Intrix provides IT security and cybersecurity services to Australian businesses, focusing on protecting IT systems and data through managed security services, vulnerability testing, and incident response.

Intrix

Intrix works with Australian businesses to provide IT security and cybersecurity services, focusing on protecting IT systems and data through managed security services, vulnerability testing, and incident response.

Intrix Cyber Security | 805 followers on LinkedIn. We build the right cyber strategies and systems to protect your business from cyber-threats, data breaches and attacks. | Intrix Cyber Security protect businesses with our Information Security Services. 
We work with Australian businesses to ensure IT systems stay secure and protected from threats. Our approach is collaborative and aligns business outcomes with controlling risks and keeping data secure.

Cyber Security Consultant - Lead Penetration Tester - Red Team

Andrew Eades

Cyber Security Consultant at Intrix Cyber Security

Robert Dawsey

Finance Administrator at Intrix Cyber Security

Jodie B.

Information Technology Governance Manager at Intrix Cyber Security

Michael Dada

Intrix Cyber Security

At Intrix Cyber Security, safeguarding your company's data and systems is our priority! 🛡️🔒 We are excited to announce the expansion of our Information Security Services, designed to protect your businesses from cyber threats and attacks. With our expertise in cyber security and our collaborative approach, we help identify and quantify cyber risks, safeguard digital assets, and provide expert assessments. Visit our website at www.intrix.com.au to learn more about how we integrate best practice cyber security measures with business strategies to keep your IT systems secure and your data safe. #IntrixCyberSecurity #SecureYourBusiness #CollaborativeApproach #CyberSecurity #InformationSecurity #CyberSecuritySolutions #ProtectYourData #InformationSecurityServices #BusinessProtection

Researchers have revealed vulnerabilities in OpenAI's advanced ChatGPT-4o voice API, demonstrating that it can be exploited for financial scams, albeit with varying success rates. The model, which integrates text, voice, and vision capabilities, has several safeguards designed to prevent misuse, particularly against unauthorized voice replication. However, the rise of deepfake technology and AI text-to-speech tools exacerbates the existing challenges related to voice-based scams, which already cost millions. In their study, researchers from UIUC explored various types of scams, including bank transfers, gift card theft, and social media credential fraud. By simulating interactions with the AI agent while posing as unsuspecting victims, they found that the voice-enabled features of ChatGPT-4o could navigate websites and perform actions necessary for these scams. They employed simple techniques to bypass some of the model's protective measures, leading to success rates ranging from 20% to 60%, depending on the scam type. Notably, credential theft from Gmail had the highest success at 60%, while other scams varied in effectiveness. OpenAI has responded by emphasizing its commitment to improving the safety and robustness of its models. The newly previewed o1 model includes advanced reasoning capabilities and better defenses against manipulation, significantly outscoring GPT-4o in safety evaluations. Despite these improvements, the potential for abuse using other less-restricted voice chatbots remains a concern, underscoring the need for ongoing vigilance and research to address the risks associated with rapidly evolving AI technologies. #AI #VoiceScams #Cybersecurity #ScamResearch #FraudDetection #AIethics #OpenAI #AIdevelopment #DeepfakeTechnology

Hackers are actively trying to exploit two critical zero-day vulnerabilities in PTZOptics pan-tilt-zoom (PTZ) live streaming cameras, commonly used in healthcare, government, and business conferences. These vulnerabilities, identified as CVE-2024-8956 and CVE-2024-8957, were discovered by GreyNoise in April 2024 after their AI threat detection tool, Sift, detected unusual activity on their honeypot network. This activity led to identifying an attempted exploit targeting the camera's CGI-based API and its 'ntp_client', aimed at executing command injections. CVE-2024-8956 is associated with a weak authentication issue in the camera's 'lighthttpd' web server, allowing unauthorized access to the CGI API without proper authorization. This vulnerability could expose sensitive information, including usernames and password hashes. In contrast, CVE-2024-8957 stems from inadequate input sanitization in the ' ntp.addr ' field, which enables attackers to use specially crafted inputs to execute remote commands. The potential ramifications of exploiting these vulnerabilities include complete control over the cameras, the ability to deploy bots, access to other networked devices, or disruption of video feeds. Following the discovery of these vulnerabilities, GreyNoise collaborated with VulnCheck for responsible disclosure to affected vendors. The vulnerabilities primarily impact NDI-enabled cameras utilizing Hisilicon Hi3516A V600 SoC V60, V61, and V63, specifically those running outdated firmware versions. While PTZOptics issued a security update in September, certain older models did not receive updates due to their end-of-life status. Furthermore, GreyNoise indicated that newer models may also be affected, urging users to consult their device vendors to determine whether the necessary fixes for these vulnerabilities have been applied in recent firmware updates. #CyberSecurity #ZeroDay #Hacking #InfoSec #Vulnerabilities #CommandInjection #Firmware #PTZOptics #CyberThreats

