Category: Vulnerability assessment and penetration testing

With the evolving digital landscape, securing data exchanges is paramount. JSON Web Tokens (JWT) have become a popular method for ensuring secure, stateless communication between parties. However, like any technology, JWTs are susceptible to hacking. Understanding the risks, impacts, and mitigation strategies for JSON token hacking is crucial for maintaining robust security.

What is a JWT Token?

A JSON Web Token (JWT) is a compact, self-contained way to securely transmit information between parties as a JSON object. It’s widely used for things like authorization and information exchange because it ensures data integrity and authenticity through digital signatures. Think of it as a digital passport that securely shares your data.

JWTs can be signed using a secret (HMAC algorithm) or a public/private key pair (RSA or ECDSA).

Use Case and Downsides of Algorithms:

1. HMAC SHA256 : (Hash-based Message Authentication Code) with SHA-256
   Use Case: This method uses a shared secret key to sign and verify tokens. It’s fast and suitable for scenarios where one trusted party creates tokens (e.g., server-to-server communication). However, the secret must be kept secure. HMAC is suitable for scenarios where both the server and client share a secret key. It’s commonly used in microservices, APIs, and single sign-on (SSO) systems. Fast and efficient due to symmetric key usage.
   Downsides: The main downside is that the secret key must be securely managed and distributed. If compromised, all tokens become vulnerable. Not suitable for scenarios involving multiple parties or cross-domain use.
2. RSASSA-PKCS1-v1_5 (RS256) SHA256: RSA (Rivest–Shamir–Adleman) with SHA-256
   Use Case: RSA-based JWTs are useful when asymmetric keys are preferred. The issuer signs the token with their private key, and anyone can verify it using the corresponding public key. RSA is widely supported and provides good security. IT is Ideal for broader scenarios involving multiple parties. They’re commonly used in scenarios where the server signs tokens and clients verify them.
   Downsides: Slower than HMAC due to asymmetric key operations. RSA operations are computationally expensive, especially for large keys. Additionally, key management (rotation, storage, and distribution) can be complex.
3. ECDSA P-256 SHA256: (Elliptic Curve Digital Signature Algorithm with P-256 and SHA-256.)
   Use Case: Similar  to RSA, ECDSA uses Elliptic Curve Cryptography. It’s efficient and secure, making it a great choice for JWTs. ECDSA is efficient and provides strong security. It’s suitable for resource-constrained environments (e.g., mobile devices) and high-throughput systems.
   Downsides: Less common than RSA. Key management is still essential. Additionally, some older libraries may not support ECDSA.

Remember to choose the method that aligns with your specific requirements and security posture. If you prioritize performance, HMAC is faster, but for broader scenarios, consider RSA or ECDSA for better security.

Key Applications of JWTs:

• Authorization: JWTs are crucial in user authentication, particularly in Single Sign-On (SSO) systems due to their minimal overhead and versatility across different domains.
• Information Exchange: They provide a secure method for exchanging information, ensuring authenticity and integrity through cryptographic signatures.

Risks of JSON Token Hacking : 

Despite their advantages, JWTs are susceptible to several hacking attempts, which typically aim to bypass authentication and access controls by exploiting structural or implementation flaws. Common hacking methods include:

1. Signature Forgery: This occurs when an attacker falsifies the token’s signature using weak or predictable signing keys. The server generates the signature by hashing the header and payload. If the signing keys are weak, an attacker can forge a valid signature and manipulate the token’s content.
2. Header Manipulation: This involves modifying the “alg” parameter in the JWT header to use a less secure algorithm or altering the “typ” parameter to bypass security checks. If these parameters are not properly validated, an attacker can manipulate them to bypass security mechanisms.
3. Algorithm Confusion: This vulnerability arises when an application treats an RSA public key as an HMAC shared secret. If the server uses the wrong algorithm for verification, an attacker could forge valid JWTs.
4. Kid Parameter Injection: The “kid” (Key ID) parameter in the JWT header can be exploited to execute arbitrary commands or SQL queries if not properly sanitized. This could lead to command injection attacks.
5. JWKS Spoofing: This attack involves manipulating the “jku” header in the JWT to point to a malicious URL, allowing the attacker to control the key used for verifying the token. If an attacker controls this URL, they can spoof the key and bypass the token’s verification process.

