After a rigorous pilot program, the association's newest certification is officially operational. More than 1,500 pilot participants who passed the exam are on the path to full certification.

**ALEXANDRIA, Va., Aug. 31, 2022 /PRNewswire** -- (ISC)² – the world's largest nonprofit association of certified cybersecurity professionals – today announced a landmark expansion of its membership and the global cybersecurity workforce. With the official launch of the (ISC)² Certified in Cybersecurity℠ certification, (ISC)² is delivering on its commitment to address the global cybersecurity workforce gap by creating new pathways into the profession for those interested in a cybersecurity career. Anyone earning the (ISC)² Certified in Cybersecurity certification demonstrates they have the foundational knowledge, skills, and abilities to take on entry- and junior-level cybersecurity roles, enabling employers to more confidently build resilient teams across all experience levels.

"We are facing a growing global cybersecurity workforce gap of more than 2.7 million people. One of the most persistent cybersecurity staffing challenges organizations around the world experience is being able to identify entry- and junior-level candidates with the right skills and aptitude to learn and grow on the job. At the same time, early career hopefuls are unable to demonstrate their understanding of cybersecurity concepts and gain the attention of hiring managers," said Clar Rosso, (ISC)² CEO. "Our Certified in Cybersecurity certification bridges that gap and connects employers to qualified entry-level candidates backed by the world's largest association of certified cybersecurity professionals. (ISC)² Certified in Cybersecurity is one of several impactful solutions underway at (ISC)² to reduce the cybersecurity workforce gap, remove barriers to entering the field and deliver a positive, long-term opportunity for individuals and employers alike."

**Certifying the Next Generation of the Cybersecurity Workforce**

The (ISC)² Certified in Cybersecurity certification was created to support and nurture a new generation of cybersecurity practitioners entering the field – from recent university graduates to career changers to IT professionals – seeking to validate their security skills and access a new career and professional development pathway.

The (ISC)² Certified in Cybersecurity certification exam evaluates candidates across the following subject areas:

*   Security Principles
*   Business Continuity (BC), Disaster Recovery (DR) & Incident Response Concepts
*   Access Controls Concepts
*   Network Security
*   Security Operations

More details about the exam subject matter are available through the (ISC)² Certified in Cybersecurity exam outline.

Since the (ISC)² Certified in Cybersecurity certification exam pilot program began earlier this year, more than 1,500 individuals have passed the exam and are now beginning their journey to full certification and (ISC)² membership. As members of the association, they will gain access to continuing education, thought leadership, peer support, industry events and other professional development opportunities. (ISC)² supports cybersecurity practitioners in their immediate and future careers as they gain experience and work toward more advanced and specialized certifications, such as the globally renowned (ISC)² CISSP®.

Learn more about the (ISC)² Certified in Cybersecurity certification at www.isc2.org/Certifications/CC.

**About (ISC)²**

(ISC)² is an international nonprofit membership association focused on inspiring a safe and secure cyber world. Best known for the acclaimed Certified Information Systems Security Professional (CISSP®) certification, (ISC)² offers a portfolio of credentials that are part of a holistic, pragmatic approach to security. Our membership, more than 168,000 strong, is made up of certified cyber, information, software and infrastructure security professionals who are making a difference and helping to advance the industry. Our vision is supported by our commitment to educate and reach the general public through our charitable foundation – The Center for Cyber Safety and Education™. For more information on (ISC)², visit www.isc2.org, follow us on Twitter or connect with us on Facebook and LinkedIn.

© 2022 (ISC)² Inc., (ISC)², CISSP, SSCP, CAP, CSSLP, HCISPP, CISSP-ISSAP, CISSP-ISSEP, CISSP-ISSMP and CBK are registered marks, and CC is a service mark of (ISC)², Inc.

SOURCE: (ISC)2

(ISC)² Launches 'Certified in Cybersecurity' Entry-Level Certification to Address Global Workforce Gap

Cloud breaches are inevitable — and so is cloud ransomware. (Second of two parts.)

In Part 1 of our tales of real-world cloud attacks, we examined real-world examples of two common cloud attacks. The first starting from a software-as-a-service (SaaS) marketplace, demonstrating the breadth of potential access vectors for cloud attacks and how it can enable lateral movement into other cloud resources, including a company's AWS environment. The second cloud attack demonstrated how attackers take over cloud infrastructure to inject cryptominers for their profit.

