 ways hackers hide their tracks
From trusted pentesting tools to LOLBINs, attackers abuse trusted platforms and protocols to evade security controls.
CISOs have an array of ever-improving tools to help spot and stop malicious activity: network monitoring tools, virus scanners, software composition analysis (SCA) tools, digital forensics and incident response (DFIR) solutions, and more.
But of course, cyber security is an ongoing battle between attack and defence, and the attackers continue to pose novel challenges.
Older techniques, such as steganography the art of hiding information including malicious payloads in otherwise benign files, such as images are evolving, leading to new possibilities. For example, recently a researcher demonstrated even Twitter wasn’t immune to steganography, and images on the platform could be abused to pack ZIP archives of up to 3MB within them.
Reseller News
Join Reseller News
Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.Sign up now
5 ways hackers hide their tracks
From trusted pentesting tools to LOLBINs, attackers abuse trusted platforms and protocols to evade security controls.
CISOs have an array of ever-improving tools to help spot and stop malicious activity: network monitoring tools, virus scanners, software composition analysis (SCA) tools, digital forensics and incident response (DFIR) solutions, and more.
But of course, cybersecurity is an ongoing battle between attack and defense, and the attackers continue to pose novel challenges.
Older techniques, such as steganography the art of hiding information including malicious payloads in otherwise benign files, such as images are evolving, leading to new possibilities. For example, recently a researcher demonstrated even Twitter wasn’t immune to steganography, and images on the platform cou
Source code and credentials belonging to cybersecurity company Rapid7 were accessed by an unauthorized third party during a supply-chain attack on Codecov.
Starting on January 31, hackers gained restricted access to hundreds of networks belonging to Codecov s customers by tampering with one of the San Francisco–based company s software development tools.
Codecov, whose customers include IBM and Hewlett-Packard, announced on April 15 that a malicious party had gained access to its Bash Uploader script and modified it. The actor gained access because of an error in Codecov’s Docker image creation process that allowed the actor to extract the credential required to modify our Bash Uploader script, stated Codecov.
PDF
Security firm Rapid7 has confirmed attackers have accessed a subset of its source code, which contained internal credentials and alert-related data, following an investigation launched after the Codecov supply chain attack.
Codecov, which provides tools to verify how well software tests cover code in development, announced the attack on April 15. Attackers had modified its Bash Uploader Script to export sensitive data, including credentials, software tokens, and keys, Codecov said. It advised clients to create a list of credentials that its software could access and consider them compromised.
Rapid7 launched an incident response process. It notes its use of the Bash Uploader script was limited; it had been deployed on a continuous integration server used to test and build internal tooling for its managed detection and response (MDR) service.