Serial entrepreneur, cybersecurity leader, and industry veteran joins ShiftLeft to drive growth and AI/ML innovation globally.

**Santa Clara, Calif. — August 2, 2022 —** ShiftLeft, a disruptor and innovator in the world of DevSecOps and NextGen SAST and SCA, today named Stuart McClure as CEO. With more than 30 years in security, vulnerabilities and prevention technology, McClure will leverage his experience to enable growth and expansion for the company while advancing AI/ML in the DevSecOps and application security market.

“I am honored to join ShiftLeft as CEO and build on the company’s stellar foundation of innovation and thought leadership around vulnerability detection and prevention in the continuous integration/continuous delivery (CI/CD) landscape,” stated Stuart McClure, CEO of ShiftLeft. “I have been waiting almost 30 years to shift the entire discussion left and take prevention to the root cause of cybersecurity vulnerabilities: source code. And with their recent $29M financing round ShiftLeft is set up for success.”

The ShiftLeft platform integrates with the CI/CD pipeline and developer community to quickly identify the known and unknown vulnerabilities that matter most to your organization. Cybersecurity threats begin with code, making them completely preventable if you identify and address them in real time, and before they become part of your product. ShiftLeft’s solution has been built from the ground up to solve the core of this problem and enables developers and application security teams to collaborate together to fix what matters most, quickly.

“As a board member, Stuart has been instrumental in promulgating the value ShiftLeft brings to the development and security community which will now go to scaling the business,” says Jay Leek, Managing Partner & Co-founder at SYN Ventures. “We are extremely grateful to Manish Gupta for building a tremendously valuable company and solution and look forward to where Stuart will take it.”

“Stuart’s background and command of the cyber landscape makes him the perfect leader for ShiftLeft’s next evolution,” says Manish Gupta, Founder and Former CEO who will continue as Advisor to ShiftLeft and the board.

“Stuart has long been among the very few that I would go into any foxhole with in the cybersecurity industry,” said Malcolm Harkins, former CISO of Intel and Cylance. “His experience in the world of prevention will apply extremely well to tackling the final place to take prevention, that of code.”

Prior to joining ShiftLeft, McClure led Cylance as its Founder and CEO and was acquired by Blackberry in 2019, driving a revolutionary new AI/ML-based approach to threat prevention, detection and response. Prior to Cylance, he was Global CTO for McAfee/Intel, Founder/President/CTO of Foundstone which sold to McAfee in 2004, and at Ernst & Young he was a founding team member of their cybersecurity practice. Finally, Stuart’s knowledge of how the attacker works is well known as the founding author of the world’s most popular cybersecurity franchise called _Hacking Exposed_ and later _Web Hacking_.

**About ShiftLeft**

ShiftLeft empowers developers and AppSec teams to dramatically reduce risk by quickly finding and fixing the vulnerabilities most likely to reach their applications and ignoring reported vulnerabilities that pose little risk. Industry-leading accuracy allows developers to focus on security fixes that matter and improve code velocity while enabling AppSec engineers to shift security left. A unified code security platform, ShiftLeft CORE scans for attack context across custom code, APIs, OSS, containers, internal microservices, and first-party business logic by combining results of the company’s and Intelligent Software Composition Analysis (SCA). Using its unique graph database that combines code attributes and analyzes actual attack paths based on real application architecture, ShiftLeft then provides detailed guidance on risk remediation within existing development workflows and tooling. Teams that use ShiftLeft ship more secure code, faster. Backed by SYN Ventures, Bain Capital Ventures, Blackstone, Mayfield, Thomvest Ventures, and SineWave Ventures, ShiftLeft is based in Santa Clara, California.

ShiftLeft Appoints Prevention-First, Cybersecurity Visionary and AI/ML Pioneer Stuart McClure as CEO

The new program offers robust protection across all five data risk categories: cyber, human, application, operation, and environmental.

**SANTA CLARA, Calif. ‒ Aug 3, 2022** ‒ Druva Inc. today introduced the industry’s most comprehensive data resiliency guarantee, and the only program backed by the reliability, security and availability of the Druva Data Resiliency Cloud. The Druva Data Resiliency Guarantee, made possible by Druva’s leading SaaS-based data protection solution and best-in-class service level agreements (SLAs), provides up to $10 million in coverage and guarantees the security, immutability and availability of customers’ data. In adopting the Druva Data Resiliency Cloud, customers can now gain even more confidence that they are protected against a wide variety of data loss and downtime events across five key risk categories: cyber, human, application, operation and environmental.

Cyber attacks and ransomware continue to pose a significant threat to business, however, organizations, and their critical data, face myriad challenges outside of these external threats. Insider threats and under-trained staff are a significant factor in cyber events, while the rising adoption of SaaS business tools increases the potential risk and impact of unplanned outages. Further, as the scope of global climate change continues to expand, business data will only become more susceptible to natural disasters. The Druva Data Resiliency Cloud offers robust coverage designed to meet today’s evolving business landscape; whether it’s providing high levels of uptime, protecting data from unauthorized user access, or ensuring continuous, successful backups readily available for recovery, Druva’s enterprise-grade SaaS platform offers an unmatched level of protection and peace of mind.

