Positive Technologies' key research activities in 2019–2021

With the global spread of information technology comes an inevitable increase in the number of vulnerabilities in information systems. The reason is the neglect of secure development principles, vulnerable architecture of these systems, and the all-too-common human factor. In 2020 alone 18,103 vulnerabilities were found in software of various manufacturers. This is more than in any other previous year. More than half of these vulnerabilities (57%) are of high or critical severity, which causes significant risks to the owners of vulnerable software. Timely installation of patches can help mitigate these risks.

Detecting new vulnerabilities and bringing them to the attention of software manufacturers is crucial when it comes to increasing the security of information systems. Positive Technologies is an active contributor to this process. Positive Technologies adheres to the principles of responsible disclosure. First, all information regarding a detected vulnerability and details of its exploitation is provided to a corresponding vendor. Next, we offer consultation on how to eliminate this vulnerability. Finally, and only after the vendor releases an official security update, do we publish the results of our research online by agreement with this vendor.

In only the last three years, our experts detected and helped to eliminate hundreds of serious vulnerabilities (including critical vulnerabilities) in products of world-renowned software manufacturers:

Positive Technologies helped to eliminate vulnerabilities in the Intel Management Engine subsystem in modern Intel processors and fix security flaws in solutions of other major companies, such as Dell (CVE-2020-5366), Microsoft (CVE-2019-0697, CVE-2019-0726), and Check Point (CVE-2020-6020), as well as in industrial control systems by Schneider Electric (CVE-2018-7760), Moxa (CSA-20-056-01, CVE-2019-9098, CVE-2019-9099, CVE-2019-9102), Rockwell (ICSA-20-070-06), and Siemens (ICSA-19-036-04).

Our company is an active contributor to OWASP (Open Web Application Security Project). Our studies highlight key information security problems and promote best practices in information systems protection. Our studies include:

  • Threat analysis research. Quarterly reports on evolving cyberthreats. The results of such studies help organizations to keep track of recent information security trends.
  • Articles about darkweb ("Custom hacking services" and "Access for sale"). In these articles, we analyze malicious schemes used by attackers. Infosec experts can use our findings to timely forecast potential threats for their companies.
  • Security assessments of IT infrastructure of major companies ("External pentests results" and "Internal pentests results"), in which we share key issues of network perimeters and local networks protection in depersonalized form. This information can help companies to avoid common mistakes and bear them in mind when building a security system for their IT infrastructures.
  • Articles on vulnerabilities and threats in mobile applications and web applications vulnerabilities, in which we share our expertise and knowledge of security problems of these systems and offer protection solutions.
  • Studies of vulnerabilities in online banking applications and ATMs, in which we discuss attack techniques, the most common vulnerabilities, and methods for their elimination.
  • Analysis of ICS vulnerabilities, in which we share our knowledge of the most serious problems of ICS security and urge industrial companies to perform a more thorough analysis and protect equipment in the ICS segment of internal networks.

Another important aspect of our experts' daily work is the analysis of activities of cybergroups and publication of tools that help to effectively confront attackers. We actively contribute to the global struggle against cybercrime, analyze attackers' tactics and techniques, and share the results of our findings in our blog. Our specialists investigated attacks by such groups as:

  • Higaisa (Winnti, APT41). The group became famous for its attacks on computer game developers.
  • TaskMasters. The main objective of the group is to steal confidential information belonging to organizations. The attackers attempt to burrow into corporate information systems for extended periods and obtain access to key servers, executive workstations, and business-critical systems.
  • Calypso. The group has been active since at least September 2016. The primary goal of the group is theft of confidential data.
  • TA505. The group has been active since 2014. During six months in 2019, the group attacked at least 26 companies in 64 countries. Targets: banks, research institutes, energy companies, healthcare, and aviation. The malefactors are drawn towards finance and intellectual property.

During ransomware epidemics (such as NotPetya), our company was among the first ones to share recommendations on how to localize threats and recover systems.

All our expertise is available in public sources and is used as a basis for the development of our security solutions.

Positive Technologies calls upon all information security researchers to follow the principles of responsible disclosure and invites them to take part in the Positive Hack Days 10 international security forum.

Related articles
Related articles

Cybersecurity Threatscape 2019

Vulnerabilities and threats in mobile banking

Security trends & vulnerabilities review: web applications (2017)
All articles