Popular Post
PRESS
JOIN NOW! The BugHunting Campaign is BACK!
Campaign Enrollment is NOW OPEN! Following the overwhelming success of our 2023 campaign, Cyberbay is thrilled to announce the launch of our highly anticipated second BugHunting Campaign 2024 co-organised with the HK Police Force Cyber Security and Technology Crime Bureau (CSTCB) Hong Kong Police Force and supported by the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD). Register now to receive a FREE CyberScan AI report and gain access to Cyberbay's crowdsourced pool of ethical hackers to find bugs on your site from June 24 to August 30, 2024. To complete your registration, please follow these steps: Registration: Sign up on our event page, and you'll find the exclusive promo code "protectHK2024" already filled in the form. Set up your mission: Provide crucial information about the in-scope websites/apps that are essential to your operations. This will help us define the scope for testing and ensure comprehensive protection. Verify ownership: Confirm your ownership of the in-scope digital assets by setting up the security.txt file or through DNS verification. This step is vital to ensure the security and integrity of the assets involved. Upon successfully fixing any bugs, you'll have the chance to earn an exclusive digital badge issued by the Hong Kong Police Force's CyberDefender website! And that's not all - the first 100 organizations to complete registration will enjoy additional benefits worth up to $10,000 HKD credit!
PRESS
JOIN NOW! The BugHunting Campaign is BACK!
Cyberbay • Jun 24, 2024
Campaign Enrollment is NOW OPEN! Following the overwhelming success of our 2023 campaign, Cyberbay is thrilled to announce the launch of our highly anticipated second BugHunting Campaign 2024 co-organised with the HK Police Force Cyber Security and Technology Crime Bureau (CSTCB) Hong Kong Police Force and supported by the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD). Register now to receive a FREE CyberScan AI report and gain access to Cyberbay's crowdsourced pool of ethical hackers to find bugs on your site from June 24 to August 30, 2024. To complete your registration, please follow these steps: Registration: Sign up on our event page, and you'll find the exclusive promo code "protectHK2024" already filled in the form. Set up your mission: Provide crucial information about the in-scope websites/apps that are essential to your operations. This will help us define the scope for testing and ensure comprehensive protection. Verify ownership: Confirm your ownership of the in-scope digital assets by setting up the security.txt file or through DNS verification. This step is vital to ensure the security and integrity of the assets involved. Upon successfully fixing any bugs, you'll have the chance to earn an exclusive digital badge issued by the Hong Kong Police Force's CyberDefender website! And that's not all - the first 100 organizations to complete registration will enjoy additional benefits worth up to $10,000 HKD credit!
INTERVIEW
CyberBay 簡培欽談道德黑客功效
RTHK • Dec 18, 2023
CEO Felix Kan participated in a enlightening interview with 勞家樂 (LoKa Lok) on RTHK's 一桶金之財經新思維 program. Covering topics from bug bounties to crowdsourcing security, he simplified complex concepts, discussed industry trends, and emphasized the vital role of fostering cybersecurity specialists for digital transformation.
PRESS
OGCIO x HKIRC Cybersecurity Symposium
Cyberbay • Dec 14, 2023
An exceptional day unfolded at the Cybersecurity Symposium 2023! Gratitude extends to OGCIO and Hong Kong Internet Registration Corporation Limited (HKIRC) for their crucial collaboration, instrumental in bringing this event to fruition. Acknowledging everyone who explored our booth, demonstrating keen interest in our cybersecurity solutions. The keynote speech by our CEO, Felix Kan, marked a significant milestone as the first speaker, emblematic of our local company's growth in Hong Kong. Sharing and connecting at the event provided a delightful platform to exchange insights on new technologies with existing clients and new acquaintances from the cybersecurity community in Hong Kong and mainland China. The engagement and enthusiasm witnessed inspire us to persist in innovating within our dynamic field. We take immense pride in being a Hong Kong-based cybersecurity company, and your support strengthens our resolve to contribute to a more secure digital future. Looking forward to welcoming more corporates onboard!
PRESS
Game-changing partnership: Cyberbay X OneInfinity by OneDegree
Cyberbay • Oct 6, 2023
Our partnership with OneDegree, Asia's digital asset insurance leader, offers robust protection for your digital assets. What's in it for you? We're bundling a cyber incident warranty powered by OneInfinity by OneDegree, ensuring your peace of mind. Combining crowdsourcing, continuous assessment, and warranty, we've got your back against cybersecurity threats. Experience peace of mind with our up to 200% protection guarantee. Our founder, Felix Kan, emphasized that CyberBay proactively assesses digital asset vulnerabilities for businesses. Our partnership with OneInfinity by OneDegree provides clients with enhanced cybersecurity protection, aligning with our ambition to create a bug-free cyber world.