“Ransomware protection alone isn’t enough to satisfy the pressures, challenges and speed of modern businesses,” said Jaspreet Singh, Founder and CEO, Druva. “Protecting data from outside attackers should be table stakes at this point but most vendors are simply unable to make stronger commitments given the limitations of their business models. In contrast, our SaaS model offers complete control over the various technology functions and the ability for our team to manage the entire customer experience. Others might guarantee certain protections or performance but we have taken this a step further by expanding our terms, extending our coverage against all five risks with five SLAs, and clearly defining comprehensive coverage for customers - all backed by up to $10 million.”

**A Guarantee With Unmatched Breadth and Depth**

The Druva Data Resiliency Guarantee is an expansion of the company’s existing limitations of liability and provides up to $10 million in coverage, enabling qualifying customers to protect against a wide variety of data loss and downtime events across five categories of risk, made possible by best-in-class SLAs:

1\. 100% Confidentiality SLA to guarantee customer data stored in backups will not be compromised (i.e. malicious and unauthorized access) as a result of a security incident

2\. 100% Immutability SLA to guarantee backups will not be deleted, encrypted, or otherwise changed as a result of a cyber attack

3\. 3. 99% Reliability SLA guaranteeing successful backup services

4\. 99.999% Durability SLA to ensure successful backups will be recoverable

5\. Up to 99.5% Availability SLA to maximize uptime

“There’s little doubt of the role data protection can play in strengthening business continuity, but enterprises are currently focusing a majority of their resources minimizing the risks of ransomware and cyber attacks specifically,” said Phil Goodwin, Research Vice President, IDC. “Druva is aiming to offer protection against five key risk categories, and guarantee it behind their cloud-native architecture, which presents organizations a very interesting offer to consider.”

The Druva Data Resiliency Cloud is a cloud-native, SaaS-based platform for unified data security, protection, and recovery. Because it is a cloud-native solution managed and maintained by Druva, the company has complete control over the various technology components that deliver customer services. By contrast, other organizations that rely on customers to manage their solutions (on-premises or cloud-based) have limited control and visibility limited to the control and visibility, and thus can only provide limited guarantees.

**Powering the Next Generation of Data Resiliency for Partners and Customers**

BuildGroup is a San Francisco-based general contracting company that takes on all aspects of construction from structural design and foundations to interiors and finish work.

“After conducting an extensive evaluation of data protection solutions, we had no doubt Druva was the best of breed and the right technology for our growing team,” said Adam Kailian, IT Manager, BuildGroup. “In addition to proven TCO savings and the only mature SaaS delivery model, Druva has put an exceptional system in place that ensures our data isn’t just protected from cyber attackers, it’s resilient from almost anything that might come our way. The Druva Data Resiliency Guarantee gives us the peace of mind that no one else could.”

Softcat is a leading provider of IT infrastructure to corporate and public sectors based in the UK, supporting thousands of customers with more than 200 partners and vendors.

“Business continuity and data resilience are crucial to all our customers, a reality that has been highlighted by the recent surge in malicious activity and the subsequent examples of ransomware attacks” said Tim Jeans, Solutions Sales Director, Softcat. “There are a number of factors to take into account in mitigating the associated risks and a solution capable of providing holistic protection, let alone guaranteeing it, like the Druva Data Resiliency Cloud, will put our customers in an outstanding position to protect their businesses.”

For more information on program terms, conditions and eligibility, visit the Druva Data Resiliency Guarantee webpage here.

**Additional Information**

**Blog:** Read more details about today’s announcement and Druva’s comprehensive guarantee

**Video:** Learn more about the new Druva Data Resiliency Guarantee

**LinkedIn Live:** Join us on August 11 for a special broadcast about today’s varied data risks, the five pillars of data resiliency, and Druva’s $10 million guarantee

**About Druva**

Druva enables cyber, data and operational resilience for every organization with the Data Resiliency Cloud, the industry’s first and only at-scale SaaS solution. Customers can radically simplify data protection, streamline data governance, and gain data visibility and insights as they accelerate cloud adoption. Druva pioneered a SaaS-based approach to eliminate complex infrastructure and related management costs, and deliver data resilience via a single platform spanning multiple geographies and clouds. Druva is trusted by thousands of enterprises, including 60 of the Fortune 500 to make data more resilient and accelerate their journey to cloud. Visit druva.com and follow us on LinkedIn, Twitter and Facebook.

Druva Introduces the Data Resiliency Guarantee of up to $10 Million

Todd Thibodeaux uses ChannelCon 2022 state of the industry remarks to unveil CompTIA’s Project Agora; invites broad industry participation in the effort to fight for tech talent.

CHICAGO, August 3, 2022 – CompTIA, the nonprofit association for the information technology (IT) industry and workforce, is undertaking an expansive effort to create the most resource-rich source of information and support for anyone interested in starting, staying and succeeding in a career in technology.

CompTIA President and CEO Todd Thibodeaux revealed the association’s Project Agora during his state of the industry remarks at ChannelCon 2022.

