Story image

Inside NZ's 'ethical hacking' firm and its quest to make systems safer

26 Jun 2017

New Zealand's first ethical hacking company has issued a critical warning to those using Microsoft Edge and Internet Explorer after it discovered zero-day vulnerabilities back in May.

Attackers are able to exploit the vulnerabilities and gain access to sensitive information. They could also run malicious code on victims' machines, Security-Assessment reports.

The company's principal consultant Scott Bell discovered the vulnerabilities in May, and Microsoft patched them in the same month.

“Security-Assessment follows responsible disclosure guidelines. This means alerting the vendor to the vulnerabilities immediately and not releasing information about the vulnerabilities until they are fixed. This is to prevent malicious actors from actively exploiting the vulnerabilities," Bell explains.

Despite being patched by Microsoft, the company is urging users to apply the patches or face being attacked.

Practice lead Phil Doole says there could be worrying repercussions for those who do not apply the patches.

“The ability for an attacker to run malicious code on a victim’s machine could have dramatic and severely damaging impact for both organisations and individuals,” he says.

"These vulnerabilities are known as 'memory corruption'. The vulnerabilities allow a malicious user to craft a special web page which, when visited, can download a payload to allow access to the victim's machine. This is typically delivered via a technique called spear phishing. Such vulnerabilities are often used by state-sponsored actors (APT) to gain a foothold in the target network," the company adds.

This year the company has facilitated seven security advisories, the most of any New Zealand security firm, it claims.

In one case, the company helped to provide incident response and forensics after a state-sponsored APT group infiltrated a client's network.

The company says that with a 100% hit rate in penetration test this year alone, it means there hasn't been one engagement in which it hasn't identified vulnerabilities.

"User awareness is key. Educating users on the dangers of clicking unsolicited links in emails can help to prevent spear phishing attacks from succeeding. For organisations running Windows 7 or older, upgrading to Windows 10 will bring additional enhancements that help to protect against such vulnerabilities," the company says in a statement.

Security-Assessment was established in 2002. In 2007, it became a wholly-owned subsidiary of Dimension Data and continues to operate as a vendor-neutral offensive security consultancy, providing security, assessment and assurance services for organisations. Dimension Data has offices in Auckland, Wellington and Singapore.

Seagate: Data trends, opportunities, and challenges at the edge
The development of edge technology and the rise of big data have brought many opportunities for data infrastructure companies to the fore.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.
How blockchain could help stop video piracy in its tracks
An Australian video tech firm has successfully tested a blockchain trial that could end up being a welcome relief for video creators and the fight against video piracy.
IBM X-Force Red & Qualys introduce automated patching
IBM X-Force Red and Qualys are declaring a war on unpatched systems, and they believe automation is the answer.
Micro Focus acquires Interset to improve predictive analytics
Interset utilises user and entity behavioural analytics (UEBA) and machine learning to give security professionals what they need to execute threat detection analysis.
Raising the stakes: McAfee’s predictions for cybersecurity
Security teams and solutions will have to contend with synergistic threats, increasingly backed by artificial intelligence to avoid detection.
Exclusive: Ping Identity on security risk mitigation
“Effective security controls are measured and defined by the direct mitigation of inherent and residual risk.”
CylancePROTECT now available on AWS Marketplace
Customers now have access to CylancePROTECT for AI-driven protection across all Windows, Mac, and Linux (including Amazon Linux) instances.