The consequences of a successful JWT token hack can be severe, including :

• Account Takeover: Unauthorized access to user accounts, leading to identity theft, data breaches, financial losses, and reputational damage.
• Data Breach: Extraction of sensitive information (e.g., usernames, passwords, PII) from tokens, which can be sold or used for further attacks.
• System Manipulation: Attackers may manipulate data, inject malicious code, or disrupt services.
• Denial-of-Service (DoS) Attacks: Using stolen tokens to overwhelm servers with requests, causing outages.
• Reputational Damage: Loss of trust in a company’s security practices, leading to financial losses and long-term consequences.

Mitigation Strategies : To mitigate JWT token vulnerabilities, consider the following strategies

• Secure Signing and Verification:
  Use Strong Keys: Utilize strong, unpredictable signing keys stored in Hardware Security Modules (HSMs).
  Robust Algorithms: Choose robust cryptographic algorithms like HMAC-SHA256 or RS256.
  Validate Claims: Ensure that all claims within the token are validated to maintain data integrity.
• Payload Content Control:
  Minimize Sensitive Data: Avoid including sensitive information in the token payload.
  Sessionless Authentication: Use sessionless authentication methods when possible.
  Short Expiration Times: Set tokens to expire after a short period to limit their validity.
• Secure Communication and Storage:
  Enforce HTTPS: Ensure all JWT communications are conducted over HTTPS to prevent eavesdropping.
  Access Controls: Implement strict access controls for signing keys.
  Secure Storage: Store refresh tokens securely, avoiding storage in cookies or local storage.
• Implementation Best Practices:
  Use Reliable Libraries: Utilize well-maintained libraries for JWT processing.
  Regular Security Audits: Conduct regular security audits and penetration testing.
  User Education: Educate users on phishing prevention and safe handling of credentials.
• Monitoring and Incident Response:
  Logging and Monitoring: Implement logging and monitoring to detect suspicious token activity.
  Incident Response Plan: Have a clear incident response plan in place to address breaches quickly.

By following these strategies, you can significantly reduce the risk of JWT token vulnerabilities in your application.

Author : Piyush Bharde | Analyst – Security

In today’s rapidly evolving technological landscape, security testers and penetration testers play a critical role in safeguarding organizations against cyber threats. As technology advances, professionals in this field must adapt and acquire new skills to effectively leverage the latest tools and methodologies. This blog post explores essential skills for security testers to stay relevant and thrive in an era driven by artificial intelligence (AI) and automation.

OpenAI, as an artificial intelligence organization, does not directly take jobs or replace professionals such as security testers or penetration testers. OpenAI’s primary focus is on developing advanced AI models like BurpGPT, PentestGPT which can assist users in generating human-like text and providing information.

It is important to recognize that AI is often viewed as a tool that can complement and assist human professionals rather than replace them. AI can help security testers by increasing efficiency, providing insights, and identifying potential vulnerabilities. However, human expertise is still crucial for contextual understanding, making judgment calls, and dealing with complex or novel situations.

Stay current: Acquire vital skills for tech-driven security testing

1. AI and Machine Learning:  Understanding AI and machine learning concepts empowers security testers to harness the potential of AI-driven tools and technologies. Familiarity with machine learning algorithms, data analysis, and model training enables professionals to effectively utilize AI-based security solutions and identify potential vulnerabilities.
2. Automation and Scripting:  Automation and scripting skills can significantly enhance productivity and efficiency in security testing. Proficiency in programming languages such as Python or PowerShell allows professionals to automate repetitive tasks, create customized testing scripts, and perform data analysis, freeing up time for more critical security assessments.
3. Cloud Security:  As organizations increasingly adopt cloud-based infrastructures, security testers must acquire knowledge of cloud security concepts, platforms (e.g., AWS, Azure), and best practices. Understanding cloud-specific security controls, identity and access management, and data protection is crucial for securing cloud environments effectively.
4. DevOps and Continuous Integration/Continuous Deployment (CI/CD):  DevOps practices are now commonplace, and security testers should familiarize themselves with DevOps principles and methodologies. This includes understanding CI/CD pipelines, containerization technologies (e.g., Docker), and integrating security practices into the development lifecycle to ensure secure and resilient applications.
5. Secure Coding and Secure Development Lifecycle (SDL):  Proficiency in secure coding practices and the SDL is essential for security testers. Understanding common vulnerabilities (e.g., OWASP Top 10), secure coding standards, and performing code reviews allows professionals to identify potential weaknesses in software applications and ensure secure development practices are followed.
6. Threat Intelligence:  Staying updated on the latest threat landscape and emerging attack techniques is critical for security testers. Continuous research on current cyber threats, novel vulnerabilities, and evolving attack vectors allows professionals to effectively assess and mitigate risks during security testing and penetration testing engagements.
7. Communication and Collaboration:  Effective communication and collaboration skills are invaluable for security testers. Being able to articulate technical concepts, collaborate with development teams, and convey security findings to non-technical stakeholders ensures that security assessments are well-understood and actionable by all involved parties.

