AI coding tools are creating serious security risks in production, with one-in-five CISOs saying they've suffered major incidents because of AI-generated code.

AI coding tools now write 24% of production code – 21% in Europe and 29% in the US – according to a new report from Aikido. But it's risky, with 69% of security leaders, security engineers, and developers across Europe and the US revealing they'd found serious vulnerabilities in AI-written code.

US-based respondents were among the worst hit by AI-related flaws, with 43% of organizations reporting serious incidents, compared with just 20% in Europe.

This, the study noted, appears to be down to better prevention and oversight. For example, EU-based firms reported more “near misses” with AI-generated code than their US counterparts, potentially highlighting more robust testing practices.

Adding more tools to address the issue isn’t helping, Aikido found. Indeed, organizations with more security tools report more incidents, with more overhead and slower remediation.

Nearly two-thirds (64%) of those with just one or two tools had an incident, the figure was 90% for those with between six and nine tools.

All-in-one AI coding tools are helping bridge gaps

Notably, teams using tools designed for both developers and security teams were more than twice as likely to report zero incidents than those using tools made for only one specific group.

“Giving developers the right security tool that works with existing tools and workflows allows teams to implement security best practices and improve their posture,” commented Walid Mahmoud, DevSecOps lead at the UK Cabinet Office.

Teams using separate AppSec and CloudSec tools were 50% more likely to face incidents, and 93% of those with separate tools reported integration headaches such as duplicate alerts or inconsistent data.

The security blame game is heating up

The blame for incidents caused by AI code is now becoming a serious point of contention within enterprises, the report noted. For example, 53% of respondents blamed security teams for failing to address issues, while 45% blamed developers who failed to spot issues before pushing to production.

Meanwhile, 42% pointed toward whoever merged it. This blame game is expected to continue escalating, according to Aikido. Half of developers reckoned they’d be blamed if the AI code they wrote introduced a vulnerability, even more than the security team itself.

“There's clearly a lack of clarity among respondents over where accountability should sit for good risk management,” commented Andy Boura, CISO at Rothesay.

Despite concerns across the board, enterprises are expected to continue driving ahead with adoption of AI coding tools, the study noted. Nine-in-ten said they expect AI to take over penetration testing within the next five years, for example

Meanwhile, 96% believe AI will write secure, reliable, code at some point, with the biggest proportion (44%) thinking it will happen in the next three-to-five years.

Only 21% think this will be achieved without human oversight, however, underlining the importance of keeping humans in the loop.

MORE FROM ITPRO

• Think AI coding tools are speeding up work? Think again – they’re actually slowing developers down
• How AI coding is transforming the IT industry in 2025
• AI coding tools are booming – and developers in this one country are by far the most frequent users

Often underestimated by CISOs, hardware and network vulnerabilities are on the rise as IoT proliferates and AI creates increasingly larger attack surfaces.

That’s according to an analysis by Bugcrowd, which found the last year has seen a massive 88% increase in hardware vulnerabilities and a doubling in network flaws.

In a new report, Inside the Mind of a CISO 2025: Resilience in an AI-Accelerated World, the firm said that 81% of security researchers had encountered new hardware vulnerabilities in the past 12 months.

Bugcrowd pointed to a 40% rise in broken access control vulnerabilities as a key factor behind rising threats. Meanwhile, sensitive data exposure was another problem area, with a 42% increase in critical vulnerabilities tied to personal information like names, addresses, and account details.

"We are in a high-stakes innovation race, but with every AI advance, the security landscape becomes exponentially more complex," said Nick McKenzie, Bugcrowd CISO. "Attackers are exploiting this complexity, but still targeting foundational layers like hardware and APIs."

The good news is that the number of critical vulnerabilities has gone down slightly year-over-year. The number of critical flaws in API targets fell by about 25%, for example, while vulnerabilities in website targets decreased by 30%.

There was a slight rise in critical vulnerabilities for Android, hardware, iOS, and network targets. Of these, broken access control is now the top category at 36%.

However, there's also been a 42% increase in sensitive data exposure and a 10% increase in API vulnerabilities as attack surfaces expand. Network vulnerabilities doubled, according to the report.

Pentesters are having a field day

This increasingly perilous threat landscape has sparked a boom time for ethical hackers and pentesters, the report noted. Across 2024, there was a 32% increase in average bug bounty payouts for critical vulnerabilities.

Bugcrowd said enterprises are focusing on critical vulnerability payouts, paying more for P1 vulnerabilities and less for P3, P4, and P5 vulnerabilities.

Despite this helping hand, CISOs are still contending with heavy workloads and growing challenges. With applications going through multiple development cycles and teams under immense pressure to release features quickly, this is creating a frantic environment where mistakes are made.

New attack vectors and often forgotten targets like APIs and hardware typically among those overlooked.

With this in mind, Bugcrowd said organizations should consider adding APIs and hardware to the scope of their offensive security testing programs.

They should also adopt an integrated approach to attack surface intelligence - which, the firm noted, would help to secure budgets by showing measurable improvements in security efficiency.

Naturally, the company urged enterprises to make better use of ethical hackers, pentesters, and red teamers for offensive security training.

“By using adversarial testing and objective measurement, security leaders can shift from reactive firefighting to building true resilience, " said Trey Ford, chief strategy and trust officer at Bugcrowd.

"Ultimately, this enables CISOs to confidently articulate their security story and secure resources necessary to protect their organizations.”

MORE FROM ITPRO

• This DeepSeek-powered pen testing tool could be a Cobalt Strike successor
• Everything you need to know about penetration testing
• Businesses are taking their eye off the ball with vulnerability patching

Hackers are deploying a new AI-native penetration testing tool for sophisticated attacks in an industry first, according to new research.

Cybersecurity firm Straiker has warned that ‘Villager’, a tool developed by a China-based red team project known as Cyberspike, is already being used to automate attacks under the guise of penetration testing.

Villager leverages the Kali Linux toolsets and DeepSeek v3 to automate attacks, and is easily accessible via the official Python Package Index (PyPI).

Based on user prompts it can exploit vulnerabilities in a given domain, launch attacks using multiple tools to ensure a victim is breached, and establish persistence for attackers in compromised systems.

“The framework's most dangerous innovation lies not in any single capability, but in how it seamlessly integrates multiple attack vectors through intelligent task orchestration,” wrote Dan Regalado, principal AI security researcher at Straiker, and Amanda Rousseau, member of technical staff at Straiker.

“By combining containerized Kali environments, browser automation, direct code execution, and a 4,201-prompts vulnerability database, all coordinated by AI decision-making, the framework dramatically lowers the technical barrier for conducting complex attacks.”

Researchers at Straiker compared Villager to Cobalt Strike, a legitimate penetration testing tool that has been widely used by hackers for illegitimate purposes.

In March, Fortra and Microsoft announced an “aggressive campaign” against hackers using Cobalt Strike across over 200 malicious domains. Malicious use of the tool on a daily basis dropped 80% as a result.

Villager pen testing tool is a step above Cobalt Strike

Unlike the scripted attacks possible via Cobalt Strike, the AI-powered Villager is capable of complex attacks based on natural language prompts.

For example, researchers noted that when Villager detects a victim’s domain using WordPress, it will launch an attack using the WordPress vulnerability scanner WPScan, for which it creates a custom Kali container.

If an API endpoint is detected, on the other hand, Villager may use browser automation to attempt a breach through a victim’s authentication workflow.

Each successful step is verified by the tool, which can dynamically adapt its vector depending on the context of the attack. Similarly, each Kali Linux container Villager creates, which can contain a range of cybersecurity tools, has built-in mechanisms to wipe themselves after 24 hours to prevent detection.

The tools’s command and control (C2) system, accessed via its Python-based FastAPI connection, ensures each attack is broken into manageable subtasks that are handled by its AI model.

Outputs are standardized using the data validation library Pydantic, researchers added. This ensures each decision Villager makes is reliable and follows on from its previous steps.

All of this points to an organic, sophisticated methodology that opens the door to more attacks from inexperienced attackers, researchers warned. Since it was published on PyPI in July 2025, Villager has been downloaded more than 10,000 times.

The authors at Straiker warned the tool could lead to more automated attacks by hackers using off the shelf tools. They also cautioned that attacks of this kind could speed up the rate at which attackers can discover new vulnerabilities and exploit them, shrinking the detection and response window for cybersecurity teams.

Straiker tracked Cyberspike as having first appeared on a domain established in November 2023, by the supposed AI firm Changchun Anshanyuan Technology Co.

The authors wrote that no evidence of such a company exists on Chinese social media, though archived pages show it sold Cyberspike as a remote administration tool (RAT) in 2023.

MORE FROM ITPRO

• Hackers are duping developers with malware-laden coding challenges
• Anthropic admits hackers have 'weaponized' its tools
• Hackers are using AI to dissect threat intelligence reports and ‘vibe code’ malware

More than a third of security leaders and practitioners admit that generative AI is moving faster than their teams can manage.

Almost half (48%) told penetration testing firm Cobalt that they'd like to have a 'strategic pause' to recalibrate their defenses against generative AI-driven threats - something they know they're not likely to get.

More than seven-in-ten (72%) cited generative AI-related attacks as their top IT risk, but a third still aren't conducting regular security assessments, including penetration testing, for their LLM deployments.

“Threat actors aren’t waiting around, and neither can security teams,” said Gunter Ollmann, CTO at Cobalt.

“Our research shows that while genAI is reshaping how we work, it’s also rewriting the rules of risk. The foundations of security must evolve in parallel, or we risk building tomorrow’s innovation on today’s outdated safeguards.”

Security leaders at C-suite and VP level are more concerned than practitioners about long-term generative AI threats such as adversarial attacks - an issue for 76%, compared with just 68% of security practitioners.

However, 45% of practitioners expressed concern about near-term operational risks such as inaccurate outputs, compared with only 36% of security leaders.

Security leaders are also more likely to consider changing how their team approaches cybersecurity defense strategies in light of the potential of generative AI-driven attacks, at 52% compared with 43% for practitioners.

Top concerns among all survey respondents included sensitive information disclosure, cited by 46%, model poisoning or theft, a worry for 42%, inaccurate data, an issue for 40%, and training data leakage, cited by 37%.

Similarly, half said they wanted more transparency from software suppliers about how they detect and prevent vulnerabilities, signaling a growing trust gap in the AI supply chain, the researchers said.

Many organizations lack the in-house expertise to adequately assess, prioritize, and remediate complex LLM-specific vulnerabilities.

This can lead to an over-reliance for fixes on third-party model providers or tool vendors - some of which may not prioritize these security issues as quickly or effectively as they should, particularly if the vulnerability lies within the foundational model itself.

LLM analysis uncovers worrying flaws

Analysis based on data collected during Cobalt pentests showed that while 69% of serious findings across all categories are resolved, this drops to just 21% of the high-severity vulnerabilities found in LLM pentests.

This is a concern, researchers said, given that 32% of LLM pentest findings are serious and is the lowest resolution rate across all test types the company conducts.

While the mean time to resolve (MTTR) for those serious LLM findings that are fixed is a rapid 19 days — the shortest MTTR across all pentest types - this is probably partly because organizations tend to prioritize quicker, and often simpler fixes.

"Much like the rush to cloud adoption, genAI has exposed a fundamental gap between innovation and security readiness,” said Ollmann.

“Mature controls were not built for a world of LLMs. Security teams must shift from reactive audits to programmatic, proactive AI testing — and fast.”

MORE FROM ITPRO

• AI security blunders have cyber professionals sweating
• Enterprises are worried about agentic AI security risks – Gartner says the answer is just adding more AI agents
• Agentic AI could be a blessing and a curse for cybersecurity

Cybersecurity provider Bugcrowd has launched a new service aimed at helping MSP’s drive pen testing capabilities - with a particular focus on supporting small businesses.

The company said the program will address a growing backlog of compliance-related pen tests among SMBs, enabling them to meet requirements and streamline capabilities.

Drawing on the expertise of ethical hackers, Bugcrowd said the launch of the scheme marks a “significant step forward” in its mission to expand support for MSPs and customers.

"Bugcrowd's new MSP offering is a game-changer for our partners and an important step for our program," said Jacques Lopez, VP for global channel & alliances at Bugcrowd.

"By leveraging our crowdsourced streamlined-scope pen testing capabilities, MSPs can offer their clients fast, reliable, and cost-effective compliance testing. This enables those clients to stay ahead of regulatory requirements and security threats, while their systems are secure and compliant.

“This offering can augment the capabilities of those partners who already provide pen testing, enabling them to reserve their in-house pen testers for projects they are best suited for while Bugcrowd handles more routine projects.”

The new MSP program is available immediately, albeit to a limited number of partners, Bugcrowd revealed. Service pricing is also based on a flat rate model, and will offer a raft of options based on the scope of the pen testing required.

What to expect with the new Bugcrowd service

The new pen testing service will cover a range of key areas, according to Bugcrowd.

This includes pen testing for networking, APIs, mobile apps, and cloud configurations. Speed and efficiency are also key target for the company, and the scheme will enable partners to launch engagements in around three business days.

This, the firm noted, will streamline customer security capabilities.

For MSPs specifically, Bugcrowd said the new program will allow partners to benefit from “faster revenue recognition” by speeding up the initiation of engagements.

As part of the move, a raft of crowdsourced offerings from the firm, including the Bug Bounty, Vulnerability Disclosure Programs, and Attack Surface Management schemes will be made available for resale.

Mitch Evans, director of cybersecurity consulting at BARR Advisory, said the new program will play a vital role in helping bolster security among small businesses, which has been a long-standing area of concern.

"SMBs often struggle to employ the services they need to meet compliance requirements. Bugcrowd’s service not only enhances our ability to deliver high-quality compliance testing to our clients but also helps us scale our operations and meet the growing demand for pentesting services," Evans said.

"We are thrilled to work with Bugcrowd on deploying this service and look forward to new and existing clients benefiting from these trusted capabilities."

MORE FROM ITPRO

• NetApp eyes SAN market gains amid tighter partner collaboration
• UK channel partners are ramping up their cloud capabilities
• ESET looks to ‘empower’ partners with cybersecurity portfolio updates

Cyber criminals have been found abusing legitimate open-source penetration testing tools to launch attacks on AWS-hosted Kubernetes environments.

The campaign, dubbed SCARLETEEL, started in February 2023 and is known for targeting cloud environments.  

The latest discoveries revealed new tools and techniques to bypass security measures and execute novel intrusions. 

A typical SCARLETEEL attack sees attackers exploiting misconfigured AWS policies to escalate their privileges and gain account control.  

Once in, the attackers target Kubernetes in order to significantly scale up the attack and deploy malware, such as cryptomining tools.  

A combination of penetration testing tools was used in the attack. Once the victim’s AWS credentials had been stolen and the AWS CLI binary installed on the exploited containers, the attackers installed Pacu, an AWS exploitation framework, to reveal further vulnerabilities in the victim’s account. 

The attackers also leveraged Peirates, a Kubernetes-specific penetration testing tool, to exploit the Kubernetes environment. 

While cryptomining remains one of the operation’s objectives, according to researchers from the Sysdig Threat Research Team, other goals include gaining persistence and the theft of proprietary data. 

What has changed in the attack pattern? 

SCARLETEEL was first noted by the team in February 2023 and the techniques in use have changed in the time since.  

Michael Clark, director of threat research at Sysdig, said: “They kind of evolved their toolsets to understand modern approaches”. 

The attacker’s scripts now account for the differences. 

Although the ability to detect the presence of a Fargate-hosted container is novel, the use of the AWS CLI and Pacu on exploited containers and Peirates to further exploit Kubernetes is a significant development. 

“They use these tools to keep hopping into new environments,” Clark said. 

“So, they may end up in a Fargate [environment] because they look for all the credentials they can.” 

How were the attackers detected? 

In Sysdig’s research, Clark noted that the tools the attackers used are “noisy”, meaning when they run, their processes are often detectable by system and network monitoring tools. 

Understanding what the tools’ reconnaissance looks like is key to detecting what they’re doing and when they’re running. 

“That is really the only way to do it,” Clark said. “You obviously can’t just say ‘don’t let them in’ - that’s the answer to everything.” 

Clark also said the use of Peirates was particularly interesting. The previous attack did not use this tool, but the SCARLETEEL campaign has now expanded to look for Kubernetes and, if found, take advantage of it. 

Moving beyond AWS 

Alessandro Brucato, threat research engineer at Sysdig, said he believes that the attackers behind the campaign will continue to develop it to target other cloud providers. 

“They will try to focus on how they can make a lot less noise, because actually they can look even more like a legitimate service provider. They may try to find some edge services on some cloud providers.” 

OpenAI has unveiled a new bug bounty program offering rewards for security researchers if they can uncover vulnerabilities in its products. 

In an announcement on Tuesday, the California-based AI firm said the bug bounty scheme is “essential to our commitment to develop safe and advanced AI” and deliver services that are secure, reliable, and trustworthy. 

As part of the initiative, OpenAI said it will offer a tiered reward system based on the severity of bugs uncovered by researchers. 

Rewards can range from as little as $200 for low-severity flaws with a maximum reward of $20,000 for “exceptional discoveries”. 

“The OpenAI Bug Bounty Program is a way for us to recognize and reward the valuable insights of security researchers who contribute to keeping our technology and company secure,” the firm said in a statement. 

“We invite you to report vulnerabilities, bugs, or security flaws you discover in our systems. By sharing your findings, you will play a crucial role in making our technology safer for everyone.”

Researchers participating in the new initiative will be able to disclose vulnerabilities or flaws through a partner organisation, Bugcrowd.

Bugcrowd will manage the submission and reward process, which OpenAI said is designed to “ensure a streamlined experience for all participants”. 

ChatGPT vulnerability concerns

The move from OpenAI follows a period of unrest over security-related issues at the generative AI firm, which has close ties with Microsoft. 

Last month, the company revealed that a bug in ChatGPT led to a leak of users' data.

This flaw meant that ChatGPT Plus users began seeing user email addresses, subscriber names, payment addresses, and limited credit card information. 

The issue prompted the company to temporarily take the chatbot offline to work on a fix. 

“The bug was discovered in the Redis client open-source library, redis-py,” OpenAI explained in a post at the time. 

“As soon as we identified the bug, we reached out to the Redis maintainers with a patch to resolve the issue.”

The team behind the Kali Linux project has released a brand-new version called Kali Purple, designed specifically for defensive security practitioners - a first for the project.

Kali Purple was released as a technical preview this week and marks the first time the platform has catered to defenders, previously being used as a tool for red teamers and penetration testers.

