Request Demo

Connective Platform™

Connective Shield

Connective Identity

Connective Vigilance

Solutions

Partners

Support

Company

Blog

Career

About Us

+1-303-423-4500

Contact Us

Analytics

Big Data

Billing

Business

Business Intelligence

Cloud Computing

Consulting

Cybersecurity

Data Warehouse

News

Services

Technology

Testing as a Service

We focus on reliability, quality, and value.

As a follow up to the DB2 Discovery Kit post, here is a link the the Updated IBM DB2 e-kit for Database Professionals

This new kit has a number of resources for migrating to DB2 from other databases, such as Oracle.

Refresh of the DB2 e-kit As a follow up to the DB2 Discovery Kit post, here is a link the the Updated IBM DB2 e-kit for Database Professionals This new kit has a number of resources for migrating to DB2 from other databases, such as Oracle.

Updated IBM DB2 e-kit for Database Professionals

Exporting from an RDBMS always depends on the syntax of the specific RDBMS in question.  For MySQL, here is how to transform a SELECT statement into a CSV export:

SELECT a,b INTO OUTFILE '/tmp/result.csv'  FIELDS TERMINATED BY ',' OPTIONALLY ENCLOSED BY '"'  LINES TERMINATED BY 'n'  FROM test_table;

Exporting from an RDBMS always depends on the syntax of the specific RDBMS in question.  For MySQL, here is how to transform a SELECT statement into a CSV export: SELECT a,b INTO OUTFILE ‘/tmp/result.csv’ FIELDS TERMINATED BY ‘,’ OPTIONALLY ENCLOSED BY ‘”‘ LINES TERMINATED BY ‘n’ FROM test_table; Reference: MySQL 5.0 Reference Manual

Export MySQL table as csv file

Even though for our core systems we have migrated most databases to DB2, we still have to deal with MySQL for some side systems, such as CRM, Blog, etc.   One of the MySQL features that I recently noticed is that dropping indexes on sizable tables takes forever.  That is apparently due to a convoluted indexing process in MySQL.  The workaround was found here: MySQL General Discussion List

1) create table T1 like T;This creates an empty table T1 with indexes ndx1,ndx2,ndx3 and ndx4.2) alter table T1 drop index ndx3;This drops index ndx3 on the empty T1, which should be instantaneous.3) insert into T1 select * from T;This will populate table T and load all three(3) indexes for T1 in one pass.4) drop table table T;5) alter table T1 rename to T;

An alternative ugly hack is to start the drop index, kill the database server.  That will crash the table on which the drop index was.  The crashed table can be recovered by running mysiamchk.

Even though for our core systems we have migrated most databases to DB2, we still have to deal with MySQL for some side systems, such as CRM, Blog, etc.   One of the MySQL features that I recently noticed is that dropping indexes on sizable tables takes forever.  That is apparently due to a convoluted […]

Drop Index in MySQL takes forever

Even though the cybersecurity pros I work with haven't fallen for the latest LinkedIn scam, seeing it hit my inbox made me realize just how dangerous and believable these attacks are. The sophistication of this one surprised even me, and that's concerning. Luckily, no damage was done this time, but as LinkedIn usage grows, we need to be prepared. Here's how to protect yourself before these scams evolve even further...

These attacks start with a super convincing fake email that looks like it's from Microsoft. It might warn you about suspicious activity and make you panic. You click, get taken to a website that looks exactly like the Microsoft login page, and enter your credentials. But here's the trick – even with your password, they need that one-time security code sent to your phone or email. The fake email pressures you to hand over that code, and once you do, the attackers are in control of your entire account.

These scams aren't going away, they'll only get trickier. Taking a few precautions now is much better than dealing with a hacked account later.

Scrutinize the Sender: I never trust an email address at first glance. One wrong letter, an extra domain (.co instead of .com), is a red flag, no matter how official it looks.

Resist Clicking: If an email makes me nervous or claims there's an urgent problem, I never click links. I go to the company website directly and log in that way.

Codes are Sacred: Codes sent to my phone or email are my last line of defense. At work, we're told to never share these with anyone, and that's my rule for everything now.

If you're unsure about phishing in general, there are great resources online Security Awareness Training | KnowBe4 And if your company offers any security training, take advantage! Before you open an unknown email – Stop, think, and don't be uninformed.

Even though the cybersecurity pros I work with haven't fallen for the latest LinkedIn scam, seeing it hit my inbox made me realize just how dangerous and believable these attacks are. The sophistication of this one surprised even me, and that's concerning.

