The LogicHub Security Roundup: December 2020 Edition

WHAT DOES IT DO?

Samsung’s Factory Reset Protection (FRP) is a feature that allows users to prevent stolen devices that they own from being used by others after a factory reset. It’s a key feature that can help reduce the frequency of stolen phones on the market.

This bypass allows an assailant to use the Secure Folder feature to prevent FRP from communicating with the remainder of the device. The process is simple enough to perform that there are even several online tutorials on the topic.

WHAT DOES IT DO?

In the Android security bulletin released near the beginning of November, a patch was announced that fixed a series of severe security flaws. The most severe flaw announced was a proximity-based flaw that could allow attackers to execute arbitrary code as a privileged process.

Using exif_entry_get and exif-entry.c, attackers could cause an integer overflow if a third party application used the libraries to process remote image data. The most significant thing of note here is that this does not require any form of user interaction to pull off.

SUMMARY

Salesforce users used to be manually added to lists, looked up via search engines, and their activity had to be verified through a series of different methods. Though effective, this process took far more time than desired and caused a greater chance for error. User managers had to be contacted regularly to confirm the presence of a user.

AUTOMATED SOLUTION

Through automated commands and custom integrations like Cisco Talos integration, cases now arrive with all information on the user previously seen in logs available to the investigator. The creation of the account, prior activity, IP rating, any existing social media, and the user’s full name become easy to access and useful for triage. In some instances, the case can be automatically resolved.