Following an early access period, OVHcloud is about to offer the Bring Your Own IP or BYOIP import service. As IPv4 addresses are scarce, it allows customers to import, via the OVHcloud Control Panel, their existing ranges of public IPv4 addresses to use as blocks of IP failover addresses. Thus, the move to cloud is made easier with less work required on network planning. Moreover, customers continue to benefit from the work they have already made concerning reputation management of their IP addresses. True to its principles, OVHcloud maintains reversibility; when the time comes, customers’ IPv4 addresses will be free of any vendor lock-in.
IP addresses are imported and segmented in block sizes ranging from /24 up to /19. OVHcloud also offers BYOAS to authorize importing customers AS numbers to further enhance the reputational aspect. The BYOIP service is available with Bare Metal Cloud, Hosted Private Cloud, Public Cloud products as well as vRack and IP Load Balancer.
With the convenience of monthly billing and no setup fee or commitment, the service will roll out in the coming weeks for all their datacenters under the condition of eligibility of customers’ IP addresses.
You can find out more here: OVHcloud Bring Your Own IP (BYOIP)
PhaaS, EvilProxy, With MFA Bypass Surfaced In Dark Web
Posted in Commentary with tags Dark Web on September 6, 2022 by itnerdA new Phishing-as-a-Service (PhaaS) dubbed EvilProxy, identified by Resecurity is being advertised in the Dark Web allowing cybercriminals to bypass Two-Factor security. And this revelation is making me nervous:
EvilProxy actors are using Reverse Proxy and Cookie Injection methods to bypass 2FA authentication – proxyfying victim’s session. Previously such methods have been seen in targeted campaigns of APT and cyberespionage groups, however now these methods have been successfully productized in EvilProxy which highlights the significance of growth in attacks against online-services and MFA authorization mechanisms.
Based on the ongoing investigation surrounding the result of attacks against multiple employees from Fortune 500 companies, Resecurity was able to obtain substantial knowledge about EvilProxy including its structure, modules, functions, and the network infrastructure used to conduct malicious activity. Early occurrences of EvilProxy have been initially identified in connection to attacks against Google and MSFT customers who have MFA enabled on their accounts – either with SMS or Application Token.
Brian Johnson, Chief Security Officer at Armorblox
“As Phishing-as-a-Service schemes take off in the dark web, it becomes easier for attackers to do very sophisticated campaigns to steal credentials, even while mimicking MFA. Reducing exposure to these involves eliminating targeted credential phishing attacks over email with a modern email security solution. It also needs more user awareness training around verifying 2FA notifications that they receive to ensure that it was generated based on an actual login attempt by them”.
Nick Ascoli, VP of Threat Research, PIXM
Based on what we are seeing in other similar 2-Factor relay attacks, this relay is more sophisticated and fully automated. Seeing these techniques make their way into commodity adversary tooling and marketplaces is going to challenge the security of MFA for virtually all organizations, not just those targeted by the more sophisticated groups and APTs. Without in-browser detection and blocking of this login page, the protection of MFA is in many cases completely nullified.
This is pretty disturbing as MFA is considered to be a great way to protect yourself. As a result of this revelation, businesses may have to rethink how they protect themselves from being pwned as clearly MFA isn’t as good as we thought it was.
Leave a comment »