This LinkedIn Scam Got Me (Almost)...and It Should Scare You Too

A hacking competition called Pwn2Own 2024 in Vancouver awarded over $1.1 million to participants who discovered vulnerabilities in various software and devices. This security competition incentivizes hackers to discover and report vulnerabilities in widely used software and devices. By finding these vulnerabilities, companies can patch them before malicious actors exploit them for criminal purposes.

The biggest winners were those who found exploits compromising Tesla cars. On the first day, hackers earned a combined $732,500 for finding 19 zero-day vulnerabilities. These vulnerabilities affected Tesla cars, along with popular operating systems and programs like Windows, Ubuntu, and Adobe Reader.

The top prize of $200,000 went to a team from Synacktiv for hacking a Tesla's electronic control unit (ECU), which could potentially allow them to manipulate the car. The second day's top earner was Manfred Paul, who won $100,000 for a critical Firefox exploit. Paul's exploit allowed for remote code execution and escaping the program's sandbox protections. Overall, Paul won more than $200,000 during the competition by also hacking other browsers as well.

A hacking competition called Pwn2Own 2024 in Vancouver awarded over $1.1 million to participants who discovered vulnerabilities in various software and devices. This security competition incentivizes hackers to discover and report vulnerabilities in widely used software and devices. 

Tesla, OS, Software Exploits Earn Hackers $1.1 Million at Pwn2Own 2024

Cybercriminals are looking for ways to integrate large language models (LLMs) into their attacks, and they have three main options: trying to bypass the safeguards on existing LLMs, building their own LLMs, or using uncensored open-source models.

One recent example is Dark Gemini, an underground service that appears to modify prompts sent to a legitimate LLM in order to bypass restrictions. While Dark Gemini's abilities weren't very impressive, it demonstrates how cybercriminals can leverage existing LLMs to enhance phishing attacks, for instance, by generating more convincing text.

Security researchers are concerned that nation-state actors are already using LLMs to improve their operations. Additionally, some researchers believe the safeguards on LLMs can be easily bypassed. However, it seems that using LLMs for more complex tasks, like creating malware, will still be difficult due to the current limitations.

In conclusion, cybercriminals are actively looking for ways to exploit LLMs, and while there are challenges, even basic use of LLMs can improve the effectiveness of existing attacks.

Cybercriminals Weigh Options for Using LLMs: Buy, Build, or Break?

In a proactive measure to enhance user security, Google has announced an update to its Chrome browser, effectively patching a series of vulnerabilities, including the zero-day flaw CVE-2024-3159, unveiled at the Pwn2Own hacking contest in March 2024. This critical issue, an out-of-bounds memory access in the V8 JavaScript engine, was exploited by Edouard Bochin and Tao Yan from Palo Alto Networks, earning them a $42,500 reward.

CVE-2024-3159 is the third zero-day discovered at Pwn2Own 2024 to be addressed by Google, following earlier fixes for vulnerabilities in WebCodecs and WebAssembly. In addition to CVE-2024-3159, the latest update also corrects two other vulnerabilities reported by external researchers, with Google disbursing $10,000 in total bounties.

The updated Chrome versions—123.0.6312.105/.106/.107 for Windows and macOS, and version 123.0.6312.105 for Linux—are currently being deployed. 

The diligent response from Google emphasizes the tech giant's commitment to user security and the pivotal role of ethical hacking competitions like Pwn2Own in identifying and mitigating potential threats. These contests not only help in uncovering hidden vulnerabilities but also foster a culture of proactive security measures among tech companies. Users are strongly advised to update their browsers to the latest version to ensure they have the most up-to-date defenses against this specific vulnerability and others that may pose a risk. Google's commitment to security, combined with the collaborative efforts of the cybersecurity community, continues to play a vital role in maintaining the integrity and safety of the digital landscape.

Source: SecurityWeek 04/03/2024

In a proactive measure to enhance user security, Google has announced an update to its Chrome browser, effectively patching a series of vulnerabilities, including the zero-day flaw CVE-2024-3159, unveiled at the Pwn2Own hacking contest in March 2024. 

Google Updates Chrome to Patch Zero-Day Flaw Exposed at Pwn2Own

It’s been three months since the Securities and Exchange Commission’s cyber disclosure rules took effect and rather than creating a deluge of incident revelations, only a trickle has emerged. Companies have submitted 12 initial Form 8-K, Item 1.05 filings, the form the SEC began requiring businesses to file for material cybersecurity incidents on Dec. 18. Each of these filings mention an “incident,” and all but two said the activity or access was “unauthorized.” While the language businesses use in Item 1.05 filings are ultimately crafted to notify regulators and investors of potential risks, these words also signal how a company detects, mitigates, contains and recovers from cyberattacks. Across the filings Cybersecurity Dive analyzed, none of the businesses described the incident as a breach or data breach in the filing with the SEC — and that was likely by design.