To learn the new skills mentioned above, here are some effective ways you can consider:

• Online Courses and Tutorials: Platforms like Coursera, Udemy, and edX offer a wide range of online courses covering AI, machine learning, cloud security, programming languages, and more. These courses provide structured learning paths, practical exercises, and certifications.
• Open Source Projects and Communities: Engaging with open source projects on platforms like GitHub allows professionals to contribute, gain hands-on experience, and collaborate with experienced individuals in the field.
• Books and Documentation: Utilize authoritative books and technical documentation to delve deep into the topics of interest. These resources provide in-depth knowledge, practical examples, and guidance from experts.
• Practical Projects and Challenges: Building practical projects and participating in coding challenges solidify understanding and enhance skills. Real-world applications and security-related challenges sharpen expertise and provide valuable experience.
• Virtual Labs and Hands-On Practice: Utilize virtual labs and online platforms that offer hands-on practice environments for security testing, programming, or cloud platforms. These platforms allow professionals to experiment with tools and technologies without impacting real systems.
• Professional Certifications: Industry-recognized certifications like CEH, OSCP, or cloud-specific certifications validate knowledge and demonstrate expertise. These certifications add credibility and showcase proficiency to potential employers.

Conclusion:  In the ever-evolving field of security testing, acquiring new skills is essential for professionals to adapt to technological advancements. AI, automation, cloud security, and DevOps practices are transforming the landscape, demanding that security testers equip themselves with relevant expertise. By embracing continuous learning, engaging with communities, and staying updated with industry trends, professionals can ensure their skills remain relevant, bolstering their position in an era driven by AI and automation.

In today’s digital landscape, organizations face a constant threat of cyberattacks and data breaches. To effectively protect sensitive information, it’s crucial to conduct regular vulnerability assessments. This blog will delve into the world of vulnerability assessments, explaining their significance in cybersecurity and providing insights into best practices. By understanding vulnerability assessments, you can proactively identify and address potential security weaknesses, safeguarding your organization’s valuable assets.

What is a Vulnerability Assessment ?

Let’s start with “what does Vulnerability mean? It is the inability to resist a hazard or to respond when a disaster has occurred. For instance, people who live on plains are more vulnerable to floods than people who live higher up.  A vulnerability in cyber security refers to any weakness in an information system, system processes, or internal controls of an organization. These vulnerabilities are targets for lurking cybercrimes and are open to exploitation through the points of vulnerability.  A vulnerability assessment is a systematic approach to identify, quantify, and prioritize security vulnerabilities within an organization’s systems, networks, and applications. It involves assessing various types of vulnerabilities, such as software flaws, configuration weaknesses, network vulnerabilities, and human factor vulnerabilities. By conducting vulnerability assessments, organizations gain a comprehensive understanding of their security posture and can take proactive measures to mitigate risks.

The Importance of Vulnerability Assessments

Vulnerability assessments offer numerous benefits to organizations, including:

• Risk Identification: They help identify potential vulnerabilities and weaknesses that could be exploited by malicious actors.
• Prioritized Remediation: By assessing the severity and impact of vulnerabilities, organizations can prioritize their remediation efforts, focusing on critical weaknesses that pose the highest risk.
• Compliance Requirements: Vulnerability assessments play a vital role in meeting regulatory compliance requirements, as many industry standards and regulations necessitate regular security assessments.
• Cost Savings: Proactively addressing vulnerabilities through assessments can save organizations from costly security breaches, financial losses, and reputation damage.

