Intrucept Private Limited

Aligning with Global Legal Landscape #DPDP Rule2025 & Creating Robust Security Protocol for Org's will bring in transformative change 🧮 The DPDP2025 rule is a transformative step as the rule aligns with global legal landscape and implementing as per organizational standards now falls with the #legal team of companies. 🧮 Tech organisations having their legal team and compliance professionals must proactively engage with these developments. 🧮 To ensure their organizations comply with new regulations and uphold the highest standards of data privacy and security. 🧮 To get the best out of the DPDP rule it is a must that adapting to these regulatory changes is crucial for maintaining trust and integrity in digital landscape and economy. 🧮 Global institutions both financial and tech, operating in India have to navigate the complexities of complying with both Indian data protection laws and their own country regulations creating harmony with data governance for effective operation. 🧮 The DPDP rules 0f 2025 makes it more important as India aligns to global data protection norms similar to EU's #GDPR. 🧮 As per #Deloitte India the draft Rules have considered three major data #fiduciary classes: #socialmedia, e-commerce and online #gaming. Additionally, data fiduciaries may also include #OTT platforms, travel websites (with huge involvement of AdTech entities), utility websites, #banking & #fintech platforms, quick commerce, big tech platforms & #telecom websites. #Rule6 of DPDP 2025 mentions: Reasonable security safeguards. *Data Fiduciaries must protect personal data through *#Encryption, masking, or virtual tokens *Controlled access to computer resources *Logs & monitoring to detect, address unauthorized access *Backup and recovery measures in case of data loss * Retaining logs for one year unless law requires otherwise *Security clauses in contracts with #Data Processors #DPDP2025 #Digitalprivacy #Digitalcomplaince #legalcompliance #Dataprotectionlaws #Dataprivacy #Cybersecurity #CISO #CDO #CIO #Intrucept #Datasecurity #regulations #Complaince Bhanumathi K SSatish KrishnaMamatha Krishna Srijith T R Ravi A S Deepa M Sharada ShankarMahesh Maney Chinmoy Pathak Sneha A Intrucept Private Limited

Aligning with Global Legal Landscape #DPDP Rule2025 & Creating Robust Security Protocol for Org's will bring in transformative change 🧮 The DPDP2025 rule is a transformative step as the rule aligns with global legal landscape and implementing as per organizational standards now falls with the #legal team of companies. 🧮 Tech organisations having their legal team and compliance professionals must proactively engage with these developments. 🧮 To ensure their organizations comply with new regulations and uphold the highest standards of data privacy and security. 🧮 To get the best out of the DPDP rule it is a must that adapting to these regulatory changes is crucial for maintaining trust and integrity in digital landscape and economy. 🧮 Global institutions both financial and tech, operating in India have to navigate the complexities of complying with both Indian data protection laws and their own country regulations creating harmony with data governance for effective operation. 🧮 The DPDP rules 0f 2025 makes it more important as India aligns to global data protection norms similar to EU's #GDPR. 🧮 As per #Deloitte India the draft Rules have considered three major data #fiduciary classes: #socialmedia, e-commerce and online #gaming. Additionally, data fiduciaries may also include #OTT platforms, travel websites (with huge involvement of AdTech entities), utility websites, #banking & #fintech platforms, quick commerce, big tech platforms & #telecom websites. #Rule6 of DPDP 2025 mentions: Reasonable security safeguards. *Data Fiduciaries must protect personal data through *#Encryption, masking, or virtual tokens *Controlled access to computer resources *Logs & monitoring to detect, address unauthorized access *Backup and recovery measures in case of data loss * Retaining logs for one year unless law requires otherwise *Security clauses in contracts with #Data Processors #DPDP2025 #Digitalprivacy #Digitalcomplaince #legalcompliance #Dataprotectionlaws #Dataprivacy #Cybersecurity #CISO #CDO #CIO #Intrucept #Datasecurity #regulations #Complaince Bhanumathi K SSatish KrishnaMamatha Krishna Srijith T R Ravi A S Deepa M Sharada ShankarMahesh Maney Chinmoy Pathak Sneha A Intrucept Private Limited

