Skip to main content

Ever got hacked by your Anti Virus?

I just got the funniest call from a client, back story; we're doing a compliance audit for a customer. In doing so, we reviewed some security control integration, including integrating Slack notifications for failed attempts on network-attached devices. (This small detail is amusing in a second)

Our client's Slack kept reporting a Windows machine brute forcing failed login attempts on different network devices. Well, in this land of Mac computers, just like with many Mac-only organizations, there's always the one accounting PC that runs the Windows-only accounting software. 

However, in this case, the one PC's AVG install was the culprit for all of the Slack alerts for failed login attempts from different devices on their network. 

Our client's head of IT needed clarification about why AVG was port scanning and brute-forcing his internal network and did some research to learn about AVG's Traffic Inspector Tool, only to find out that it is indeed its intended function. 

I feel bad because it was a false positive, but it's nice to know all the new alerting was making management more painless for our client, so at least we did our job, right?

Comments

Popular posts from this blog

Why traditional Pen Testing is dead.

Annual, bi-annual, and quarterly penetration testing schedules will be a thing of the past.  The advent of sophisticated cyber threats has necessitated a paradigm shift in vulnerability management. In this transformative digital era, the static, once-a-year model of traditional penetration testing is becoming increasingly obsolete. Instead, it's time for businesses to embrace a dynamic model of continual vulnerability detection and mitigation - Penetration Testing as a Service (PTaaS) by Xcape, Inc. This innovative service combines the precision of automated remote pen testing with the strategic oversight of seasoned penetration testers, creating a comprehensive solution for the latest cybersecurity concerns. The Case for Internal and External Network Testing In a conventional cybersecurity setup, the focus is often on safeguarding the external network, the so-called perimeter. However, this perimeter-centric approach, while essential, is not sufficient in today's threat land

Have you tested your backup recently?

We're in the business of helping people, so when a business owner reached out for assistance during a ransomware attack they had experienced, our first question was, "When was your most recent backup?" The owner said his CTO assured him they backed up their Amazon Web Services infrastructure.  Well, they had one snapshot from several years ago, which wouldn't do anything for them. Of course, we always feel bad for giving business owners awful news. But, sometimes, even as experts without the absolute minimum being done technically, we're only left with a few options in ways we can help. So we reversed-engineered and created a decryption application based on the ransomware sample we recovered during our investigation. Recovering over 3 TB of data in the process. While that's not always a possibility, in this case, many things went right for us during the investigation.  Is there a better way to handle ransomware attack recovery ? YES! But the issue wasn't t

How secure is your SMB's domain name?

Studies show that small businesses are being targeted now more than ever in cyber attacks. ( Forbes: Small Businesses Are More Frequent Targets Of Cyberattacks Than Larger Companies ) When cybersecurity professionals discuss two-factor authentication, domain registrars or DNS hijacking is often not the topic. (Think 2FA for GoDaddy , NameCheap , and SquareSpace , to name a few. Take a moment and use these links to setup 2fa for your domain, or google "How to turn on 2fa for name of provider .") Surprisingly, even in 2023, some providers still don't support this essential security control.  However, your domain name controls an organization's corporate website and email exchange records. And suppose an attacker were to get control of it. In that case, they could recreate your email addresses, and password reset their way to control all the accounts owned by an organization.  A few of the recent incidents we've responded to involve attacks where the attacker obtains