As of now, Kali Purple is a proof of concept distro for security testing, described by Kali as a “reference architecture for the ultimate SOC In-A-Box”.

It will allow teams to engage in internal wargames, learn how to protect small-to-medium-sized IT environments, and practice threat hunting, among other activities.

The name references the addition of blue and purple team capabilities to Kali Linux’s existing suite of red team testing tools, expanding the distro from its offensive testing pedigree to encompass the entire security testing spectrum.

More than 100 defensive tools are included within Kali Purple. These include CyberChef, which can encrypt or decrypt data as well as compression and data analysis, Elastic’s security information and event management (SIEM), and the open source network intrusion detection system Zeek.

Kali Autopilot, a script builder for automated attacks is also included in Kali Purple. Through a community hub developers will be able to share scripts for blue teams to go up against, as well as practice packet captures to train in network analysis.

The developers outlined their goal of making Kali the best Linux distro for security tests, and expanding enterprise-grade security to all.

“Remember what we did a decade ago with Kali Linux? Or with BackTrack before that? We made offensive security accessible to everyone,” Kali wrote in its blog post.

“No expensive licenses required, no need for commercial grade infrastructure, no writing code or compiling tools to make it all work… just download Kali Linux and do your thing. We are excited to start a new journey with the mission to do exactly the same for defensive security: Just download Kali Purple and do your thing.”

Kali Purple has been structured around the National Institute of Standards and Technology’s (NIST’s) five functions as outlined in the Cybersecurity Framework: “identify, protect, detect, respond, and recover”.

In addition to the announcement of Kali Purple, the firm highlighted eight new tools included in Kali Linux 2023.1.

These include the aforementioned Cyberchef, as well as packet capture system Arkime, DevSecOps and vulnerability management tool DefectDojo, network scanner Dscan, Kubernetes package manager Kubernetes-Helm, password analysis and cracking kit 2 (PACK2), pen test data management tool RedEye, and cryptographic algorithm interface Unicrypto.

The update also brings a visual refresh to the distro, with new wallpapers and Kali Purple themes, as well as a new tiling and widget system with the introduction of the graphical workspace environment KDE Plasma 5.27.

Kali Purple is available as a pre-launch technical preview now, with a dedicated Discord server and wiki. Further details on its full launch are expected in the future.

This automatically-generated transcript is taken from the IT Pro Podcast episode ‘Meet the cyborg hacker’. We apologise for any errors.

Adam Shepherd

Hi, I'm Adam Shepherd,

Connor Jones

And I'm Connor Jones.

Adam

And you're listening to the IT Pro Podcast, where this week we're taking a look at the emerging world of biohacking.

Connor

Now it's probably worth making the distinction between the two types of biohacking there are in the world right now. You know, there is of course, the kind of biohacking reserved for scientists, professional and homebrew, that involves the CRISPR gene editing technology. But this of course, is is an IT podcast and we're most concerned with a form of bio hacking of the cyber kind; you know, the one involving tech baked into the human body.

Adam

Now, since the invention of computer systems, people have been finding ways to break into them and customise their operation to best suit their own needs. In recent years, however, adventurous experimenters have begun exploring how the same principles can be applied to the human body.

Connor

The so called biohackers have explored a number of ways to combine digital technology with flesh and blood, including implantable chips, digitally enhanced prosthetic limbs and much, much more. But what potential advantages does human augmentation hold? And are there any security risks that might be associated with this emerging practice? We're joined today by Len Noe, a technical evangelist, white hat hacker at CyberArk, and self described transhumanist, who's been immersed in this world for a number of years. Len, thanks for joining us.

Len Noe

Thank you guys for having me. It's a pleasure to be here.

Adam

So Len, first of all, you've got a number of, shall we say aftermarket extras? Can you talk about some of the biohacking modifications that you've made yourself?

Len

Well, to be fair, I didn't make them myself. I, the first thing I'm going to say is everything I have, I've done it as safely as humanly possible. I'm not one of those. Do It Yourself guys to do this in your garage.

Adam

Don't try this at home, kids.

Len

Yeah. I mean, there was a time that that was the way it was, but we passed that time, we can actually get some some some safe implants. Yeah, currently, I have eight different microchips with varying degrees of functionality, but predominantly, they revolve around RFID and NFC. I can do redirection tags via NFC, I can also have chips that will handle a lot of physical access cards like MIFARE classics, HID procs one and two, pyramid and dala, I actually have a credit card payment chip in my the top of my left hand, so I can actually do tap to pay with my hand, I have a biosensing magnets so that that one's a lot of fun. It's not really a lifting magnet. But due to the way that the magnet was constructed, it actually gives me the ability to feel electromagnetic currents and electromagnetic fields, kind of like a spidey sense. So yeah, and we can get into it a little later. I'm actually in the working on the second round of my prototypes for my pegleg. Those won't be the standard microchip style things. But that's actually a Raspberry Pi Zero W2 that's been actually loaded with Kali encased in bio encapsulation, and then I'm going to be implanting that in my leg, so that way I can actually take systems into places where you can't, or shouldn't be allowed to take technology. So having it set up to run low energy Bluetooth sweeps along with auto pwns while I'm sitting here talking, so yeah, I kind of have a little bit of a fascination with human upgrades.

Connor

This is already my favourite podcast I've ever done. This is great. Can I just ask what is what is the upside of being able to detect and sense electro magnetic fields?

Len

Well, I'm also very, very passionate about physical pen testing. I'm an avid lock picker. I'm a member of multiple different lock picking clubs. And when you look at physical security, especially around warehouses, how are most of them secured? Magnetic locks, magnetic locks require electricity. So depending on the wiring and the amount of shielding in your your Romex cabling for your electromagnet, I can sit on the outside of your building, run my hands over the wall, and I can actually trace your electrical lines. So at that point, I actually have an idea of where to shim or make, you know, especially if it's a destructive pen test, I can make a small hole and basically clip the electrical wire. And if you know anything about mag locks, especially if you're dealing in like an emergency situation like a fire or a power outage, magnetic locks are automatically designed to actually go into an open state due to an emergency to allow people to get out. So basically the that's one great thing for the magnet. The other thing is it makes a really cool trick at a bar, you can pick up bottle caps and things, you know. And it's, if nothing else, it's a really cool way to get, it's a cool magic trick around young kids too.

Adam

In the immortal words of the Insane Clown Posse: magnets, how do they work?

Len

Why do you have to go there, man? I mean, I'm from Detroit, but I mean, in St. Cloud, we had better musicians, man, let's go with the MC5 or, or the Bay City Rollers. Ted Nugent.

Adam

This is Shaggy 2 Dope erasure, and I will not stand for it. So in terms of some of the other practical use cases that this technology has, aside from the magnets, you mentioned some of the chips that you've been using, particularly the RFID and NFC devices, the contactless payment devices; what other kinds of use cases are there for this technology, either currently, or that you can kind of see emerging in the near future?

Len

Well, I mean, at this point, it's anything around the contactless technology, we see a lot of NFC used in IoT. You know, when it comes to personal devices, almost every mobile device or tablet that's been released within the last three to five years has NFC capability. And the truth is not a lot of people understand what it is. And the fact that it by its design is an unsecured protocol. You know, the problem when it comes to NFC is we're using application level security to try and lock down an insecure protocol. You know, so anything from, you know, compromising a mobile device through the use of the implants, I mean, one of my favourites is the physical access side of things, you know, and, you know, let me, let me go into this for just a second, if I may, you know, when it comes to our physical access, a lot of places, especially in my tenure, you know, and I've been doing this kind of work for pushing 30 years, only two companies I've ever worked for had any type of multifactor for physical access locations of high, high privilege, you know, data centres, things like that. Most companies will have a single point of access, and it's usually just a bar or a card read, and then the door unlocks. So if we take a look at my implants, and the fact that I have the ability to basically emulate multiple different physical card protocols, here's where it gets funny. If I don't have a copy of a cloned badge, if I don't have a Proxmark, or some type of replay device, if I'm found in a restricted area, the worst you're going to be able to do is trespass me. You're not going to be able to get me arrested, because all I have to do is say, hey, you know the door was open, I'm here looking at the building, I thought this was part of the tour. You know, unlike the days of old, you know, where if I did have that physical piece of evidence that shows how I got in there, then I can be actually looked at as a criminal. So I'm playing a lot in the grey areas. You know, the whole point is the obfuscation. I'm not doing anything that anybody else hasn't done before in a different method, I'm just doing it in a way that would be very, very difficult from a digital forensics or incident response perspective, to be able to actually find that true root cause, on top of the fact that even if they saw some of the bulges in my my skin where I have some of my implants, when it comes to most of the privacy laws in most, you know, first world countries, they're not allowed to actually delve too deeply because it involves my personal medical, the minute it went inside my skin.

Adam

And also, I'd imagine they're not the kind of thing that one would typically notice, unless you knew exactly what you were looking for and where, right?

Len

Exactly. I mean, I've gotten asked a lot of questions in turn over the since I started doing this, like, you know, are these the same chips that I that, you know, are in my dog, are these chips that are in my cat, you know, and in some way the answer's yes. I mean, they all run on the same NFC style protocol. You know, and just like when it comes to a pet, you know, they have those very large wands. So they're gonna they would have to actually try and find the implant, energise the chip, to be able to get a read. Therein lies the same problem when it comes to all augmented humans, in order to be able to detect me and my chips, you would actually have to energise those chips to be able to get a read. So you would need multiple different spectrum analyzers on both high frequency and low frequency. And they would have to be strong enough to energise my entire body in order to for the detection. So from a management or you know, an actual implementation perspective, there is currently no way to actually detect an augmented human with this type of technology inside the body. And that becomes a very large problem for security professionals. And the only way that I can really give as a way to try and combat this is a true defence in depth, and a layered security approach. You know, I've said it a million times, you know, we have no problem putting multifactor authentication in front of all of our privileged data. But we don't do the same thing for our physical locations. And when if there's one person out here, like me, that has the ability to do this, I think that's fact enough that we should be looking at this as a potential threat on a larger scale, and we need to address it accordingly.

Connor

So you can clearly see that there's a real benefit to having sort of, like you said, multi layer security with a biological air to it. And you obviously yourself also, what maybe like 5% technology, both by the amount of things that you've got in you by the sounds of it.

Len

I'm working on it; I'll take 5% is a compliment.

Connor

So what what what attracted you to the world of biohacking in the first place?

Len

Why do you climb a mountain? Because it's there. If anybody wants to take a Google, just google me and you can find a picture; I am, I consider the fact that I have one tattoo, it just starts at my neck and goes all the way to my my, the top of my feet. I do flesh hook suspensions for fun. So when I saw that people were actually implanting technology, it just seemed kind of like the next natural evolution to somebody like me, I considered myself to be a modern primitive for a very, very long time. So as far as I know, I was the first person that had brung the, the idea that these can be used for an offensive purpose to the security community. I know I am not the first guy to ever do this. I'm just the first guy that opened his mouth about it. And I think that goes into just the way that I see the world. I was a black hat for a very, very long time. So when I look, walk into a room, the first thing I see is okay, there are cameras, where's the the exit strategies? You know, if you tell me that this is an NFC chip that can interact with a mobile device, maybe you're going to use it for your digital business card, I'm going to look at that same device and see how can I use this in a way that would suit my purposes?

Adam

So let's talk about some of those methods, then some of those ways in which this technology could potentially be used to target businesses. You've spoken already about some of the offensive applications of the magnets you have, for example, but what about some of the, for example, the NFC and RFID chips?

Len

Sure. NFC, you know, like I said, it's pretty much a standard protocol on most modern mobile devices and tablets. The abilities through NFC can be anything from transferring, beaming a file, it could you can use it to set up a Wi-Fi network, you can use it to redirect. I mean, we've seen all kinds of different possibilities. So the way that I've redirected those, I released three different attacks at RSA two years ago. The first one was called Flesh Hook. Flesh Hook is a redirect. Yeah, I made the exploits. I got to name them. That's one of the benefits. So essentially, what that one was, is I would I've set up a BeEF server. And you know, for any of the newbies out there that don't remember the good old days of BeEF, BeEF is the browser extension exploit framework. This is the website that, you know, we've all heard the rumours of the minute you log into this website, the bad guys are in your system. Yeah, that's BeEF. So it's a little bit of a social engineering play. You know, I'd walk up Hey, Adam, man, check this out, dude. Let me see your phone. I found this amazing new video on YouTube. I want to show you. As soon as I can get the device in my hand, if you have NFC turned on, the large flexNExT implant that's in the top of my right hand will actually have enough distance on the antenna that it'll actually read through the actual meat of my hand. I can hold the phone in the correct orientation. It will pop up a redirector where I'm going to just send you to a video, but the minute your browser hits that website, the Java code in the HTML page is actually going to hook the browser and then I have access to the entire BeEF suite. So I can do on device spear phishing attacks, I can geolocate your device, access the cameras, I can use DNS enumeration if you're on a local network or a corporate network, I can do domain identity, subdomain identification and enumeration. Anything that I could even think of. The other one was called leprosy. Again, my attack, I named it. Leprosy doesn't really work as well against iOS devices. But when it comes to Android, once again, you know, this one is a little bit easier. Adam, oh my god, man. You know, I'm over here in the UK with you, you know, my phone died. My wife, I was just on the phone with my wife. She told me something happened to my grandson, man, can I borrow your phone for just a second? You know, of course, you know, you know, yeah, here, dude, call your wife. And again, the URL that's been programmed into the NFC chip, points to a web location where I've got an infected APK that was created with MSF Venom or, you know, a Cobalt Strike beacon. At this point, you know, it's Oh, my God, you know, let's be honest, who remembers my who remembers phone numbers anymore? What's my wife's phone? What's the country code for the United States? Plus one. Okay. So I can go through this big rigmarole of trying to remember a phone number, when actually what I'm doing is installing that APK. And as soon as I'm done, it's like, oh, shit, I can't remember the phone number man here, I'm gonna just go plug my phone in. But at this point, I have a reverse TCP connection back to the device, I can set up persistence, I can get a shell. I mean, at that point, it's whatever I want. And the third one was called handshake. You know, they're all you know, biologically related names. What can I say? And, you know, at that one, you know, I can use a Proxmark, any type of card skimmer I want, get your badge information, write it down onto one of my chips. And if we're in one of those single point access situations, I'm in your privileged locations on prem. And once again, the problem is there's zero indications of compromised to any one of these different attacks.

Connor

I think judging by mine and Adam's reactions after the first question we came in with, and we're just like grinning like Cheshire cats, right? I think we can speak for the both of us saying we're so excited just to hear about this kind of thing, because it's not something we hear about a lot. So with that in mind, then, how many black hats like your former self, are using this in the wild or starting to think about using it in terms of real world attacks?

Len

Okay, this is one of the hardest questions to answer in regards to doing conversations like this. I can tell you this with 100. There, there are some facts that I can give you with 100% certainty. Within the United States, one of the biggest distributors for microchip implants is a company called DangerousThings.com. Within Europe, there is a company called KSEC, K-S-E-C. So I am, I spoke with the CEO of Dangerous Things, a gentleman by the name of Amal. And from him, I was able to gain the fact that Dangerous Things has sold close to about 300,000 implants. I was actually back in y'all's neck of the woods last weekend up in Newcastle, where I actually got to meet Kai from KSEC. And between the two of us we basically came up with an estimation of between four hundred and six hundred thousand implants have been shipped. How many of those implants were actually, have actually made their way inside of a human body? We don't know, but I can tell you this much. I know that I'm using it. I know of quite a few people who are on red teams that are using this technology. We have not found any indications from any type of incidents that have actually happened in the wild where implants were shown to be the root cause, but at the same time, how would you be able to determine that, you know, and therein lies the problem. We may have, I mean, we've seen, you know, breach reports where NFC or RFID were included in the evaluation in terms of cause of breach, but without actually getting access to an individual to find out if they were actually augmented, it could have been a card, it could have been an implant, we don't know. Because, as I said before, there's really no way to determine any type of augmented human with current technology.

Adam

And if yourself and, you know, a significant amount of other red teamers are using this technology and are interested in this technology, it's a fairly safe bet that black and grey hat actors are also interested in it and are deploying it in the wild, you know, it's not, it's not that much of a logical leap.

Len

No, and that's the way I see it. If once I actually brought this to the out at RSA, I knew this was going to open the door and somebody who is going to read this and there's going to be some black or grey hat somewhere that goes, Hey, this is a new vector. And due to the you know, the privacy laws and everything else, this becomes a much safer road to try and travel if you're going to try and do offensive type activities.

Adam

So let's talk about some of the practicalities of this, then, cause this is a very kind of new, very emerging field. Have you experienced any challenges with biohacking and with your implants, you know, other than getting through airport security, which I can imagine is just a barrel of laughs.

Len

Okay, well, you brought it up - the airport is the number one question that I get.

Adam

I'm not surprised.

Len

You want, would you like me to tell you how I walk, how I get through an airport?

Adam

Absolutely.

Len

I put one, the left foot in front of the right and then I repeat. That's it.

Adam

No. Does it, do none of them come up on the scanners?

Len

All right, let's talk about the two different types of metal detectors for two seconds. We have the magnetometer which is just kind of the archway you walk through. There is not enough combined metal in all of my implants to actually trigger a magnetometer. I'm going to carbon date myself here; before my my career in IT, you know, almost 30 years ago, I used to do the job of the TSA before there was a TSA and airport, airport security was still privatised. And don't quote me on this, but I if I remember correctly, the magnetometers would not trigger unless you had a combined metallic weight of at least a .22 calibre bullet. So I mean, if you think about it, when you walk through a metal detector, if you have like a necklace on with a gold charm, it doesn't go off, if you have earrings in, it won't go off. Now, I'm not saying that they couldn't change the sensitivity of the magnetometers to where they would detect it. But they would get so many false positives, trying to check people into an airport that it would be an unusable control. Same with the metal detectors. When you think about my implants, most of them are actually silicone, you know, with the exception of the copper antennas on the larger flexible main membrane implants or the bio magnet, which is a iron core wrapped in titanium, but that's less smaller than the size of a pea. So even if I'm doing you know, the X ray metal detector, doesn't show up, I can walk straight through, the magnetometer will not trigger. So that to me kind of says something about what we're dealing with in terms of airport security. But, you know, we can do a different talk on that one another day.

Adam

That's quite a scary prospects in some ways, particularly if you're trying to defend against these types of attacks.

Len

Yeah, I mean, thankfully, at least at this point, there's not a lot in aeroplanes that are relying on RFID or NFC, you know, but if I can get that pegleg you know, where I actually have a full Linux system, then yeah, that is something that could potentially interact with the Wi-Fi entertainment system on the plane, I mean, it opens a whole lot of different vectors at that point.

