Cyber News Roundup for December 20, 2024

/by

In this week’s roundup, we’re seeing significant cybersecurity threats making headlines across the globe. APT29, linked to Russia’s SVR, has launched a widespread spearphishing campaign, while CISA is advising high-risk individuals on securing their communications in the face of ongoing Chinese espionage activities. We also dive into rising risks from Mirai malware infections, the latest on the TikTok ban challenge, and emerging vulnerabilities in devices ranging from routers to cameras. Stay ahead of the curve with the latest cyber developments.

 

APT29 launches widespread rogue RDP campaign
Trend Micro has published a report on a spearphishing campaign by Russia’s APT29 (tracked by Trend Micro as “Earth Koshchei”) designed to trick recipients into using a rogue RDP configuration file, causing their machines to connect to one of the threat actor’s RDP relays. APT29 has been widely attributed to Russia’s foreign intelligence service, the SVR. The campaign, which peaked in October, targeted governments, armed forces, think tanks, academic researchers, and Ukrainian entities. Trend Micro explains, “The RDP attack begins when the victim attempts to use the .RDP file that was sent in a spear-phishing attack. This then makes an outbound RDP connection to the attacker’s first system (Figure 2). Here, the attacker employs PyRDP to act as a MITM proxy, intercepting the victim’s connection request. Instead of connecting the victim to what they think is a legitimate server, the PyRDP proxy redirects the session to a rogue server controlled by the attacker. This setup enables the attacker to pose as the legitimate server to the victim, effectively hijacking the session. By doing so, the attacker gains full visibility and control over the communication between the victim and the RDP environment.” (Trend Micro)
CISA issues security guidance for highly targeted individuals amid Salt Typhoon hacks
The US Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory yesterday recommending that “highly targeted individuals” use end-to-end encrypted apps such as Signal amid ongoing Chinese espionage campaigns targeting US telecom providers. The advisory is meant for “individuals who are in senior government or senior political positions and likely to possess information of interest to these threat actors,” though the guidance is applicable to anyone interested in securing their communications. The agency says highly targeted individuals “should assume that all communications between mobile devices—including government and personal devices—and internet services are at risk of interception or manipulation.” (CSIA)

 

BeyondTrust suffers cyberattack

BeyondTrust, a cybersecurity company specializing in Privileged Access Management (PAM) and secure remote access solutions, itself suffered a cyberattack in on December 2. “Its products are used by government agencies, tech firms, retail and e-commerce entities, healthcare organizations, energy and utility service providers, and the banking sector.” After detecting “anomalous behavior” it was determined that “hackers gained access to a Remote Support SaaS API key that allowed them to reset passwords for local application accounts.” “BeyondTrust immediately revoked the API key, and notified known impacted customers. It is not yet clear whether the threat actors were able to use the compromised Remote Support SaaS instances to breach downstream customers. (BleepingComputer)

Fortinet warns of critical flaw in Wireless LAN ManagerThis flaw, which has now been patched, tht could have allowed admin access and sensitive information disclosure on the Wireless LAN Manager (FortiWLM) product. Security researcher Zach Hanley from Horizon3.aistated that the vulnerability, which has a CVE number as well as a CVSS score of 9.6, “enables remote attackers to exploit log-reading functions via crafted requests to a specific endpoint.” A subsequent report from Horizon3 stated that FortiWLM’s verbose logs “expose session IDs, enabling attackers to exploit log file read vulnerabilities to hijack sessions and access authenticated endpoints.” The CVE number for this vulnerability is available in the show notes to this episode. CVE-2023-34990 (Security Affairs)

Juniper routers with default passwords are attracting Mirai infections, says manufacturer

According to an advisory from Juniper, customers last week started reporting “suspicious behavior” on their Session Smart Routers. What the customers all had in common was that they were still using the factory-set passwords on the devices. Investigation found a variant of Mirai malware that had been scanning for such vulnerable routers. Once infected, the devices were “subsequently used as a DDOS attack source” attempting to disrupt websites with junk traffic, Juniper says. The company does not mention how many devices were infected or where the attacks were directed. Juniper recommends that customers with Session Smart Routers “immediately apply strong, unique passwords and continue to monitor for suspicious network activity such as unusual port scanning, increased login attempts and spikes in outbound internet traffic.” (The Record)

 

CISA issues a Binding Operational Directive requiring federal agencies to enhance cloud security

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued Binding Operational Directive (BOD) 25-01, requiring federal agencies to enhance cloud security by adopting secure configuration baselines. The directive aims to mitigate risks from misconfigurations and weak controls by mandating compliance with CISA’s Secure Cloud Business Applications (SCuBA) standards. Agencies must identify cloud tenants and create an inventory by February 21, 2025, deploy SCuBA assessment tools by April 25, 2025, and implement mandatory SCuBA policies, including Microsoft Office 365 baselines, by June 20, 2025. Annual updates to cloud tenant inventories and continuous reporting are also required. CISA plans to maintain and update policies, assist agencies, and monitor compliance. While directed at federal agencies, CISA encourages broader adoption to bolster collective cybersecurity resilience.

