Authentic8 Blog Category: Threat Intelligence

10 Top Tools for Threat Hunters from Black Hat USA 2019

Posted by: Amir Khashayar Mohammadi
Published on:

So you weren't able to make it to Las Vegas this year, or didn’t get to check out all the latest and greatest tools at the booths and workshops? We've got you covered.

Check out these ten short reviews of useful tools presented at Black Hat USA 2019 for threat intelligence analysts, OSINT researchers, forensic investigators, and threat hunters:

King Phisher: Phishing Toolkit for Red Teams

King Phisher

Source: Github

King Phisher, created by SecureState, is a tool designed to simulate real-life scenario phishing attacks that may occur on a corporate network. It’s intended for red teaming, enabling the user to create complex attack scenarios to test internally if anyone in the organization fails to identify the bait.

This highly flexible tool allows you to run numerous phishing campaigns simultaneously, control the phishing email's content (embedded images, HTML, and more), map the location of all the phishing victims, and run SPF checks (Sender Policy Framework) for forging sender address during email delivery.

JavaScript Template Attacks: How Browsers Give Away the Store

Posted by: A8 Team
Published on:

Did you know? Attackers use  your locally installed browser base and JavaScript to draw up intricate exploit roadmaps for targeted attacks on your organization. Listen to our interview with security researcher Michael Schwarz to learn how JavaScript template attacks work and how to prevent them.

*

“Free” browsers boast features and extensions that supposedly enhance security and privacy online. The same settings or plugins, it turns out, can be used by adversaries to achieve precisely the opposite effect.

That’s just one of the eye-opening findings reported in the research paper JavaScript Template Attacks: Automatically Inferring Host Information for Targeted Exploits.

The paper was authored by security researchers Michael Schwarz, Florian Lackner and Daniel Gruss of Graz University in Austria. They describe how JavaScript template attacks help attackers prepare pinpointed zero-day or side-channel attacks against large organizations, by exploiting the ubiquitous data leaks in “free” browsers and their extensions.

The researchers found an abundance of environment-dependent properties in Firefox, Chrome, Edge, and mobile

Covert Online Investigation Tools: How Yesterday’s DIY Is Today’s Negative ROI

Posted by: Claudia Berth
Published on:

Security Officers, are your online researchers still relying on custom-made covert investigation solutions cobbled together from disparate tools to save money? New research proves that the opposite is happening: It costs you extra.

A few years ago, providing research teams with out-of-the-box capabilities to perform anonymous online research was crazy expensive. The task of enabling cyber threat hunting, without the risk of crippling the network, for example, needed a separate six-figure line item on the IT budget. It’s no wonder that there are so many organizations that rely on a patchwork of make-do and DIY tools and methods.  

Today though, the DIY approach to enabling sensitive research on the open, deep, or dark web is unnecessary, as well as out of sync with the demands of our rapidly changing internet threatscape.

A new comparative analysis by Authentic8 shows how DIY costs leaps and bounds more money than the new, low maintenance, SaaS alternative available today.  

Covert Online Research Costs: DIY Approach vs. Silo Research Toolbox by Authentic8

Source (excerpt): Authentic8 Whitepaper

In a

Webinar: Cloud-based Research Platform for Threat Hunters

Posted by: Drew Paik
Published on:

One of the most important applications of a cloud browser is investigating threat intelligence. Information security analysts can get quickly overwhelmed with data, from potential risks to false leads. Providing context for threat intelligence is critical for any security operations team.

Investigating leads from threat intelligence can be time-consuming and expensive for an already over-taxed function. Imagine having thousands of alerts, and no way to tell which ones are legitimate and which ones are benign.

Cloud-based technologies make infosec analysts more productive by doing much of the grunt work for them. Instead of slogging through thousands (or millions) of alerts, analysts rely on threat intelligence services like Recorded Future for in-depth and high-speed analysis to bring that down to a manageable number. And a cloud browser like the Silo Research Toolbox gives analysts a safe and efficient way to perform deep analysis on legitimate threats.

Illustration: Silo Research Toolbox - the cloud browser for analysts, researchers and investigators (screenshot)
Silo Research Toolbox on the Dark Web

Authentic8 and Recorded Future are presenting a cloud-based research platform