“The goal of Project Agora is to create the most respected place to start, build and supercharge your tech career,” he said. “With amazing resources and broad support from our members, partners and industry Project Agora will help people find success in the tech workforce.”

The labor market is in a period of unprecedented transition, characterized in large part by the volume of frictional unemployment as individuals search for, or transition from one job to another. One in four US workers were actively seeking a new job or pursuing other career options during Q2 2022, CompTIA research reveals. While tech is among the top five industries job seekers were considering, it ranked behind several other sectors, including sales, real estate, healthcare, hospitality and finance. A lack of confidence in technical skills, concerns about the cost and the time it will take to learn those skills and perceptions about the tech industry culture are factors that contribute to reluctance to consider tech as a career option.

“Our challenge is to convert more career intent people to tech intent,” Thibodeaux said. “We need to tell better stories, more consistently, about how truly great it is to work in tech. The way we get the talent we need is by fighting for it.”

Project Agora will help in that effort, first by enabling individuals to explore in great depth tech jobs and careers. CompTIA has identified 30 different job roles covering 90% of tech employment. The next step is creating resources to engage users and convert them from career intent to tech intent. Thibodeaux issued a call to action for the industry to get involved in this effort to build the best, most comprehensive collection of tech career resources available anywhere.

“Confidence gaps, career transition gaps and reskilling gaps are not insurmountable barriers but rather opportunities to chart a new course for individuals and the companies that employ them,” Thibodeaux concluded. “Project Agora is all about unlocking potential, for the industry, and for millions of people we want and need working in it.”

Organizations interested in getting involved in Project Agora can contact CompTIA at \[email protected\]  

**_About CompTIA_**  
The Computing Technology Industry Association (CompTIA) is a leading voice and advocate for the $5 trillion global information technology ecosystem; and the estimated 75 million industry and tech professionals who design, implement, manage, and safeguard the technology that powers the world’s economy. Through education, training, certifications, advocacy, philanthropy, and market research, CompTIA is the hub for unlocking the potential of the tech industry and its workforce. https://www.comptia.org/.

CompTIA CEO Outlines Initiative to Create the Pre-eminent Destination to Start, Build and ‘Supercharge’ a Tech Career

Converged SASE platform provides AI-driven Zero trust security and simplified, optimized connectivity to any network location or device, including IoT.

SANTA CLARA, Calif., Aug. 2, 2022 /PRNewswire/ -- Netskope, the leader in Security Service Edge (SSE) and Zero Trust, today announced it has acquired Infiot, a pioneer in enabling secure, reliable access with zero trust security, network and application optimization, and AI-driven operations.

As Netskope Borderless WAN, the addition of Infiot's revolutionary technology will enable Netskope customers to apply uniform security and quality of experience (QoE) policies to the widest range of hybrid work needs, from employees at home or on-the-go, to branch offices, ad-hoc point-of-sale systems, and multi-cloud environments. For customers, all of these capabilities are delivered in a single architecture, using one policy framework, and one console, which dramatically simplifies operations, preserves network performance, and ensures SASE success.

**The Benefits of SASE**

Businesses and governments are rapidly adopting SASE to safeguard data wherever it moves, support digital transformation efforts, and realize better efficiency and return-on-investment from their technology. Netskope is a widely acknowledged leader in SSE, which describes the security services needed for a successful SASE architecture.

Relevant to SASE growth, Gartner® notes:

· "By 2024, 80% of SD-WAN deployments will incorporate SSE requirements, up from less than 25% in 2022"\[1\]

· "By 2025, 80% of enterprises will adopt a strategy to unify web, cloud services, and private application access from a single vendor's SSE platform"\[2\]

Despite SASE's popularity, however, confusing vendor messaging often accompanies piecemeal product sets that are spuriously marketed as "SASE." Most of these products are not natively integrated, nor able to simplify technology environments, and lack critical network and infrastructure transformation capabilities—all of which risk higher levels of security incidents, network downtime, and poor ROI.

Netskope Borderless WAN combines with Netskope Intelligent SSE in a fully converged SASE platform, uniquely addressing these challenges.

**Borderless WAN Unlocks Full SASE Potential**

Founded in 2018 by veterans of the SD-WAN market, Infiot was one of only four vendors recognized in the 2021 Gartner "Cool Vendors™ in Cloud Networking"\[3\] report, was twice named to The Futuriom Top 40\[4\], and has been successfully deployed by customers in healthcare, retail, education, energy, manufacturing, telecommunications, and other industries.

Infiot technology leverages a cloud-based, zero-touch deployment and provisioning model with multiple physical and virtual appliance form factors. The solution includes built-in routing, a transport-agnostic approach that supports both wired and wireless networking, app-aware QoE enforcement combined with policy-based traffic steering, and other integrated network security functions critical for deployment at the edge. For customers, all of this capability is delivered in a single architecture, using one policy framework, and one console, which dramatically simplifies operations for thinly-stretched networking and infrastructure teams.