The Vulnerability Assessment Process

1. Planning and Scoping: Define the scope and objectives of the assessment, including the systems, networks, and applications to be assessed.
2. Information Gathering: Collect necessary information about the target environment, such as network diagrams, system configurations, and asset inventories.
3. Vulnerability Identification: Utilize specialized tools to scan and detect vulnerabilities within the target systems, networks, and applications.
4. Assessment and Prioritization: Analyze the identified vulnerabilities, assess their severity and potential impact, and prioritize them based on risk levels.
5. Remediation and Mitigation: Develop a remediation plan to address the identified vulnerabilities, implementing appropriate security controls and fixes.
6. Validation and Reporting: Validate the effectiveness of remediation efforts and prepare comprehensive reports outlining the findings, recommendations, and ongoing risk management strategies.

Tools and Techniques for Vulnerability Assessment

Several tools and techniques aid in vulnerability assessments:

1. Vulnerability Scanners: Automated tools that scan networks and systems, identifying known vulnerabilities and misconfigurations.
2. Penetration Testing: Simulating real-world attacks to identify vulnerabilities that automated scans might miss..
3. Security Configuration Reviews: Assessing system configurations against industry best practices to identify weaknesses.
4. Source Code Analysis: Examining application source code to identify vulnerabilities within the codebase.

Best Practices for Effective Vulnerability Assessments

To ensure successful vulnerability assessments, follow these best practices:

• Conduct assessments regularly and systematically to maintain an up-to-date understanding of your security posture.
• Keep vulnerability databases and scanning tools up to date to detect the latest vulnerabilities.
• Prioritize critical vulnerabilities based on their potential impact and likelihood of exploitation.
• Foster collaboration among stakeholders, including IT teams, management, and third-party experts.
• Document findings, recommendations, and remediation efforts for future reference and compliance purposes.

Integrating Vulnerability Assessments into Your Security Strategy

Vulnerability assessments should be an integral part of an organization’s broader security strategy. By integrating the findings from vulnerability assessments with incident response plans, risk management frameworks, and security controls, organizations can

ensure a holistic approach to cybersecurity.

Future Trends in Vulnerability Assessment

The field of vulnerability assessment is continuously evolving. Keep an eye on these emerging trends:

• Artificial Intelligence and Machine Learning: These technologies are being leveraged to enhance vulnerability detection and automate assessment processes.
• Cloud-based Vulnerability Assessment Solutions: Cloud platforms offer scalable and centralized vulnerability assessment tools and services.
• Automation and Orchestration: The automation of vulnerability assessments and their integration with security operations streamline processes, saving time and effort.

Vulnerability assessments are crucial for identifying and mitigating security risks. By implementing regular assessments, organizations can proactively address vulnerabilities, minimize the likelihood of successful attacks, and protect their valuable assets. Embrace vulnerability assessments as a fundamental component of your cybersecurity strategy, and you’ll be better equipped to face the evolving landscape of cyber threats.

Data breach is an incident where sensitive, confidential, or protected information is accessed, used, or disclosed without authorization. This can occur due to a variety of reasons such as hacking, phishing, malware, and other forms of cyber-attacks, as well as human error and system failures.

Data breaches can have serious consequences, including financial losses, legal penalties, and damage to an organization’s reputation. They can also lead to identity theft and other forms of fraud for individuals whose personal information is compromised.

Some notable information security breaches include:

1. SolarWinds hack: In December 2020, it was discovered that hackers had breached the software supply chain of IT management company SolarWinds, affecting multiple government agencies and private companies. The cause of the breach is believed to be a supply chain attack in which the hackers inserted malware into a software update for the SolarWinds Orion platform.
2. Marriott data breach: In November 2020, Marriott International announced that hackers had breached the Starwood guest reservation database, potentially exposing the personal information of millions of guests. The cause of the breach is believed to be a vulnerability in the database’s firewall.
3. Twitter hack: In July 2020, a group of hackers took control of multiple high-profile Twitter accounts, including those of Barack Obama, Joe Biden, and Elon Musk. The cause of the hack was a phishing attack that allowed the hackers to gain access to the Twitter accounts of several employees.
4. Zoom data leak: In July 2020, it was discovered that a database containing personal information of millions of Zoom users had been left exposed on the internet. The cause of the leak was misconfigured security settings on the database.
5. Capital One data breach: In July 2019, a hacker was able to gain access to the personal information of over 100 million Capital One customers. The cause of the breach was a misconfigured firewall on a cloud-based server.