“Words like ‘breach’ and ‘data breach’ have very specific legal meanings and consequences, and they also have a particular meaning within what I’ll call the public consciousness,” said Travis Brennan, partner and chair of the privacy and data security practice at Stradling. “It’s just become a very loaded term, generally, and I think it’s one that companies in these disclosures will studiously avoid using in most cases,” Brennan said. “Once there has been a breach, as opposed to merely an incident, that suggests that the risk of harm has just gone up a few notches.” 

It’s been three months since the Securities and Exchange Commission’s cyber disclosure rules took effect and rather than creating a deluge of incident revelations, only a trickle has emerged. 

How companies describe cyber incidents in SEC filings

APIs were the target of 29% of web attacks in 2023, with cybercriminals exploiting the swiftly growing API economy for new avenues of attack, according to a report from Akamai. The commerce sector experienced the highest number of attacks, accounting for about 44%. Business services followed at nearly 32%. Attacks ranged from Local File Inclusion (LFI) and SQL Injection (SQLi) to Cross-Site Scripting (XSS).

Akamai’s findings underscore the escalating concerns in the industry surrounding API security threats. In 2021, Gartner predicted API abuse and data breaches would double by 2024. In 2023, the Open Web Application Security Project (OWASP) released a dedicated list of API-specific risks, highlighting the growing concern. “APIs are increasingly critical to organizations, but their security is often not designed into the capability, or the security team is not able to keep up with the rapid deployment of new technology,” Steve Winterfeld, advisory CISO of Akamai, said in the State of the Internet (SOTI) report.

APIs are pivotal in developing new capabilities within companies. However, their security often receives inadequate attention, either overlooked in early planning stages or failing to match the pace of rapid technological deployment. Akamai pointed out two distinct issues in this regard — posture and runtime problems.

API implementation flaws in an enterprise can lead to posture problems. Most common among them include shadow endpoints, unauthenticated resource access, sensitive data in a URL, a permissive cross-origin resource sharing (CORS) policy, and excessive client errors.

Runtime problems, on the other hand, are active threats demanding immediate action. These include unauthenticated resource access attempts, API activity with unusual JSON payloads, path parameter fuzzing attempts, illogical API timestamps, geolocation, or sequence, and data scraping. 

Adopting a comprehensive API security program provides organizations with unparalleled visibility across their digital ecosystem. This includes discovering all APIs within the organization, auditing their risk levels, detecting abnormal behaviors indicative of abuse, and enabling expert-led investigations to hunt for hidden threats.

APIs were the target of 29% of web attacks in 2023, with cybercriminals exploiting the swiftly growing API economy for new avenues of attack, according to a report from Akamai. 

A third of web attacks targeted APIs in 2023, threatening the expanding API economy

DDoS attacks against the financial services sector historically accounted for about 10-15% of all attacks, however that trend began to rise in 2021, the FS-ISAC and Akamai found. “Financial services companies are prime targets because successfully disrupting operations, for even just a moment, can lead to severe reputational risks and distrust in the global financial system,” Teresa Walsh, chief intelligence officer and managing director, EMEA, at FS-ISAC, said via email.

Akamai in September said it prevented a DDoS attack on a major U.S. financial institution. The attack peaked at 633.7 gigabits per second and 55 million packets per second. The increased activity was driven in large part by hacktivist groups using DDoS as a tool to disrupt institutions at a time of rising geopolitical tensions.

U.S. authorities in July warned that threat groups were potentially targeting multiple sectors using DDoS capabilities, including one group which claimed to have targeted the Treasury Department’s Electronic Federal Tax Payment System. By October, security researchers warned a novel zero day vulnerability, known as HTTP/2 Rapid Reset, was being used to launch some of the most powerful DDoS attacks ever recorded.  

DDoS attacks against the financial services sector historically accounted for about 10-15% of all attacks, however that trend began to rise in 2021, the FS-ISAC and Akamai found. 

Financial services sees sharp increase in DDoS attacks as geopolitical tensions rise

The NIST Cybersecurity Framework (CSF) 2.0, an evolution of its predecessor, is a comprehensive guide designed to assist organizations across various sectors in managing and mitigating cybersecurity risks effectively. This framework, while not prescribing specific actions, offers a taxonomy of high-level cybersecurity outcomes, enabling organizations, regardless of their size, sector, or maturity, to better understand, assess, prioritize, and communicate their cybersecurity efforts.

