SquareX Team @SquareXTeam

According to @getsquarex the company's newly published browser syncjacking attack could enable full browser and device takeover. Yikes. infosecurity-magazine.com/news/full-brow…

Using Secure Web Gateways? NEWSFLASH: SWGs cannot protect you against Last Mile Reassembly Attacks. During our #DEFCON32 talk, we demonstrated classes of web attacks that can bypass any #SWG, no matter how advanced they are. Check if your organization is vulnerable at browser.security #cybersecurity #enterprisebrowser #browser #SASE #SSE

CISOs need more than technical skills. One of the most important qualities for #CISOs is "the ability to stay calm under pressure when dealing with a crisis. Kicking off the insight sharing from our Industry Report is our first contributor: Eifion Jones, Director of Cyber Security - Global Practice at TENTEN Partners! He shares his insights on the changing demands for #cybersecurity professionals, the kind of threats that keep CISOs awake at night, and what blend of skills makes a great CISO. Read the full report here 👇🏻 Interested in contributing your insights on browser security? Comment down below or drop us a DM!

keyboard_arrow_left Previous keyboard_arrow_right Next

In Episode 3 of the Be Fearless podcast we have a special guest - Anand Prakash @anandpraka_sh , Founder of Pingsafe (now acquired by SentinelOne). I personally had the good fortune to invest in his company in the seed round - thanks to an introduction by Anandamoy Roychowdhary @smdcmc In this conversation, Anand shares his journey from discovering hacking in cyber cafes to becoming a top bug bounty hunter and successful cybersecurity entrepreneur. Episode Highlights: 1. Introduction and starting as a bug bounty hunter 2. The story behind earning $12,500 for a single bug 3. Starting a career in cybersecurity 4. From Flipkart employee to starting PingSafe 5. Meeting Sequoia SEA @peakxvpartners 6. The journey to acquisition 7. On success as an entrepreneur 8. Thoughts on the cybersecurity startup ecosystem in India youtube.com/watch?v=g9xwi7…

External contractors and clients might share legitimate documents with your employees through SharePoint, Google Drive, and other trusted services. However, some SharePoint links could redirect employees to deceptive sites after multiple hops. With a Secure Web Gateway (SWG), you can create domain rules to whitelist all trusted SharePoint accounts and block employees from interacting with unauthorized accounts. This is an intensive process, as the list needs to be curated across the entire organization. Additionally, such a whitelist can impede productivity when new vendors interact with employees. As a browser-native solution, SquareX has full visibility into the user's navigation around the web and allows for policies to be applied on a workflow level. With SquareX, you can create a policy that whitelists your company's SharePoint account while adding additional checks or blocks on all third-party accounts. In this demo, a user lands on a third-party SharePoint page and, after multiple hops, is required to log in to their Microsoft account. The page is a phishing site, and the policy to block data input if the user's page visit path originated from a third-party SharePoint account is triggered. Want to try SquareX for your enterprise? Sign up for a free pilot sqrx.com/enterprisepilot

A malicious office document in Teams or Slack, now spreading virally within your organization? This could happen via a compromised user account or a legitimate user receiving a malicious document over email/web and sharing it internally. Unfortunately this is more common than you think and many of these web channels do not have adequate scanning capabilities. In this video, we show you a demo of such a malicious document goes undetected in Teams and might end up spreading virally within your organization. With SquareX you can solve this on the client-side by deploying a policy by blocking uploads of malicious/suspicious office documents. Want to secure your organization against these attacks? try SquareX enterprise today: sqrx.com @getsquarex

Our customer success and product teams are working tirelessly to speak with prospective customers and understand the company’s use cases and pain points that SquareX can solve. Want to speak to us? Sign up for our enterprise pilot and get on a call with the team today: sqrx.com/enterprisepilot

Are all employees in your organization using strong passwords for daily web application logins? Can you accurately collect those datapoints, or enforce rules for them to do so? If you are using a web proxy or an endpoint security solution, there’s a high chance that you won’t be able to enforce such a policy. Many sites encrypt the password before it is sent through the network, rendering the password data opaque to the security solutions. Strong passwords help defend against brute force attacks and password spraying. With SquareX, admins can create a policy to enforce the use of strong passwords across the whole world wide web, amongst employees. Read more on how SquareX can help your organization prevent identity attacks: labs.sqrx.com/identity-crisi… Other use cases covered at sqrx.com @getsquarex

Do your employees use the company identity to sign up for random services online as its easy to just click and do SSO? Unfortunately, many 3rd party SaaS apps often request overly broad permissions, like full Google Drive access, when they only need specific file creation permissions. This becomes highly risky if the third party service gets compromised or if the app itself is deliberately malicious. So how can you protect your organization but still allow your employees to sign in to 3rd party apps using their company identity? SquareX allows you to define OAuth scopes to allow or block apps based on their requested permissions. More demos on how SquareX can protect you from identity attacks: sqrx.com/usecases/ident… Sign up for an Enterprise Pilot here: sqrx.com/enterprisepilot @getsquarex

