July 2022 Summaries

The recent update to the tool's navigation aims to enhance user experience by making it easier to access attack surface information and scan settings. This improvement addresses previous user feedback that found these features difficult to locate, potentially causing them to miss critical insights like open ports and DNS information. The updated interface now includes Surface Management and Scan Management views, allowing users to manage root assets, configure scans, and view results more intuitively. The update also features a list of newly added vulnerabilities from the community of ethical hackers, which can be explored in the "What's New?" section. These enhancements are designed to provide users with a clearer overview of their attack surface and improve the management of their security settings.

Web browsers are integral to daily online activities, offering functionalities that can, unfortunately, be exploited by cybercriminals, making them a common target for cyberattacks. These attacks often leverage vulnerabilities in browsers, plugins, and extensions, allowing attackers access to sensitive information such as passwords, session tokens, and even credit card details. Browsers store passwords and session cookies, which can be exploited if an attacker gains access. Browser plugins and extensions, while enhancing functionality, can introduce security risks if they contain vulnerabilities or if users are tricked into downloading malicious ones. Attackers can inject malicious code into websites to hijack browsers and exploit IoT devices on internal networks. The use of JavaScript poses additional risks, as it can be used to extract information from the browser and control it to communicate with other machines. To mitigate these risks, users should avoid saving passwords in browsers, regularly update software, carefully manage extensions, and maintain strong local passwords. Organizations should enforce security settings through global policies to protect their systems and data.

Recent updates to the attack surface management tools aim to help security teams more efficiently manage their growing array of Internet-facing assets, including subdomains and root assets. Users can now filter the attack surface by root asset, simplifying the process of identifying associated subdomains and retrieving enrichment data like ports and IPs. Additionally, the ability to filter by DNS record type provides easier access to historical DNS data and specific record types such as CNAME records. Several new SSL assessments have been introduced, addressing vulnerabilities like DROWN, Heartbleed, and Logjam, while improvements to the Autodiscovery feature have doubled the number of subdomains identified daily. The updates are designed to streamline the process of discovering and managing potential security threats, ensuring teams can quickly access critical information about their attack surface.

OAuth users are advised to scrutinize their sign-in flows for third-party scripts, including error flows, due to potential vulnerabilities that could lead to single-click account takeovers, as detailed in recent research by Frans Rosén from Detectify. Rosén discovered that many popular websites are not adhering to OAuth specification best practices, making them susceptible to complex attack chains involving response-type switching, invalid state, redirect-uri quirks, and third-party JavaScript inclusions. His research identified three main vulnerabilities: weak postMessage-listeners, cross-site scripting on sandbox domains, and out-of-bounds API URL fetching. OAuth, a widely-used open specification for secure access delegation via third-party credentials, has faced numerous security challenges over the past decade, yet remains integral to both consumer and enterprise web applications. With the increasing adoption of OAuth, these vulnerabilities present significant risks for targeted attacks, emphasizing the need for organizations to ensure their OAuth flows are free from third-party scripts. Rosén has responsibly disclosed his findings to affected parties and provided insights to the IETF's working group on OAuth 2.0 security best practices.