Risky Business #739 -- ALPHV exit scams while Change Healthcare burns
Mar 5, 2024
auto_awesome
This podcast discusses the aftermath of a healthcare ransomware attack, including a hefty payment to AlphaV and an exit scam. They explore memory safety in cybersecurity, the urgency for improved security measures after a breach, and enhancing security with continuous access evaluation profiles. Additionally, they address stability in identity infrastructure administration and highlight the importance of strong authentication measures at the IDP level.
Memory corruption remains a prevalent vulnerability despite emphasis on memory safety in severe bugs.
ConnectWise's critical security flaw allowed system code execution through bypassing access controls via URL manipulation.
SMS-based two-factor authentication poses risks as demonstrated by YX International's exposed text message database, highlighting vulnerabilities in the security method.
Deep dives
Memory Safety Bugs Still Prevail
Despite the prevalence of memory safety issues in severe bugs, many vulnerabilities in the wild leverage memory corruption issues, highlighting the importance of using memory-safe languages.
ConnectWise Exploit Exposes Vulnerability
A vulnerability in ConnectWise's setup process allowed attackers to bypass access controls by adding an extra slash in the URL, leading to system code execution, demonstrating a critical security flaw in the system.
SMS2FA Vulnerabilities
The use of SMS for two-factor authentication has long been discouraged due to vulnerabilities like SIM swapping. YX International's misstep in leaving a database of text messages exposed underscores the risks associated with relying on SMS for security purposes.
Octa's Efforts to Improve Security Posture
Octa has taken significant steps to enhance its security measures by introducing new features such as universal logouts and pinning sessions to network ASN. Through these innovations, Octa aims to combat token theft and improve integration with app providers, encouraging vendors to adopt these new features to bolster security measures.
Continuous Access Evaluation Profile and Proof of Possession Tokens
Octa emphasizes the importance of technologies like Continuous Access Evaluation Profile and Proof of Possession Tokens for OAuth to enhance security. These tools provide a standardized protocol for IDPs to communicate with applications, enabling better session management and reducing blind spots in token theft scenarios. By advocating for widespread adoption of these technologies, Octa aims to address evolving security threats effectively.
In this week’s show Patrick Gray and Adam Boileau discuss the week’s security news. They talk about:
The serious consequences from the Change Healthcare ransomware, and the need for a … nastier response
Predator spyware maker getting a stern sanctioning
A German military WebEx meeting gets snooped
Mem-corrpution is still king
And much, much more
In this week’s sponsor interview Patrick Gray speaks to Karl McGuinness, Okta’s chief architect, about some new security improvements they’ve built into their IDP.