As we have witnessed, more attacks have moved onto the cloud, so it was only a matter of time before ransomware attacks did, too. Let's look at two scenarios where attackers leveraged ransomware to gain profits, and how unique cloud capabilities helped victims avoid paying the ransom.

**MongoDB Ransomware Demand Mitigated**

The first case (or rather cases, as this attack has appeared numerous times) is the notorious MongoDB ransomware, which has been ongoing for years. The attack itself is simple— attackers use a script to scan the internet (and now, common cloud vendor address spaces) for hosts running MongoDB exposed to the internet. The attackers then try to connect to the MongoDB with the empty admin password. If successful, the attack erases the database and replaces it with a double ransomware note: _pay, and your data will be returned; don't pay, and your data will be leaked._

Intervention was necessary to address the second part of the extortion scheme: data leakage. Luckily, the company had data backups, so recovery was easy, but the database contained considerable amounts of personally identifiable information (PII), which, if leaked, would be a major crisis for the company. This forced them into the position of either paying a hefty ransom or dealing with the press. MongoDB default logging, unfortunately, cannot provide a definitive answer regarding the data accessed, as not all potential types of data collection commands are logged by default.

This is where the cloud infrastructure became an advantage. While MongoDB may not log every command, AWS logs the traffic going in and out of servers, because it charges for network costs. Correlating the network traffic going out of the attacked server with the times when the attackers were connected to the compromised MongoDB server provided proof that the data could not have been downloaded by the attackers.

    

AWS traffic log over 10 day period. The marker represents the incident time. Source: Mitiga

This allowed the company to avoid paying the ransom _and_ ignore the threat. As expected, nothing further was heard from the attackers.

**Mitigating Ransomware in a Cloud Environment**

Another company experienced an attack on its main servers running on AWS EC2, where it was hit by a ransomware Trojan, not unlike those seen on on-premises servers. As often occurs these days, this was another double-extortion ransomware attack and the company needed help dealing with both issues.

Luckily, due to the company's cloud architecture and preparedness, there were AWS snapshots of the environment going back 14 days. The attackers were unaware of the snapshots and had not disabled them in their attack. This allowed the company to immediately revert to the day before the data encryption, resolving the first part of the attack with minimal effort. That still left two challenges to deal with: the potential data leak and the eradication of the attackers from the environment.

To address these challenges, there was a full investigation of the breach, which turned out to be quite complex due to the hybrid nature of their environment. The attackers compromised a single account with limited access, used by an IT person. They then identified a legacy on-premises server where that individual was an admin and used it to take over the Okta service account, allowing privilege escalation. Finally, using a decommissioned VPN service, they were able to hop to the cloud environment. Using the elevated privileges, they took over the EC2 servers and installed the malware.

The investigation yielded two significant findings. The first was the attack timeline. It showed that the compromise of all hosts occurred before the earliest snapshots were taken, indicating that the recovered servers were compromised and could not be used. New servers were installed, the data was transferred to them, and the original affected servers were purged.

The second finding was even more surprising. Malware analysis identified that the attackers used _rclone.exe_ to copy the files to a remote location. The connection credentials were hardcoded in the malware, so the company was able to connect to the same location, identify, and remove their files, eliminating the attackers' access to the files, eradicating the extortion aspect of the attack.

**Cloud Breaches Are Here to Stay**

As these real-life scenarios reveal, attackers are infiltrating the cloud and cloud breaches are on the rise. It's time for organizations to prepare for cloud incidents. Cybercriminals are leveraging cloud capabilities in attacks, and you should use them, too, to protect your organization and prevent a crisis from hitting the headlines.

Real-World Cloud Attacks: The True Tasks of Cloud Ransomware Mitigation

No-code startups such as Mine PrivacyOps say they offer best of both worlds — quick development and compliance with privacy laws.

As part of the digital transformation reshaping the global business landscape, no-code/low-code tools are on the rise. Gartner projects the use of no-code/low-code tools will grow from almost 25% of applications in 2020 to 70% in 2025.

In a recent Dark Reading survey of 136 IT professionals on the state of no-code/low-code tools and implementation in their businesses, only 39% said they don't use no-code/low-code tools or intend to use them in the near future. The no-code/low-code market is a robust one, valued at nearly $13 billion in 2020 and estimated to reach over $47 billion in 2025 and $65 billion in 2027.

While no-code/low-code tools hold promising potential, they also come with a big challenge: security. The security concerns associated with using no-code/low-code tools are numerous. In the Dark Reading survey, only 7% of respondents said they aren't concerned about the security of no-code/low-code applications.