Adam

But even beyond air travel, if airport security - which is, I would argue, among the most stringent kind of security, you know, scanning in terms of concealed objects and devices - If it can get past airport gate security, then security in and out of a building or or complex doesn't really stand a chance for detecting this kind of stuff, does it?

Len

Not even, not even a little bit. You know, one one thing that I, just cause you guys are are a lot of fun, and I think you guys will get a kick out of this. I think everybody is familiar with the drug smelling dogs that are used by the authorities.

Adam

Yes.

Len

Well, one of the, they actually have a new type of canine that is being released to help military and law enforcement. And they're actually technology sniffing dogs.

Adam

No.

Len

Yes, you can look them up. So these are not used in the same way that narcotic sniffing canines are in terms of they don't use them to be able to get an arrest. They don't bring them up and smell somebody and go, okay, yeah, we've got you, we're going to take you away. They're used more in the post arrest investigation point. They're used a lot with human trafficking, child predators, things like that; people that would actually store illegal data on hard drives, in technology. So if someone gets arrested, they'll get a search warrant, they run the dog around the house looking for hard drives, thumb drives, you know, anywhere that they may have, you know, tried to store illegal and illegal things. I found out that one of the law enforcement agencies that is close to me here in Texas, actually recently got one of these drugs, these key technology smelling dogs. So after, you know, sending an email to the police department going, No, I am not crazy. Yes, I have implants. And here's here's my CV. So you can see I'm a real person, and I'm not messing with you. I'm interested in information about this dog. And after they researched me, they're like, okay, apparently cyborgs are a real thing. They became really open to, you know, having conversations, and I've actually been invited to go up to the Dallas Police Department. And we're going to see if Remi, the technology dog, is able to sniff any of the implants that I have. Because that would actually be probably one of the first ways to try and detect somebody of augmented nature. And the one point that I wanted to point out, and since you guys are definitely geeks, and take that as a hardcore compliment, if you think back to the Terminator movies, where, you know, wherever the resistance was right at the entrances, they always had the guys with the dogs, because they could smell the technology. And I just start to wonder is this going to be a situation where life imitates art or art imitates life? I don't know which, but I'm really excited to get up there. Due to my travel schedule, it's been a little difficult, but I'm hoping to be up there sometime towards the middle of November. And you know, maybe I'll drop you a line and let you guys know how it turns out.

Adam

Yeah, absolutely. I'm going to ask the obvious question, how can dogs smell technology? How can anyone smell technology?

Len

Okay. Just like the they've taught the dogs to be able to detect specific narcotics, you know, heroin, cocaine, marijuana, things like that. They actually have taught them to key in on specific components that are used in the creation of technology. The name is triphenylphosphine oxide.

Adam

Oh, wow.

Len

So they found one very, very specific element that is used in the creation and manufacture of technology circuit boards, hard drives, and they basically train these dogs to hit on that one specific compound. I don't know if they'd be able to smell it through the skin. I don't know. But I still think it's going to be one hell of an interesting experiment.

Connor

Hmm. Yeah, definitely. And you get to hang out with more dogs as well. So that's a win win, really, and especially in my eyes. So in terms of getting this tech into the mainstream then, because obviously, I'm just from hearing you for the past half hour, I'm super excited about it, and I'm probably not going to be alone. So say further down the line that this kind of stuff does reach consumers, the everyday consumer that is, what are the limitations you can imagine a potential regulator seeing, you know, for example, can can realistically we actually have Internet facing machine augmentations of the kind like your like your peg leg, or is that is that a hacking risk waiting to happen?

Len

Um, well, I mean, let's be honest, you know, we can talk about QR codes and they are hacking risks waiting, just waiting to happen, and we see those on buses and trains, and taxi cabs. I don't think honestly, the imposed threat of any technology is going to stop someone from using it if there is the potential for a monetary gain. So to answer your original question, there is a lot of implants going out right now that I see is going to probably help break that stigma barrier. One of them, like I said, is the Walletmor chip that I have in my right hand, it's an actual credit card. So I can do tap to pay. I think, right now, the idea of implants is still, like you said, it's very, very fringe. And you everybody looks at me like I'm some kind of a terminator half the time. I mean, my friends shut their Bluetooth and their Wi-Fi off, the minute I walk into a room. All I want to do is just look at him when I leave and go, I'd be back. But another one that I see that's really made an impact is there's the ability, if you drive a specific model Tesla, you can get an implant and you can programme your valet key onto an implant. And you can basically just jump in your Tesla and you can drive. I think as we see a lot more of these types of implants and technologies that people can actually find a legitimate day to day use for is going to help with the concept of adoption and understanding and acceptance. Right now, there's like I said, 400,000 to 600,000 potential augmented humans out there. I see it moving beyond just the microchip concept, especially with a lot of the advancements we're seeing around graphene batteries. The big issue when it comes to any type of implant is outside of anything that's considered biomedical, there's no internal power for anything yet. And even when it comes to the pegleg, that I'm planning on putting in myself, it uses an indirect power receiver to actually power the device, but there's no battery in it. Because to charge something generates heat. So I think we're right at the precipice of you know, a whole new set of things that could be potentially coming out. I did a keynote in Newcastle over the weekend, and the title was Resistance is futile, we're already Borg. And in that talk, I just brought up some of the stuff that's actually already out there that people may not even be aware of. We've got spinal implants that are, you know, returning motility, to paralysed people, we have ocular implants that are working on giving sight to the blind, we're able to use DNA as a storage medium, and one gramme of DNA could potentially hold over seven terabytes worth of data with a retention period of over 100 years. So we are right on the cusp of so many different technological breakthroughs that cross that human technology barrier, that I think that you know, in terms of what we're going to see in the relatively near future is going to really be up to the order in which these discoveries are made.

Adam

So speaking of future technology, and just going back to the kind of Tesla use case you mentioned a little earlier, just as a brief digression. What do you think is the kind of feasibility of projects like Neuralink and other brain computer interfaces?

Len

Oh, you brought up Neuralink, if everybody's familiar with Neuralink, but nobody's familiar with the other company. I'm very, very interested in BCI. Brain computer interfaces, especially for disabled and locked in individuals, I think it's going to be crucial. I just watched an amazing documentary on my way back from Newcastle. Dr. Phil Kennedy, the name of the documentary was called Father of the cyborgs. Dr. Phil Kennedy was actually one of the he's a neurosurgeon. And he actually was the first individual to implant brain computer interfaces into paralysed people. You know, so everybody wants to talk about Neuralink, but they don't want to talk about all the other ones. Another really big player in the BCI field is Synchron. And they're already in human trials. So I think that the idea of BCI is definitely something that's going to happen. But at the same time, all of these new technologies they do will have, you know, an underlying firmware. You know, and one of the things that I'm trying to look at in regards to this, the melding of technology and humanity is as security professionals, we already know there are going to be attack vectors there and we need to be talking about those now. You know, the attacks we see today, the vectors may have changed, but at the core, every single attack today is the same attack that it's been for the last 20 years. I mean, they're looking for credentials, I'm looking for data, I'm trying to exfiltrate things, or I'm going to ransom you, you know, the end game is going to be the same; how we get there may be different. And if we think about all this new advancements in technology, and just that crossover, what happens when ransomware starts affecting Bluetooth or internet enabled bio implants, you know, what happens if I'm, my pacemaker gets a ransomware, then it's an a real ransom at that point. You know, and, you know, we keep running towards the technology and trying to, you know, make ourselves more than human, which is absolutely the core of, you know, the trans human movement. But one thing that I've said all along, and I even started the conversation with you guys today is, it needs to be done safely. And when we look at everything that's coming up, honestly, in my opinion, the end game is still identity, you know, and being able to maintain our individual identity as we become something potentially more than human. And as such, I think our identities, our personal information, you know, identity is going to become the new security. Because once the lines between an individual and the tech stacks that they're interfacing with, you know, gets either faded or removed completely, the only thing left is the individual and the individual identity of the person that's making those interactions.

Connor

So just to round things off, then looking at the long term, what kind of potential benefits might be out there for technologists or IT professionals, you know, outside of red teams and perhaps even security, who want to explore biohacking as the practice itself matures?

Len

Well, again, you know, that's like, in my opinion, that's like asking someone how, how do you want to utilise a laptop or a mobile device? I mean, these microchips were never designed to be used necessarily as offensive tools. But if you look at things like Mimikatz, which is every hacker's favourite LDAP tool, it was, it's originally designed as a an LDAP auditing tool. Any tool this, regardless of what its intended purpose was, can be reused and misconfigured and used as a weapon. So I guess I, you know, not to try and blow off your question. But I guess it depends on really, what are they trying to do? You know, it could be something, I mean, I have no doubt that maybe we're going to start seeing the ability to do OTP. If you're not familiar with it, there's an amazing ecosystem out there. It's called the VivoKey. And this is an implant, the VivoKey architecture will actually allow for one time, you know, MFA OTP, where you're actually going to validate via an implant with an app on your phone, you know, so that's a potential security advancement moving forward, it could be something as simple as using your, your chip, almost kind of like a Fido chip, where you're going to scan your implant to access your computer, again, I would still want to password in there, don't like single points of failure as from a security perspective, you know, maybe you're gonna put your, your badge for work on your chip, and you're just not going to, you know, that way you can badge in. Not everything around implants, or implanted technology is a black art, for the lack of a better term, you know, they can be used just to make people's lives a little simpler. But one of the quotes that I love to use in pretty much every single time I talk is in from my personal experience, things that make life easier, rarely make them safer. So we have to, we are the security professionals, we're the ones that you know, have to warn the masses, we're the ones that have to take care of our employees. So it's up to us to understand what these kinds of threats are, and build that layered security approach and that defence in depth, so that these types of people, people such as myself, are left sitting at the door going well, I managed to hit the badge reader, but I still don't know the key, you know, our data, our physical locations, privilege is privilege, I don't care if it's physical, I don't care if it's digital, you know, and we are the ones that have been empowered by our companies to be the gatekeepers in the security for these types of things. And we need to do our job and be aware that people like me exist and build a strategy around that knowledge to be able to stop people like me.

Adam

Well, while we could spend all day digging into the intricacies of biohacking, sadly I'm afraid that's all we've got time for this week.

Len

Aww.

Adam

I know, I could spend the rest of the afternoon talking about this. But our thanks once again to cyberArk's Len Noe for joining us.

Len

It was absolutely my pleasure, guys. I really enjoyed talking to you. Maybe we can do it again sometime.

Adam

Yeah, absolutely.

Connor

Sounds great. You can find links to all of the topics we've spoken about today in the show notes and even more on our website at ITpro.co.uk.

Adam

You can also follow us on social media as well as subscribe to our daily newsletter.

Connor

Don't forget to subscribe to the IT Pro Podcast wherever you find your podcasts. And if you're enjoying the show, leave us a rating and a review.

Adam

We'll be back next week with more insight for the world of IT. And until then, goodbye.

Connor

Bye.

The technological arsenal available to cyber criminals is already enough to give any security professional nightmares, but there’s another emerging threat on the horizon that may keep them up at night: bio-augmented hackers. Implantable chips and other modifications are growing in capability and sophistication, and there are a variety of creative ways that attackers can use them to carry out both physical and device-based attacks -

This is made all the more concerning by the fact that these implants are all but impossible to detect. This week, we’re joined by CyberArk technical evangelist, white hat hacker and self-described transhumanist Len Noe to find out what kind of augmentations cyber criminals currently have access to, how can they be used in intrusions, and why the industry needs to start preparing for their implementation now - as well as some of the positive uses that this technology can be put to.

Highlights

“Would you like me to tell you how I get through an airport? I put the left foot in front of the right and then I repeat. That's it… There is not enough combined metal in all of my implants to actually trigger a magnetometer… even if I'm doing the X-ray metal detector, [it] doesn't show up, I can walk straight through, the magnetometer will not trigger.”

“I know that I'm using it. I know of quite a few people who are on red teams that are using this technology. We have not found any indications from any type of incidents that have actually happened in the wild where implants were shown to be the root cause, but at the same time, how would you be able to determine that - and therein lies the problem.”

“From… an actual implementation perspective, there is currently no way to actually detect an augmented human with this type of technology inside the body. And that becomes a very large problem for security professionals. And the only way that I can really give as a way to try and combat this is a true defence in depth, and a layered security approach.”

Read the full transcript here.

Footnotes

• The IT Pro Podcast: The secret life of hackers
• Stories from the front line: The secrets of the Red Team revealed
• Trade Unions Congress fearful of implanting workers with tracking chips
• Should employees be microchipped?
• What is Neuralink?
• ARM fights paralysis with brain implant chips
• What is penetration testing?
• Should human augmentation technology be regulated?
• IT Pro 20/20: The future of augmentation
• The IT Pro Podcast: Can technology make us more than human?
• The IT Pro Podcast: Should companies spy on their employees?
• BSidesSF 2022 - Biohacker: The Invisible Threat (Len Noe) - YouTube

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

Security researchers have discovered hackers abusing the latest penetration testing tool in active attacks on global targets.

Unit 42 experts said that a malicious payload associated with the Brute Ratel C4 (BRc4) red teaming tool goes undetected by many major security products and has been sued against organisations in North and South America.

The packaging of the malicious payload is consistent with the tactics deployed by advanced persistent threat group 29 (APT29) - otherwise known as ‘Cozy Bear’ - a Russian-linked state-sponsored hacking group known for the notorious SolarWinds attack in 2020.

The BRc4 tool has been around since 2020 with India-based security engineer Chetan Nayak, who previously worked for red teams at leading western security vendors, recently commercialising the product.

Nayak has said the pentesting tool was built after reverse-engineering several major security products, while Unit 42 said BRc4 is newer but no less capable than the more commonly abused Cobalt Strike.

“Overall, we believe this research is significant in that it identifies not only a new red team capability that is largely undetectable by most cyber security vendors, but more importantly, a capability with a growing user base that we assess is now leveraging nation-state deployment techniques,” Unit 42 said.

“We encourage all security vendors to create protections to detect activity from this tool and all organisations to be on alert for activity from this tool.”

After first being uploaded to VirusTotal in May 2022, the malicious payload slipped under the detection of 56 different security vendors that evaluated it, assigning it ‘benign’ status, Unit 42 said, showing how effective Nayak’s reverse engineering efforts have been.

Method of delivery

The malicious file is packaged up as a self-contained, benign ISO file and included in the ISO is the lure file - a Windows shortcut (LNK) file masquerading as a Word document, complete with a fake word doc file icon, and seemingly being a CV for a Roshan Bandara.

This is the actual malicious file, hidden inside the ISO which slipped through security vendors’ detections. It appears on a user’s hard drive after the ISO is double-clicked and mounted as a Windows drive. When the lure file is opened-clicked, BRc4 would be installed.

This file is typically sent to victims through spear-phishing campaigns or downloaded to the victim by a second-stage downloader, Unit 42 said.

“While we lack insight into how this particular payload was delivered to a target environment, we observed connection attempts to the C2 server originating from three Sri Lankan IP addresses between May 19-20,” said the researchers.

In the same folder where the lure file is stored, other archived .exe and .dll files are present but hidden to most Windows users thanks to the operating system’s (OS) default configuration.

BRc4’s capabilities

Once installed, BRc4 advertises itself as having a broad range of capabilities. These were designed for legitimate use in red team-blue team exercises, but like Cobalt Strike, the powerful tools are often abused by black hat hackers in malicious cyber attacks.

Some of the tool’s capabilities include:

• SMB and TCP payloads provide the functionality to write custom external C2 channels over legitimate websites such as Slack, Discord, Microsoft Teams, and more
• Ability to keep memory artefacts hidden from EDRs and AV
• Take screenshots
• x64 shellcode loader
• Reflective and object file loader
• Patching Anti Malware Scan Interface (AMSI)
• Create Windows system services
• Upload and download files

Unit 42 also said the C2 infrastructure used by the threat actors abusing BRc4 is consistent with the methods used by APT29, using popular cloud storage and collaboration platforms.

The sample analysed by the researchers found the payload ‘calling home’ to an AWS-registered IP address located in the US over port 443. The X.509 certificate on the listening port was also self-signed and set up to impersonate a Microsoft security team.

A Ukrainian IP address was also used to administer the C2 infrastructure, and researchers believed that the attackers harnessed a residential network for this.

The company behind digital forensics and penetration testing Kali Linux platform has announced that it will be livestreaming free security training sessions, for 25-weeks, for those looking to build offensive cyber security skills.

Offensive Security, which created the Debian-based Kali Linux distro, launched its remote learning course, OffSec Academy, during the pandemic when live training became unworkable.

The new livestreamed programme, known as OffSec Live: PEN-200, an independent offshoot of its paid-for OffSec Academy, will deliver two 60-minute sessions every week for 25 weeks, starting on 22 June 2022. All sessions will be available on public streaming platform Twitch.

The sessions will be broadcast every Wednesday and Friday between 17:00 and 18:00 (BST) and will continue until 30 November.

OffSec Live will cover the main topics of the PEN-200 curriculum - the content required to prepare budding pen-testers for the Offensive Security Certified Professional (OSCP) certification - but the company said it does not replace the PEN-200 course.

Those who tune in to the livestreams will also have access to Offensive Security’s mentors via a Discord server, though it’s unlikely the same level of one-to-one support will be available as it is to those who pay to enrol on the PEN-200 course.

Students paying for expert guidance on the PEN-200 course, not the Twitch-broadcasted OffSec Live: PEN-200 version, have access to the full range of course materials, additional exercises, and demos to cement their learning.

“When the pandemic started we were provided a very unique opportunity to experiment with remote training options,” said Offensive Security. “With live training no longer an option, the entire industry was forced to try their version of streaming-based training. For us, the last thing we wanted to do was to take a five-day live class and just make it online. We felt like that would be a really poor experience, and instead we wanted to take advantage of the streaming format and make something special and unique.

“OffSec Live is our attempt to take what is great about OffSec Academy, and our learnings about successful student learning journeys, and make it available to all students.”

The OffSec Live initiative is brand-new for the company and in its first iteration. It encourages as many aspiring pentesters to join and engage in the livestreamed sessions, and provide as much feedback as possible.

Offensive Security said this feedback will inform future evolutions of the course, whether it will continue beyond this first run, and if it will become part of its standard offering.

The US Department of Justice (DoJ) has announced that it will no longer prosecute ethical hackers under its anti-cyber crime law, the Computer Fraud and Abuse Act (CFAA).