As the foundation of the new Netskope Borderless WAN solution, Infiot technology will allow customers to embrace modern, cloud-first networking by leveraging Netskope SASE Gateways, creating secure, optimized connections between any enterprise location, including site-to-site, or the cloud. Netskope SASE Gateways also enable end-to-end optimization for improved app performance, provide increased network resilience through real-time link monitoring and dynamic path selection, and offer identity and per-app access policies to apply zero trust principles to the network.

Netskope Borderless WAN critical use cases include:

· Easy access to industry-leading Netskope Intelligent SSE services powered by world-class Netskope NewEdge infrastructure

· All-in-one intelligent access, routing, wireless WAN, network security, app assurance, and edge compute as an effective way to modernize, simplify and implement SASE architecture

· The ability to offload MPLS and eliminate costs by sending more traffic direct-to-net, eliminate backhauling and leverage fixed/mobile connectivity options (such as 4G/5G)

· Better guaranteed WAN connectivity to ensure end-to-end performance, from the "last mile" to the cloud or legacy data center

· Simplified operational overhead associated with running custom third-party applications

**Quotes**

"Today, leaders across IT, security, and networking and the world's best-known analyst firms agree that the explosion of data and devices, along with the numerous ways that people connect, communicate, and collaborate, make the transformation of both networking and security a critical imperative for businesses and governments. It is in this transformation where Netskope is uniquely positioned to help customers with a fully converged SASE platform," said Sanjay Beri, Netskope CEO. "We're very excited to introduce Borderless WAN, and to welcome Infiot to our growing team."

"Today, many-to-many secure optimized connectivity is required to address any user, device, and location, in combination with a zero trust approach that integrates seamlessly with Security Service Edge," said Parag Thakore, Infiot CEO. "Netskope Intelligent SSE is the industry's leading SSE, and the combination of Infiot and Netskope will deliver on the promise of SASE like no other technology vendor can."

"As we continue to transform our patient care experience, we are excited to partner with Netskope,'' said Rick Lacy, Senior Enterprise Network Engineer, CHRISTUS Health. "Netskope Borderless WAN provides adaptive, identity-aware precision access for our medical workers to deliver care from the comfort of their homes, without compromising experience, all at a significantly lower cost to our business. In the future we see many applications for Netskope, including our medical IoT deployments."

"Netskope Borderless WAN is a new mindset. It's a new way of thinking about how our users access our domain and critical applications," said Robert Boopsingh, CIO, The Beacon Insurance Company. "For us, it will replace VPN for our employees and branch offices across our seven countries. We have implemented a zero trust model while delivering superior network access with this modern, secure, cloud-first implementation."

"This is a great move," said Frank Dickson, Group Vice President, Security & Trust, IDC. "What Netskope will now be able to offer, thanks to its compelling security platform and Infiot's technology, is fully secure hybrid-work in-a-box, solving for both networking challenges and security challenges at the same time. It's a self-provisioning network, with security that's automatic. That's not just an abstract framework or a good idea, it's a specific set of benefits and use cases for businesses."

In addition to offering Borderless WAN capabilities, Netskope integrates with key SD-WAN partners, ensuring customers benefit from Netskope Intelligent SSE in mixed environments while maintaining flexibility and choice in vendor partners.

Financial terms of the acquisition are undisclosed. Parag Thakore and the Infiot product team now comprise Netskope's Borderless WAN group, and Infiot's sales team has joined Netskope's sales organization.

Read the Netskope blog for more on today's acquisition news. Visit Netskope.com for more on Borderless WAN and the Netskope SASE platform.

**Gartner Disclaimer**

Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

GARTNER and COOL VENDORS are a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and are used herein with permission. All rights reserved.

**About Netskope**

Netskope, a global cybersecurity leader, is redefining cloud, data, and network security to help organizations apply Zero Trust principles to protect data. Fast and easy to use, the Netskope platform provides optimized access and real-time security for people, devices, and data anywhere they go. Netskope helps customers reduce risk, accelerate performance, and get unrivaled visibility into any cloud, web, and private application activity. Thousands of customers, including more than 25 of the Fortune 100, trust Netskope and its powerful NewEdge network to address evolving threats, new risks, technology shifts, organizational and network changes, and new regulatory requirements. Learn how Netskope helps customers be ready for anything on their SASE journey, visit netskope.com.

\[1\] Gartner, "How to Align SD-WAN Projects With SASE Initiatives," Bjarne Munch, Lisa Pierce, Craig Lawson, 18 April 2022

\[2\] Gartner, "Gartner Predicts 2022: Consolidated Security Platforms Are the Future," Charlie Winckless, Joerg Fritsch, Peter Firstbrook, Neil MacDonald, Brian Lowans, 1 December 2021

\[3\] Gartner "Cool Vendors in Cloud Networking," Andrew Lerner, Arun Chandrasekaran, Jonathan Forest, Joe Skorupa, 16 April 2021

\[4\] Futuriom, The 2022 Futuriom 40, R. Scott Raynovich, January 31, 2022

Netskope Acquires Infiot, Will Deliver Fully Integrated, Single-Vendor SASE Platform

Rising interest in chess may feed the next generation of cybersecurity experts.

