A roundup of the alerts, incident reports and security tips we published on our Telegram channel Cyber Israel during 2023. Join the channel to get these updates in real time (updates are posted in Hebrew).
July 11, 2023
😇 Happy to see that more vulnerabilities from my reports have been closed, and proud to appear (twice 😆) in the Hall of Fame. It's important to remember to appreciate and protect our precious country.
August 14, 2023
A vulnerability in the cannabis license issuance system — performing actions on behalf of physicians and obtaining physicians' personal contact details.
A vulnerability that allowed anyone to submit a cannabis license application in the name of any licensed physician. The weak authentication in use enabled:
1. Performing actions on behalf of physicians.
2. Exposing physicians' personal contact details.
3. Submitting a cannabis license application even by a physician who is not authorized to do so.
The following link served as a Ministry of Health application form, to be filled out by physicians in order to issue a cannabis license for patients -
https://forms.gov.il/globaldata/getsequence/getHtmlForm.aspx?formType=CannabisReq@moh.gov.il
The authentication in use relied on details that are easy to obtain — the physician's license number, national ID number, and date of birth.
Physician license number — the details of tens of thousands of physicians in Israel can be found easily, as they are publicly accessible on the following site –
https://practitioners.health.gov.il/Practitioners/1
Combined with the ID number and date of birth used for authentication, the action could be carried out. These details can easily be found via a Google search, on the wall of any doctor's office, and in various databases. Before the fix, any physician could submit a cannabis license application even if not authorized to do so.
https://youtu.be/Z6CCo8zhnuY
The issue was reported to the Israel National Cyber Directorate and the Ministry of Health. The Ministry fixed the authentication and implemented the government identification system for physicians, so that unauthorized actions can no longer be performed in physicians' names, and their personal contact details can no longer be obtained without authorization. In addition, when an application is submitted, the system now distinguishes between a physician who is authorized to submit such a request and one who is not.
The Ministry of Health expressed its thanks for the report and confirmed that the issue was successfully resolved.
Lior Ben-David — entrepreneur, researcher, and lecturer in cyber security and blockchain; member of the cyber committee of the Israeli Directors Union; owner of a cyber security and software development company; mentor and advisor to startups; holds an Executive MBA from Bar-Ilan University and is CISSP certified; volunteer at "Yedidim" 😊. Regularly reports security vulnerabilities and delivers training to boards of directors on proper oversight of cyber risks in the organization; inventor and holder of a smart charger patent.
Join the group to receive cyber security updates
Join the Telegram channel https://t.me/cyberisrael
Telegram group
https://t.me/cyberisraeli
Facebook group
https://www.facebook.com/groups/cyberisrael
September 21, 2023
Google Calendar has been down for the past half hour across wide regions.
September 29, 2023
A guide to enabling the built-in "Secure Browsing"/"Isolated Browsing" browser that ships with the operating system from Windows 10 Pro and above.
This option is free of charge — all you need to do is enable it, with no external installations. For some reason Microsoft decided not to enable it by default; still waiting for their answer as to why.
This guide is dedicated to a dear friend whose values and professionalism I greatly admire as a cyber security expert, manager, and CISO —
the man, the legend: Hagay Perlmutter!
Tutorial video:
https://youtu.be/JyjSDte4viU
FREE amazing security feature from Microsoft. For all that are seeking to protect themselves from browser attacks, apparently most people are not familiar that we have a free integrated isolated browser within Windows 10 Pro versions and above and all you need to do is activate it (can't understand how it is not activated by default... Microsoft, what is the reason???) NO INSTALLATION OF 3RD PARTY IS NEEDED IT IS PURELY MICROSOFT!!! Dedicated to an amazing friend, person and CISO - Hagay Perlmutter.
Cyber Israel Facebook group https://www.facebook.com/groups/cyberisrael
#securebrowsing (?q=%23securebrowsing) #cyber (?q=%23cyber) #cybersecurity (?q=%23cybersecurity) #informationsecurity (?q=%23informationsecurity) #microsoft (?q=%23microsoft) #israel (?q=%23israel) #isolatedbrowser (?q=%23isolatedbrowser) #סייבר (?q=%23%D7%A1%D7%99%D7%99%D7%91%D7%A8) #סייבר (?q=%23%D7%A1%D7%99%D7%99%D7%91%D7%A8) ישראל
October 9, 2023
The payment apps are failing to handle the load from donation drives for soldiers, and it appears they are also suffering DDoS attacks at the same time. I hope they return to normal operation soon. My standing recommendation is to build a separate infrastructure for domestic traffic and a separate infrastructure for international traffic, and of course to make sure the infrastructures are capable of scaling up very quickly during peaks (a bit difficult in these cases, since they are apparently not approved for cloud hosting).
Recent Comments