Possible causes of these breaches include:

•   Supply chain attacks: As seen in the SolarWinds hack, attackers can target a company’s software supply chain to gain access to their networks.
•   Phishing attacks: As seen in the Twitter hack, phishing attacks can be used to trick employees into giving away their login credentials.
•   Vulnerabilities in software or hardware: As seen in the Marriott data breach, hackers can exploit vulnerabilities in software or hardware to gain access to sensitive information.
•   Misconfigured security settings: As seen in the Zoom data leak, misconfigured security settings can leave sensitive information exposed to hackers.

To avoid similar breaches, organizations should:

• Implement strong security measures, such as firewalls, intrusion detection and prevention systems, and encryption.
• Regularly update and patch software and hardware to fix known vulnerabilities.
• Train employees to recognize and avoid phishing attempts.
• Regularly review and audit security settings to ensure that they are properly configured.
• Conduct regular security assessments and penetration testing to identify and address vulnerabilities.
• Monitor network and data activity to detect and respond to suspicious activity.
• Have incident response plan in place to quickly contain and mitigate the breach.
• Regularly backup data and have disaster recovery plan in place.

These are just a few examples of the recent information security breaches and possible ways to avoid them. It is important for organizations to stay informed of the latest threats and take proactive measures to protect their networks and data.

Ever heard of the term “Password fatigue”? It refers to a condition when people are forced to remember multiple passwords. In a 2014 survey by Intermedia, it was found that an organization provides access to a minimum of 15 applications to each of its employees on an average. This means that every employee of an organization needs to remember 15 different credentials every day. Not only does this create password fatigue for the employees but it also creates various challenges putting the network and organization’s data in a vulnerable position through this cumbersome process. Single Sign-On, referred to as SSO solves this problem effortlessly.

Single sign-on has not only solved the many problems faced by employees but has become an important part of the organization’s security program. It can be described as a software solution that gives users single access to various portals through one login and credentials. By decreasing the number and frequency of login attempts, the number of errors comes down, and eventually, network safety is increased. Along with good network safety, an SSO also brings with it several advantages. Let us get to know a few of them:

Benefits of SSO:

• Healthy password practices:  The SSO reduces the risk of password fatigue and poor password practices as only a single login attempt are required instead of multiple login attempts. This actually enables users to come up with strong passwords as there is no cumbersome process involved with credentials.
• Aids compliance process:  We all know that compliance and risk management go hand-in-hand. The SSO aids in maintaining compliance in the organization. There is constant monitoring of access management and it ensures compliance within the organization, thus aiding in better management of cyber risk.
• Password, and beyond:  The SSO is not just about a single access point and credential management. The right SSO solution can even lead to the elimination of credentials totally, through new advancements like OTP-based login, biometric, etc. Organizations have the option to gain better network security by opting for various techniques like two-factor authentication (2FA), multi-factor authentication (MFA). Such techniques can prove to be a breakthrough to an organization’s cyber security practices.
• Increased speed:  There is a need for highly efficient systems with high speed in industries such as defense, emergency services, hospitality, medicine, etc. due to the huge amount of operations and the quick nature of work involved. SSO not only saves time from repetitive tasks and prevents errors by providing single access to multiple platforms to a huge amount of employees at the same time, but it also increases the efficiency of their operations by preventing cyber-attacks and intrusions.
• Increased productivity:  By using the SSO, the complexities of mundane routine tasks like remembering multiple credentials, multiple login attempts due to frequent session time-outs, waiting for support from the IT team, etc. are eliminated and in turn, the speed and productivity of employees increase.
• Easy usage:  With SSO, there is no worry of having to memorize 10 different credentials for 10 different applications or having to log in 15 times again when a session times out. Users can enjoy real ease of use, which in turn induces better cyber safe practices and behavior.
• Enabling cyber security in a timely manner:  We are well aware of the kind of sudden surge of pressure that the IT teams had to face during the onset of the COVID 19 pandemic. Due to the contingent nature of arrangements that they had to come up with in a short span of time, the burden on the IT team to provide support increased drastically.