Malicious actors are constantly spinning new tactics and attack models, and no-code/low-code tools leave huge backdoors for them to exploit. An assessment by the Open Web Application Security Project (OWASP) reveals several no-code/low-code security risks — from account impersonation, to authorization misuse, to credential sharing, and more. For some observers, no-code/low-code tools sacrifice security on the altar of improved productivity.

**Building Privacy Ops With No-Code/Low-Code Tools**

Although no-code/low-code tools present data security challenges, several companies are working on ways enterprises can use these tools to actually improve security. Israel-based Mine PrivacyOps says its no-code platform helps enterprises automate and streamline their privacy operations by securing data and meeting data privacy regulations like the GDPR and CCPA.

One of the privacy-accommodating features Mine PrivacyOps offers is automatic fulfillment of privacy requests via data subject requests and data subject access requests (DSR/DSAR), a requirement of the GDPR under the right of access. The software also handles consent management and third-party risk assessment. No-code integrations with Salesforce, HubSpot, Shopify, Klaviyo, Zendesk, and other data sources allow clients to automate privacy and deletion requests concerning those systems. The data mapping tool creates GDPR-compliant Records of Processing Activity (ROPA) and tracks all personally identifiable information (PII) collected in the client's systems.

"Our no-code approach … means that we have the fastest implementation time in the market, allowing companies to set up in less than 30 minutes with no engineering resources needed," says Gal Ringel, CEO of Mine PrivacyOps. Mine PrivacyOps claims over 2,000 customers use its platform. The company has competition in cloud-based governance, risk, and compliance software makers Hyperproof, Netwrix Auditor, Egnyte, and others.

While security concerns continue to be a major conversation around no-code/low-code tools, there are still bright spots to consider. Companies like Mine PrivacyOps show that no-code tools can factor security into their core functionalities.

Closing the Security Gap Opened by the Rise of No-Code Tools

But one issue that lets websites overwrite content on a user's system clipboard appears unfixed in the new Version 105 of Chrome.

Google's first stable channel version of Chrome 105 for Windows, Mac, and Linux, released this week, contained fixes for 24 vulnerabilities in previous versions of the software, including one "critical" flaw and eight that the company rated as being of "high" severity.

A plurality — nine — of the security issues that Google addressed with Chrome 105 were so-called use-after-free vulnerabilities, or flaws that allow attackers to use previously freed memory spaces to execute malicious code, corrupt data, and take other malicious actions. Four of the patched vulnerabilities were heap buffer-overflows in various Chrome components, including WebUI and Screen Capture.

Attackers often exploit buffer overflows for a variety of malicious purposes, including executing random code, overwriting data, crashing systems, and triggering denial-of-service conditions.

**Clipboard Overwriting**

One issue that Google does not appear to have fixed in the update centers around clipboards. According to Malwarebytes, when users of Google Chrome — or any Chromium-based browser — visit a website, the site can push any content they want to the user's OS clipboard, without the user's permission or any interaction.

"This means that by simply visiting a website, the data on your clipboard may be overwritten without your consent or knowledge," Malwarebytes said.

This can result in users losing valuable data they might have wanted to cut and paste elsewhere while also giving attackers an opening to try and sneak malicious code on a user's system, the security vendor said. The problem has to do with the absence of any requirement in Chrome and Chromium-based browser for users to take specific steps such as using "Ctrl+C" to copy content from a website to the user's clipboard, Malwarebytes said.

Security researcher Jeff Johnson identified the issue with Chrome as part of a broader problem that impacts both Safari and Firefox as well. "Chrome is currently the worst offender, because the user gesture requirement for writing to the clipboard was accidentally broken in version 104," he said in a report this week.

However, the reality is that users of other browsers such as Firefox and Safari can have websites overwriting their system clipboards more easily than they realize, Johnson said. Though both these browsers require users to take some action to copy website content to their clipboards, the actions are a lot broader than they might imagine.

For instance, actions like focusing out on a screen, or pressing keydown/ keyup and mousedown/ mouseup, can result in website content getting copied to the clipboard without the user's knowledge, Johnson said.

The researcher noted that Chrome developers are already aware of the issue and are addressing it. Google did not immediately response to a Dark Reading request for comment.

"Attackers may abuse this bug to copy malicious links to users' clipboards, which could result in users pasting those links in their address bar and accessing malicious sites accidentally," says Ivan Righi, senior cyber threat analyst at Digital Shadows.