The world of cybersecurity is not so different than a high-stakes chess game. In chess as in cybersecurity, players must outsmart their opponents, capitalize on their weaknesses in a timely and strategic manner, and think numerous steps ahead. As the need for cybersecurity grows in our increasingly digitized world, these skills will become more and more in demand.

With interest in chess booming, here are five ways in which strategic chess play can inspire the next generation of cybersecurity experts.

**1\. Understand Weaknesses**

Chess, unlike its board, isn't just black and white. The best chess players must have mastery over tactics, strategy, openings, endgames, and more. Players must memorize key moves and predictable patterns while solving chess puzzles to hone their ability to adapt to near-infinite scenarios. Each skill must be finetuned on its own before being combined into a sum greater than its parts, and no one player is perfect in every regard.

Similarly, there is also no such thing as 100% cybersecure. There’s a famous saying in the cybersecurity industry: "You can’t protect what you can’t see." As in chess, cybersecurity experts must steep themselves in what is visible – assets, vulnerabilities, threats, patterns of past attacks, and so on – to prepare for what is not _yet_ visible. Knowing that your own king is protected is as important as knowing when your opponent's king isn’t.

**2\. Get into the Minds of Opponents**

In chess, each turn is a complex effort to estimate what an opponent will do next and then determine how to respond to that estimated move, how the opponent will respond to the response, and so on. The very same principle is key to a good cybersecurity strategy. Getting insight into the opponent's mindset by studying past moves is key to intuiting future ones.

Using adversarial techniques, red teams, and vulnerability research, cybersecurity experts also attempt to find their own weaknesses. Sometimes a single weakness in security posture will be enough for an adversary to exploit the entire network – a dangerous gambit. The goal is to always stay ahead by knowing those weaknesses better (and sooner) than bad actors do. The adage "know thyself" is imperative – in cybersecurity, in chess, and in life.

**3\. Have a Plan — Any Plan**

"A bad plan is better than no plan." This quote from former World Chess Championship competitor Mikhail Chigorin should guide every chess player. Moving pieces without a clear guiding strategy makes it difficult to evaluate the situation and make required changes when needed. If you're making moves on the fly, you've already lost.

The cybersecurity world is noisier and filled with even more unknowable possibilities than a chess game. Thus, it is critical to ensure that every security decision an organization makes is part of a thoughtful, comprehensive long-term strategy, built around concrete objectives. Incident planning, for example, is a good way to ensure that once an incident occurs and panic likely ensues, the right controls and processes will already be in place.

**4\. Keep Time on Your Side**

Time is a key element in chess. If you don’t organize your pieces fast enough, your opponent will get an advantage. If you play too slow, you'll be pressured later to make suboptimal decisions.

As a cyber defender, the growing number of increasingly sophisticated threat actors forces you to outsmart an unpredictable opponent faster than they outsmart you. And the playing field isn't just an eight-by-eight checkered board right in front of you. In the cybersecurity game, opponents ceaselessly attempt to exploit your systems, and they do so along myriad invisible, global digital connections.

Be timely, or be hacked.

**5\. Automate … Everything**

The advent of computers has changed chess dramatically. When the Deep Blue computer beat World Champion Garry Kasparov in 1997, chess programs became a must-have for every professional player. These programs enable players to analyze games and prepare for matches while allowing them to focus on creativity and strengthen weaknesses in a controlled environment.

For cybersecurity, the use of automation whenever possible is key to staying ahead of the meteoric rise in the number of devices and types of connectivity; it is simply impossible for the human brain to keep track of so much at once. Having the right automated cybersecurity tools will allow security staff to focus on the most important challenges, without leaving basic security functions unaddressed.

**Endgame**

The Internet has made it easier than ever for anyone to learn and play chess. This is beneficial for an increasingly online generation, challenging young minds in new ways and potentially positioning them as the cybersecurity experts of the future.

5 Ways Chess Can Inspire Strategic Cybersecurity Thinking

Phishing operators are taking advantage of security bugs in the Amex and Snapchat websites (the latter is unpatched) to steer victims to phishing pages looking to harvest Google and Microsoft logins.

Malicious actors have been taking advantage of open-redirect vulnerabilities affecting American Express and Snapchat domains to send phishing emails targeting Google Workspace and Microsoft 365 users.  

Research published by INKY reveals that in both cases the phishers included personally identifiable information (PII) in the URL. This allows the actors to rapidly customize the malicious landing pages for individual victims and disguised the PII by converting it to Base 64, turning the information into a sequence of random characters.

Phishing emails in the Snapchat group used DocuSign, FedEx, and Microsoft lures, which led to Microsoft credential harvesting sites.

INKY engineers detected more than 6,800 Snapchat phishing emails containing the open-redirect vulnerability during a period of two and a half months. Despite previously being reported to Snaptchat by Open Bug Bounty nearly a year ago, the vulnerability remains unpatched, according to the report.  

The issue was even worse with the American Express open-redirect vulnerability, which was uncovered in more than in 2,000 phishing emails during the course of just two days in July.

However, the report notes, American Express has since patched the vulnerability, and any user who clicks the link now is redirected to an error page on the company's actual website.