Due to this kind of change in situation and expectations, many IT teams had to compromise on the quality of network security they could provide. It can be said that the importance and highlight on cyber security and data protection saw a sudden fall, especially in a time when it was required the most due to the fact that even day-to-day operations proved to be a herculean task to them with the many limitations the “work-from-home culture” brought in. This problem can be resolved with an SSO solution, as it eliminates most of the troubleshooting process and enables an easier diagnosis that can be taken up on a self-help basis. This way, day-to-day operations can be normalized and data security can be given the due importance it requires.

• Preventing significant losses:  It is an evident fact that SSO improves network security and decreases the risk of data breaches. Organizations gain by avoiding financial and goodwill loss, which would otherwise be caused through cyber-attacks.
• User account management:  Not only does it help at times of emergency, but also it maintains an orderly manner of credential management during the onboarding and exit of employees in a normal situation. With the SSO, managing user-profiles and accounts becomes hassle-free, thus breaking down complexities.
• IT costs:  When the process of login and credential management is simplified, the need for troubleshooting in areas like credential management, help desk support, ticket resolutions, etc. reduces. This way, the organization can reduce IT costs.

Gaining the most of it:

While the SSO can prove to be one solution to multiple issues, an organization looking to implement an SSO must take a few extra steps in order to get the most of it. Let us take a look at what these extra steps are how these small steps can go a long way in extracting the best for the organization:

• Enforcing strong passwords:  Although it is an SSO that makes the intrusion process difficult and provides better network security, the whole network would be compromised even if an intruder manages to crack one single user credential. This is why the management must always enforce extra-strong password practices for its employees to prevent endangering any user.
• Caution while choosing an SSO solution:  Choosing the right SSO solution is very crucial as in an SSO, authentication, and access to all the applications or portals of the organization are singular. This means that if one portal is facing an issue, access to the rest of the applications will also be delayed. To avoid this, the SSO solution chosen by the organization must be highly reliable and contingency plans for business continuity must be placed properly.
• Connected authentication, connected access, and connected risks:  A single intrusion not only means all users are endangered, it also means that all the applications connected through the SSO are also at risk open to the attacker. Just strong password practices are not sufficient to avoid this kind of classic failure situation, selecting a high-quality service provider with high-quality network security goes a long way.
• Set-up process:  The set-up process for an SSO can be quite time and effort-consuming. The bigger the organization, the more complex the process. Caution must be taken while doing tasks like linking the identity provider to the service provider.

There is almost no aspect in today’s developed world that does not have technological interference in its design. Dependence on technology is such that it is required in every aspect of our lives and automobiles are no exception. The Automobile industry is one of the first industries which brought software aspects into its design to provide state-of-the-art facilities to people. From being just a mode of transportation from one place to another, they have taken the experience of traveling to another level with the help of technological advancements. But along with the advantages of technologically savvy features comes the risks too. The need for cyber security compliance is high here as the risk associated with each and every code installed into these automobiles is also high.

When it comes to cyber risk in automobiles, it might seem like it is associated with just the vehicle but the actual threat is to the user. This kind of threat is more when the automotive vehicle is an autonomous or connected car.

So how serious are these threats, how important is cyber security for the automobile industry, and what are the quick fixes and long-term solutions to the cyber risk present in evolving automobile technology? Read through to find out…

Role of Cyber security in the automotive industry

As already mentioned, major advancements in the automobile industry have been contributions from the field of technology. According to recent research, the E/E component market in the automobile industry is expected to grow USD 469 billion in the next 10 years. This simply means that the cyber risks associated with this industry are also expected to grow. Let us consider the possible kinds of cyber threats that can arise from these advancements:

• 1.  Risks associated with connected cars: Tools like Bluetooth and Wi-Fi are major contributors to communication devices and automobiles have adapted to equipping these features. Hackers are on the constant lookout for cloud networks when to gain access to the chain of vehicles connected to cloud networks through these tools. There are various technologies like vehicle to vehicle, vehicle to cloud, etc. for enabling this threat.
• 2.  Risk associated with autonomous vehicles: Autonomous vehicles need sensors within for functioning and they are dependent on data networks present around them like GPS. Any attack potentially can harm their functioning and lead to accidents. Although these seem straight out of fiction, without proper cyber security they will not be safe to function.
• 3.  Risks associated with electric vehicles: Electric vehicles need charging stations for consistent functioning. Any cyber-attacks on the charging stations or infrastructure can collapse the vehicle and lead to a power accident. This is a major concern when the cyber security of the vehicle is considered.