"Another way this bug could be exploited is to conduct fraudulent cryptocurrency transactions. Threat actors could leverage the flaw in conjunction with social engineering attacks to get users to enter the wrong wallet addresses for transactions," Righi says. However, the likelihood of such attacks being successful is low because users are likely going to notice abnormal contents placed on their clipboard, he says.

**A Plethora of Use-After-Free Issues**

Meanwhile, the sole critical vulnerability (CVE-2022-3038) Google addressed with the stable version of Chrome 105 was reported by a security researcher from its own Project Zero bug hunting team: The use-after-free flaw in Google Chrome Network Service gives remote attackers a way to execute arbitrary code or trigger denial of service conditions on user systems by getting them to visit a weaponized website.

External bug hunters and security researchers reported all the remaining vulnerabilities that Google addressed this week in Chrome. The most consequential among them appears to have been CVE-2022-3039, a high-severity, user-after-free vulnerability in WebSQL that two researchers from China's 360 Vulnerability Research Institute reported to Google. The researchers received $10,000 for reporting the bug to Google — the highest amount awarded in the current set.

Another high-impact, use-after-free flaw in Chrome Layout garnered $9,000 for the anonymous security researcher that reported the issue to Google. Bounties for the remaining bugs ranged from $1,000 to $7,500. Google has not yet determined rewards for four bug disclosures.

As has become standard practice among major vendors, Google said it has restricted access to bug details until most users have an opportunity to implement the new, stable version of Chrome.

"We will also retain restrictions if the bug exists in a third-party library that other projects similarly depend on but haven’t yet fixed," Google said in a blog this week. A senior Microsoft security executive had recently used the same reason to explain why Microsoft's bug disclosures also contain scant details these days.

While the bug fixes are almost certainly the primary reason why users might want to update to the stable version of Chrome 105, the new browser version also introduces a handful of additional features. These include features that allow developers to add windows controls button — such as closing, maximizing, or minimizing — to progressive Web apps, a new picture-in-picture API for Chrome on Android, and improvements to Chrome's Navigation API.

Google Fixes 24 Vulnerabilities With New Chrome Update

The ongoing campaign is spreading worldwide, using the lure of a fully functional Google Translate application for desktops that has helped the threat stay undetected for months.

A cryptomining campaign has potentially infected thousands of machines worldwide by hiding in a Google Translate download for desktops.

According to researchers at Check Point, the threat actor behind it is a Turkish-speaking software developer called Nitrokod, which offers free versions of popular software applications that don't have an official desktop version — like Google Translate.

In fact, its version of the translation utility, created using the official Google Translate webpages and a Chromium-based framework, is its most popular offering, researchers said in a blog post this week. It's distributed in a watering-hole approach, available via websites like Softpedia and uptodown, and turning up at the top of search results for “Google Translate desktop download."

Unfortunately, the downloads are Trojanized, which victims might not realize for a very long time (or ever) given that the app actually works as advertised.

"This campaign highlights the diverse methods of propagation employed by cryptojacking groups," says Matt Muir, security researcher at Cado Security. "Although masquerading as legitimate applications is as old as malware itself … sadly, it remains far too easy to trick an end user into installing what they believe to be a popular application."

**Built for Stealth**

The campaign, which is ongoing and spreading globally, sports several features that are designed to help it remain undetected, Check Point researchers found.

For instance, after the software is installed, the infection process goes dormant for weeks. Tom Kellermann, senior vice president of cyber-strategy at Contrast Security, tells Dark Reading that this is a prime example of a growing trend.

"Notably, after initial injection they are waiting weeks to remain undetected," he says. "Placing malware on a sleep cycle is becoming mainstream, and 'chronos' attacks are growing where adversaries use time for the purposes of evasion."

After the sleep interval, the infection process is initiated and the victim receives an updated file that, over the course of a few days, loads a chained series of four droppers onto the machine. Finally, the last dropper fetches the Monero-focused XMRig cryptominer and executes it.

The download then connects out to a command-and-control (C2) server for configuration data and begins mining, while the attackers delete any evidence of the infection process. Meanwhile, Google Translate will continue to work properly, separately — offering no red flags for analysis.

"This allowed the campaign to successfully operate under the radar for years," according to Check Point's analysis. "This way, the first stages of the campaign are separated from the ones that follow, making it very hard to trace the source of the infection chain and block the initial infected applications."