Redirect vulnerabilities arise when domains accept untrusted input that could cause the site to redirect users to another URL. By modifying the URL for these sites — for instance, by adding a link to another destination to the end of the original URL — an attacker can easily redirect users to websites of their choice.

"Perhaps websites don't give open-redirect vulnerabilities the attention they deserve because they don't allow attackers to harm or steal data from the site," today's report notes. "From the website operator's perspective, the only damage that potentially occurs is harm to the site's reputation. The victims, however, may lose credentials, data, and possibly money."

**Examine Links, Present Users with Disclaimers**

The report recommended that when examining links, surfers should keep an eye out for URLs including "url=", "redirect=", "external-link", or "proxy", strings that may indicate a trusted domain could redirect to another site.

Another telltale sign indicating redirection are links with multiple occurrences of "http" in the URL.

"Domain owners can prevent this abuse by avoiding the implementation of redirection in the site architecture and can also present users with an external redirection disclaimer that requires user clicks before redirecting to external sites," according to the report. "If redirection is necessary for commercial reasons, then implementing an allow-list of approved safe links prevents bad actors from inputting malicious links."  

The scam that INKY reported is the latest in a long line of phishing scams roiling the IT security landscape — earlier this week, researchers from ThreatLabz issued a warning over a large-scale phishing campaign aimed at Microsoft Outlook email services users.

American Express, Snapchat Open-Redirect Vulnerabilities Exploited in Phishing Scheme

New finding comes amid report of overall surge in threats targeting mobile and IoT devices over the past year.

Thousands of mobile apps are leaking Twitter API keys — some of which give adversaries a way to access or take over the Twitter accounts of users of these applications and assemble a bot army for spreading disinformation, spam, and malware via the social media platform.

Researchers from India-based CloudSEK said they had identified a total of 3,207 mobile applications leaking valid Twitter Consumer Key and Secret Key information. Some 230 of the applications were found leaking OAuth access tokens and access secrets as well.

Together, the information gives attackers a way to access the Twitter accounts of the users of these applications and carry out a variety of actions. This includes reading messages; retweeting, liking, or deleting messages on the user's behalf; removing followers or following new accounts; and going to account settings and doing things like changing the display picture, CloudSEK said.

**Application Developer Error**

The vendor attributed the issue to application developers saving the authentication credentials within their mobile application during the development process so they can interact with Twitter's API. The API gives third-party developers a way to embed Twitter's functionality and data into their applications.

"For example, if a gaming app posts your high score on your Twitter feed directly, it is powered by the Twitter API," CloudSEK said in a report on its findings. Often, though, developers fail to remove the authentication keys before uploading the app to a mobile app store, thereby exposing Twitter users to heightened risk, the security vendor said.

"Exposing an 'all access' API key is essentially giving away the keys to the front door," says Scott Gerlach, co-founder and CSO at StackHawk, a provider of API security testing services. "You have to understand how to manage user access to an API and how to securely provision access to the API. If you don't understand that, you have put yourself way behind the eight ball."

CloudSEK identified multiple ways that attackers can abuse the exposed API keys and token. By embedding them into a script, an adversary could potentially assemble a Twitter bot army to spread disinformation on a mass scale. "Multiple account takeovers can be used to sing the same tune in tandem, reiterating the message that needs to be disbursed," the researchers warned. Attackers also could use verified Twitter accounts to spread malware and spam and to carry out automated phishing attacks.

The Twitter API issue that CloudSEK identified is akin to previously reported instances of secret API keys being mistakenly leaked or exposed, says Yaniv Balmas, vice president of research at Salt Security. "The main difference between this case and most of the previous ones is that usually when an API key is left exposed, the major risk is to the application/vendor."

Take the AWS S3 API keys exposed on GitHub, for example, he says. "In this case, however, since users permit the mobile application to use their own Twitter accounts, the issue actually puts them at the same risk level as the application itself."

Such leaks of secret keys open up the potential for numerous possible abuses and attack scenarios, Balmas says.

**Surge in Mobile/IoT Threats**

CloudSEK's report comes the same week as a new report from Verizon that highlighted a 22% year-over-year increase in major cyberattacks involving mobile and IoT devices. Verizon's report, based on a survey of 632 IT and security professionals, had 23% of the respondents saying their organizations has experienced a major mobile security compromise in the past 12 months. The survey showed a high level of concern over mobile security threats especially in the retail, financial, healthcare, manufacturing, and public sectors. Verizon attributed the increase to the shift to remote and hybrid work over the past two years and the resulting explosion in the use of unmanaged home networks and personal devices to access enterprise assets.

"Attacks on mobile devices — including targeted attacks — continue to increase, as does the proliferation of mobile devices to access corporate resources," says Mike Riley, senior solution specialist, enterprise security at Verizon Business. "What stands out is the fact that attacks are up year-over-year, with respondents stating that the severity has grown along with the increase in the number of mobile/IoT devices."

The biggest impact for organizations from attacks on mobile devices was data loss and downtime, he adds.