Race Condition Vulnerability in OpenSSH (CVE-2024-6387): PoC Exploit Released OpenSSH is a suite of networking utilities based on the Secure Shell (SSH) protocol. 👾 It is extensively used for secure remote login, remote server management and administration, and file transfers via SCP and SFTP. #OpenSSH server process ‘sshd’ is affected by a signal handler race condition allowing unauthenticated remote code execution with root privileges on glibc-based #Linux systems. 👾 The vulnerability affects millions of OpenSSH servers globally, with older versions particularly at risk. Rated with a CVSS score of 8.1, the flaw poses a significant security threat. Over 14 million OpenSSH server instances exposed to the Internet have been identified as potentially vulnerable, with around 700,000 instances facing external internet threats. 👾 Signal handler race condition in sshd’s SIGALRM, triggered during login timeout (LoginGraceTime). 👾 This Vulnerability if exploited could lead to complete system takeover. Remediation: 👾 Immediate Patch: Upgrade OpenSSH to version 9.8p2 or later, which resolves the issue.  👾 Access Restrictions: Implement firewall rules or TCP wrappers to limit SSH access to trusted IP ranges.  👾 Monitor Activity: Use intrusion detection systems (IDS) to analyze logs for unusual activity, failed login attempts, or exploitation patterns. #Cybersecurity #Vulenrabilitymanagement #RCE #CISO #Hacking #IDS #OpenSSH #Securityadvisory #Intrucept #Firewall #Patching #Patchmangement #Linux #intrusion Read more with www.intruceptlabs.com Ravi A S Swarup MannaMamatha Krishna Satish Krishna Chinmoy Pathak Srijith T RShweta HunshimaradBhargav Reddy Manish Jain Intrucept Private Limited Mahesh Maney https://lnkd.in/g2stgd53

#ChildrenData to be more #Tech Savy; To Protect them from Nuisances of Digital Space 💻 Data Protection Rules (#DPDP) To Focus on Children's Digital Data; Rules will be refined to make Tech Savy say's Union minister #AshwiniVaishnaw. #DPDP Rules will be refined further to connect children with technology while saving them from harms in digital space. 'The rules will evolve based on the learning from their implementation'. 💻 The Digital Personal Data Protection Rules-2025 (DPDPR-2025) provides for ‘Verifiable Consent for Processing Personal Data of Children & Persons with Disabilities’. 💻 Key requirements include obtaining verifiable consent from parents or legal guardians before processing the personal data of children or persons with disabilities. 💻 Accordingly, a ‘Data #Fiduciary’ must implement measures to ensure that the person providing consent for a child’s data processing is really the child's parent or legal guardian and that they can be properly identified. 💻 Why Protecting Children's Digital Data is important? For the well-being and safety of the child who is very much of todays digital landscape. 💻 To ensure that data processing is conducted within a defined and limited scope. 💻 The Act provides for Part A and Part B, and Part B of the schedule says what are the particular purposes for which the exemptions apply, including processing for #legal duties, issuing subsidies or benefits to children, “creating user accounts for communication, or ensuring that a child does not access harmful information. 💻 In these cases, processing is restricted to what is necessary to perform the function, service, or duty, with a strong emphasis on protecting the child’s best interests”. 💻 According to #Deloitte India, maintaining consent artefacts and offering the option to withdraw consent for specific purposes would necessitate changes at design & architecture level of #applications & platforms. #DPDP2025 #Childrensdata #Dataprivacy #Digitallandscape #Application #Datasecurity #Intrucept #Personaldata #Technology #CISO #CDO #CIO #Cybersecurity #Cybersaftey #Digitalpersonaldataprotection #Dataprotectionlaws Bhanumathi K S Satish KrishnaMamatha Krishna Chinmoy Pathak Srijith T R Ravi A S Mahesh ManeyDeepa M Intrucept Private Limited Manish Jain Sneha ABhargav Reddy

