New Zealand Cyber Security Blog

Thoughts on the cyber security landscape with a pinch of technical insights

Threat Advisory
Russian travel sanctions against an additional 121 Australians: Impacts for Australian organisations’ cyber risk

On 16 June, the Russian Foreign Ministry announced sanctions against 121 Australians operating across the defence, government, mining, technology, think tank, higher education, entertainment and media sectors.

CyberCX Intelligence assesses this development materially increases cyber risk in the immediate to medium term for the sanctioned individuals and organisations directly connected to them.

Intelligence Update
Solomon-Islands-China Security Agreement: Implication for regional cyber risk

There is increasing diplomatic tension and instability in the Pacific, a development likely to also increase cyber risk for all organisations in Australia and New Zealand.

The Solomon Islands-China Security Cooperation Agreement (the Security Agreement) and associated actions will be key drivers in the Pacific cyber threat landscape.

Intelligence Update
A question of timing:
examining the circumstances surrounding the Nauru Police Force hack-and-leak

On 2 May 2022, 285,631 files stolen from the Nauru Police Force, including some relating to alleged human rights abuses in Australia’s offshore processing centres, were leaked.

CyberCX assesses that there are several anomalies that invite scepticism about the motivations of the threat actor and warrant further investigation. 

CyberCX Cyber Dialogue: A-UK-US heavyweights talk Russia’s invasion and cyber implications

The Ukraine-Russia war is a major turning point in cyber history – this was the key message emerging from Cyber Dialogue webinar.

 

Change and disruption: How the Russia-Ukraine conflict is reshaping cyber crime

Australian and New Zealand organisations face a real chance of ransomware, data theft extortion or DDoS attacks by pro-Russia criminal groups and hacktivists.

 

Threat Advisory Update. Russia/Ukraine conflict: Impacts for Australian and New Zealand organisations

CyberCX continues to urge all Australian and New Zealand organisations to adopt a posture of heightened cyber readiness and awareness.

Threat Advisory. Escalating geopolitical tensions between Russia, Ukraine and NATO members: Impacts for Australian and New Zealand organisations

The situation in Ukraine is actively evolving. CyberCX Cyber Intelligence is closely monitoring developments.

To pay or not to pay: In a ransomware attack, this is not always the question

The Australian Cyber Security Centre received nearly 500 reports of ransomware attacks against Australian organisations last financial year. CERT NZ received over 70 reports during the same period.

When Scanning Isn’t Enough: Practical Tips for Log4j Vulnerability Detection

The Log4j critical vulnerability (CVE-2021-44228) is being actively exploited and is a major concern for organisations worldwide.

Log4j Critical Vulnerability (CVE-2021-44228): Planning for the holidays

The Log4j/Log4Shell incident is continuing to evolve. We have seen both blue teams and red teams changing and improving their techniques to adapt.

Log4j Critical Vulnerability (CVE-2021-44228): Practical Tips to Protect Your Organisations

Over the weekend, the Log4j vulnerability kept security teams across the world at work and

Accellion Kiteworks Vulnerabilities

Adam discusses a set of of Kiteworks flaws, chained into authenticated user to remote root code exec

Fortinet FortiPortal Vulnerability Disclosures

Ben provides details on the recent vulnerability disclosures to Fortinet in the FortiPortal management portal

AirTag Hacking

Jamie shares an improved methodology for dumping the firmware of an
Apple AirTag.

Identifying Gophish Servers

Alain shares a methodology for discovering and identifying Gophish deployments in the wild. How easy is your Gophish installation to spot?

Ghostscript SAFER Sandbox Breakout (CVE-2020-15900)

Tim shares the discovery process of a recent Ghostscript bug, and lessons learned.

Advanced Open Redirection Vulnerability Discovery

Toby discloses advanced methods for detecting open redirection vulnerabilities.

JSON Web Token Validation Bypass in Auth0 Authentication API

Ben discusses a JSON Web Token validation bypass issue disclosed to Auth0 in their Authentication API.

Exploring Users With Multiple Accounts In BloodHound

Alain presents a methodology and Python script for exploring Active Directory users with multiple accounts in BloodHound.

PlayStation Classic Hacking

Ben discusses a method for gaining a root shell on the PlayStation Classic with the use of hardware hacking techniques.

Ten things you should know about ISO/IEC 27001

ISO 27001 is a risk-based compliance framework designed to help organisations effectively manage information security.

Enhancing protection of Australian critical infrastructure

Critical infrastructure law reform remains a major focus for the Australian Government in 2021.

LogRhythm Zero Days

As a result of our team’s penetration testing and exploitation activities, we uncovered a series of high-risk vulnerabilities that could be chained together.