Phishing campaigns targeting mobile devices have soared as well over the past two years. Telemetry that Lookout collected and analyzed from over 200 million devices and 160 million apps showed that 15% of enterprise users and 47% of consumers experienced at least one mobile phishing attack in each quarter in 2021 — a 9% and 30% increase, respectively, from the prior year.

"We need to look at security trends on mobile in the context of protecting data in the cloud," says Hank Schless, senior manager, security solutions at Lookout. "Securing the mobile device is an important first step, but to fully secure your organization and its data, you need to be able to use mobile risk as one of the many signals that feed your security policies for accessing data in cloud, on-prem, and private apps."

Thousands of Mobile Apps Leaking Twitter API Keys

Complex neural networks, including GPT-3, can deliver useful cybersecurity capabilities, such as explaining malware and quickly classifying websites, researchers find.

GPT-3, the large neural network created with extensive training using massive datasets, provides a variety of benefits to cybersecurity applications, including natural-language-based threat hunting, easier categorization of unwanted content, and clearer explanations of complex or obfuscated malware, according to research to be presented at the Black Hat USA conference next week.

Using the third version of the Generative Pre-trained Transformer — more commonly known as GPT-3 — two researchers with cybersecurity firm Sophos found that the technology could turn natural-language queries, such as "show me all word processing software that is making outgoing connections to servers in South Asia," into requests to a security information and event management (SIEM) system. GPT-3 is also very good at taking a small number of examples of website classifications and then using those to categorize other sites, finding commonalities between criminal sites or between exploit forums.

Both applications of GPT-3 can save companies and cybersecurity analysts significant time, says Joshua Saxe, one of the two authors of the Black Hat research and chief scientist for artificial intelligence at Sophos.

"We are not using GPT-3 in production at this point, but I do see GPT-3 and large deep-learning models — the ones you cannot build on commodity hardware — I see those models as important for strategic cyber defense," he says. "We are getting much better — dramatically better — results using a GPT-3-based approach than we would get with traditional approaches using smaller models."

The research is the latest application of GPT-3 to show the model's surprising effectiveness at translating natural-language queries into machine commands, program code, and images. The creator of GPT-3, OpenAI, has teamed up with GitHub, for example, to create an automated pair programming system, Copilot, that can generate code from natural-language comments and simple function names.

GPT-3 is a generative neural network that uses deep-learning algorithms' ability to recognize patterns to feed back results into a second neural network that creates content. A machine learning (ML) system for recognizing images, for example, can rank results from a second neural network used to turn text into original art. By making the feedback loop automatic, the ML model can quickly create new artificial intelligence (AI) systems, like the art-producing DALL-E.

The technology is so effective that an AI researcher at Google says one implementation of a large-language chatbot model has become sentient.

While the nuanced learning of the GPT-3 model surprised the Sophos researchers, they are far more focused on the utility of the technology to ease the job of cybersecurity analysts and malware researchers. In their upcoming presentation at Black Hat, Saxe and fellow Sophos researcher Younghoo Lee will show how the largest neural networks can deliver useful and surprising results.

In addition to creating queries for threat hunting and classifying websites, the Sophos researchers used generative training to improve the GPT-3 model's performance for specific cybersecurity tasks. For example, the researchers took an obfuscated and complicated PowerShell script, translated it with GPT-3 using different parameters, and then compared its functionality to the original script. The configuration that translates the original script closest to the original is deemed the best solution and is then used for further training.

"GPT-3 can do about as well as the traditional models but with a tiny handful of training examples," Saxe says.

Companies have invested in AI and ML as essential tools to improve the efficiency of technology, with "AI/ML" becoming a must-have term in product marketing.

Yet ways to exploit AI/ML models have jumped from whiteboard theory to practical attacks. Government contractor MITRE and a group of technology firms have created an encyclopedia of adversarial attacks on AI systems. Known as the Adversarial Threat Landscape for Artificial-Intelligence Systems, or ATLAS, the classification of techniques includes abusing the real-time learning to poison training data, like what happened with Microsoft's Tay chatbot, to evading the ML model's capabilities, such as what researchers did with Cylance's malware detection engine.

In the end, AI likely has more to offer defenders than attackers, Saxe says. Still, while the technology is worth using, it will not dramatically shift the balance between attackers and defenders, he says.

"The overall goal of the talk is to convince that these large language models are not just hype, they are real, and we need to find where they fit in our cybersecurity toolbox," Saxe says.

Large Language AI Models Have Real Security Benefits

The campaign uses adversary-in-the-middle techniques to bypass multifactor authentication, evade detection.

Researchers are warning about a new, large-scale phishing campaign aimed at Microsoft Outlook email services users.

The team at ThreatLabz discovered the new phishing kit and said it uses an adversary-in-the-middle (AiTM) model, which can be effective for evading detection by email and network security protections, as well as bypassing multifactor authentication protections.

ThreatLabz researchers said they detected several newly registered domains being used in the active phishing campaign.

"The campaign is specifically designed to reach end users in enterprises that use Microsoft's email services," the ThreatLabz report on the new phishing campaign said. "Business email compromise (BEC) continues to be an ever-present threat to organizations, and this campaign further highlights the need to protect against such attacks."