Active since 2019, Nitrokod claims to offer free and safe software, which in reality are all threats, researchers noted. The behaviors are similar to the Google Translate campaign in all other infected programs, they said. Thus, while this campaign was spotted in July, it's likely that there will be additional activity from the cybercrime group going forward.

**How to Protect Against Cryptomining**

Assaf Morag, lead data analyst on the Aqua Nautilus research team, notes that the campaign illustrates how cryptojacking crooks are proliferating their attack methods and continuing to go after virtual coins as a quick financial win.

In addition to Trojanized applications, "some cryptominers are hidden in websites, and when an unsuspecting victim browses the site, the cryptomining script on the website is running in the browser, often without users' knowledge or consent," he says. "Another type of cryptojacking that we've seen recently is often more complex. It involves a large botnet infrastructure that scans for vulnerabilities and misconfigurations, exploits them, and disseminates the cryptojacking malware and often other malware aimed to expand the attack and make it persistent."

As a result, businesses should shore up their basic defenses such as patching and Web filtering, and implement policies against downloading anything but approved software onto endpoints, network sensors, servers, and firewalls. And even then, users should only download software from official repositories — like Google Play, in this case; if there's no official desktop app, users should make do with the Web-based version.

Michael Clark, director of threat research at Sysdig, also says the campaign puts remote workers on notice.

"The software it pretends to be something that could be used by anyone," he says. "It shows that your endpoints and even users at home could be affected by cryptomining. Endpoints may not be as powerful as servers, but for a cryptominer, every bit of processing power they can steal adds to their profits."

And what if it's too late? If infected, "users will see a performance issue with their systems and potentially need a fresh install of their operating system to rid the system of the malware effectively," says James McQuiggan, security awareness advocate at KnowBe4.

Crypto-Crooks Spread Trojanized Google Translate App in Watering-Hole Attack

New Golang cyberattacks use deep space images and a new obfuscator to target systems — undetected.

Threat hunters are warning security teams to be on the lookout for new cyberattack that uses a chance to see historic James Webb space telescope deep field images as a lure. The campaign's victims are infected with Golang malware. 

Besides the novel lure strategy, the Go programming-based malware gives threat actors added flexibility across platforms and frameworks, in addition to providing reverse-engineering protections and obfuscation benefits, the Securonix research team reported. They dubbed the new cyberattack chain GO#WEBFUSCATOR for its ability to get around extended detection and response (EDR) defenses.

"The image contains malicious Base64 code disguised as an included certificate," the researchers who found the James Webb image-themed cyberattack explained. "At the time of publication, this particular file is undetected by all antivirus vendors according to VirusTotal." 

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

James Webb Telescope Images Loaded With Malware Are Evading EDR

OpenText makes a $6 billion bet that bigger is better in security and that cybersecurity platform plays are the future.

Canadian software giant OpenText last week announced its intention to purchase Micro Focus in a deal valued at roughly $6 billion.

To give an idea of the scale of the combined company, the statement announcing the acquisition listed the combined company's totally addressable market to be $170 billion. Of that, Micro Focus's most recent annual revenue was $2.7 billion, while OpenText's revenue was approximately $3.5 billion.

The difference between revenue and addressable market presents an idea of why the companies see the potential for growth to come out of the combination.

**Growth by Acquisition**

Both Micro Focus and OpenText have spent recent years growing by acquisition. Micro Focus added SIEM/SOAR vendor ArcSight into its fold, along with NetIQ, Fortify, Voltage, and other products, thanks to its 2017 spinout-merger with Hewlett Packard Enterprise's software division. OpenText has added a resilience company like Carbonite to a portfolio that includes a variety of thread detection, investigation, and response (TDIR) products and services, as well as insider threat mitigation, and an array of forensics products.

So, what does the combination mean for customers and potential customers? For one thing, it dramatically increases the likelihood that any given midsize or large enterprise is already a customer of the new company. OpenText lists more than 120,000 customers in 110 countries around the world, while Micro Focus claims revenue in 180 different countries. Together, the companies have remarkable penetration in the large enterprise segment internationally.

The cybersecurity market, and the broader IT industry, has seen company strategies flow between a focus on single, "best of breed" solutions and a push toward multisolution conglomerates. OpenText and Micro Focus are obviously practitioners of the latter. For customers that look to their solution providers for broad security suites, the combination should make OpenText a more compelling potential provider by way of a considerably broader set of solutions. The combination may be even more compelling for customers trying to make decisions regarding security for hybrid- or multicloud architectures.