Types of Cyber-attacks on vehicles

Now that we are aware of what kinds of vulnerabilities exist in these automobiles, let us know further about how these vulnerabilities are used by hackers to attack:

1.  Direct physical attacks. This type of attack is not possible without physical access to a vehicle. Also, the usage of physical devices like ports or connectors is required for this kind of attack. With the help of such devices, hardware is installed during the repair or renewal process of the vehicle and later the vehicle is controlled by the hacker when the normal usage process is resumed.

2.  Indirect vulnerabilities in a physical attack: This is also a type of physical attack where a device with infected malware is installed into the physical vehicle. An example of this type of attack would be attacked using SD cards, USB devices, or music players.

3.  Threats in a wireless attack: It involves all types of attacks that involve Bluetooth, Wi-Fi, GPS or cellular mechanisms, etc. For this type of attack, no physical access is required.

4.  Attacks using sensor fooling methods: There are ways in which sensors can be taken advantage of. Although these kinds of attacks are not very prevalent, the days are not far from where we will be dealing with these attacks if proper cyber security measures are not taken.

Below are the few types of attacks widely prevalent and used by hackers:

DOS- A DOS attack can be used to harm the user of the vehicle. It does not give any external access to the hacker but it makes the internal system of the automotive system fail. Although a hacker cannot intrude into the data or the cloud if the intention of the hacker is to harm the user, a DOS attack surely solves the purpose by making the vehicle collapse through methods like disabling the brake system.

MitM attacks-If the hacker wants to steal data from the server or intrude between the automotive and its server, the MitM attack serves the purpose. Through this type of attack, the hacker can gain access to the server.

Command injection data corruption-This type of attack is very hazardous as it uses software coding as a tool to gain access into the data stored and corrupt it.

Common steps for better cyber security in automobiles

Although cybersecurity measures must be followed all throughout the life cycle of an automotive component, below are few measures that can be followed to aid in better management of risks:

• 1.  OTA refers to Over-The-Air update. Caution must be kept with interfaces such as OTA, OBD, Ethernet, and Bluetooth, basically all outside the world.
• 2.  Secure all gateways related to safety and must be kept isolated or separate.
• 3.  HSM refers to Hardware Security Module. It plays a significant role in delivering security services and is a major step in cyber security measures other than software-related measures.
• 4.  The requirements prescribed in ISO 21434 must be followed throughout the supply-chain by all the parties across.
• 5.  Cyber security framework must be followed while developing protocol stacks like  UDS,  SOME/IP,  Flex Ray,  DoIP. These must-have firewalls as an in-built function.
• 6.  The ECU entry points must be deleted including all the services completely as it is a vulnerability when considered for hackers.

ISO SAE/DIS 21434
The ISO/SAE DIS 21434 is a standard jointly published by the ISO and SAE with the objective of providing a framework to organizations. The ISO 21434 is the standard when it comes to compliance for automotive cybersecurity. The ISO 21434 is for automotive cyber security as to how the ISO 26262 is for functional safety for road vehicles.

Let us get to know this standard concisely:

Cybersecurity Management:  As the name suggests, this deals with the management of cyber security. It defines the aim, scope, objectives of setting the tone for cyber security through various strategies, etc.

Risk Management methods:  Risk assessment is the first step in the risk management framework. Various methods to assess existing risks are explained and an analysis is conducted on existing vulnerabilities.

Concept Phase:  This is the time when goals are redefined according to the extent of various automotive components exposed to risk. This aids in reducing the risks.

Product Development:  This stage refers to hardware, software, and system development and the cyber security framework exclusively to be followed at this stage.

Supporting Processes:  The CLAL is introduced into the activities at this stage. CLAL stands for Cybersecurity Assurance Level. CLAL in the ISO 21434 is the same as ASIL is for the ISO 26262. It is a measure which states how aggressive cybersecurity must be for a particular component.