The CSF 2.0 emphasizes the importance of communication and integration in cybersecurity risk management. It advocates for a shared understanding and approach to managing cybersecurity risk, not just within an organization but also in its interactions with third parties. This shared understanding is crucial for making informed decisions about cybersecurity expenditures and actions, ultimately enhancing an organization’s cybersecurity posture.  The NIST Cybersecurity Framework 2.0 serves as a foundational resource for organizations seeking to navigate the complex landscape of cybersecurity risks. It encourages a proactive, nuanced approach to cybersecurity, emphasizing flexibility, adaptability, and continuous improvement. 

The NIST Cybersecurity Framework (CSF) 2.0, an evolution of its predecessor, is a comprehensive guide designed to assist organizations across various sectors in managing and mitigating cybersecurity risks effectively.

An Overview of the NIST Cybersecurity Framework 2.0

Google’s new Security Command Center Enterprise (SCC Enterprise) could streamline cloud risk management through AI automation, saving security teams time, experts say. Enhanced with Mandiant threat intelligence and generative AI, SCC Enterprise aims to offer comprehensive insights across the cloud security lifecycle. Google Cloud has identified gaps in the protection provided by current cloud-native application protection platforms (CNAPPs) and introduced SCC Enterprise as a solution to better guard against emerging threats.

“There are two things that Security Command Center Enterprise addresses compared with previous solutions: tighter integration between cloud and enterprise security and coverage across multi-cloud rather than just operating in silos,” Narayana Pappu, CEO at Zendata, a San Francisco-based provider of data security and privacy compliance solutions said in an interview. “Automation and integration of Gen AI brings efficiencies that will save teams time as well.”

According to Suni Potti, VP/GM of Google Cloud Security, the new platform integrates Mandiant Threat Intelligence with modern SecOps capabilities, enabling swift responses to cloud security incidents through “SIEM-powered visibility and SOAR-driven accountability.”

“Security teams can get a single view of their posture controls, active threats, cloud identities, data, and more, while integrating remediation and issue accountability into the end-to-end workflows of a converged cloud risk management platform,” Potti wrote in a blog post.

Google’s new Security Command Center Enterprise (SCC Enterprise) could streamline cloud risk management through AI automation, saving security teams time, experts say. Enhanced with Mandiant threat intelligence and generative AI, SCC Enterprise aims to offer comprehensive insights across the cloud security lifecycle.

Google’s Security Command Center Enterprise fills gaps across cloud security lifecycle

Lookout recently discovered an advanced phishing kit exhibiting novel tactics to target cryptocurrency platforms as well as the Federal Communications Commission (FCC) via mobile devices. Following the tactics of groups like Scattered Spider, this kit enables attackers to build carbon copies of single sign-on (SSO) pages, then use a combination of email, SMS, and voice phishing to trick the target into sharing usernames, passwords, password reset URLs and even photo IDs from hundreds of victims, mostly in the United States.

Lookout first flagged this phishing kit when our automated analysis discovered a suspicious new domain registration that matched a common format used by Scattered Spider, as mentioned in a recent warning by CISA.  The domain in question was fcc-okta[.]com, which is only a single character different from the legitimate FCC Okta Single Sign On (SSO) page. This phishing kit first asks the victim to complete a captcha using hCaptcha. This is a novel tactic that prevents automated analysis tools from crawling and identifying the phishing site. It may also give the illusion of credibility to the victim, as typically only legitimate sites use captcha. Once the captcha is completed, the login page mimics the FCC’s legitimate Okta page. Upon providing their credentials, the victim can be sent to wait, sign in, or ask for the MFA token.

Unlike typical phishing kits, which attempt to harvest credentials as quickly as possible, this one seems to be aware of modern security controls organizations have put in place such as MFA. 

Lookout researchers saw that there is an administrative console that the operator uses to monitor the phishing page. While we were unable to directly access this console, we were able to access its javascript and css and piece together much of its functionality.  Each time a victim visited the page and entered information, we observed that a new row was populated on a table. Once the victim enters their username and password, the admin is able to select from a long list of options of where to send them next. The attacker likely attempts to log in using these credentials in real time, then redirects the victim to the appropriate page depending on what additional information is requested by the MFA service the attacker is trying to access, For example, they can be redirected to a page that asks for their MFA token from their authenticator app or a page requesting an SMS-based token.  

We were also able to investigate the phishing kit, which gave us additional insight into targets and tactics used. The kit contains numerous references to cryptocurrency platforms and SSO services. While the version of the kit targeted at the FCC impersonates the FCC’s specific Okta page by default, the kit is able to impersonate many different company’s brands. 

Lookout recently discovered an advanced phishing kit exhibiting novel tactics to target cryptocurrency platforms as well as the Federal Communications Commission (FCC) via mobile devices.

Blog Category: Data Warehouse

Categories