Critical Windows Privilege Escalation Vulnerability with Public Exploit Cybersecurity researchers reported a critical Windows privilege escalation vulnerability, identified as CVE-2024-43641 affecting Microsoft #Windows. This flaw, which affects various editions of Windows Server 2025, Windows 10 & Windows 11, has been assigned a CVSS v3.1 score of 7.8, indicating high severity. 📌Released Proof-of-Concept (PoC) exploit demonstrates how attackers can exploit this flaw to gain elevated privileges.  📌 The vulnerability allows attackers to corrupt the memory by controlling the canister header structure in the Windows Registry. 📌 To reproduce the vulnerability, researchers used a test environment with a Windows 11 VM (4 GB RAM) and a separate Linux VM running a Python-based SMB server. Technical Summary  📌 The vulnerability, CVE-2024-43641, exploits a design flaw in Windows registry hive memory management, specifically during a double-fetch process under memory pressure 📌 A malicious #SMB server can respond with differing data to consecutive read requests, breaking kernel assumptions. Exploitation leverages a “False File Immutability” (FFI) condition. Remediation:  📌 Apply #Patches: Users and system administrators are strongly advised to promptly apply the latest security updates.  📌 Monitor Activity:  Monitor logs for suspicious activity related to registry operations. The cybersecurity community is actively monitoring the situation for any indications of active exploitation in the wild. #Registry #Applicationsecurity #Windows #Cybersecurity #Vulnerabilitymanagement #Patchmangement #Securityadvisory #Malware #CISO #Cyberattack #Hacking #Intrucept Bhanumathi K S Deepa M Mahesh Maney Guruprasad B S Ravi A S Satish Krishna Mamatha KrishnaSwarup MannaSneha A Mahesh Maney Intrucept Private Limited https://lnkd.in/gGjKsBFc

Significant Step to Initiate Trust & Security in India’s Digital landscape; DPDP Act 2025 The Union government on Friday released the draft for Digital Personal Data Protection rules (DPDP) and Meity (Ministry of Electronics and Information Technology) invited stakeholders to share their feedback by feb18 on the MyGov portal at the link https://lnkd.in/g44Ut3B8. A simple way to understand all about DPDP rule, it is a comprehensive legislation that provides a legal framework for the protection of personal data in India. Key Focus points of DPDA act 2025: The law regulates how companies and organizations collect, store, process, and share personal data. The Data Protection Board itself will function as a digital office and will be “born digital”, with a digital platform and app to enable citizens to approach it digitally and to have their complaints adjudicated without their physical presence being required. Under the rules, digital platforms will have to inform and take the consent of people in a language of their choice — either in English or in any of the 22 Indian languages listed in the Constitution. As per rules various precautionary measures such as need for parental consent for children under the age of 18 to create a social media account. All digital platforms would also have to notify their users of the online links using which they may exercise their rights for withdrawing their consent, obtaining information regarding processing of their data, updating & erasing their data, grievance redress, nomination. The #DPDP2025 Act seeks to strengthen legal framework for protecting digital personal data by providing necessary details & actionable framework. Any quantum of penalty would depend upon the nature, gravity, duration, type, repetitiveness, efforts made to prevent breach, etc. Further, significant data fiduciaries have higher obligations under the Act & rules, while a lower compliance burden is envisaged for startups. Any penalty imposed for defaults would be fair & proportionate The Act do not mandate that all personal data has to be stored within India. In certain cases transfer of personal data outside India may be restricted for certain classes. There will be clear procedures for users to request access to their data, request for deletion known as Data #Fiduciaries. DPDP rule will set timelines for Data Fiduciaries to erase personal data when consent is withdrawn and for resolving user complaints. DPDP Act places restrictions on the transfer of personal data to foreign countries. #DPDP #DPDPACT2025 #Meity #Digital #DataProtection #Datasaftey #Datasecurity #Complaince #Intrucept #Cybersecurity #CTO #CIO #CDO #CXO #CISO Bhanumathi K S Satish Krishna Ravi A S Sharada Shankar Mamatha Krishna Mahesh Maney Bhargav ReddyChinmoy Pathak Manish Jain Shweta Hunshimarad https://lnkd.in/gtTpPzcQ