Compliance process explained

The process of obtaining compliance for ISO 21434 consists of three steps, which are :-

1. Assessment:  The first step in the compliance process is risk assessment. The status and scope of risk are evaluated and a guideline is provided in a framework to be followed as a format. Before prescribing the guidelines, the compatibility to the evaluated result is thoroughly analyzed.
2. Implementation:  After assessment comes to the implementation stage. This process includes defining the processes and procedures and roles of all the people involved in the implementation of the framework. This implementation is done keeping the ISO 21434 and its requirements in focus.
3. Operations:  The final step towards compliance is operations, which is a continuous process. It includes controlling, assessing which would lead finally to the launch of the CSMS.

When we make a checklist of all the risks that may cause turbulence to our business, we often forget the damage that can be caused by a cyber-attack! Not just that, most companies even ignore the fact that it is a constant investment too – leading to them not improving their security processes each year. The common problem that most companies have is to understand the risks that may be present. How do you do that? With a  vulnerability assessment  of your business!

A test of this kind would show the kind of weaknesses that exist in your company and how they can be exploited. These weaknesses could be because of ignorance, mistakes or just plain lack of attention.

To understand if the internet security is acceptable or stable for usage, a malicious attack is usually self generated or simulated. This is called penetration testing. Either of these methods can be used on a wired or wireless network which the program to penetrate could even be a mobile application. Of course both these testing processes would require a meaningful investment and here is why –

• Understanding the errors in programming that maybe a possible risk towards cyber attacks.
• Implementing these standards would secure your IT networks from attacks both internally and externally.
• Create and implement a methodical approach towards risk management in the company.
• Keep your entire business logic away from IT networks
• Indentifying opportunities for ROI on IT security investments
• Keep your business away from financial or reputational downfalls.

Why would your business be vulnerable?

Wrong programming practices would the first and sole reason and the second reason would be configurations errors of these programming practices. If you have your routers, switches or servers that are not configured right or have gaps in security – it would be extremely for a break into your internal system.

How can a vulnerability assessment help?

With a vulnerability assessment, you would be using a technical approach to find the gaps that lie in your network or software security system. This is completely a process of repeated searches for errors. Upon a single process, you would be able to see the vulnerabilities and the severity level for each of the problems. How would you explore and exploit a vulnerability in your system though?

Penetration testing to assess the damage

Penetration testing  would help you go deeper into the vulnerabilities that were highlighted. You would be sure of the vulnerability and know what damage can be caused to your application or network. Do keep in mind though that this process is very intrusive and can cause a lot of damage to your systems – hence you need to be very cautious and plan it out perfectly.

How do you choose between both?

The answer to this question is quite simple – you need both. You need to analyse the risks that are present first and then figure out the level of damage that can be done with keep such risks at hand. They both go hand in hand towards a more secure system and as per ISO 27001 you need to prevent the exploitations of any technical vulnerabilities that may lie on your system. Simply put, the need of the hour is to have both techniques on your system to ensure there are no gaps.

Cosmos Bank Pune main branch server has been hacked.  Hackers carried out transactions worth Rs 94.42 crore in Hong Kong and India. The incident occurred on 11th August’18. An amount of around 78 crores is transferred out of the country via various transactions.

Transaction worth Rs. 2.5 crore was done through National Payments Corporation of India (NCPI) and VISA.

This did not stop here, the server was hacked again on 13thAugust’18 and the amount of Rs.14 crore

through Swift Transaction was transferred to the account of ALM trading limited at Hang Seng Bank in Hong Kong.

A complaint has been registered against ALM Trading Limited and unknown persons in Pune.

Earlier this year, in the month of Feb’18, India’s City Union Bank lost $2m via SWIFT Cyber Attack. In past three years, this was the fourth time that SWIFT has been hacked.

Secure Business from the Cyber Attacks

With the growing number of cyberattacks in the financial sector, many small and large enterprises are getting affected.   Multiple cases where public, private enterprises and even individuals who lost critical data due to the ransomware infection have been reported.

Overall, organizations may adapt the five-step approach mentioned below to safeguard themselves from the cyber security attacks,

PREVENT:Conduct regular monitoring, review of

DETECT:

RESPOND:

INVESTIGATE:

ADAPT:

Chief Technology Officer Troy Leach.