The landmark change comes after a policy revision, stipulating that cyber security research conducted in “good faith” should not be prosecutable, came into force on Thursday.

There is no concrete guidance on what type of activity falling under the umbrella of ‘cyber security research’ is protected or unprotected under the new policy revision, but security researchers acting in a way that intentionally avoids harm will not be charged under the CFAA.

Cyber security researchers have previously been fearful of reporting security vulnerabilities in the past out of fear of being charged under the Act, but the US is now adopting a fresh perspective, saying vulnerabilities that are discovered responsibly benefit “the common good”.

“Computer security research is a key driver of improved cybersecurity,” said Lisa O. Monaco, deputy attorney general. “The department has never been interested in prosecuting good-faith computer security research as a crime, and today’s announcement promotes cyber security by providing clarity for good-faith security researchers who root out vulnerabilities for the common good.”

The majority of security researchers (60%) speaking to Bugcrowd in 2020 said they had not reported security vulnerabilities they found in the past due to fear of being prosecuted under the CFAA.

The law has also threatened other areas of cyber security such as legitimate penetration testing. Security professionals working for Coalfire in 2019, for example, were handed criminal charges for breaking into Iowa’s Dallas County courthouse after being contracted by the state of Iowa.

The charges were ultimately dropped but the CFAA, which was drafted in 1986, well before the modern internet, has always threatened ethical security research.

The UK’s equivalent legislation, the Computer Misuse Act (CMA), has been criticised in the past for also not legally accepting ethical hacking as a benefit to society and industry.

Drafted in 1990 but currently under review, the CMA has been labelled an outdated piece of legislation and like the CFAA up until this week, it too outlaws good-faith ethical hacking.

A recent report from the CyberUp campaign, in partnership with techUK, showed that 80% of legitimate cyber security researchers have worried about being punished under the CMA while defending cyber attacks.

Ethical hacking’s protection from the CFAA received a boost last year in a significant ruling in the Van Buren vs United States case.

In it, the US Supreme Court ruled that a law enforcement officer, bribed by an outside individual, did not break any laws under the CFAA in accessing information from a computer for unsanctioned reasons.

Although Van Buren was authorised to access a police database, he was not authorised to hand over confidential information to an outside party in exchange for money, but the ruling meant he could not be prosecuted under the CFAA, leading onlookers to believe this could lead to positive implications for ethical hackers.

The latest policy revision to the CFAA has been greeted warmly by the cyber security community. Brian Higgins, security specialist at Comparitech, told IT Pro that “this is definitely a step in the right direction by the US authorities”.

“It’s unreasonable to place such disproportionate restrictions on a vital community of professionals, the majority of whom operate to high standards of ethics and integrity,” he said.

“Taking the gloves off, even to this extent, will allow a better understanding of the threats we face and the best way to defend against them. This proactive development in the United States will undoubtedly attract a lot of scrutiny from the international community, the majority of whom will be seeking to follow suit in some fashion.”

The DoJ said that individuals claiming to be conducting security research “is not a free pass for those acting in bad faith”. It used an example of extorting other people after discovering a vulnerability, all in the name of research, which would not be protected under the policy revision.

“Hacking itself, using its current common definition rather than the original, isn't inherently good or evil. Using it for profit and abuse is evil,” said Sam Curry, chief security officer at Cybereason to IT Pro. “Breaking the law is evil. But using it to improve security is a vital function without which we really can't resist the darker kind. In the world of cyber, this is great news for white hats and gives a ray of hope to some grey hats too.”

Although greeted warmly by many, other corners of the industry have criticised the DoJ for not making more allowances in its policy review.

Not setting a clear line as to what constitutes an offence in the process of ethical hacking, and what doesn’t, is the main point of contention for the Electronic Frontier Foundation (EFF), which said that it would be better if there was a technological restriction defendants would have to defeat in order to be charged under the CFAA.

“Instead of this clear line, the new policy explicitly names scenarios in which written policies may give rise to a criminal CFAA charge, such as when an employee violates a contract that puts certain files off limits in all situations, or when an outsider receives a cease-and-desist letter informing them that their access is now unauthorised,” it said.

The EFF also criticised the DoJ for saying that security research should be conducted “solely” in good faith, and it excludes “a lot of how research happens in the real world”.

UK cyber security unicorn Darktrace has acquired Dutch attack surface management startup Cybersprint in a deal worth €47.5 million (£39.6 million).

The acquisition is a mix of 75% cash and 25% equity and represents the first takeover Darktrace has made in its nine-year history.

Cybersprint describes itself as an "attack surface management company" that offers penetration testing services and continuous, real-time insights from an outside-in perspective. One of its services is an automated tool that maps an organisation's assets so they can continuously monitor areas that might go unnoticed by in house checks, such as older IP addresses.

Darktrace said the two companies shared an "aligned vision" of delivering a "continuous cyber AI loop", adding that Cybersprint's employees bring an understanding of how to continuously model real-time internet data as well as ethical hacking expertise.

With the deal, Darktrace will also gain a second Research and Development centre, Cybersprint's Hague facility in the Netherlands, which will be integrated into the Darktrace network.

The UK cyber firm will aim to use Cybersprints' seven years' worth of R&D to accelerate its own AI-based 'Prevent' product suite, according to CEO Poppy Gustafsson.

"We are very excited to welcome the Cybersprint team to Darktrace. Bringing inside-out and outside-in visibility together is critical and having access to the robust, rich, real-time external dataset combined with Darktrace's Self-Learning AI means that customers get a holistic view of prioritised cyber risks to harden the parts of their organisation that are most vulnerable," Gustafsson said.

Cybersprint CEO Pieter Jansen said he felt an "instant" connection on vision, culture and technology with Darktrace. He added that both firms were "passionate" about automating manual tasks in cyber security from an outside perspective and that "attackers never sleep".

"We are looking forward to joining Darktrace and working together to accelerate state-of-the-art innovations to make organisations more cyber secure," Jansen said.

Bosses at West Midlands Trainline are facing a backlash after they used the promise of a company-wide bonus as a lure in a phishing simulation test.

Julian Edwards, the managing director of the train operator, emailed the company's 2,500 employees with a message saying it wanted to thank them for their hard work during the pandemic, according to the Guardian.

The email promised a one-off payment, but those who clicked the link for the bonus received a message telling them it was a "phishing simulation test" designed by the firm's IT team to entice employees.

The leader of the Transport Salaried Staffs Association, Manuel Cortes, called the email "crass and reprehensible", according to the Guardian, especially considering many of the people who work for West Midlands Trainline have had to do so on the front line throughout the pandemic.

However, while the initiative isn't ideal in the current climate, there's often a balance between upsetting the business vs what a malicious attacker would consider, according to Scott Nicholson, the co-CEO of cyber security firm Bridewell Consulting

"In reality, malicious phishing campaigns will devise the content that is most likely to achieve success," Nicholson told IT Pro. "However, on the other hand, there are many other topics that can be used and techniques to improve user behaviour and phishing defence, detection and response.

"In this instance, employees will understandably feel frustrated and I wonder whether key business stakeholders were aware of the content and topic beforehand. Often, when developing internal phishing awareness campaigns, it is useful to have a small group of key stakeholders agree on phishing content so that an organisation can reduce the risk of phishing attacks but without demotivating or upsetting the workforce."

Nicholson added that phishing simulations are an essential awareness tool but he also warned that they should not be solely relied upon. The content of the attack requires careful consideration, he said, as businesses can achieve the same outcomes without upsetting their employees.

This free guide answers the questions commonly asked by penetration testing buyers and provide guidance to help you maximise the benefits of your penetration testing experience.

Whether you’re planning a development project, are mindful of a potential upcoming compliance requirement, are concerned of the brand damage a breach could cause, or you’re looking to improve your organisation’s cyber security capabilities, a penetration test, performed by a proven, certified provider, is one of the most powerful and effective ways to understand and improve your organisation’s security posture.

Download this resource to start taking a proactive approach to cyber security.

Fill out the form below to access the free resource.

Four in five UK cyber security professionals are worried about breaking the law due to confusion caused by the ageing Computer Misuse Act (CMA).

The 30-year-old legislation is restricting pen-testers and white hat hackers with strict and often out-dated definitions, according to a survey commissioned by teckUK and the CyberUp Campaign.

The survey, which was circulated between 46 respondents representing 11 organisations and some 25,120 employees, found that the legislation was stifling security teams in the UK, with 80% of respondents saying they have been worried about breaking the law when researching vulnerabilities or investigating cyber threat actors.

Around 40% of those surveyed said the CMA has acted as a barrier to them or their colleagues and had even prevented employees from proactively safeguarding against security breaches. Furthermore, 91% of businesses believed that the law puts UK consultancies at a competitive disadvantage with other countries.

Some of the answers also suggested confusion about what counts as a criminal offence under the CMA. In fact, in only three cyber incident examples - 'web scraping' (74%), 'open source internet scanning' (68%), and 'default credentials in login panels exposed to the internet' (74%) - did respondents reach a reasonable level of consensus.

The Computer Misuse Act was enshrined in 1990, long before the internet became the essential tool for businesses it is today. Although it has been updated a number of times, both techUK and the CyberUp Campaign are calling for the government to open a consultation within the industry to put the law through "rapid modernisation".

"I know from my time in this industry that there are now real concerns among the cyber security community that this law is impeding professionals ability to protect the nation from the ever-evolving range of cyber threats we face, and preventing the sector from establishing its leadership position on the international stage," Conservative MP Ruth Edwards wrote in the report.

"If ever there was going to be a time to prioritise the rapid modernisation of our cyber legislation, it is now, when our reliance on safe, reliable and resilient digital technologies has been brought into stark relief by the coronavirus pandemic."

Penetration tests and vulnerability scans are useful for getting insight into the security posture of an organisation at a specific moment. Although useful, they do not present the full picture, especially when it comes to sophisticated, multi-vector attacks.

Download this whitepaper to learn:

✓ The pros and cons of each method

✓ The new and effective approach to cybersecurity validation

Workers in areas like HR and finance are more likely than IT or security professionals to object to internal security testing, a report has found, raising serious ethical questions around how far security teams should go in their work.

The process of red team security testing on colleagues and fellow workers may lead an organisation to identify gaps or lapses in its cyber security hygiene, but such actions could have an adverse effect on staff morale, research has suggested.

There are wide differences in the moral interpretation of social engineering attacks between IT and non-IT employees, according to findings by researchers Tarah Wheeler and Roy Iverson. For example, non-tech workers, in areas such as HR and legal, are nine times more likely to object to receiving a phishing email than staff in security-related jobs.

These employees are also three times more likely to object to security workers impersonating VIPs, and four times more likely to object to the red team targeting receptionists to gain entry into an organisation.

The team surveyed more than 500 workers about their stance on the moral acceptability of conducting internal security tests and presented their findings at the Washington-based tech conference ShmooCon 2020.

The type of testing that respondents were questioned on ranged from sending threatening emails to inciting bribery, and even planting files on employees’ devices.

These measures may or may not comprise offensive red team testing routinely conducted by teams within or external to organisations. One prominent case of penetration testing, for example, arose last September when two individuals hired by a US-based courthouse were caught trying to physically break into its premises.

Despite many workers holding moral objections to elements of red team testing, the research also found that employees were generally more comfortable being on the orchestration side than on the receiving end.

In some cases, those on the receiving side of red team testing are approximately four-and-a-half times more likely to morally object to certain tests being conducted than if they were organising these tests.

“What we found was surprising and counterintuitive,” Wheeler and Iverson said in their research paper.

“Respondents (even professional security experts) were reportedly 450% more likely to be morally fine with conducting certain often-used tests on other people than they are with having tests run against themselves.”

The researchers added that the data collected allows them to start a discussion about the best practices with engaging in internal penetration testing within an organisation, and the impact of deceptive social engineering attacks on company morale.

Moreover, company boards should adopt a measured approach to overseeing cyber security policy in order to raise the overall level of hygiene among senior employees as well as across the wider workforce.

These measures include hearing a presentation about information security at least twice a year, demanding high-value targets like executives are within scope of testing and understanding the incentives for succeeding in compromising targets inside the company.

“Anecdotally, we have heard internal red teamers describing scoping for engagements that disinclude [sic] the most likely targets - executives,” Wheeler and Iverson added. “Because those same executives did not wish to have the potential interruption to their services that the discovery of poor security awareness would entail.

“This is unfortunate, as rapid, constant testing that perpetually integrates small changes leads to the strongest defence of any company.”

As organisations try and stay one step ahead of cyber criminals, Breach and Attack Simulations (BAS) are growing in popularity as a way of testing cyber resilience. The technology is used to automatically spot weaknesses in an organisation’s cyber security, a little like automated, ongoing penetration testing.

The global BAS market is expected to reach $1.68 billion by 2027 - a 37.8% growth from 2018’s figures - primarily driven by demand for prioritising security investments as vulnerability management grows ever more complicated.

Furthermore, Breach and Attack Simulation technologies were highlighted as one of the top solutions for CISOs to consider in a recent report from Gartner, because of its effectiveness at testing against known threats.

But just what are Breach and Attack Simulations, and how are they being used by businesses?

The different types of Breach and Attack Simulations

BAS is an emerging technology that runs simulated automated attacks, mimicking the attacks likely to be deployed by cyber criminals. These ‘pretend’ attacks can help a company identify potential vulnerabilities in security systems, as well as test out the detection and prevention capabilities.

According to Cymulate, BAS technologies fall into three main categories, depending on the approach needed.

The first is agent-based vulnerability scanners. As opposed to using protocols like SSH to remotely access network devices, this method involves running agents directly on target devices themselves to test them for known vulnerabilities. These agents are deployed inside an organisation’s LAN and distributed across a number of machines, with the goal being to map out the potential routes an attacker could take to move through the network.

The second type of BAS tests the organisation’s security by generating ‘malicious’ traffic inside the internal network. Virtual machines are set up inside the network which act as targets for the test, using a database of attack scenarios. The BAS sends attacks between these machines, then checks that the organisation’s security solutions are able to detect and block the traffic.

The third category consists of multi-vector simulated attacks, and are the most advanced and true-to-life type of simulation that can be deployed. This ‘black box’ approach puts a lightweight agent on a workstation within the network. Usually cloud-based, the assessments utilise distinct types of attack tactics to try and bypass the security in place, both internally and externally to the organisation’s LAN.

Pros and cons of Breach and Attack Simulations

One major benefit of BAS is the automation aspect. Having tests scheduled and frequently carried out automatically by a tool means that potential weaknesses can be spotted and dealt with quickly, compared to one-off tests where staff may be more alert to issues.

Automated tests can be particularly useful in larger organisations where networks are constantly changing, especially if new tools are being deployed, software is updated, or operations expand into new locations. Regular tests can identify issues with complex networks quickly and efficiently, and some BAS technologies can be set up to run constantly, meaning that vulnerabilities can be spotted almost instantly.

However, human cyber experts are usually much more creative in how they deploy attacks. BAS is limited in what it can test, and can only run known attack simulations. This is why penetration testing - a simulated attack run by highly trained security professionals to probe business systems for vulnerabilities - may uncover different problems compared to BAS.

There is also a danger that IT teams can end up overloaded with notifications on an ongoing basis with BAS, especially if there is no easy way to differentiate routine issues from important alerts.

As with many security tools, Breach and Attack Simulation is not a comprehensive solution, and different tools have different purposes depending on how they are deployed. However, as part of a comprehensive cyber security strategy, BAS can play a valuable role, particularly as the technology matures and BAS providers continue to evolve their offerings.

As cyberattacks become more sophisticated, they become harder to detect and mitigate. Current methods that organisations use to verify that their systems and data are protected are vulnerability scans and penetration tests, neither of which present the full picture of an organisation’s security posture.

The most effective way for an organisation to test its resilience against the growing wave of cybercrime is to opt for targeted attack simulations that use multi-vector simulated attacks. These kinds of simulations are known as Breach and Attack Simulations (BAS).

This whitepaper evaluates the effectiveness of a holistic BAS strategy compared to traditional methods of gaining insight into the security posture of an organisation.

Until recently, the cybersecurity professional’s arsenal of testing tools has mainly consisted of vulnerability scanners and manual penetration testing. But that has changed since Breach and Attack Simulation (BAS) technology has become available.

All BAS solutions are able to simulate threat actor’s hostile activities with some level of automation, yet different BAS vendors offer different approaches, each with its own set of capabilities, benefits and drawbacks.

This whitepaper takes a closer look at the different categories of BAS solutions, to make it easier for CISOs, CIOs and other cybersecurity professionals to select the most appropriate BAS solution for their organisation.

Hackers are 'no longer winning the cyber crime war' following years of public and private investment and cross-industry collaboration, according to KPMG's global head of cyber futures David Ferbrache.

The nation's cyber resilience against hackers has improved over the past two years, with joint operations between law enforcement and the private sector frustrating opportunities for criminals to profit from cyber crime.

Speaking at a London technology forum on Thursday, Ferbrache said: "I'm not sure they quite are [winning the war], curiously... I would have given you a different answer two years ago."

"The takedown operations by law enforcement in conjunction with tech firms, telecoms, financial services are getting better, faster and more disruptive in terms of some of the things that the dark web sites use for trading information," he said.

He also said that active defence measures taken by the National Cyber Security Centre, that are being used to protect the wider population who cannot be expected to implement advanced cyber security protocols, are also very effective at keeping the bad guys at bay.

It's also becoming increasingly difficult to hack modern systems, something he observed during his time as red team exercise leader at the professional services firm, he explained.

"It's actually getting harder to break into well-configured systems than it used to be. I used to run the red team penetration testing for KPMG as well and our job was getting harder."

He added it's the systems that aren't well-configured that worry him the most, such as easily discoverable routers left with their default passwords unchanged.

Echoing the tone of the Westminster eForum discussion around the UK's cyber security capabilities, Fiona Boyd, head of cyber security operations at Fujitsu EMEIA, described the fight against hackers as "a constant war of attrition".

Boyd cited figures from the Student Loans Company, which in 2015 reported three cyber attacks on the business. A year later, that rose to 95, and in the fiscal year 17/18 that rose to 965,000.

Although Ferbrache said things are getting better, there was agreement on the panel that pervasive threats still threaten the cyber security of both the public and private sectors in the UK.

Smart malware

Jeremy Watson, professor of engineering systems at University College London (UCL), said that he was "excited" at the prospect of smarter, AI-powered cyber defence tools becoming available, but added AI-driven malware is already a threat.