PRESS
Cyberbay與香港警務處「狩網運動 2023」圓滿結束 60家參與企業及機構 約八成存網絡漏洞
Cyberbay • Sep 5, 2023
數碼港網絡漏洞檢測初創Cyberbay與香港警務處攜手合作的首屆「狩網運動」已圓滿結束。為期兩個月的活動成功推動本地企業、數碼初創公司、非牟利團體及公營機構建立網絡安全保護和提升對網絡威脅的意識。參與企業及機構成功透過免費網絡漏洞測試 (Bug Bounty)，了解其業務網絡安全狀況，並獲得相關的網絡安全報告及一對一專業網絡安全諮詢，以加強其網絡安全狀態的掌握。 今年的「狩網運動」吸引了60家企業及機構積極參與，超過一半是初創公司或中小企業，三成為非牟利團體及公營機構。參與的行業包括金融、科技、旅遊、醫療、教育、製造業等，反映各行業對網絡安全的關注程度日益上升。 在為期兩個月的活動期間，網絡安全專才共發現了197個網絡安全漏洞，其中有一成屬於嚴重漏洞，四成屬於高風險漏洞。參與的企業和機構中，有八成存在網絡漏洞，其餘在活動結束前尚未發現有網絡安全漏洞。大部分參與的企業和機構已經具備了固定的網絡安全措施。本次「狩網運動」的舉辦成功展示了該計劃能為企業的網絡安全增加額外的防護層。 網絡安全建議方面，每個企業或機構平均得到4個整改方案，當中一半方案屬於高風險的優先改善項目，需要盡快處理並修正，包括協助企業及機構保護客戶資料、保障業務帳戶及防範電子郵箱被用作釣魚詐騙工具。這些數字除突顯是次運動能成功揭示各行業在網絡安全方面的潛在威脅外，同時亦反映部分企業在保護其數碼業務方面表現出色。 運動進行期間，超過 60 位本地網絡安全專才亦在協助企業及機構找出漏洞及發佈漏洞報告上作出重大貢獻，前3名本地網絡安全專才在兩個月內共獲得了超過170,000港元的獎勵。由此可見，賞金獵人在檢測參與上的卓越表現，同時亦有助鼓勵更多數碼專才，加入網絡安全行業，透過參與新興的網絡安全漏洞檢測服務，為企業找出潛在漏洞，賺取賞金收入同時，為香港建立更安全的數碼業務環境。 參與運動的企業及機構收到漏洞報告後，仍需要修復漏洞及透過Cyberbay專屬平台進行重新檢測。重新檢測數據顯示，相比傳統網絡安全測試方法，Bug Bounty網絡安全漏洞檢測服務成本更低，速度更快。目前透過傳統網絡安全測試方法，平均需要60-150天修復漏洞，而參與運動的企業平均只需要兩星期來完成漏洞修復，最快修復時間為9天。 這次活動讓企業機構成功了解其業務網絡安全狀況，網絡安全專才亦能在當中體驗實用檢測技巧，展現實力。今後Cyberbay將繼續與香港警務處攜手合作，透過未來「狩網運動」，更精準、更針對性地提升個別行業網絡安全表現，同時亦繼續培育本地網絡安全專才，吸引更多數碼專才加入Bug Bounty網絡安全漏洞檢測服務，擴大人才庫，全面提高香港在網絡安全和整體創科環境中的競爭力。 <hr/> 根據香港警務處公佈的數據，2023年上半年本港科技罪案共有15,637宗，比去年同期10,613宗飇升近一半（47.3% 或 +5,024宗），損失共$20.3億港元，上升28%（+$4億5千萬港元）。科技罪案佔整體42,923 宗罪案的比例超過36%（36.4%）。
BLOG
Microsoft Patch Tuesday
Dark Lab • Feb 24, 2023
Microsoft has released patches for 77 vulnerabilities on 14 February 2023. A CVA will be drafted. The Patch Tuesday includes: 12 Elevation of Privilege Vulnerabilities 2 Security Feature Bypass Vulnerabilities 38 Remote Code Execution Vulnerabilities 8 Information Disclosure Vulnerabilities 10 Denial of Service Vulnerabilities 8 Spoofing Vulnerabilities The CVA will include the most critical vulnerabilities, as well as the 3 actively exploited vulnerabilities. Deploy latest patches <a href="https://msrc.microsoft.com/update-guide/vulnerability" style="text-decoration: underline;">https://msrc.microsoft.com/update-guide/vulnerability</a>
BLOG
Fortinet Critical Remote Code Execution (RCE) Vulnerabilities (CVE-2022-39952 and CVE-2021-42756)
Dark Lab • Feb 24, 2023
CVE Number: CVE-2022-39952 CVE Score: 9.8 Affected Products: FortiNAC : 9.4.0, 9.2.5, 9.2.4, 9.2.3, 9.2.2, 9.2.1, 9.2.0, 9.1.7, 9.1.6, 9.1.5, 9.1.4, 9.1.3, 9.1.2, 9.1.1, 9.1.0, 8.8.9, 8.8.8, 8.8.7, 8.8.6, 8.8.5, 8.8.4, 8.8.3, 8.8.2, 8.8.11, 8.8.10, 8.8.1, 8.8.0, 8.7.6, 8.7.5, 8.7.4, 8.7.3, 8.7.2, 8.7.1, 8.7.0, 8.6.5, 8.6.4, 8.6.3, 8.6.2, 8.6.1, 8.6.0, 8.5.4, 8.5.3, 8.5.2, 8.5.1, 8.5.0, 8.3.7 Impact: RCE PoC: To be released by security researchers Exploit in the wild: No Discussion in SOCINT/DARKINT: Yes Known TA exploiting this CVE: NA IoC: NA CVE Number: CVE-2022-39952 CVE Score: 9.3 Affecting Products: FortiWeb : 6.4.1, 6.4.0, 6.3.9, 6.3.8, 6.3.7, 6.3.6, 6.3.5, 6.3.4, 6.3.3, 6.3.2, 6.3.16, 6.3.15, 6.3.14, 6.3.13, 6.3.12, 6.3.11, 6.3.10, 6.3.1, 6.3.0, 6.2.6, 6.2.5, 6.2.4, 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.1.2, 6.1.1, 6.1.0, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.9.1, 5.9.0, 5.8.7, 5.8.6, 5.8.5, 5.8.3, 5.8.2, 5.8.1, 5.8.0, 5.7.3, 5.7.2, 5.7.1, 5.7.0, 5.6.2, 5.6.1, 5.6.0 Impact: RCE PoC: No Exploit in the wild: No Discussion in SOCINT/DARKINT: Yes Known TA exploiting this CVE: NA IoC: NA The vendor advises end users leveraging vulnerable versions of FortiNAC and FortiWeb to apply the latest patches as soon as possible to remediate the vulnerabilities. No further workarounds or mitigations have been disclosed. <a href="https://www.fortiguard.com/psirt/FG-IR-22-300" style="text-decoration: underline;">https://www.fortiguard.com/psirt/FG-IR-22-300</a> <a href="https://www.fortiguard.com/psirt/FG-IR-21-186" style="text-decoration: underline;">https://www.fortiguard.com/psirt/FG-IR-21-186</a>