Would uploading and sending EXEs be OK with your enterprise policy? 🤔 🙄 In this video, we show you how SquareX can help build File Upload policies which can block EXE uploads - not just based on file extension analysis (does it end with a .exe) but also analyzing the file itself so that extension renaming attacks can't work (popular technique is to combine this with social engineering). So how do we do it? Send the file back to the server? Nopes - our in-browser file scanner has the ability to do this entirely in the browser itself! Making this both fast and privacy-first! Checkout dozens of other demos: sqrx.com and sign up for an Enterprise Pilot! @getsquarex

ChatGPT does not have any official browser extension but there are thousands of extensions on the browser stores claiming to integrate/provide access to it. Unfortunately, a large majority of them are malicious extensions and once they get installed with permissive permissions, they can steal credentials and data. Currently there is no easy way to block employees from using these extensions. Even through a Chrome Enterprise, you cannot create a rule to block these ChatGPT related extensions as the Chrome Store does not have a separate category for them. With SquareX @getsquarex , every piece of information about an extension can be used to create policies to allow, block or isolate these extensions. This includes the extension name, description, publisher information, ratings, reviews, user count and so on. Want to try SquareX Enterprise? Sign up now: sqrx.com/enterprisepilot

Malicious QR codes are every enterprise's nemesis! Attackers use this as an Out-Of-Band (OOB) channel to get the users to visit a malicious link on their phones where conducting credential stealing spear-phishing attacks is a lot simpler. The ONNX Phishing-as-a-service group launched attacks targeting financial organizations, sending PDFs with QR Codes that direct users to malicious websites. The problem with quishing attacks is that the user is usually on their mobile phones and are no longer protected by Secure Web Gateways or Endpoint Security. Neither can these solutions prevent the user from scanning the QR code as they have no visibility to a QR code being present on the browser screen. With SquareX Enterprise edition you can now Detect-Block this attack predictably! Wherever a QR code is on the web browser, SquareX can correctly identify it, unfurl it, and detect malicious links. In the video demo below we detect and block a phishing attempt on a Microsoft account. We also have the capability to isolate QR code links or to outright block them based on enterprise policy. A more detailed blog post here: labs.sqrx.com/malicious-qr-c… Contact us for an enterprise pilot today : sqrx.com @getsquarex

A simple yet powerful way to fool many AV/Email Scanners is to just rename the file, and then orchestrate a social engineering attack to have the target rename it on his computer. SquareX @getsquarex can detect the true MIME type of a file and point out that a file download / the email attachment is not actually in a format that it claims. We have a ton of other use cases on our website: sqrx.com

There are classes of attacks that are orchestrated entirely within the browser that both cloud proxies and endpoint security have no visibility into. One such attack is the Browser-in-the-browser (BitB) phishing attack, where a browser view is embedded within a page, appearing as a window popup. Users get tricked into entering their data into these seemingly unassuming pages. Enterprises can leverage SquareX to block employees from facing BitB attacks. For instance, if an enterprise is using Okta for authentication, then a simple site content policy to check for Okta login content against the domain can be done effectively, using SquareX. A demonstration of this is shown against the recent and ongoing ‘Steamcommunity’ phishing attack that is propagated through Discord. Simply using a screenshot of the actual phishing page, you can see the power of SquareX’s detection technology. The phishing site is already down so we simulated one locally. If this interests you, reach out to me at founder [] sqrx.com to chat. Youtube video credit: @ NoTextToSpeech

This problem is not unique - many organizations struggle with typosquatting attacks including those done on an eTLD level (the suffix included in the domain i.e. .com). In your case, .ml and other common eTLDs were used to phish users who are looking for the .mil sites. SquareX has a very elegant solution to prevent employees from accidentally stumbling upon such typosquatting links - by leveraging our AI policy copilot, admins can simply mention the eTLDs to allow or block, as shown in this quick demonstration.  The interesting part here is how easily the policy engine handles wildcard cases where legitimate domain names could be paired with any combination of eTLDs to provide users with comprehensive protection! Here is quick demo of how to solve this with @getsquarex

Tune in to hear as our founder @vivekramac and @thedarktangent, founder of DEF CON and Black Hat chat about: - Jeff Moss' origin story - the inception of DEF CON and Black Hat - his insights into the current worldwide threatscape - and more Watch it here: youtube.com/watch?v=lMWp05…

Was an exciting day today! We wanted to launch a podcast dedicated to discussing cybersecurity attacks including web threats for a while and we finally got started! We were lucky enough to get none other than Jeff Moss @thedarktangent , the founder of @defcon and @BlackHatEvents , who graciously accepted our request to feature in our inaugural episode! We spent almost 90 minutes talking about Jeff's journey into cybersecurity, how he build DEF CON and BlackHat into the world's largest cybersecurity conferences, his advisory work with leading government organizations and public companies and his views about the current worldwide threatscape. We will be releasing the full episode early next week after post-production but here is a sneak preview! @getsquarex

We are super excited to unveil our enterprise product at RSA next week! I will be personally there with our team @shouryaps @JuniceLiew and @dakshitaababu . If you are an enterprise worried about your users getting attacked when they are online, come see us! Book an appointment: getstarted.sqrx.com/rsa @getsquarex

@Vicky_kumar2 @getsquarex Thank you for the feedback! We've passed it to the team who will be taking a look at it😊