And while they've received little credit for it in the marketplace, both organizations have quietly been fostering notable innovations. Micro Focus earlier this year launched its Galaxy threat research platform, the latest initiative in a multiyear effort to position ArcSight at the center of a differentiated, cutting-edge security operations center (SOC) platform. Meanwhile, OpenText has built its own security management platform with Security Cloud, positioning the offering as an end-to-end cloud security solution for the large, distributed enterprise.

**Additive Strengths**

It's important to remember that for both OpenText and Micro Focus, security is just one focus area amid a broad set of overall business offerings. While the security offerings of the two companies will certainly complement one another, the most significant corporate benefits may be the additive strengths the product and service solutions deliver. Micro Focus, for example, has significant product offerings in the COBOL space, suggesting that running applications in hybrid mainframe-cloud architectures could be easier with the combined products from the two organizations.

OpenText began life as a university-based project to bring the world's most comprehensive dictionary to word-nerds around the globe. It has, since the mid-1990s, grown by acquisitions of ever-greater size and scope. While the Micro Focus purchase is OpenText's largest deal yet, there's no reason for customers or investors to believe it is the last.

OpenText Goes All-in on Cybersecurity Size and Scale With Micro Focus Purchase

(ISC)² pledges to expand and diversify the cybersecurity workforce by providing free "(ISC)² Certified in Cybersecurity" education and exams to 1 million people worldwide.

**ALEXANDRIA, Va., Aug. 31, 2022 /PRNewswire/** — (ISC)² — the world's largest nonprofit association of certified cybersecurity professionals — today announced that the (ISC)² One Million Certified in Cybersecurity initiative is now accepting participants. To qualify, individuals must enroll as an (ISC)² Candidate, for free, which entitles them to a wide array of exclusive programs and services to assist individuals starting a cybersecurity career, including free education and exams for the association's new entry-level cybersecurity certification (ISC)² Certified in CybersecuritySM.

First announced by (ISC)² CEO Clar Rosso during last month's Cyber Workforce and Education Summit at the White House, (ISC)² is acting on its pledge to implement meaningful solutions to our global cybersecurity workforce challenges. Research suggests organizations that focus on recruiting and developing entry-level cybersecurity staff — including those with little or no technical experience — accelerate the invaluable hands-on training the next generation of professionals needs to start a successful cybersecurity career.

Those who earn the (ISC)² Certified in Cybersecurity demonstrate to employers that they have the foundational knowledge, skills and abilities necessary for an entry-level cybersecurity role.

"The global cybersecurity workforce shortage is an issue we can no longer just talk about. It's time for decisive action," said Rosso. "I am proud that our association — with its rich history of advocating for the advancement, expansion and enablement of the cybersecurity workforce — is undertaking this unprecedented initiative to make rewarding cybersecurity careers accessible to so many people. We look forward to welcoming our One Million Certified in Cybersecurity participants to our community as (ISC)² Candidates and soon as new certified members of our association."

**How the Program Works  
**  
To participate in the One Million Certified in Cybersecurity initiative, individuals must visit www.isc2.org/candidate and enroll as an (ISC)² Candidate. Upon completion of that process, which includes an online form and affirmation to abide by the (ISC)² Code of Ethics, individuals will be able to access their free education and exam via their (ISC)² Candidates benefits page.

Participants will receive a free exam, as well as access to the (ISC)² Certified in Cybersecurity online self-paced education course. The course provides a review of the subject matter published in the (ISC)² Certified in Cybersecurity exam outline, which shares the security concepts on which certification candidates will be evaluated, including:

— Security Principles  
— Business Continuity (BC), Disaster Recovery (DR), and Incident Response Concepts  
— Access Controls Concepts  
— Network Security  
— Security Operations

University students, recent graduates, career changers and other professionals wishing to expand their skills and opportunities are encouraged to participate, especially individuals employed or seeking employment within small and midsized businesses.

After successfully completing the exam, participants will become (ISC)² members with access to a wide array of professional development resources to help them throughout their careers. The (ISC)² entry-level cybersecurity certification is the first step on a career-long journey that will help cybersecurity professionals gain experience and work toward advanced qualifications such as the CISSP®.

**Encouraging Diversity and Inclusion  
**  
In addition to open enrollment, (ISC)² will work closely with new and existing partner organizations to reach historically under-represented populations and encourage greater diversity within the cybersecurity community. (ISC)² has pledged that 500,000 course enrollments and exams will be directed toward students of historically black colleges and universities (HBCUs), minority-serving institutions (MSIs), tribal organizations and women's organizations across the US and the globe.