A new iteration of the FakeCall malware for Android has emerged, designed to hijack outgoing calls from users attempting to contact their banks. This version reroutes calls to an attacker’s phone number, aiming to steal sensitive information and funds directly from victims' bank accounts. Originally reported by Kaspersky in April 2022, FakeCall is a banking trojan focused on voice phishing, wherein attackers impersonate banks during calls to extract confidential data from unsuspecting users. The latest findings from Zimperium highlight the malware's advanced capabilities, including setting itself as the default call handler upon installation. By doing so, it can manipulate both incoming and outgoing calls through a deceptive interface that resembles the legitimate Android dialer. Victims are led to believe they are speaking directly with their bank when, in reality, their calls are being intercepted and redirected, allowing attackers to harvest sensitive information without the victims’ knowledge. Recent enhancements to the malware include features that enable attackers to monitor and control various aspects of the infected device, such as recording audio and live streaming content. The malware now utilizes Android's Accessibility Service for increased control, allowing it to simulate user actions and communicate with a command and control server for further malicious commands. Despite its sophisticated design and ongoing development, users are advised to avoid installing apps from untrusted sources and to rely on Google Play for app downloads to reduce the risk of infection. #FakeCall #Malware #AndroidSecurity #VoicePhishing #BankingTrojan #Cybersecurity #OnlineSafety

A recent report from the National Australia Bank (NAB) reveals that 63% of Australians have encountered a cyber attack or data breach in the past year. Conducted as part of Cyber Security Awareness Month, the survey indicates that while 85% of respondents feel familiar with basic cyber security practices, only 16% consistently follow them. Concerns about personal cyber security are prevalent, with 62% expressing significant anxiety about potential threats. NAB's chief security officer, Sandro Bucchianeri, highlights the urgent need for a collective approach to cyber security amid rising economic challenges. The report identifies major companies and phishing scams as the primary sources of data breaches, affecting 38% and 34% of Australians, respectively. Vulnerable sectors, such as small businesses and individuals, are increasingly targeted by cyber criminals employing various tactics, including ransomware. The report stresses the importance of vigilance among small and medium enterprises (SMEs). Laura Hartley from NAB notes that while Australians are becoming more scam-savvy, cyber criminals are adapting their methods. Brokers and financial professionals are encouraged to educate clients on cyber security, use secure communication channels, and consider cyber risk insurance to better protect sensitive information. #CyberSecurity #DataBreach #Australians #NAB #CyberCrime #Awareness

A cybersecurity researcher, Alexander Hagenah, has developed a tool called 'Chrome-App-Bound-Encryption-Decryption' that allows users to bypass Google's recently implemented App-Bound encryption, which was designed to protect saved credentials in the Chrome browser. The release of this tool poses significant risks for users who store sensitive information, as it enables the extraction of encrypted data, undermining Google's efforts to safeguard against credential theft from infostealer malware. Google introduced App-Bound encryption in July with the aim of enhancing security by encrypting cookies through a Windows service that operates with SYSTEM privileges. This mechanism was intended to thwart malware that runs with user-level permissions, making it more challenging for attackers to decrypt stolen cookies without escalating their access rights. Despite these protective measures, within a few months, various infostealer programs found ways to circumvent this security feature, highlighting the ongoing "cat and mouse" dynamic between cybersecurity defenders and malicious actors. Hagenah's tool, now publicly available on GitHub, allows for the decryption of App-Bound encrypted keys stored in Chrome. Although it requires administrator privileges to use, many Windows users operate under such accounts, which makes the tool accessible. Security experts note that while Hagenah's method is relatively basic compared to more sophisticated techniques employed by infostealers today, it still demonstrates vulnerabilities in Chrome's security infrastructure, which have not been adequately addressed by Google despite their claims of enhanced defenses. #Cybersecurity #GoogleChrome #DataProtection #Infostealers #Encryption #Malware #PrivacyRisks #HagenahTool #AppBoundEncryption