Exploit Proof-of-Concept Released for LDAP CVE-2024-49112 addressed by Microsoft As a part of PatchTuesday updates for Dec2024, alongside CVE-2024-49112 (CVSS score: 9.8), a critical integer overflow flaw in the same component that could result in remote code execution. 🎐 Technical Summary  The exploitation of CVE-2024-49112 involves a zero-click attack leveraging the LDAP protocol to execute #arbitrary #code or crash #Windows #Servers by targeting the Local Security Authority Subsystem Service (LSASS). 🎐 As per security researchers #Integer overflow in LDAP-related code allows remote unauthenticated exploitation via crafted RPC and LDAP queries. 🎐 Exploit Details:  An #attacker sends a DCE/RPC request to the target server.  The target queries the attacker’s DNS server for #domain information. The attacker manipulates NetBIOS and CLDAP responses to redirect the target server to a malicious LDAP server.  A crafted LDAP referral response crashes LSASS, causing crash and a system reboot. 🎐 Remediation: To mitigate the risk posed by these vulnerabilities, it’s essential that organizations apply patches released by Microsoft. 🎐 In situations where immediate patching is not possible, it’s advised to “implement detections to monitor suspicious CLDAP referral responses. 🎐 Apply Patches 🎐 Monitor Activity 🎐 Suspicious CLDAP referral responses with malicious values.  🎐 Unusual DsrGetDcNameEx2 calls.  🎐 Anomalous DNS SRV queries.  🎐 Testing: Use the #SafeBreach PoC tool from their #GitHub repository to assess the effectiveness of the patch Conclusion: With #Microsoft’s patch available, organizations must prioritize patching & deploy monitoring strategies to safeguard against exploitation. For more information, refer to SafeBreach’s #GitHub repository and detailed technical findings. #Applicationsecurity #CISO #CXO #Cybersafety #Cybersecurity #DNS #Intrucept #LDAP #Microsoft #PatchMangement #PoC #RCE #Remediation #Securityadvisory #VulnerabilityManagement Intrucept Private LimitedRavi A SBhanumathi K SMahesh ManeySharada Shankar Bhargav Reddy Shweta HunshimaradManish Jain Swarup Manna Satish Krishna Mamatha Krishna https://lnkd.in/g7eUaxgF

Critical DoS Vulnerability found in Palo Alto Networks PAN-OS High-severity Denial-of-Service (DoS) vulnerability, tracked as CVE-2024-3393, has been discovered in the DNS Security feature of Palo Alto Networks DNS Security is Using a Specially Crafted malicious packet This issue is applicable to the PAN-OS software versions listed below on PA-Series firewalls, VM-Series firewalls, CN-Series firewalls, and Prisma Access. If exploited, this vulnerability enables an unauthenticated #attacker to remotely trigger a firewall #reboot. Recommendations:  Avoid Using EOL Versions:  PAN-OS 11.0 is end-of-life (EOL) as of November 17, 2024. Ensure that you are not using this version and upgrade to be supported versions. Monitoring & Incident Response:  Regularly monitor firewall logs for unusual behavior, especially DoS triggers. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.  Required Configuration for Exposure This issue does not affect #Cloud NGFW, Panorama M-Series, or Panorama virtual appliances. For PAN-OS software to be affected: Either a DNS Security License or an Advanced DNS Security License must be applied DNS Security logging must be enabled. Key characteristics of the vulnerability include: Attack Vector: Network-based Privileges Required: None User Interaction: None Impact: High on availability; no effect on confidentiality or integrity. How do you see the vulnerability? Provide us with an input. #Intrucept #vulnerability #DNS #PaloAlto #Firewall #Patching #NGFW #CXO #CISO #Patchmangement #DOS #Cybersecurity #CISA #Securityadvisory Bhanumathi K SRavi A SBhargav ReddyManish JainMahesh Maney Sharada Shankar Satish KrishnaMamatha KrishnaSwarup Manna Shweta Hunshimarad Intrucept Private Limited https://lnkd.in/g_Teta9q