For more information on One Million Certified in Cybersecurity, including how to partner with (ISC)² to help support under-represented populations globally, visit www.isc2.org/IMCC.

**About (ISC)²**  
(ISC)² is an international nonprofit membership association focused on inspiring a safe and secure cyber world. Best known for the acclaimed Certified Information Systems Security Professional (CISSP®) certification, (ISC)² offers a portfolio of credentials that are part of a holistic, pragmatic approach to security. Our membership, more than 168,000 strong, is made up of certified cyber, information, software and infrastructure security professionals who are making a difference and helping to advance the industry. Our vision is supported by our commitment to educate and reach the general public through our charitable foundation — The Center for Cyber Safety and Education(TM). For more information on (ISC)², visit www.isc2.org, follow us on Twitter or connect with us on Facebook and LinkedIn.

© 2022 (ISC)² Inc., (ISC)², CISSP, SSCP, CCSP, CAP, CSSLP, HCISPP, CISSP-ISSAP, CISSP-ISSEP, CISSP-ISSMP and CBK are registered marks, and CC is a service mark of (ISC)², Inc.

SOURCE: (ISC)2

(ISC)² Opens Global Enrollment for '1 Million Certified in Cybersecurity' Initiative

A security vulnerability (CVE-2022-28799) in one of TikTok for Android's deeplinks could affect billions of users, Microsoft warns.

A high-severity flaw in the Android version of the TikTok app — which has been installed more than 1.5 billion times so far via the Google Play Store — could allow threat actors to hijack a user's account with a single click.

Microsoft discovered the high-severity vulnerability in the handling of one of TikTok for Android's deeplinks, a particular type of hyperlink in Android that links to a specific component within an app. To exploit it, cybercriminals could craft a malicious link that, if clicked, would allow full account access.

Tracked as CVE-2022-28799, the flaw could allow attackers to modify users' TikTok profiles and access sensitive information, "such as by publicizing private videos, sending messages, and uploading videos on behalf of users," according to a Microsoft Security blog post published Wednesday.

In all, an exploit exposes 70 methods for an attacker to modify users' TikTok profiles and access sensitive information without users' awareness, he said.

**Under the Hood: Exploiting JavaScript**

While CVE-2022-28799 itself is found in a deeplink in the Android version of TikTok, exploiting the flaw depends on the app's implementation of JavaScript interfaces, which are provided by the app's WebView component, Microsoft said.

WebView allows applications to load and display web pages and, using the "addJavascriptInterface" API call, also can provide bridge functionality that allows JavaScript code in the web page to invoke specific Java methods of a particular class in the app.

The issue with WebView is that if someone such as a threat actor loads untrusted web content to WebView with application-level objects accessible via JavaScript code, the app is vulnerable to JavaScript interface injection. This may lead to data leakage, data corruption, or, in some cases, arbitrary code execution, Microsoft said.

"TikTok for Android uses JavaScript interfaces extensively, enhancing the WebView capabilities that are used within the app," according to the post.

Microsoft researchers discovered what they call "a class of interest" that makes use of WebView in TikTok's Android version that "registers a JavaScript bridge that has access to every type of functionality implemented by the classes of a bridge," which can be exploited due to the deeplink vulnerability, they said.

"Attackers can use the vulnerability to redirect URLs to various components of the application via a query parameter to trigger the deeplink and call nonexported activities, expanding the attack surface of the application," according to the post.

**Proof-of-Concept TikTok Attack**

In a proof-of-concept (PoC) exploit, Microsoft researchers were able to force the application to load an arbitrary URL (https://www.tiktok\[.\]com, in this case) to the application's WebView, they said.

"By crafting this URL with additional query parameters, it was possible to inject an instance of the JavaScript bridge that provides full access to the functionality implemented by the affected bridge package," according to the post.

It added, "In short, by controlling any of the methods able to perform authenticated HTTP requests, a malicious actor could have compromised a TikTok user account."

**Patch the TikTok App Now**

Microsoft notified TikTok about the flaw, according to its responsible disclosure practices. TikTok responded by rapidly issuing a fix to both versions of the Android app it offers — one for East Asia and Southeast Asia and the other for all remaining countries — which both were affected. Users should update their apps to the latest version to protect themselves.