"At UCL we've been looking at how AI can shape an attack system for industrial control systems and been able to show that it is possible to do that as well as to defend," said Watson. "So, if we can do that from an academic point of view then clearly people with malintent and the resources can do it in other ways."

Speakers added that 'secure by design' protocols should be implemented as soon as possible to help secure the growing internet of things (IoT) industry, which is set to explode as manufacturers capitalise on the demand for smarter devices.

This would include the creation of new business models to make securing IoT devices more attractive for manufacturers, according to Watson.

However, the panel warned that without legislation compelling manufacturers to bake security measures into the device as standard, it becomes a difficult task.

"If you look at the darker side of some security, it's like selling the absence of the negative - it isn't necessarily an easy sell," said Watson.

Penetration testing, or "pen testing", is the practice of performing simulated attacks on a network, in order to evaluate the various cyber security controls and processes an organization may deploy to protect IT assets.

Typically performed by an external agent, a penetration test can be performed in a variety of ways, but they all involve attempts to breach an organization's defenses using the same tools that threat actors may deploy.

Despite common wisdom, the main goal of a penetration test is not to simply find vulnerabilities in an organisation's defenses. Instead, a test should be viewed as the primary way of gaining assurance in an organization's vulnerability assessment and management process.

A report from application security vendor Veracode found that automated scans failed to find 62% of Common Weakness Enumeration (CWE) flaws successfully exposed by manual pen testing. It's for this reason that Mordor Intelligence analysis forecasts the testing market will reach $12.8 billion by 2029.

"Some bugs require knowledge of underlying business logic or data flows," Veracode chief research officer Chris Eng points out. "For example, with a page that should only be accessible by certain users, an automated scan generally wouldn’t be able to tell if the appropriate access control check was in place because it doesn’t know the business rules unique to that application."

A penetration tester uses contextual clues to evaluate vulnerability impacts. It can be worse to allow a user to manipulate a price, versus letting them manipulate some other variable - but code-wise these look identical, Eng says.

How penetration tests are deployed

External pen tests may target servers and hardware that any hacker might see, with internal tests typically simulating what happens if hackers cross the network perimeter or an insider threat wants to cause trouble. Either way, a test should never disrupt or put systems at risk.

Tactics strictly reflect organizational context. Conversely, 'straight' vulnerability scanning, while useful, merely inspects points of potential exploitation on the network. Pen testing is more probing and wide-ranging as well as active, rigorous and tailored.

Don't ask testers to simply see what they can find - what comes back may be too costly or overlook business-critical issues. Define structure and goals for testing from the start; know what success looks like so you can judge the results. Is it just about keeping hackers out, or more about vulnerability exploitation and data exposure?

Eng says balance speed against depth. Pen testing can "absolutely" drive a deep dig to unravel issues, but "seeing how far you can get" depends on budget. If 80% of issues are likely identified in week one, is a second testing week worthwhile?

Different organizations will have different thresholds, part-dependent on application criticality and data sensitivities. A good test team will understand how deep they can go within agreed timeframes without sacrificing necessary breadth of coverage, he says.

One evolving approach is a move toward smaller, more frequent penetration tests, with a pool of hours or days used at shorter notice. Instead of testing massively once a year, test new functionality as it’s developed - mirroring faster development timeframes and agile practices.

What should be tested?

"Consider your overall attack surface. If you have a bunch of public-facing applications that are easily exploitable via a bug in some open source library, probably address that before finding and fixing bugs deeper within the system," Eng says.

"I would want to run software composition analysis and possibly an attack surface management (ASM) tool for a big-picture view of lowest hanging fruit before drilling too deeply into any single penetration test."

Certain applications will want pen testing regardless, he adds.

"Even a small 'shop' can be one ransomware attack from being shuttered," agrees Charles Henderson, enterprise vice-president (EVP) of cyber security services at cyber security and compliance services provider Coalfire.

Approaches might include "adversary emulation" - or red teaming. This simulated attack is like a fire drill that might need to be as realistic as possible. It might also be important that internal IT staffers aren't notified of tests prior to completion and reporting, enabling comparisons that highlight the gap between attempted attack and successful defense.

Conversely, the focus may be on how the internal 'blue' team moves from a posture of assumed breach to detect and respond, or a 'purple' mix of teams and approaches, Henderson says.

The critical factor can be how the 'home' team detects and responds to breaches, because that's always possible, he points out.

How to pick a penetration testing company

It's key to analyse teams and skillsets on offer in detail. Security consultants capable of pen testing typically hail from providers who can offer someone with a relevant research background and who can speak authoritatively on the topic.

"If they're relying on the the skills of others on how to test, they're very reactionary," Henderson notes. "You're looking for a firm with really good testers, because no matter how good their methodology is, it comes down to who's on the keyboard."

Even with suitable skillsets, good methodology and enough time and resource are essential. And as usual - if you get pricing that's too good to to be true, it probably is, he says.

Some may be doing mostly tool based testing - although there's absolutely a place for that, he adds, whether in a self-service capacity or as a managed service with oversight.

"We offer it too - but if you're doing penetration testing, you're really looking for that manual use of human beings to connect issues they find and fully understand the gravity of it, rather than just delivering a list of defects across the environment," Henderson explains.

Decide which players you can trust and with what. You might also look at strong recommendations from previous customers and focus on accredited testers, for instance with the global Council of Registered Ethical Security Testers (CREST) certification, which requires examination and adherence to enforceable codes of conduct.

What happens in a penetration test?

As we've noted, the nature of the test depends entirely on what objectives an organization hopes to achieve. 

Typically, though, pen testers perform both external tests, which target the servers and hardware that any hacker would be able to see, and internal tests, which simulate what would happen if those hackers made it past the perimeter and got inside your network, or if an employee wanted to cause trouble. 

Both approaches can be revealing and combined they can provide a good indication of your real-world security position.

An external test may be almost invisible, although, if you have a good security infrastructure, it will hopefully flag up any suspicious connection attempts. An internal test needn't be much more invasive: the tester simply requires access to your network so they can mimic the actions of a hacker.

If that makes you nervous, remember that the testers are looking to expose vulnerabilities, not to exploit them. No data will be compromised, no systems will be interrupted and no damage will be done. Still, it's worth making sure any senior stakeholders have been notified that a pen test is taking place so that they're aware of what's happening.

Tests can take as little as a few hours or last as long as a few weeks, depending on the scope. Just remember that the pen testers' work isn't over when they log out or discontinue their simulated attacks; further time is needed to produce a vulnerability report, after which your business will need time to digest its findings and respond as needed. Indeed, there's a good chance that you will want to involve the testing agency in remedying any issues discovered, so it's worth thinking about keeping them involved for the long-term.

With all tests, you should focus on what needs fixing urgently and be realistic about what's a long-term goal, or what might not be worth fixing at all given the risk appetite of your business. The value of pen testing is that it gives you the information you need to make these decisions.

How to prepare your business for a penetration test

In the interest of simulating an 'attack' that's as realistic as possible, internal IT teams would ideally not be notified of an incoming test before it has been completed and an external report has been compiled. Typically, only a small number of key stakeholders will be aware a test is even happening.

This way, defences will be tested organically, with internal IT teams able to devise their own report accordingly, mirroring the process of an actual attack like a mock fire drill. The two reports can then be compared to highlight the differences between what was actioned in the attack, and what was picked up by the IT team.

Before the test team arrives, it can also pay to undergo a security pulse check, including basic patch management and applying hardware and software updates. Of course, patch management and general updating should be regularly undertaken regardless, but ensuring everything is completely up-to-date as a preliminary for penetration testing will mean that security measures are tested in their entirety.

Prepare also to work collaboratively with the test team. Sharing knowledge beforehand can save them time, and you money. Conversely, you should take the time to understand the methods and tools they will use to analyse your network. The more you understand, the more valuable the test.

Hacking is a profession that requires lots of preparation. It isn't a case of selecting a target and hitting them with whatever malware you've got - it's far more nuanced. Pentesters and malicious attackers need to know how best to hit an organisation, including how to gain access to their networks without being caught, and when the right time to strike is. This information will only be gleaned from thorough reconnaissance.

With the sheer volume of systems and cloud environments on offer to businesses, a blueprint of the target helps to strengthen the attack. Does the target use an on-premise infrastructure, or does it use a cloud service from a third-party provider? How many employees does it have, and which ones are authorised to access the systems you want to hit? Do employees have their own devices at work? - this can all be critical information.

Regardless of your route in, the key to successful reconnaissance is stealth. Going undetected will keep your eventual attack a surprise (though most businesses should expect to be regularly attacked these days).

Active vs passive reconnaissance

"Reconnaissance', which is often shortened to 'recon' is a military term for observing a region to locate the enemy or find information to design an attack strategy. Within IT, the term is normally classified as either 'active' or 'passive' with each referring to different methods.

Active reconnaissance

Active reconnaissance is a more direct approach. Hackers will use this method to probe a system for weaknesses, often risking early detection. Of the two, this is the fastest method of recon, actively searching for vulnerabilities or entre points.

System information is used to gain unauthorised access to protected materials, infiltrating any firewalls or routers. The hacker then actively maps the network infrastructure, using tools such as NSLookup to identify hosts. Once they have been found, a port scan is conducted to reveal any potential vulnerabilities.

The Nmap open source tool is perhaps the most well-known exploit kit used for active reconnaissance, which uses a range of different scan types to find hosts and services connected to a network.

Given this approach requires interaction with a system, it’s far more likely that a scan will be caught by a system’s firewall or an attached security suite.

Passive reconnaissance

Passive reconnaissance does not rely on direct interactions with a target system, and is therefore far easier to hide. This technique involves simply eavesdropping on a network in order to gain intelligence, with hackers being able to analyse the target company for partner and employee details, technology in use, and IP information.

If the attack is conducted successfully, the only evidence of a hacker's presence would be in analytical data, and with no red flags raised, they shouldn't appear in security logs.

Using tools such as Wget, hackers can browse a website offline, analysing content to reveal hardware, operating systems and contact information. Other common methods of passive reconnaissance include advanced Google searches, sifting through information stored on discarded devices, and impersonating users.

Use cases for active and passive reconnaissance

Differences in method, unsurprisingly, yield different results. Active reconnaissance is riskier (from the hacker's perspective) but generally more useful information is gathered. Passive reconnaissance carries less risk, but is slightly more unreliable, can be time-consuming, and is usually far less revealing.

Despite these drawbacks, passive reconnaissance is the preferred tactic for many hackers, chiefly because of the reduced risk of detection. It also allows hackers to avoid the risk of incrimination, and the information gathered is still incredibly useful for supporting future cyber attacks. Conversely, active reconnaissance normally requires scrupulous preparation in order to avoid detection, and hackers always run the risk that a trace of their attack may be left behind.

All organisations are susceptible to these types of attacks, not just high profile networks. Small and medium-sized businesses should be particularly wary of reconnaissance, especially if they have digital transformation projects underway. Ventures that haven’t been properly checked for potential security breaches, or that have misconfigured security tools, can be especially helpful to hackers trying to infiltrate your network.

Other risks worth considering include unfortified applications containing data which could be vulnerable to being accessed by third-parties. Every organisation should be one step ahead of potential hackers and consider all the processes that a criminal could deploy in order to gain access to confidential information.

It’s also important to remember that reconnaissance is equally useful for ethical hacking. This process usually involves professional penetration tests deploying the methods hackers normally adopt in order to locate the holes in an organisation's defences. This would allow the business to resolve any of these weaknesses as and when they're found before they're exploited by hackers in a live setting. The method isn't always free from fuss, however, and pen-testers have occasionally been mistaken for actual criminals.

Penetration testers would likely cover both methods in order to provide a comprehensive overview of an organisation's cyber defences. Vulnerabilities are reported, and the organisation will then set out to remedy them. Taking into account information gathered, organisations can augment a web application firewall (WAF), the most holistic defence against cyber attacks. A strong WAF should be flexible to adapt to an organisation's needs, and secure to protect applications both in the cloud and on-premise.

Magnus Carling, CISO of worldwide conglomerate Stena AB, likened modern cyber security practices to the oversights which led to the Titanic disaster in 1912.

Speaking at Cloudsec 2019, Carling told attendees "the iceberg was innocent. It wasn't the iceberg that made Titanic sink", before drawing some obvious comparisons between the famous sinking and modern cyber attacks.

Carling said the Titanic's captain ignored warnings from other ships about the oncoming iceberg, just like how system administrators sometimes either ignore or misread warning signs that a business may be under attack.

In addition, the captain demonstrated unsafe practices by travelling at around 22 knots - much higher than what was considered to be safe. This can be considered equal to ignoring other security best practices such as securing endpoints or not managing patches adequately.

The crew tasked with keeping the smooth running of the ship was also not given any sort of disaster training, said Carling which akin to not having a disaster recovery strategy in place if a business comes under a cyber attack.

The last similarity was that before leaving for her maiden voyage, the Titanic was equipped with too few lifeboats and the crew knew this and departed anyway. In doing so, the crew "silenced the security voice", Carling said.

"I can bet my dog that someone somewhere told someone in charge [that] it's not a good idea to run in that high speed, it's not a good idea to not have lifeboats and not train the crew how to use the lifeboats - and I think we're seeing this today, in many cases," he added.

Carling said cyber security practitioners need to ask themselves whether their security voice is strong enough but to permanently avoid this possibility, we must embrace regulations.

"But there's one thing that can help us which is a good thing and that's regulations because a lot of people think that regulations are like this heavy weighted blanket [and that] it's a lot of work being compliant. But they do help you because they give you arguments that you should improve your cyber security stature."

One such regulation that Carling heralded was the network and information systems (NIS) directive adopted by EU member states in 2016 - it was the first EU-wide cyber security regulation. Carling said the NIS directive is the cyber security equivalent of the safety of life at sea (SOLAS) convention adopted in the maritime industry.

The NIS directive aimed to unify the standards of cyber security within the EU to help protect member states from being attacked through vulnerabilities in other nations. It was implemented in UK domestic law at the same time as GDPR.

But regulations alone won't keep out the numerous intruders trying to steal data from businesses, a well-trained team running a tight security operations centre (SOC) that can react quickly and effectively to cyber threats is the best defence against attackers.

That's why at Stena AB, the company runs red team versus blue team exercises roughly three times every year so its cyber security practitioners are ready to respond to the latest threats that could strike their business.

A red team drill is like a cyber attack training day, security practitioners assemble and are divided into two teams: red team attacks and blue defends. The red team will try to simulate a cyber attack by attempting to breach Stena's systems and the blue team will try and stop it from happening. It's a common industry exercise that keeps security teams sharp.

When IT Pro asked for details of anything that came up in recent exercises, Carling told us that asset management was something that Stena and all other companies in the world will face issues with.

"[The red team] will find devices that are not supposed to be there and utilise them, they will breach them and get in. If you have a good red team, you can't stop them, they will get in one way or another," said Carling. "The only difference is how long it takes for them to get in. The improvement that we want to see is whether the blue team is getting better at detecting them."

In addition to regular exercise, Stena also has a global SOC which gives their security experts a holistic, business-wide view of their facilities' security.

"No captain would ever navigate without radar," he said, so there's no reason why security professionals should operate without an extensive view of oncoming threats.

"If you don't know what's in your network, you don't have security - you need to know exactly what's out there," said Carling.

The latest technique used by the company is deploying cyber security ambassadors where individuals from different Stena facilities who have shown an interest in cyber security can congregate and receive extensive training and then head back to their base and spread that knowledge to their team.

Two security specialists have been arrested after physically breaking into a US courthouse, something they claim was part of the cyber security penetration assessment they were hired to complete.

Dallas' State Court Administration (SCA) hired the two specialists through a third-party to conduct a penetration test of the electronic records held by the Dallas County Courthouse. However, authorities were alerted when the two men were found attempting to breaking into the site using an assortment of burglary tools.

The two men later claimed they were hired to test the courthouse alarm system, and how responsive the police were, according to the Des Moines Register.

The SCA, which governs courthouses in the state, confirmed they had hired the pen-testers from security firm Coalfire to "attempt unauthorised access to court records through various means" and ascertain vulnerabilities.

"SCA did not intent, or anticipate, those efforts to include forced entry into a building," the organisation added in a statement.

"SCA apologizes to the Dallas County Board of Supervisors and law enforcement and will fully cooperate with the Dallas County Sheriff's Office and the Dallas County Attorney as they pursue this investigation."

It's currently unclear what the agreement stipulated, however, the two specialists remain adamant that by physically breaking into the site they were operating under the boundaries of the contract.

The testing of physical defences forms an integral part of many cyber security strategies, particularly in locations housing highly sensitive data, as there are often security vulnerabilities that can only be exploited by being in close proximity to target devices.

Nvidia, for example, last month disclosed five dangerous vulnerabilities in its GeForce, Quadro and Tesla graphics processing units (GPUs), with the most severe flaw allowing an attacker to install malware on a victim's machine.

These flaws, however, required hackers to be physically close to target devices, meaning an organisation hoping to protect themselves from attacks would need to invest in physical defences just as much as cyber defences.

"Coalfire is a global cybersecurity firm that has conducted over 10,000 security assessments since 2001," a spokesperson told IT Pro.

"We have performed hundreds of assessments for similar government agencies, and our employees work diligently to ensure our engagements are conducted with the utmost integrity and in alignment with the objectives of our client.

"However, we cannot comment on this situation or any specific client engagements due to the confidential nature of our work and various security and privacy laws. Additionally, we cannot comment on this specific case as it is an active legal matter."

The two pen-testers, Justin Wynn and Gary Demercurio, have been charged with third-degree burglary and possession of burglary tools. They are set to return to the Dallas County Courthouse for a preliminary hearing on 23 September.

IBM has revealed what it thinks could be a future attack vector for cyber criminals to harness when attempting to hijack a victim's wireless network and steal sensitive data without detection.

The technique explained by the company at Black Hat 2019 is being coined "Warshipping" and involves concealing a tiny homebrew device, which it said costs less than $100 to build, inside of a regular-looking parcel and sending it to a victim - perhaps a business or CEO.

With the number of packages getting delivered to businesses and stored in mailrooms increasing every day, attackers can use this to their advantage by deploying this device to sniff a company's network for access points and other data worth harvesting.

"Think of the volume of boxes moving through a corporate mailroom daily. Or, consider the packages dropped off on the porch of a CEO's home, sitting within range of their home Wi-Fi," said Charles Henderson, global head of IBM X-Force Red. "Using warshipping, X-Force Red was able to infiltrate corporate networks undetected.

"Our aim in doing so was to help educate our customers about security blind spots and modern ways adversaries can disrupt their business operations or steal sensitive data."