BLOG
Adobe Acrobat Reader DC RCE Vulnerability (CVE-2023-21608)
Dark Lab • Feb 24, 2023
Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file by persuading a victim to open a specially-crafted document, an attacker could exploit this vulnerability to execute arbitrary code on the system with the privileges of the victim or cause the application to crash. Adobe recommends users update their software installations to the latest versions <a href="https://hacksys.io/blogs/adobe-reader-resetform-cagg-rce-cve-2023-21608" style="text-decoration: underline;">https://hacksys.io/blogs/adobe-reader-resetform-cagg-rce-cve-2023-21608</a> <a href="https://securityonline.info/poc-exploit-for-adobe-acrobat-reader-dc-rce-vulnerability-cve-2023-21608-released/" style="text-decoration: underline;">https://securityonline.info/poc-exploit-for-adobe-acrobat-reader-dc-rce-vulnerability-cve-2023-21608-released/</a> <a href="https://nvd.nist.gov/vuln/detail/CVE-2023-21608" style="text-decoration: underline;">https://nvd.nist.gov/vuln/detail/CVE-2023-21608</a> <a href="https://helpx.adobe.com/security/products/acrobat/apsb23-01.html" style="text-decoration: underline;">https://helpx.adobe.com/security/products/acrobat/apsb23-01.html</a>
BLOG
CISA adds Fortra GoAnyWhere MFT RCE Vulnerability (CVE-2023-0669) to their Known Exploited Vulnerabilities Catalog
Dark Lab • Feb 24, 2023
Affected Products: GoAnywhere MFT Impact: RCE PoC: Yes - https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html Exploit in the wild: Yes Discussion in SOCINT/DARKINT: Known TA exploiting this CVE: TA505, Cl0p Ransomware IoC: As soon as possible, please follow the steps below to determine whether the GoAnywhere MFT instance(s) you have running have been targeted for this exploit. Search for the following: Errors containing the text “/goanywhere/lic/accept” NOTE: By default there are 10 logs that are archived when a log size reaches 5 MB. [system_name] represents each system or node in your cluster. You should search all of these 10 archive logs for all systems/nodes search the userdata/logs/[system_name]-goanywhere.log* files on your system in your cluster. Standalone (non-HA) logs will be goanywhere.log, goanywhere.log1, goanywhere.log2, etc.) Errors containing the text “Error parsing license response” The following additional error has been observed and may further confirm unauthorized access has taken place: java.lang.RuntimeException: InvocationTargetException: java.lang.reflect.InvocationTargetException at org.apache.commons.beanutils.BeanComparator.compare(BeanComparator.java:171) at java.util.PriorityQueue.siftDownUsingComparator(PriorityQueue.java:721) at java.util.PriorityQueue.siftDown(PriorityQueue.java:687) at java.util.PriorityQueue.heapify(PriorityQueue.java:736) at java.util.PriorityQueue.readObject(PriorityQueue.java:796 Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2. Successful exploitation requires access to the admin console of the application, which in most cases is accessible via a private company network, via VPN, or by allow-listed IP addresses. If the admin console is publicly-exposed, access controls are required to limit trusted sources and minimize the risk of infiltration by malicious actors. Only