The quick response is notable, given the myriad privacy and security issues that have plagued TikTok in the past. However, it has been cleaning up its act in recent years, starting with its introduction of a bug-bounty program through HackerOne in 2020.

In February, the company's global chief security officer Roland Cloutier told Dark Reading that TikTok has committed to building a culture of security and transparency going forward, given its access to sensitive data and content for billions of organizations and individuals.

TikTok for Android Bug Allows Single-Click Account Hijack

While cloud breaches are going to happen, that doesn't mean we can't do anything about them. By better understanding cloud attacks, organizations can better prepare for them. (First of two parts.)

Cloud breaches are inevitable.

It's the reality we live in. The last few years have demonstrated that breaches occur, no matter how much security organizations put in place. The increased complexity of organizations — where a single mistake or vulnerability can lead to a compromise — coupled with the increased motivation, sophistication, and dedication of attackers, means breaches are here to stay. At the same time, organizations are transitioning to the cloud, making attackers shift focus to rapidly increase their attacks on cloud environments.

While this means that cloud breaches are inevitable, that doesn't mean we can't do anything about them. By better understanding cloud attacks, organizations can better prepare for them. Then, hopefully, they can contain and respond to attacks faster, reducing their impact and averting a crisis.

This two-part series will explore real-world attacks that unravel, investigate, and share insights on practical ways organizations can respond to cloud attacks in today's threat landscape.

**SaaS Marketplace Hack Leads to Major Breach**

In the last few years, software-as-a-service (SaaS) platforms have been replacing traditional enterprise applications, making it easier for organizations to adopt and manage them. Part of the value such platforms provide is the ability to integrate and expand rapidly, supporting the ever-growing demands of users for more functionality. Further enhancing their platforms, SaaS vendors are creating a marketplace to allow third-party providers to add functionality and integration for its users. These marketplaces, however, can introduce substantial third-party risk, as can be seen in the following scenario.

After a company was notified by GitHub of a potential risk, GitHub didn't provide any specific indicators of unauthorized access. Instead, GitHub provided only a generic notice that DeepSource, one of the apps the company had previously been using on the marketplace, was breached, making it hard to understand whether the organization was affected or not. An initial review done by the company of its GitHub logs did not help, as it could not see any access to its code by DeepSource.

The reason for this was rather simple — and it is at the heart of how many SaaS marketplaces operate. A few months before the breach, one of the company's developers tried out the DeepSource app, wherein the developer granted DeepSource access to the code under his username. When the attackers used DeepSource's access to download the entire code repository, what appeared in the logs was a pull request under the name of a legitimate user. The only indicator that it was malicious was the identification of an irregular IP address, which eventually was tied to other known attacks.

At this point, it became clear that the entire code repository had been stolen, and a full-blown response was needed to contain and recover from the breach. As with most code leakage cases, the immediate concern was access to secrets (passwords/keys) in the code. While it is generally bad practice to have hardcoded secrets in code, it is still a common practice by many — and this case was no different. By identifying the relevant secrets in the code, the next steps of the attackers — which, as expected, started accessing some of the Amazon Web Services (AWS) infrastructure — was predicted. By quickly identifying them, the company was able to block access to all relevant resources, contain the breach, and recover before more damage could be done.

**Cryptominer Injected into a Virtual Machine Template**

What if one could mine cryptocurrency at somebody else's expense? This idea is at the heart of many cryptomining attacks we see today, where attackers take over cloud resources, then run cryptominers on them collecting cryptocurrency while the hacked organization pays the cloud compute bills for it.

In a recent incident, a company had identified unknown files on 18 AWS EC2 machines they were running in the cloud. Looking at the files, it became clear they had fallen victim to the ongoing TeamTNT Watchdog cryptomining campaign. It was initially unclear how the attackers managed to infect so many EC2 instances, but as the investigation unfolded, it became apparent that instead of targeting individual machines, the attackers targeted the Amazon Machine Image (AMI) template used to create each machine. During the creation of the original image, there was a short time where a service was misconfigured, allowing remote access. TeamTNT used automatic tools to scan the network, identify it, and immediately place the miners there, which then got duplicated to every new machine created.

This highlights another common attack pattern: implanting cryptominers in publicly available AMIs through the Amazon marketplace.

As demonstrated by these cases, cloud attacks are here to stay. They're different from what we're used to observing, so it's time to better prepare for their arrival. Stay tuned for part two, where we will dive into cloud ransomware and how to avoid it.

_The second part of this article is here._

Source

DARKReading