Fog and Akira ransomware operators are increasingly infiltrating corporate networks through compromised SonicWall VPN accounts, leveraging a critical flaw known as CVE-2024-40766. This vulnerability, related to SSL VPN access control, was addressed by SonicWall in late August 2024, but reports quickly emerged indicating its active exploitation shortly thereafter. Arctic Wolf researchers have documented at least 30 incidents where these ransomware groups gained initial access via SonicWall VPN accounts, with about 75% of these attacks linked to Akira and the remainder to Fog. The collaboration between Akira and Fog is underscored by their shared infrastructure, suggesting a coordinated approach to cyberattacks. Although researchers cannot confirm that the specific vulnerability was used in every case, all targeted systems were running outdated, unpatched software. The time frame from initial intrusion to data encryption was notably short, averaging around ten hours, with some incidents occurring within as little as 1.5 to 2 hours. The threat actors typically masked their identities by accessing systems through VPNs, making detection more challenging. Additionally, compromised organizations often failed to implement multi-factor authentication on their SSL VPN accounts and operated services on default ports, increasing their vulnerability. In many instances, firewall logs revealed remote user login events prior to the rapid encryption of data, targeting primarily virtual machines and their backups. The data stolen included sensitive documents and proprietary software, with the attackers ignoring older files. Fog ransomware, launched in May 2024, is gaining traction, while Akira, a more established group, is recovering from recent issues with Tor site access. #Cybersecurity #Ransomware #VPNSecurity #SonicWall #DataBreach #Akira #Fog #ThreatActors #CVE2024 #Malware #ArcticWolf

Are you leveraging security audits to boost your risk management strategy? This article explores how going beyond compliance not only protects your organization but also enhances its overall resilience. Don’t miss out on these key insights that can help you navigate today’s complex security landscape! 🔒 Read more here: https://lnkd.in/gUDJU5Bz #RiskManagement #SecurityAudits #CyberDefense #Compliance #BusinessContinuity #InformationSecurity

A recent vulnerability in Fortinet's FortiManager, known as "FortiJump" and tracked as CVE-2024-47575, has been exploited in zero-day attacks affecting over 50 servers since June 2024. Mandiant's report reveals that the vulnerability stems from a missing authentication flaw in the FortiGate to FortiManager Protocol (FGFM) API, which enables unauthenticated attackers to execute commands on both the FortiManager server and the managed FortiGate devices. This flaw allows attackers with valid certificates to connect to exposed FortiManager servers, potentially gaining access to sensitive configuration data. The threat actor identified as UNC5820 has been active since June 27, 2024, staging attacks that involve exfiltrating configuration data from managed FortiGate devices. This data includes detailed configuration information and user passwords, which could facilitate further attacks on the enterprise environment. The initial attack was traced back to an unauthorized FortiManager-VM that registered itself with an exposed server, using a generic name and serial number. During the attack, the threat actor created several files containing critical information about the FortiManager and managed devices. Fortinet has since released patches for the vulnerability and recommended mitigations to enhance security, such as restricting access to specific IP addresses. While Mandiant found no evidence of malicious payloads on compromised devices, they noted that the stolen data has not yet been used to spread to managed FortiGate devices. The motives and location of the attackers remain unclear, and further investigations may provide more insights. Fortinet's advisory also includes mitigation strategies and indicators of compromise to help affected organizations secure their systems. #FortiJump #CVE202447575 #Cybersecurity #Fortinet #DataBreach #ZeroDayAttack

Recent investigations have uncovered that many popular mobile apps for iOS and Android contain hardcoded, unencrypted credentials for cloud services like Amazon Web Services (AWS) and Microsoft Azure. This vulnerability can lead to unauthorized access and potential data theft, as attackers could exploit these credentials. Symantec highlights that these issues often arise from poor development practices. Notable apps identified with these security flaws include "Pic Stitch" and "Crumbl," which collectively have millions of downloads. While having these apps does not necessarily mean user data has been compromised, it raises significant security concerns. Symantec previously reported over 1,800 apps with similar vulnerabilities, stressing the need for developers to address these risks. To enhance security, experts recommend developers use environment variables for credentials, utilize secrets management tools, encrypt sensitive data, and conduct regular code reviews and automated scans. Implementing these best practices is crucial to protect user information from potential breaches. #MobileSecurity #DataProtection #CloudSecurity #AppDevelopment #Cybersecurity #SecureCoding #DataBreach #InformationSecurity #DeveloperBestPractices #VulnerabilityManagement

AU:COM:INTRIX

Intrix