Image by IBM

The makeshift device (pictured above) is fitted with a wireless 3G modem which allowed IBM researchers to remotely control the device from back in their lab. The device itself is a single board computer (SBC) which are cheap and cheerful networked PCs powered by a mobile phone battery.

The design's main limitation is its power consumption, but IBM managed to tweak it to become a low-power device, capable of being turned off when it's not needed.

Once concealed in the parcel and in transit, the device periodically scans for wireless networks which lets the controllers monitor the location of the parcel and ultimately verify that it has been delivered to the intended target.

"Once we see that a warship device has arrived at the target's front door, mailroom or loading dock, we are able to remotely control the system and run tools to either passively or actively attempt to attack the target's wireless access," said Henderson. "The goal of these attacks is to obtain data that can be cracked by more powerful systems in the lab, such as a hash."

IBM said it could gain a foothold on the network by listening for a handshake (a packet signalling an established connection) and capturing the hash to crack a preshared key which can be used to gain network access, and collect data that can be siphoned back to a more powerful system for cracking.

The warship can also be set up as an 'evil twin' network whereby attacks could be performed by setting up a spoof network to which employees could be enticed to connect devices to, revealing their true credentials which can then be used to move deeper throughout a legitimate network.

Henderson noted the researchers were then able to exploit vulnerabilities in things like employee devices to establish a persistent foothold on the network, giving them the ability to "steal employee data, exfiltrate corporate data or harvest user credentials".

The name 'Warshipping" was inspired by and named after a combination of Wardialing and Wardriving.

The former was a network-cracking approach in the 1980s and 1990s dial-up era which involved attackers spamming phone numbers until they landed on a weak system.

The latter was used more recently in the 2005 TJX data breach which cost the company close to $2 billion. In this case, attackers drove around Miami and sat in TJX store car parks and sniffing the store's networks locally from a vehicle, using cheap wireless equipment.

"Attacks like these are particularly concerning as they are so difficult to detect and can prove to be detrimental if executed successfully," said Stuart Sharp, VP of solution engineering at OneLogin. "These attacks are certainly viable as they require low powered devices that can be activated remotely, meaning they can withstand transit for many days without losing power.

"Organisations should be extra vigilant when accepting packages and refrain from leaving empty boxes within the confines of the business," he added.

Henderson said we could expect to see the attack method being exploited more heavily during times of the year which see high volume deliveries such as Christmas or Black Friday.

No examples of Warshipping have been seen in the wild yet. However, in late 2018 a string of European banks were targeted by attackers posing as job seekers, couriers and inspectors who then installed Raspberry Pi devices in places like meeting rooms and stole tens of millions of dollars by doing so.

Often depicted as hooded basement-dwellers, faces lit only by blue light, hackers come in all shapes and sizes - and notably wear different coloured hats. The annoying, destruction-wielding hackers are known as black hats whereas those who use their hacking abilities for ethical, productive purposes are known as white hats.

Ethical hackers are in short supply in the industry and they serve an important purpose in the overall protection of modern businesses and other organisations. The old saying ‘attack is the best form of defence’ certainly rings true in the cyber security industry, and it’s why ethical hackers are paid handsomely for their services. Their role is to use their hacking abilities and knowledge of systems to find security vulnerabilities in software and infrastructure so they can be patched before criminals can exploit them.

Their work is invaluable to businesses that handle large quantities of sensitive or personally identifiable information, or those that are subject to tight regulations such as banking and financial services firms.

White hats can most commonly be found working in-house at businesses or independently, either as contractors or as modern-day bounty hunters - hackers who look for security vulnerabilities in companies that offer bug bounty programmes. There are a number of large companies such as Apple and Microsoft that offer lucrative bug bounties that increase in monetary reward based on how severe the vulnerability is.

There are a multitude of routes one can take to become an ethical hacker and, as previously mentioned, a number of different ways these hackers can monetise their skill set. The cyber security industry has been intent on attracting new talent to the scene and there is an abundance of resources to get you on your way to becoming a fully-fledged white hat.

What is an ethical hacker?

Before delving any deeper, it's important to clear up any misconceptions of what an ethical hacker is, rather than making judgements on what's morally right and wrong.

Jeff Schmidt, global head of business continuity, security and governance at BT, describes an ethical hacker as a computer security expert. They must specialise in penetration testing (i.e. working out how easy it is to break into computer systems) and other testing methods to ensure infrastructure is sufficiently secured against potential hacks.

However, another expert in the field of cyber security, Conrad Constantine, a research team engineer at AlienVault, thinks the description of any role as a "hacker," whether ethical or not, is irrelevant.

"Nobody says they are going to go see an ethical locksmith or an ethical lawyer do they?" he told IT Pro.

But what the role is called is simply semantics. It could be we decide to refer to them as a white hat hacker or penetration tester. The important differentiator between an ethical hacker and a criminal hacker is that the former carries out security testing with the full consent of the company they are working on behalf of.

If they did not have permission, the offence would be punishable under the Computer Misuse Act.

Ian Glover, chairman of CREST, prefers the penetration tester label and his definition goes a little further in that it recognises you need to be more than just a techie in order to truly fulfil the role. He believes you need to have consultancy skills as well.

A penetration tester, he says, has to be able to "communicate the results of the tests at a level tailored to the audience", Glover says, and "provide technical consultancy and recommendations to customers as to how any reported vulnerabilities could be mitigated".

What certifications and training do ethical hackers need?

OK, so talking of the necessary skills for the job, what qualifications do you need? Peter Chadha, chief executive and founder of DrPete, reckons that all you need is "a vast amount of technical knowledge of IT systems and software and, in particular, how to exploit their vulnerabilities", but acknowledges that there are formal qualifications available.

"Most commonly the EC-Council Certified Ethical Hacker certification, a self-study or classroom course with a 200 multiple choice question exam at the end," Chadha says, adding: "Communications-Electronics Security Group (CESG) [now part of the National Cyber Security Centre] approval is also required for any penetration test on a company, and this is appointed by a government department."

This involves the CHECK scheme, where penetration testers prove themselves through practical examination under lab conditions. "There are two levels of approval," Chadha explains. "A penetration test member and a penetration test team lead, and government departments will require at least one team lead working on any project."

Phil Robinson, director of Digital Assurance and a Founder Associate Member of the Institute of Information Security Professionals points towards the Tiger Scheme and CREST certifications. "There are entry level testing certifications, for those wishing to be part of a testing team and working under the management of a team leader, and senior testing certifications for more experienced individuals to either work on their own or to lead a team," Robinson told IT Pro.

"It also helps to have a reasonable general background and experience alongside certifications such as a Masters in Information Security," he added.

As far as the CREST certification is concerned, Ian Glover points out that in order to pass at the lower level a candidate will need "knowledge and skills on a wide range of relevant subjects, and in addition they would normally require two to three years regular and frequent practical experience, equating to about 6,000 hours experience and research." When it comes to the higher level that increases to five years or 10,000 hours.

Can cyber criminals become ethical hackers?

But what about if that 'experience and research' was largely garnered on, for want of a better phrase, the dark side? Can, and do, black hat hackers cross the divide and enter the legit world of the penetration tester?

Dominique Karg, is the co-founder and brilliantly titled chief hacking officer at AlienVault. He has no problem with poachers turned gamekeeper.

"I think they're the only ones that can do the job well," he says, adding "I got my ethical hacking job that way. I had to choose between being taught something I already knew at the university or getting paid for what I liked to do anyway. The decision was easy."

Ian Glover agrees that we have to recognise where the industry has come from. "There are individuals within the industry that have crossed from the dark to the light," he says, but warns that the situation is changing very quickly.

"There is no reason now to have worked on the dark side to enter or progress in the industry," Glover argues, concluding "in fact the high ethical standards that CREST member companies sign up to would make it difficult for them to employ such individuals."

Marcus Ranum, chief security officer at Tenable Network Security, thinks that a track record as a recreational hacker simply shows errors in judgement and a willingness to put self-interest first. "That's not something that should impress a prospective client," he insists. "After all, if you were acting like a sociopath last month, why should I believe you're not one today?"

What kinds of ethical hacker job roles are available?

Much like how cyber security as an industry is somewhat of a catch-all term for different sub-fields, the term ‘ethical hacker’ also encompasses many different types of jobs, the most common and perhaps most glamorised being a penetration tester.

Penetration testers, or pen testers, are hired to probe a business for cyber security weaknesses through both digital and kinetic means. Some penetration testers are hired to assess the physical security of a company’s office building, for example, since this can be an entry point through which hackers could conduct local attacks. Other common job roles are security analysts, information security consultants, and network security specialists.

There are also opportunities to get involved in corporate red team-blue team exercises, which involve cyber security staff taking part in virtual war games to hone skills and ensure everyone is prepared to face a real cyber attack when the time comes. Ethical hackers will typically get drafted in to participate on the red team - the offensive team the company’s staff try to keep out of their systems - and these kinds of roles can often pay well too, especially on a contract or consultancy basis.

What's the average salary for an ethical hacker?

Experts speaking to IT Pro all said that there is plenty of money to be made as an ethical hacker, with the demand for such talents far outweighing the supply. Newcomers to the job market can expect to make around £25,000, according to Ian Glover, while a registered professional with some experience could be looking at a salary in the region of £55,000. A team leader should be expecting even more; a sum north of £90,000 would be about right in the current market.

Peter Chadha adds that a penetration tester working as a contractor can easily earn between £400-£500 a day. As for market buoyancy, Glover told IT Pro that "the demand for high-quality individuals working for professional companies far outstrips supply."

"The UK is seen as one of the leaders in this area and the opportunity to work on international projects is increasing every day."

John Yeo, director at Trustwave SpiderLabs, put it in a nutshell when he told us that given the recent uptick in mainstream media awareness of the types of malicious compromises that take place on a regular basis, and the reality that now cyber security is much higher on every organisation's executive agenda "in many respects it has never been better".

Another way to ethically make money from hacking is to take part in bug bounty programmes, which are used by companies like Google, Microsoft, Uber, and even PornHub to encourage hackers to discreetly report flaws instead of exploiting them. However, bug bounty programmes aren’t only reserved for major tech companies. The UK’s Ministry of Defence (MoD) recently introduced its own programme through which white hat hackers can disclose vulnerabilities to the UK government department without fear of prosecution.

Apple is especially well-known for handsomely rewarding its ethical hackers, having launched a bug bounty programme in 2016 which pays security experts between $25,000 (£18,000) and $1 million (£720,000) for a disclosed security issue. What's more, the company states that vulnerabilities which “were previously unknown to Apple” could potentially “result in a 50% additional bonus” added to the payout.

In October 2020, the tech giant paid a team of penetration testers at least $288,500 (£222,813) for finding and disclosing critical vulnerabilities in its network. Out of the 55 bugs reported by the team, the 11 most critical ones made it possible to access Apple’s infrastructure and use it to potentially steal confidential information such as private emails and iCloud data.

Only a few months prior, developer Bhavuk Jain managed to identify a security vulnerability in the "Sign in with Apple" feature which could have been used to enable hackers to take control of a user's account. For this discovery, the tech giant chose to award Jain with a $100,000 (£72,280) payout.

So what are you waiting for?

How to apply for a job as an ethical hacker

Who should you approach if you actually want to get started in the penetration testing field? We ask the experts...

• Ian Glover: "Anyone interested in a career in the industry should contact CREST who will provide advice and guidance on the best way to enter and then progress in the industry. We are also working with a number of universities to provide internship and work placement opportunities for individuals, with a great deal of success."
• Marcus Ranum: "Get a job working as an auditor. Penetration testing can be thought of as a 'more aggressive audit' and there's a lot of intellectual overlap in the field."
• Jeff Schmidt: "The Cyber Security Challenge UK is a good starting point to get an understanding of the cyber learning opportunities and careers within the industry."
• Peter Chadha: "Search for the equivalent of CESG team members and network with them to build connections and knowledge in this area."
• John Yeo: "Invest the time and effort in going to conferences and get to know the various characters within the industries for which this isn't just a day a job, but enjoy it so much that they're regulars on the conference circuit."

The speed at which the security landscape is evolving can make it challenging to keep up to date with the latest threats for those on the front line of a business' cyber defences. It is even more difficult for employees who aren't involved in cyber security to know what to look out for when it comes to ransomware, phishing and data breaches.

The four major cyber security concerns expressed by IT professionals in a recent survey are a breach of confidential data, with 68% highlighting it as a major concern, followed by phishing attacks (68%), CEO fraud attacks (68%) and ransomware attacks (62%).

All of these methods of attack can involve exploiting employees at a company, and therefore training is one way to reduce the risk of staff accidentally opening a malicious email attachment, or falling prey to a social engineering attempt.

What is security awareness training?

As the name suggests, security awareness training is educating staff about what potential cyber threats look like, so that they are able to avoid attacks.

It doesn't guarantee that an employee will never make a mistake, but by raising awareness of common and emerging ways that hackers can try and get information, it keeps cyber security at the forefront of their minds.

Security awareness training should focus on three primary strands: firstly, how IT and devices should be used in the business; secondly, what security threats look like; and thirdly, how to respond both to suspicious activity, and an actual cyber attack.

Most organisations should have corporate policies about how to use devices, whether those are business-issued or personal. Shadow IT - or unauthorised business devices and apps - is a security issue that can leave businesses vulnerable, so it is important to set out and regularly reinforce expectations for what devices staff can use, and any limitations on that, particularly when they're connected to a corporate network.

Keeping employees up-to-date with what security threats look like is another important aspect of security awareness training. This can be everything from the basics of what to look out for with a phishing email, to trends right at the cutting edge of the cyber security landscape.

Finally, it is crucial not to leave out what to do in the event of receiving a suspicious email, such as reporting procedures and who to turn to, as well as what to do in the event of a cyber attack. This can also be a good place to highlight the organisation's disaster recovery plan, to improve how the business will respond and ensure all employees are on board.

Pros and cons of security awareness training

With 56% of security professionals saying that employees are the number one cause of data breaches, there are numerous benefits to improving staff awareness of cyber threats.

Frequent security awareness training will help bake cyber security into an organisation's culture. Collective awareness is a powerful tool, and is particularly important for businesses with a high staff turnover.

If staff are being vigilant about the emails they receive, what passwords they set, and how they share information internally and externally, the risk of a silly mistake having devastating consequences for the business is greatly reduced.

One clear benefit of having regular training is increased compliance. Should a data breach happen, showing that you had adequate training in place and that it was enforced will be a key part of determining how much fault lies with the business.

However, there is always a risk that, as with too-frequent fire alarms, too much of an emphasis on security awareness training can make employees blas about potential threats.

Some forms of security awareness training can also be quite costly, especially hands-on and classroom-based training, which is often more effective than an online course or internal briefings. But the costs of implementing security awareness training should be balanced against the long-term financial and reputational cost of a successful cyber attack.

Security awareness training will also not help if an employee is intent on acting maliciously. It does, however, mean that they can't plead ignorance about policies and procedures if these are regularly highlighted in training.

How to implement security awareness training

A large part of security awareness training is highlighting bad habits that staff may be getting into, and raising awareness of the consequences. There are four main ways that security awareness training can be implemented to improve some of these simple vulnerabilities:

A classroom-style approach, where employees gather in an external or internal room for a dedicated training session. This can be delivered by a member of the IT or security team, or an external training company can be hired.

An online course, which can be delivered to both new and existing employees on a regular basis. Online courses or training videos are often used for compliance training, fire safety and more, and can easily be used for security awareness as well. Although there is no guarantee of how engaged an employee is when doing online courses, they can be completed by new starters almost straight away, and quizzes can be used at the end to test understanding.

Internal tests are a method growing in popularity, where companies send simulated phishing attacks to their own employees. Security staff can then determine who falls prey to a phishing attack, and use that for further training if necessary. Bristol City Council recently sent a wave of spoof phishing attacks to their own colleagues, sending those who clicked on the link to a targeted training site.

Frequent reminders like posters which can be displayed prominently in an office alongside health and safety notices, or specific company emails, both of which can be used to cover subjects like what a suspicious email looks like, how to verify links, and the importance of a secure password.

The key with any form of awareness training is to keep it frequent. At the moment, just 11% of organisations continuously train employees on how to spot cyber attacks, according to global research from Vanson Bourne. 52% perform training just quarterly, or once a year.

But annual training means that a new member of staff could go for over 11 months without any form of security training, hugely increasing the risk of them accidentally clicking a malicious email, or worse.

The speed at which attacks evolve means that continuous training is the best way to keep employees up-to-date with what to look out for, as well as embedding cyber awareness into the company culture.

Who takes the initiative?

Security awareness training reduces the likelihood of employees falling victim to a cyberattack, yet which employee is responsible for organising the training? Such initiatives have been known to fall between the scope of several roles, with CIOs, IT managers, and even human resources known to pick up the mantle.

IT managers are understandably most enthusiastic about security awareness training, as they are well versed in cyber threats. They are burdened with at least a portion of responsibility in the event of a breach, and so typically are the people pushing for training to be deployed. But in most organisations they are overshadowed by a CIO who has one eye on a stretched IT budget.

Senior business managers may be resistant to training, since their employees' schedules would be disrupted. Though training does initially hamper productivity, in the long run eliminating security threats ensures a higher level of productivity. Needless to say, business managers usually play no more than a side-role in introducing training.

For security to be given the attention it deserves at employee-level, it must be managed by the board. In the present day, CIOs are frequently given a chair at the top table in order to keep C-suite members aware of security issues and compliance risks. By acting as a bridge between IT managers and those at the top, the CIO can ensure the board of directors takes security seriously, going a long way to bolstering the security training programme within an organisation.

In all, the CIO would typically be responsible for bringing a security awareness program to the board, but for it to be successful, all within the organisation must buy-in to the initiative.

Security researchers who discover flaws in Microsoft's Azure DevOps platform could earn themselves up to $20,000, after the company announced its latest bug bounty programme.

The Microsoft Azure DevOps Services Bounty is the company's tenth concurrent bug bounty programme and covers Redmond's suite of cloud-based DevOps tools. Previously known as Visual Studio Team Services, these include continuous integration and continuous delivery (CI/CD) tools, Git repos, kanban boards, testing tools and more.

"Security has always been a passion of mine," said Microsoft's director of engineering for Azure DevOps, Buck Hodges, "and I see this program as a natural complement to our existing security framework. We'll continue to employ careful code reviews and examine the security of our infrastructure. We'll still run our security scanning and monitoring tools. And we'll keep assembling a red team on a regular basis to attack our own systems to identify weaknesses."