the administrative interface is susceptible to exploitation, public-facing Web Client interfaces are not susceptible to this exploit, though according to best practices should also not be exposed to the internet. The vulnerability has been observed to be leveraged by threat actors leveraging the Cl0p ransomware. Fortra released a patch for the vulnerability (GoAnyWhere MFT 7.1.2) on 8 February 2023 and subsequently provided an updated security advisory on 13 February 2023 with further mitigation and remediation advice. <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" style="text-decoration: underline;">https://www.cisa.gov/known-exploited-vulnerabilities-catalog</a> <a href="https://nvd.nist.gov/vuln/detail/CVE-2023-0669" style="text-decoration: underline;">https://nvd.nist.gov/vuln/detail/CVE-2023-0669</a> <a href="https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis" style="text-decoration: underline;">https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis</a> <a href="https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft" style="text-decoration: underline;">https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft</a> <a href="https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html" style="text-decoration: underline;">https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html</a> <a href="https://github.com/rapid7/metasploit-framework/pull/17607" style="text-decoration: underline;">https://github.com/rapid7/metasploit-framework/pull/17607</a> <a href="https://infosec.exchange/@briankrebs/109795710941843934" style="text-decoration: underline;">https://infosec.exchange/@briankrebs/109795710941843934</a> <a href="https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1" style="text-decoration: underline;">https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1</a> <a href="https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/" style="text-decoration: underline;">https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/</a>
BLOG
Oracle E-Business Suite Unauthenticated RCE Vulnerability (CVE-2022-21587)
Dark Lab • Feb 20, 2023
A security researcher announced on 25 January 2023 that they have observed numerous CVE-2022-21587 exploitation attempts since 21 January 2023, shortly after the release of the PoC by Vietnamese security researchers. Given the vulnerability is low in complexity, and impacts a widely deployed business solution, we posit that malicious actors will continue to attempt to exploit the vulnerability to achieve initial access and execute RCE. It is advised that organisations running a vulnerable version of the Oracle E-Business Suite apply the latest patch released by the vendor as soon as possible. A temporary workaround is to update your firewall to block connections from the following URLs: • /OA_HTML/BneUploaderService • /OA_HTML/BneViewerXMLService • /OA_HTML/BneDownloadService • /OA_HTML/BneOfflineLOVService <a href="https://twitter.com/Shadowserver/status/1618258799575597064" style="text-decoration: underline;">https://twitter.com/Shadowserver/status/1618258799575597064</a> <a href="https://blog.viettelcybersecurity.com/cve-2022-21587-oracle-e-business-suite-unauth-rce/amp/" style="text-decoration: underline;">https://blog.viettelcybersecurity.com/cve-2022-21587-oracle-e-business-suite-unauth-rce/amp/</a> <a href="https://t.co/SGyT3abwB1" style="text-decoration: underline;">https://t.co/SGyT3abwB1</a> <a href="https://t.co/dlQekxZ4fD" style="text-decoration: underline;">https://t.co/dlQekxZ4fD</a>