Wishing you a Very 'Happy New Year 2025' from Intrucept Private Limited As we bring in 2025, we wish all our clients, partners, colleagues & entire Cybersecurity community ' A VERY HAPPY NEW YEAR ' filled with love, laughter & endless adventures. Cheers to 2025!!! 🎉 🎉🎉 May the year #2025 be filled with immense possibilities to reach higher goals & achievements 🎉. #Happynewyear2025 #2025 #Cybersecurity #Infosec #informationsecurity #CISO #CXO #CTO #CIO #Intrucept

🚨 When Pop-Up Ads Turn Malicious: A Deep Dive into Adware 🚨 It all began with a simple complaint about annoying pop-up ads on Android phone. At first, it was brushed off as regular ads. But things got serious while using messaging #app 👽 "Someone has access to your #screen" The rise of malware on Android devices is a growing concern, as #cybercriminals increasingly target users with malicious apps, adware, and trojans. Adware malware displays unwanted ads and simultaneously track our online activity and mostly spread through free app downloads, unsafe websites, or #phishing emails. These threats often disguise themselves as legitimate applications, leading users to unknowingly download harmful software. Adware floods devices with intrusive ads while secretly collecting personal data, while trojans steal sensitive information. As a cybersecurity researcher of Intrucept Private Limited, Swarup Manna couldn’t ignore it. What followed was a deep dive into #Android #malware that revealed an alarming truth. 🔍 Here’s what uncovered: 1️⃣ The Hidden Culprit: I discovered an #app masquerading as a simple to-do list, consuming an unbelievable 1.5GB of data and displaying no trace in the app drawer. 2️⃣ Red Flags in App Details: The app’s version, publisher, and developer info didn’t match across platforms like GetApps and Official Play Store. Blocking its network access immediately stopped the ads, but I dig deeper. 3️⃣ The Malware Unveiled: Uploading the app’s APK to VirusTotal confirmed it as adware. Further analysis revealed its connection to an ad mediation platform, flooding devices with ads while monetizing in the background. 🛡️ Key Takeaways for Android Users: 👉 Monitor unusual spikes in app data usage. 👉 Cross-check app details across official stores before installing. 👉 Deny unnecessary permissions. 👉 Use antivirus software to catch hidden threats. This journey from an annoying pop-up ad to uncovering malicious adware has been an eye-opener. It's a reminder to stay vigilant and spread awareness about these types of threats. 🔗 Check out the full story https://lnkd.in/gMci86Wc #Mitigation to protect your Android device ➡️ Install apps only from trusted sources like the Google Play Store ➡️ Keep your software updated ➡️ Use antivirus protection & be cautious with app permissions. Staying informed and vigilant is key to safeguarding your data from these evolving #Cyberthreats." Let us know in the #comments if you have more information to share! #Adware #Threatmitigation #Android #Device #Dataprotecion #Andriodusers #Malware #Applicationsecurity #Cybersecurity #CybersecurityResearcher Bhanumathi K SMahesh ManeySatish Krishna Mamatha Krishna Ravi A SBhargav Reddy Shweta HunshimaradSharada ShankarManish Jain Swarup Manna Intrucept Private Limited