Rewards range from $500 all the way up to $20,000 at the top end, with payouts affected by a number of different factors. The quality of the report itself (meaning how easy the report makes it for Microsoft's engineers to understand, reproduce and fix the problem) is graded as either high, medium or low, with different bounties for each.

Different levels of compensation are also awarded based on the severity of the bug, but only 'critical' or 'important' bugs will qualify for a reward - disclosures of any other category of bug will merely earn a public acknowledgement from Microsoft, should the report lead to a fix.

Finally, the impact of the bug itself will be taken into consideration too. Remote code execution flaws are, understandably, the most valuable, followed by privilege escalation and information leaking, while tampering flaws are eligible only for a limited payout, and denial of service vulnerabilities are not rewarded at all.

Bug bounties are becoming an increasingly common security measure among large companies, with the idea being to make it more valuable to responsibly disclose the flaw to the victim than to exploit it for personal gain.

Major organisations like Facebook, Apple, and Google all offer their own bug bounty programmes, and the practice is touted as a good way to ensure that fewer flaws and exploits appear in the wild.

"We think like hackers do," explained Tim Holman, CEO of 2|SEC. "Criminals don't just stop at the first exploit they find. They will chain exploits and pivot off exposed systems to gain further leverage."

2|SEC is a London-based cyber security service provider that provides penetration testing services - among others - for a wide variety of clients. Otherwise known as "ethical hackers" or "pen testers", such specialists are contracted by organisations that want to know if they need to up their security game.

And, if they do, where.

"The obvious benefit is that your systems will be protected against the latest criminal exploits and techniques that are being used against you," Holman explained. "Unless you have [a] full time, dedicated resource that can stay on top of the latest threats and vulnerabilities, your company will find it very difficult to match the experience and expertise that a professional penetration tester will bring."

There's nothing shady about contracting with an ethical hacker. The companies we approached for this feature were happy to talk about what they do and how they do it, pointing out that they remain within the law by only accessing the systems they've been authorised to target, and only doing so within a defined time frame.

"Our approach is always to use the very latest research, exploits and techniques to see if we can gain a foothold in your company; and to do that, we have to be very careful not to bring systems crashing down or inadvertently expose sensitive data."

Growing importance

As organisations handle and process larger amounts of data, the need for pen testing is increasing. Not long ago, they were routinely advised to run tests every couple of years, but that no longer satisfies many of their clients.

"Some of the compliance requirements are mandating that organisations who accept payment card data should be doing this at least annually and moving towards a model where they do it every six months," said Oliver Pinson-Roxburgh, MD of Bulletproof. "If your application undergoes a significant change since your last pen test, advice would be to retest then, too."

In part, this is being driven by the strictures of GDPR. "We have more customers asking about what they should be doing," Pinson-Roxburgh said. "Often, they don't have an incident response plan and want to know that if they get caught out, they can at least do something."

Having such a plan in place, and being able to prove you've been diligent with your testing, helps to demonstrate you're taking some responsibility. "It shows that you've taken reasonable efforts to do all that you can," said Mark Nicholls, director of cyber security at Redscan.

"We have often helped companies assess their readiness for a breach and, defensively, asked what a security and network team have done in response when an attack has taken place. Have they been able to acquire the necessary information within the first 72 hours following an attack to report to authorities?"

Making such reasonable efforts will often be enough to avoid the breach in the first place, as it will help identify where patches and fixes either haven't been applied, or are only partially effective.

"My experience has been that those organisations that were fined under the Data Protection Act could largely have solved their problems by doing a pen test or implementing some form of initial security scanning or testing," said Pinson-Roxburgh. "Where the ICO has published rulings, they [often] show that if the organisation had done the right things about security it would have identified the problems.

Often, it's a well-known, three-month-old vulnerability that they should have known about and fixed."

Your first approach

Ethical hackers are used to hand-holding new customers - particularly any that aren't sure what they need or what's on offer.

As Nicholls explains, outlining what the client does as a business, the systems it's running and what the ethical hacker can do is usually the start for any conversation. "We'll then assign a number of days [for the test during which] they can stand up appropriate resources, whether it be project managers or developers, to make sure we don't take anything down - or so they can address critical issues as we find them."

Pen testers are often told to social engineer their way into systems - even offering fake bribes to staff

But pen testing often goes further than sitting at a keyboard and mouse and searching for vulnerabilities.

"We have red team exercises where the customer gives us an objective that we have to achieve by any means," said Pinson-Roxburgh. "That could be physically going to the building and finding our way in, or social engineering our way in. We've done a few big data centre tests, supposedly the most secure data centres in the world, and found our way in through a combination of social/physical access to the buildings, and hacking portals. For some customers we've even done bribes to see how their staff react to security [threats]."

Pinson-Roxburgh's preference would be to work with live systems wherever possible because, "if they're going to give us a system that's half finished because it's in pre-production, they're not going to get a realistic test. [That's not good when] most of the organisations are saying they want you to simulate things from the hacker's perspective."

But Nicholls also sees value in working with parallel infrastructure and data sets. With live systems, he says, "there's always an inherent risk when you're testing an application or server where issues may arise from being scanned.

Although rare with applications nowadays being more resilient, it can lead to downtime. So, we advise testing against a representative system that closely mirrors what's live. It gives you a good idea of what vulnerabilities there are, and we don't need to hold back. We can assess every parameter."

Confidentiality and confidence

Should a tester gain access to your system, they could have access to confidential data. It's essential to ensure your pen tester signs and complies with a non-disclosure agreement, and that its staff have the necessary security accreditation.

Ultimately, you need to feel comfortable working with them, but that doesn't necessarily mean avoiding someone with a shady background - so long as they've since gone good.

"Many of the most celebrated security people started on the wrong side," Nicholls said. "Curiosity, early on, can be an issue but if that has changed and they're now progressing in a security career where they're offering their capabilities, there's no reason why a person such as that wouldn't meet the various standards and certifications."

Responding to an unsolicited approach, though, is a different matter entirely, and Pinson- Roxburgh advises caution.

"What I've seen more recently is organisations being solicited directly by people looking for bug bounties. I'd recommend an organisation be very cautious in such a situation because we've seen scenarios where the person making the approach is demanding certain amounts of money, only for the organisation to discover that the thing that's been found doesn't warrant the amount of money they've paid...

"When you're approached by someone asking about bug bounties, mention the Computer Misuse Act and the fact that nobody should be testing your systems without your authorisation."

The NHS is struggling to retain critical cyber security expertise and expenditure is being allocated erratically, with some Trusts spending as little as 250 in the last year, it has emerged.

Despite the Department for Health and Social Care (DHSC) having committed an additional 150 million on NHS cyber security a year after the WannaCry attack, research by Redscan has exposed a prominent gap in both funding and staffing.

The average spend on data security training across 159 Trusts surveyed was 5,356 in the last 12 months, but this ranged widely from between 238 and 78,000 with no correlation to the size of Trust, or its location.

For a mid-sized Trust of between 3,000 and 4,000 employees, for example, training spend ranged from 500 to 33,000. But the research also notes a significant amount of training was conducted in-house using NHS Digital resources.

GDPR training was the most common programme taken up, with other prominent courses including BCS Practioner Certificate in Data Protection, and Senior Information Risk Owner.

However, it was found that NHS Trusts have only employed an average of one qualified security professional per 2,582 staff.

Alarmingly, almost a quarter of Trusts, 24 out of 108, retain no staff with security qualifications despite some employing around 16,000 full-time and part-time workers. A handful of Trusts also reported having employees in the process of obtaining security qualifications.

"These findings shine a light on the cyber security failings of the NHS, which is struggling to implement a cohesive security strategy under difficult circumstances," said Redscan's director of cyber security Mark Nicholls.

"Individual trusts lack in-house cybersecurity talent and many are falling short of training targets; while investment in security and data protection training is patchy at best. The extent of discrepancies is alarming, as some NHS organisations are far better resourced, funded and trained than others."

The findings, released following a Freedom of Information (FOI) campaign which saw responses from 159 NHS Trusts, have been released a year-and-a-half after the devastating WannaCry attack that DHSC estimated to cost 92 million.

Several parliamentary reports have since savaged the NHS' record on cyber security resilience, with among the latest in April showing zero Trusts passed the government's cyber security assessments.

A separate FOI request Redscan sent to NHS Digital revealed signs of improvement, as 139 Trusts had now undertaken a Data Security Onsite Assessment, compared to just 60 Trusts last year.

Beyond announcing an additional 150 million over the next three years, the DHSC also committed to upgrading all Windows XP devices to Windows 10 by 2020 in a deal struck with Microsoft earlier this year.

"Cyber security is a priority for this government and funding is provided to NHS Trusts based on their specific needs and capabilities," a DHSC spokesperson told IT Pro.

"Over 60m was invested last year for critical infrastructure, and there will be a further 150m over the next three to improve resilience across the health and care system.

"Where Trusts do not take sufficient action to secure their networks and systems, we will use strong enforcement powers to ensure they improve."

Redscan's Nicholls added that as the skills gap continues to grow, it'll become harder for organisations across all sectors to find the people with the right knowledge and expertise.

"It's even tougher for the NHS, which must compete with the private sector's bumper wages," he continued, "not to mention the fact that trusts outside of traditional tech hubs like London and Cambridge have a smaller talent pool from which to choose from."

Kaspersky's principal security researcher David Emm told IT Pro that given how very attractive health data is to criminals, it is vital the NHS invests money in robust protections.

"Healthcare providers must also work closely with their IT security teams to implement sophisticated, high-quality protection that will allow them to manage and protect customer data," he said.

"Not just for the sake of tick-box' compliance, or to avoid hefty fines and embarrassing, often irreparable reputational damage, but to enable them and their patients to reap the many rewards of advanced digital healthcare, confident in the knowledge that data, devices and networks are secure."

IT Pro also approached NHS Digital, NHS England and NHS Improvement for comment.

MPs and Lords have warned it's "impossible" to completely protect the UK's infrastructure from a WannaCry-scale cyber attack, with mitigation quickly-becoming a new normal'.

Several factors stand in the way of fully securing the UK's critical national infrastructure (CNI), including an increasingly complex security landscape, and the government's failure to define what it considers to be critical, according to the Joint Committee on the National Security Strategy (JCNSS).

In a report assessing the scale of threat the UK faces, the Parliamentary committee also said laws stemming from EU-wide regulations have been useful, but do not go far enough.

"'Critical' national infrastructure is, by definition, a priority for the Government and industry. However, as the economy becomes more interconnected, it is increasingly difficult to determine which elements are truly critical," the JCNSS report said.

"Fast-changing threats and the rapid emergence of new vulnerabilities make it impossible to secure CNI networks and systems completely.

"Continually updated plans for improving CNI defences and reducing the potential impact of attacks must therefore be the 'new normal' if the Government and operators are to be agile in responding to this changing environment and in taking advantage of constant technological innovation."

The committee raised concerns that the expectations for the National Cyber Security Centre (NCSC), formed to provide cyber training and leadership for UK organisations, is outrstripping its resources.

NHS Digital deputy chief executive Rob Shaw revealed in evidence that he had expected an "army" of experts to support the NHS through 2017's WannaCry attack, but soon learned the NCSC lacked staffing to help out on the ground.

JCNSS said it had concerns about the NCSC's capacity to meet growing demand for services and expertise, and that its effectiveness will be limited in future unless it can recruit at the appropriate scale.

The government must also publish a ten-year plan for the institutional development of the NCSC, setting out the resources and staffing levels it expects the organisation to need.

The committee made several further recommendations for the government and for businesses, including instigating a cultural change among CNI-linked organisations, and for politicians and ministers to take initiative in making cyber resilience a priority.

Private sector companies overseeing CNI, as well as firms comprising the supply chain, should consider cyber security as another business risk, and proactively manage threats. This is especially true where "commercial interests may not always align with the demands of national security".

Moreover, the government needs to appoint a cabinet office minister charged with overseeing the resilience of CNI, instead of patchwork of multi-ministerial oversight that exists currently.

Under the current structure, each department would have a different approach to overseeing cyber security in its constituent sectors, with occasional overlap.

A more focused and proactive leadership from central government is needed to ensure cyber security is handled in a more consistent way, the report continued, and blasted the status quo of ministers only occasionally checking-in as "wholly inadequate".

"It's vital that that short-term memories and political distractions such as Brexit do not derail focus from these important initiatives," said Mimecast's cyber resilience expert Pete Banham

"Private sector businesses today need a risk and security champion in the boardroom; likewise, it's time Government had a cyber tsar in the Cabinet.

"Minimising the impact of attacks should be top priority as a defence-only strategy is doomed to fail. This should include regular fire drills' for all employees to respond to and recover to cyber-attacks.

"We've seen a growing number of CNI organisations, including the NHS, make determined moves to adopt more resilient postures in the last two years. WannaCry helped focus attention and budget allocation but still more needs to be done."

Stuart McKenzie, FireEye's vice president for EMEA, meanwhile warned much of the technology used within CNI remains fragile and relies on outdated standards of security.

"The threats facing CNI have constantly evolved, meaning that today's threat is something that wasn't imaginable when many of the systems were originally designed, leaving them increasingly vulnerable," he said.

"These are not quick problems to solve, but they are not insolvable. We would recommend that CNI organisations conduct a mapping exercise to understand their exposure and risk and put in place some controls to protect the most critical threats.

"With breaches becoming inevitable, organisations need to not only to set defences and identify attacks, but crucially to have a really clear understanding of what to do in the event of a breach - every organisation needs to have a really clear incident response plan that's well tested and regularly rehearsed."

Mandatory policy decisions should also be implemented, the report recommended, including a plan to roll-out penetration-testing for CNI-linked organisations, and continued membership in key EU groups and information-sharing schemes following Brexit.

The vast majority of successful breaches into corporate networks last year were caused by vulnerable web applications, according to a Kaspersky Lab analysis of penetration tests.

Against a backdrop of increasingly-common remote and cloud-based working habits, experts found that 73% of successful beaches exploited weaknesses in web applications, with 43% of organisations assessed having 'low or extremely low' protection against external threats.

Kaspersky's latest 'Security Assessment of Corporate Information Systems' comprised an examination of the security configurations of organisations across various industries, and in the public sector, finding that only 14% had above 'average levels' of security.

Using its own metrics and methodology, the cyber security firm said 29% of companies examined had 'extremely low' levels of security, with a further 29% scoring 'average' levels. No organisation assessed achieved 'high' levels of security.

The information security landscape, meanwhile, is even worse, with a 'low or extremely low' level of protection identified for 93% of all organisations. In 86% of cases Kaspersky's experts were able to gain the highest internal network privileges in an organisation, and for 42% of companies only two attack steps were needed to achieve this.

"Our research has shown that vulnerable web applications can provide gateways into corporate networks," said Kaspersky Lab's principal security researcher David Emm.

"There are many security measures that can be implemented to guard against this nature of attack - half of these breaches could have been prevented by restricting access to management interfaces.

"We encourage IT security specialists to identify the vulnerabilities their organisations have and focus on strengthening them."

Kaspersky's analysis showed "unambiguously" that sufficient attention is not being paid to the security of web applications.

Damningly, all web applications used by government organisations had high-risk vulnerabilities, with an average of 2.6 high-risk vulnerabilities per application. E-commerce web applications, on the other hand, contained the fewest high-risk weaknesses.

Arbitrary file upload proved the most widespread vulnerability exploited to gain access to a network, while other vulnerabilities, such as SQL injection, arbitrary file reading, and XML external entity, were used to steal sensitive information such as passwords.

"To improve their security stances, companies are recommended to pay special attention to web application security, timely updates of vulnerable software, password protection and firewalling rules," the research paper concluded.

"The task of completely preventing compromising of information resources becomes extremely difficult in large networks, or even impossible when attacks are launched using 0-day vulnerabilities.

"Therefore, it is important to ensure that information security incidents are detected as early as possible."

The need for organisations to bolster their cyber security infrastructure and guard against both external and internal breaches has arguably never been greater.

Companies must be especially vigilant in light of the newly-introduced General Data Protection Regulation (GDPR), which carries a fine of up to 20 million or 4% of global annual turnover for the most serious breaches.

In light of the growing threat of cyber attack and malicious infiltration organisations of all sizes and in all industries now face, Gartner recently revealed that global security spending is expected to exceed $124 billion by the end of 2019.

Whether this level of expenditure is high enough or is being committed into the right areas, remains to be seen - but Kaspersky's analysis certainly painted a bleak picture for the global cyber security landscape in 2017, at the very least.

A new facial recognition tool has been released that could help automatically identify and harvest the social media profiles of thousands of targets with very little effort. The tool is primarily aimed at white hat hackers.

The tool - dubbed Social Mapper - was developed by security company Trustwave, who has released it on Github under an open source license. The company, which specialises in ethical hacking services, says that Social Mapper is intended for use by white-hat hackers, penetration testers and 'red teams' - internal security staff who are tasked with simulating cyber attacks on the organisation.

Social Mapper only needs a list of targets with the individuals' names and photographs. Users can also input the LinkedIn ID of a specific company, and it will automatically create a list of targets based on all the people who are registered as employees of said company on LinkedIn.

From there, Social Mapper logs into a range of social media sites - including Facebook, Twitter, LinkedIn, Google+ and Instagram, as well as regional platforms like VKontakte and Weibo - and searches the targets' names, using facial recognition to match their profile picture to the given photo.

The software will then output a report containing all of the available social media profiles for each target, available in a variety of formats. It can also generate the target's work email, if you tell the software what format to use.

Any security expert worth their salt will tell you that a complete list of a target's social media profiles is an incredibly useful tool when conducting a cyber attack, and gathering such data is often the first step when conducting reconnaissance before an attack.

"Once social mapper has finished running and you've collected the reports, what you do then is only limited by your imagination, but here are a few ideas:

• Create fake social media profiles to 'friend' the targets and send them links to credential capturing landing pages or downloadable malware. Recent statistics show social media users are more than twice as likely to click on links and open documents compared to those delivered via email.
• Trick users into disclosing their emails and phone numbers with vouchers and offers to make the pivot into phishing, vishing or smishing.
• Create custom phishing campaigns for each social media site, knowing that the target has an account. Make these more realistic by including their profile picture in the email. Capture the passwords for password reuse.
• View target photos looking for employee access card badges and familiarise yourself with building interiors."

However, Trustwave's Jacob Wilkin (who created the tool) noted that "While this is an easy task for a few, it can become incredibly tedious when done at scale". This, he said, is the primary idea behind Social Mapper: to speed up intelligence gathering that pen testers previously had to do manually.

