Short Takes – 12-10-24 – Cyber Geek Edition

Pro-Russian and Pro-Palestinian Hacktivists Targeting Australian Organizations. Radware.com threat advisory. Pull quote: “The campaign was not limited to digital disruption. Z-Pentest, another group aligned with the pro-Russian effort, claimed responsibility for breaches of operational technology systems within Australia. They alleged access to a sewage pumping station in Melbourne, potentially endangering public health, and interference with cooling systems at a fruit and vegetable warehouse in Sydney, threatening food supply chains.” Not much information beyond showing Telegram claims….

Exploring the Use of Multi-Vendor Firewalls in OT Network Security.  Pull quote: “The exploitation of perimeter devices remains a significant threat to OT networks. While adopting multi-vendor firewall solutions at key ingress points can enhance security, this approach requires careful planning and resource allocation. For organizations with the maturity and capacity to manage such complexity, this strategy can be a valuable component of a broader defense-in-depth framework. However, for less resourced entities, prioritizing the effective use of a single firewall vendor and addressing systemic issues like patching delays may provide a more practical path to resilience.” I love the phrase ‘less resourced entities’….

Why SCADA and DCS Face Different Cyber Threats. IndustrialCyber.co article. Pull quote: “Even so, both systems have significant weaknesses. Outdated protocols and legacy equipment, which often lack modern security features, remain a persistent vulnerability. Additionally, the supply chain introduces another layer of risk, as attackers can exploit third-party components or software used in these systems. Insider threats, often linked to nation-state actors targeting critical infrastructure, present a particularly serious challenge. By examining their architecture and the unique risks they face, it becomes evident why SCADA systems are generally harder to defend and why a tailored approach is necessary to secure both SCADA and DCS against evolving threats.” Nice discussion about differences between to systems….

Mandiant devised a technique to bypass browser isolation using QR codes. SecurityAffairs.com article.  Pull quote: ““While this technique proves that browser isolation technologies have weaknesses, Mandiant still recommends browser isolation as a strong protection measure against other types of attacks (e.g., client-side browser exploitation, phishing, etc).” concludes the report. “Organizations should not solely rely on browser isolation to protect themselves from web-based threats, but rather embrace the “defense in depth” strategy and establish a well-rounded cyber defense posture.”” Cyber version of gain-of-function research….