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Massive New Phishing Campaign Targets Microsoft Email Service Users

Venafi investigation of 35 million Dark Web URLs shows macro-enabled ransomware widely available at bargain prices.

**SALT LAKE CITY, Aug. 2, 2022—** Venafi, the inventor and leading provider of machine identity management, today announced the findings of a Dark Web investigation into ransomware spread via malicious macros. Conducted in partnership with criminal intelligence provider Forensic Pathways between November 2021 and March 2022, the research analyzed 35 million Dark Web URLs, including marketplaces and forums, using the Forensic Pathways Dark Search Engine. The findings uncovered 475 web pages of sophisticated ransomware products and services, with several high-profile groups aggressively marketing ransomware-as-a-service.

*   87% of the ransomware found on the dark web has been delivered via malicious macros to infect targeted systems.

*   30 different "brands" of ransomware were identified within marketplace listings and forum discussions.

*   Many strains of ransomware being sold — such as Babuk, GoldenEye, Darkside/BlackCat, Egregor, HiddenTear and WannaCry — have been successfully used in high-profile attacks.

*   Ransomware strains used in high-profile attacks command a higher price for associated services. For example, the most expensive listing was $1,262 for a customized version of Darkside ransomware, which was used in the infamous Colonial Pipeline ransomware attack of 2021.

*   Source code listings for well-known ransomware generally command higher price points; Babuk source code is listed for $950 and Paradise source code is selling for $593.

"Ransomware continues to be one of biggest cybersecurity risks in every organization," said Kevin Bocek, vice president of security strategy and threat intelligence for Venafi. "The ransomware attack on Colonial Pipeline was so severe that it was deemed a national security threat, forcing President Biden to declare a state of emergency."

Macros are used to automate common tasks in Microsoft Office, helping people to be more productive. However, attackers can use this same functionality to deliver many kinds of malware, including ransomware. In February, Microsoft announced a major change to combat the rapid growth of ransomware attacks delivered via malicious macros, but it temporarily reversed that decision in response to community feedback.

"Given that almost anyone can launch a ransomware attack using a malicious macro, Microsoft's indecision around disabling of macros should scare everyone," said Bocek. "While the company has switched course a second time on disabling macros, the fact that there was backlash from the user community suggests that macros could persist as a ripe attack vector."

In addition to a variety of ransomware at various price points, the research also uncovered a wide range of services and tools that help make it easier for attackers with minimal technical skills to launch ransomware attacks. Services with the greatest number of listings include those offering source code, build services, custom development services, and ransomware packages that include step-by-step tutorials.

Generic ransomware build services also command high prices, with some listings costing more than $900. At the other end of the price spectrum, many low-cost ransomware options are available across multiple listings — with prices starting at just 99 cents for Lockscreen ransomware.

These findings are another example of the need for a machine identity management control plane to drive specific business outcomes, including observability, consistency, and reliability. In particular, code-signing is a key machine-identity management security control that eliminates the threat of macro-enabled ransomware.

"Using code-signing certificates to authenticate macros means that any unsigned macros cannot execute, stopping ransomware attacks in its tracks," Bocek concludes. "This is an opportunity for security teams to step up and protect their businesses, especially in banking, insurance, health care, and energy, where macros and Office documents are used every day to power decision making."

**About the research**

This research was carried out between November 2021-March 2022 by Venafi in partnership with Forensic Pathways, which has developed Dark Search Engine (DSE), an automated crawler/scraper of the Tor.Onion Dark Web. The intelligence tool contains more than 35 million URLs in the index.

Publicly available information, such as PC Risk, was used to determine if malicious macros were used in the initial attack vector.

For more information read the blog.

**About Venafi**

Venafi is the cybersecurity market leader in machine identity management. From the ground to the cloud, Venafi solutions manage and protect identities for all types of machines — from physical and IoT devices to software applications, APIs, and containers. Venafi provides global visibility, life cycle automation, and actionable intelligence for all machine identity types and the security and reliability risks associated with them.

Jetstack, a Venafi company, is a cloud native products and strategic consulting company working with enterprises using Kubernetes and OpenShift. An open source pioneer, Jetstack has achieved notable industry recognition as the creator of cert-manager, the open source industry standard for cloud native machine identity management.

Jetstack’s open source products and solutions protect the application environments and platform infrastructure of global banks, multinational retailing companies, and defense organizations by providing enterprise platform and security teams the power to build, scale, and secure their cloud infrastructure.

With more than 30 patents, Venafi delivers innovative machine identity-management solutions for the world's most demanding, security-conscious organizations and government agencies, including the top five U.S. health insurers; the top five U.S. airlines; the top four credit card issuers; three out of the four top accounting and consulting firms; four of the five top U.S. retailers; and the top four banks in each of the following countries: the US, the UK, Australia, and South Africa.

www.venafi.com

www.jetstack.io

**About Forensic Pathways**

Incorporated in 2001, Forensic Pathways provides innovative technologies within the criminal-intelligence arena.

Focused primarily on the provision of digital forensic technologies, Forensic Pathways offers its international clients unique technologies in the management of mobile phone data, image analysis, and ballistics analysis.

Source

DARKReading