"Its primary benefit comes from the automation of matching profiles and the report generation capabilities. As the security industry continues to struggle with talent shortages and rapidly evolving adversaries, it is imperative that a penetration tester's time is utilized in the most efficient means possible."

While Trustwave has stated that Social Mapper is intended to be used by ethical white hat hackers, concerns have been raised that because the tool can be freely downloaded and used by anyone, it could easily be deployed by criminals.

Tim Helming, director of product management at DomainTools said that threat actors using open source components for phishing attacks show that available tools on the internet have "enormous potential to be used for both helpful and nefarious purposes".

Despite what a million stock images might tell you, hacking isn't just for hooded teenagers in darkened rooms. It can also be used for good in the great outdoors, such as by enabling people to pentest from outside their building, for instance.

To be able to hack from 'anywhere' you need the right tools and downloading the Kali Linux on the Raspberry Pi should be your first port of call. The Raspberry Pi is a small, credit card-sized computer that doesn't require a lot of power to use. When combined with Kali Linux it becomes a super-portable network testing machine that you can take anywhere.

This can be run on your laptop and used to test your Wi-Fi password strength - or your neighbours. You can also spoof networks, test for Bluetooth vulnerabilities and much more. If you don't want Kali installed directly on to your computer, you can even add a touchscreen device.

All you need to get started is either a Raspberry Pi 2 or 3, a supply of power, a HDMI cable, a minimum 8GB SD-Card and a keyboard and a mouse for control.

Downloading the Kali image for Raspberry Pi

To start, you need a Kali Linux 2.0 image file, which you can download from the Offensive Security downloads area. You'll have to scroll down to find the Raspberry Pi2/3 download as there are a number of different variants.

It is vital that you properly verify what you're installing and that it is a genuine version of kali, rather than a fraudulent lookalike, especially if you plan to use it for security testing. Detailed instructions on how to do so can be found on the Kali website.

After you have the file downloaded it will need to be extracted. Most computers will not have the right software to extract it, but WinRAR can be downloaded and installed to extract the image file if you don't already have software for that purpose.

When you have extracted the image, you're ready to write it to an SD-Card. The minimum size is 8GB, although using something bigger like 16GB or even 32GB is considerably better as it will give you more space to download and run tools and apps.

From there, load the image file into Win32Disk Imager (a Windows program for saving and restoring images from removable drives) and write it to the correct drive, making sure you have picked the correct one as it will overwrite any drive that is selected. It will take a few minutes to write the package, and will state 'Write Successful' when it has completed.

Installing Kali on Raspberry Pi

Once the image is written to the SD-Card, it is ready to install into the Pi. Everything can now be plugged into a monitor or TV with a HDMI cable and you can even add an old keyboard and mouse for control.

After powering up the Pi it will go through a boot up process where the screen will go blank a few times before you can finish. For the final step, a login prompt will appear asking for a username and a password. The default should be 'root' and 'toor' respectively.

Naturally, it goes without saying that you'll want to change the access credentials to something more secure as soon as possible, but you should also change the SSH host keys, as the Kali image for Raspberry Pi comes with a set of default keys pre-configured. From the command line, use the following commands to change your SSH host keys:

root@kali:~ rm /etc/ssh/ssh_host_*

root@kali:~ dpkg-reconfigure openssh-server

root@kali:~ service ssh restart

Installing hacking tools

Once that's done, enter the command startx from the command line to boot into the graphical desktop environment. By default, ARM-based Kali images come with the bare minimum of tools pre-installed, but you can use Kali metapackages to install new ones. Various metapackages are available containing different groups of tools for specific purposes such as password cracking or Wi-Fi analysis.

The full list of available metapackages can be found here. You can install the 'kali-linux-full' metapackage to get all the tools that are included with the default desktop image of Kali, or you can get every single available tool with the 'kali-linux-all' metapackage. Alternatively, you can also pick specific metapackages to install based on your needs. All metapackages are installed using the standard Linux apt-get method - for example, to get the complete toolset, you'd use the command apt-get install kali-linux-all.

Once you've installed your desired tools and made sure you've changed the default passwords, you're all set to start using Kali. Happy hacking!

When it comes to innovation, many IT leaders are fond of the mantra 'move fast and break things'. However, if you're responsible for the integrity and availability of your organisation's IT systems, breaking things can have some pretty disastrous consequences.

So how do some of the tech industry's top security chiefs handle the problem of ensuring their companies can move at the necessary speed required to maintain a viable digital transformation initiative whilst also keeping everything as protected as possible?

For Marks & Spencer's head of information security, Lee Barney, the answer is in making sure that you're properly implementing DevOps practices and agile methodologies. The rest, he says, will follow naturally.

"We bake the responsibility for cybersecurity into the first line of defence," he explains. "Making sure the software engineers know exactly what they need to do to code securely, so they are as good as the red team [penetration testers probing the infrastructure for vulnerabilities], for example, in identifying unsecure code and avoiding that... that is the way to do it.

"If you've gone the whole hog with DevOps, that should be fine, because the people who are actually making the changes - not just the software engineers but the people who are responsible for making sure that particular product is up and running - they also know about security. They know enough security to know when they don't know enough, and they then come to you and ask for assistance."

John Meakin, CISO of GlaxoSmithKline, agrees that the key is in enabling developers and giving them a good toolkit for securing and testing their code. After all, he points out - they're the ones that are going to be responsible for actually delivering security, rather than the CISO.

"You basically let go and allow them to do the security - so long as you're there," he says. "You've got to be there and you've got to be confident in telling them when they're doing it wrong. Because you're there, you're [telling them] early enough that it makes a difference.

"If the design is fundamentally wrong, then you need to point that out; you need to point out the risk. Not say to them 'the design is wrong, this is how you design it'. You point out the risk, which leads them to the decision 'oh, the design was wrong, I need to design it a different way'."

For Graeme Hackland, CIO of Formula One team Williams, achieving 'security by design' in a DevOps environment is tricky if your development team hasn't specifically trained for it. If integrating security as a core part of the development process isn't a natural thing for them, developers will often see the addition of security as something which slows them down when they're on a tight deadline.

"We're getting to the point where you have to get to your developers a lot earlier and get them into that mindset and thinking fairly early in their career," he states. "So it's focusing on the human aspect from my point of view, and making sure that your coders and the testers who are sitting right next to them are in that mindset just without even having to think about it - it's just part of who they are."

However, Meakin also warns that developers need to meet security personnel halfway. While he noted that the culture of a developer community isn't going to change overnight, he stressed the importance of developers evolving and engaging with security on a deeper level.

Thankfully, he sees a new breed of developers and development managers entering the industry who do truly understand the value of security and are happy to work with security teams as a core part of the development process.

"One of the great things within GSK is that there's been a recognition that not only does security need to adapt its approach but the developer community themselves need to adapt their mindset," Meakin says.

"What we're finding is that as we look out at the developer community as part of a natural refresh, we're finding a generation of developers - including development managers - who really get security. They don't know all the techie details we do... but they get security and they're prepared to give security almost equal weighting with business function points."

Picture: Shutterstock

The former CEO of TalkTalk, who witnessed the fallout from the telecom provider's 2015 hack, has issued a stark warning to companies, advising them to invest in decommissioning their legacy technology systems before it's too late.

Speaking at the annual InfoSecurity Europe conference in London, Dido Harding told attendees that if they did not take the time to audit their legacy technology, it may have dire consequences further down the line.

Harding speaks from experience; it was a flaw in a legacy system that caused the catastrophic data breach of TalkTalk's systems in 2015 and led to the theft of 157,000 customers' bank details and personal information, as well as a then-record breaking fine from the ICO of 400,000.

"We were a business that had grown through a lot of acquisitions, and a business that we had bought had bought a business, that had bought a business, that had a legacy website that had an extremely simple SQL injection vulnerability in a legacy website that had not been used in two of those three acquisitions."

TalkTalk failed to properly scan the infrastructure of Tiscali when it bought the company's UK business in 2009, and was unaware that three vulnerable webpages enabled hackers to gain access to a database holding customer information, or that the database version was outdated and out of support.

According to Harding, the flaw went undiscovered despite penetration testing, security audits and other forms of cyber due diligence being carried out at the time Tiscali was acquired by TalkTalk. "None of us found it. We should have done, but none of us did."

"It is the legacy that gets you," she added. "It's acquisitions and legacy within acquisitions that gets you. And it's business leaders not really hearing from their security experts that they need to spend money in decommissioning the legacy - whether they acquired it or built it themselves. And that's pretty much what happened to us."

Harding also talked in more detail about the infamous hack, including laying out TalkTalk's immediate response to it in more detail. She said that her biggest regret was not informing customers earlier, and reminded attendees that three months after the hack, TalkTalk's customer base reported higher satisfaction and lower churn than it did before.

One of the former CEO's most important takeaways from the hack was that security is a board-level issue, but also that boards are looking at security in the wrong way. Rather than looking at security as a black-and-white, pass-fail metric, boards need to see security as a spectrum of risk.

"The vast majority of boards want to be able to abdicate responsibility by asking their security professionals 'are we ok?'," she said, "and you mustn't let them ask that question."

"If you're running an oil rig, as the chief exec, you wouldn't go 'are we physically OK?'. You'd ask a different question; you'd say 'what are the risks? What are the risks I'm happy to accept, and what are the risks that I'm really worried about that we need to be pushing to mitigate?'"

Kali Linux is now officially available on the Microsoft Store, marking another milestone in Microsoft's recent bid to support open source software.

Running on Windows Subsystem for Linux (WSL), a feature introduced as part of last year's Fall Creators Update that allows users to run various Linux distros on top of existing Windows 10 installations, Kali Linux joins other popular distros such as openSUSE, Fedora and Ubuntu.

"Our community expressed great interest in bringing Kali Linux to WSL in response to a blog post on Kali Linux on WSL. We are happy to officially introduce Kali Linux on WSL," said Microsoft's WSL programme manager, Tara Raj, as part of a blog post announcing the distro's availability.

"We would like to extend our sincerest thanks to the Kali Linux team and especially [Kali lead developer] Mati Aharoni for all their patience, hard work and support to plan, build, and publish their distro packages in the Windows Store. Thank you!"

Kali Linux, a security-focused Linux distro based on Debian, is designed primarily for 'offensive security' - a branch of cyber security that involves ethical hackersattacking businesses in order to expose flaws in their networks that can then be fixed, a process known as penetration testing.

As well as penetration testers and red teams, the distro is also used by actual cyber criminals, due to its effectiveness. The software comes pre-packaged with a variety of different hacking tools, including password crackers, packet sniffers and exploit tools.

Ian Thornton-Trump, cyber vulnerability and threat hunting lead at Ladbrokes Coral, toldIT Pro that such tools could be dangerous in the wrong hands, but equally warned that using these tools on Windows 10 could expose hackers, due to the type of data Microsoft collects from the OS.

"Windows 10 collects a ton of user telemetry. If you're going to get your hack on, you're going to get caught," he said,"and in the US, you may go to jail for a very long time - especially if you are a jerk and go after infrastructure you don't own. So, it's like a bear trap for script kiddies and entrepreneurial cyber criminals."

However, he also pointed out that making Kali more accessible could lead to improvements in overall security, such as security teams using it to illustrate network vulnerabilities to board members.

"Kali is pure red, like the blood of your cyber enemies. But I do think it may do some good if used to improve security, and the key word is responsibly," he said. "Learning is always cool - getting busted under the CFAA because OPSEC training is not included in Kali is un-cool. Bottom line: hack what you own. If you don't own, it don't hack it - unless you have written permission."

De Montfort University in Leicester is launching a week-long programme of hands-on events designed to give students a chance to get to grips with the practical aspects of cyber security.

Beginning this Saturday, #DMUCyberWeek will include challenges, workshops and talks lead by some of the security industry's top minds, such as researchers from Check Point, BT, Deloitte and Airbus.

"We are fortunate in the Cyber Technology Institute to have such excellent relationships with industry," said the head of DMU's school of computer science and informatics, Professor Helge Janicke.

"#DMUCyberWeek represents an important knowledge exchange opportunity - our students have the chance to meet potential employers and our partners get to meet the future talent of their industry."

One of the sessions involves a digital forensics challenge that has been featured at Las Vegas' infamous Defcon security show and is co-hosted by former DMU alumnus Molly Betts, who is now part of Airbus' cyber forensics division, following a placement with the company as part of her studies.

The programme will also play host to the official start of Cyber Security Challenge UK's 2018 schedule. The government-endorsed initiative hosts an annual series of competitions designed to encourage engagement with and participation in the security community among students.

#DMUCyberWeek will host the initiative's first Capture the Flag event, which is part of the qualifying rounds to earn a place in the final Masterclass round. Teams of students must work together to solve a variety of security problems and earn points.

"I love taking part in anything run by Cyber Security Challenge UK," said Chris Hatton, second-year DMU computer security student and secretary of the university's cyber security society, DMU Hackers. "It's a great way to get experience and I'm keen to encourage other DMU Hackers to join in."

"Competitions like these are great for three reasons - they're really fun, they're the best way to learn and they're perfect for networking and getting your name out there if you want to get into cyber security. #DMUCyberWeek is definitely one of the best weeks at DMU. You just don't get another chance like it to hear from and speak to so many industry experts."

Getting more students and young people into the world of cyber security is one of the industry's top priorities, as reports have indicated that a looming skills gap could be set to leave organisations dangerously lacking in talented security personnel.

Cyber criminals will change their tactics in response to the National Cyber Security Centre's (NCSC's) success in blocking millions of attacks against UK businesses over the last year, the organisation's director warned today.

In a report entitled Active Cyber Defence - One Year On', the GCHQ-led agency today detailed the success it has had in reducing cybercrime against businesses and citizens since it introduced its four Active Cyber Defence (ACD) programmes a year ago, under the government's National Cyber Security Strategy.

These four programmes are aimed at improving UK security by checking public body websites' security, blocking fake emails, thwarting phishing attacks and stopping public sector bodies' IT systems from landing on malicious websites.

As a result, the UK's share of visible global phishing attacks has almost halved since the measures began a year ago, dropping from 5.3% in June 2016 to 3.1% November 2017, according to the report. The organisation also blocked an average 4.5 million malicious emails per month from reaching users, and carried out more than one million security scans and seven million security tests on public sector websites.

Additionally, the NCSC removed 121,479 UK-hosted phishing sites, 18,067 of which were spoofing UK government services. As a result, the average time it took to take down sites spoofing government services dropped from 42 hours to 10 hours, it said.

ACD has also accommodated for a dramatic drop of scam emails from bogus @gov.uk' accounts, the report said, with a total of 515,658 rejected over the year.

NCSC technical director Ian Levy said: "The ACD programme intends to increase our cyber adversaries' risk and reduces their return on investment to protect the majority of people in the UK from cyber attacks. The results are positive, but there is a lot more work to be done."

However, he warned that the programmes' success will see attackers alter their tactics.

"The successes we have had in our first year will cause attackers to change their behaviour and we will need to adapt," he said. "Our measures seem to already be having a great security benefit - we now need to incentivise others to do similar things to scale up the benefits to best protect the UK from commodity cyberattacks in a measurable way."

The NCSC's report also listed the 10 most-spoofed government departments, revealing that HMRC is the most targeted, with 16,064 fake websites taken down. Also on the list are the DVLA, the Student Loans Company and the Crown Prosecution Service.

The report comes after UK defence secretary Gavin Williamson warned that a cyber attack by Russia could cripple Britain's infrastructure and cause "thousands and thousands and thousands of deaths". The NCSC's head, Ciaran Martin, had earlier claimed that an attack on the UK's energy infrastructure or election process "is a matter of when, not if".

Shh - what's that? If you listen very, very carefully, you'll hear it; it's the sound of countless security experts smashing their heads against their keyboards in frustration. The cause, as so often before, is the government's laughable attitude to data privacy and cyber security.

Where to begin with this latest shambles? You may recall that First Secretary of State Damian Green was allegedly found to have rude and naughty pictures of the pornographic variety on his government-issued computer, which Green denies.

Nadine Dorries, Conservative MP for Mid Beds, leapt to Green's defence over the weekend, pointing out that if porn was found on Green's computer, it may not have been him who was downloading and/or viewing it on taxpayer time. After all, she said, her staff use her login to access her official computer all the time. Even interns on exchange programmes!

Er, sorry... What?

Yes folks, you read that correctly - Dorries is so free and easy with her access credentials that she even hands them out to visiting exchange students. To make matters worse, several of her fellow MPs admitted they also share their login details with staff, including Nick Boles, Will Quince and Robert Syms.

Of course, Dorries was quick to downplay the seriousness of her actions, stating that all she has on her computer is a shared email account, with no access to government documents. Boles, similarly, said that only the four people he employs to deal with correspondence from constituents have access to the passwords, which are regularly changed.

For the avoidance of doubt, let's be crystal clear: this is a dangerous, insecure and irresponsible practice. Under no circumstances should anyone be sharing one login between multiple staff members. There are numerous ways to ensure staff members can access a shared computer, mailbox or file storage system without having one login that simply gets passed around, and the fact that government MPs are apparently not using any of them is extremely alarming.

Dorries and co claim that sharing their login with staff isn't an issue, but let's take the time to unpick some of the many, many problems with these arguments.

Firstly, there's the issue of lateral movement. Dorries says that the only thing on the computer is a shared email account. Even if that's true, the computer itself is 'Westminster-based', and is likely to be connected to some kind of internal network. This opens up the possibility for lateral movement, using Dorries' machine as a way to gain access to a more important target within the network.

Then there's the issue of data protection. The shared mailbox used by the staff of Dorries and Boles presumably contains at least a partial list of constituents' names and email addresses, along with who knows what additional information shared as part of their correspondence. Behaviour like this puts all of that information at risk.

Last but not least, accountability is the biggest problem with using a shared login - and one that is best illustrated, ironically, by the very issue that prompted Dorries' admission in the first place. She is quite right in stating that if Green's access credentials were shared by his staff, there's no way of proving that it was him that was allegedly looking at porn, but that's a huge problem.

Let's imagine that, instead of perusing some nudes, the First Secretary of State was instead accused of using his computer to leak classified intelligence data to Russian agents. With a single shared login, it's virtually impossible to trace the source of the leak back to the mole. If everyone has their own credentials, it's instantly obvious.

The concept of not sharing your username and password with anyone is a basic, fundamental tenet of cyber security best practice, and the tools to ensure that you shouldn't need to share your credentials have existed for years. Considering that the Tories are supposed to be the party of business, its own staff seem to be trailing laughably far behind the curve when it comes to keeping up with industry security standards - which would be funny if it wasn't so alarming.