Meanwhile, the Office of the National Cyber Director and CISA released a playbook to guide federal grant managers and recipients on integrating cybersecurity into critical infrastructure projects. The “Playbook for Strengthening Cybersecurity in Federal Grant Programs” offers model language and recommendations for incorporating cybersecurity into grant-making processes and project assessments. Reflecting Biden administration priorities like the Investing in America initiative, the playbook emphasizes secure-by-design principles and critical infrastructure resilience. While advisory, it encourages agencies and grant recipients to prioritize cybersecurity in upcoming infrastructure upgrades. (SecuityWeek, CISA)

 

HiatusRAT malware operators are scanning for vulnerable web cameras and DVRs

The US FBI has issued an alert warning that HiatusRAT malware operators are conducting scanning campaigns against Chinese-branded web cameras and DVRs across the US, Australia, Canada, New Zealand, and the United Kingdom. The Bureau states, “The actors scanned web cameras and DVRs for vulnerabilities including CVE-2017-7921, CVE-2018-9995, CVE-2020-25078, CVE-2021-33044, CVE-2021-36260, and weak vendor-supplied passwords. Many of these vulnerabilities have not yet been mitigated by the vendors. In particular, the actors targeted Xiongmai and Hikvision devices with telnet access.” The FBI recommends limiting the use of these devices or isolating them from the rest of the network. (FBI)

 

Supreme Court to hear TikTok ban challenge

The long road to a TikTok ban in the US might be approaching a final stop. As a refresher, Congress passed a law in April requiring ByteDance to divest TikTok or see the app cut off from app stores and web-hosting services in the US. That law is set to go into effect on January 19th. On December 6th, a DC Circuit appeals court ruled that Americans saw concerns over the Chinese government’s ability to gather data and potentially manipulate content as “well-founded” and represented a “compelling national security interest.” Now, the US Supreme Court will hear TikTok’s challenge to that ruling on January 10th. The outgoing Biden administration will present the government’s case. (CBS)

 

US weighs TP-Link ban

The Wall Street Journal reports that the U.S. government is considering a ban on TP-Link routers amid rising security concerns. Investigations by the Commerce, Defense, and Justice Departments suggest TP-Link routers, made by a China-based company, may pose national security risks. A Microsoft report linked TP-Link devices to a Chinese hacking network targeting Western organizations. The devices dominate the U.S. home and small-business router segment with a 65% market share TP-Link routers are often shipped with unresolved security flaws, and the company reportedly doesn’t cooperate with security researchers. The Justice Department is also probing whether TP-Link’s low pricing strategy violates antitrust laws. The potential ban could disrupt the router market, which TP-Link has dominated due to affordability and partnerships with over 300 U.S. internet providers.

TP-Link denies selling products below cost and insists on compliance with U.S. laws. While U.S. officials haven’t disclosed evidence of deliberate collusion with Chinese state-sponsored hackers, concerns persist. TP-Link’s founders remain connected to Chinese institutions conducting military cyber research. Despite efforts to rebrand as U.S.-centric, including announcing a California headquarters, critics see the company’s ties to China as inseparable. If enacted, the ban would mark the largest removal of Chinese telecom equipment in the U.S. since Huawei in 2019. Similar bans have been enacted in Taiwan and India, citing security risks. The move underscores the broader challenges of securing the telecommunications supply chain, with U.S. officials acknowledging systemic vulnerabilities across the router market, including domestic brands. (WSJ)

 

Cisco data leaked

In October, the threat actor IntelBroker claimed they had obtained data from Cisco in a breach, including source code and encryption keys. A company investigation found this data was obtained from a public-facing DevHub environment. This ordinarily hosts source code and other materials meant for public consumption, but Cisco said a configuration error caused some private data to be inadvertently published. This week, IntelBroker published 2.9 gigabytes of data obtained from DevHub, claiming they obtained a total of 4.5 terabytes. Since its initial incident reports on the leaked data, Cisco removed a statement saying it found no evidence that personal information or financial data was compromised. (Security Week)

 

Microsoft quietly patches two potentially critical vulnerabilities

Microsoft announced the patching of two potentially critical vulnerabilities in Update Catalog and Windows Defender. These flaws, tracked as CVE-2024-49071 and CVE-2024-49147, have been fully mitigated and require no user action. The Windows Defender flaw, rated medium-severity based on CVSS scores, could have allowed unauthorized disclosure of sensitive file content over a network due to improper index authorization. The Update Catalog vulnerability, involving deserialization of untrusted data, was a privilege escalation issue on the webserver. Microsoft emphasized that neither flaw was disclosed publicly nor exploited before patching. The company is now assigning CVE identifiers to cloud service vulnerabilities for transparency, following industry trends. Similar measures have been adopted by Google Cloud, reflecting growing emphasis on proactive security and communication about server-side vulnerabilities. (SecurityWeek)

Iran-linked threat actor deploys new ICS malware

Researchers at Claroty have discovered a new strain of IoT/OT malware “IOCONTROL” used by Iran-affiliated attackers to target devices in Israel and the US. The researchers state, “IOCONTROL has been used to attack IoT and SCADA/OT devices of various types including IP cameras, routers, PLCs, HMIs, firewalls, and more. Some of the affected vendors include: Baicells, D-Link, Hikvision, Red Lion, Orpak, Phoenix Contact, Teltonika, Unitronics, and others.” Notably, Claroty says, “One particular IOCONTROL attack wave involved the compromise of several hundred Israel-made Orpak Systems and U.S.-made Gasboy fuel management systems in Israel and the United States. The malware is essentially custom built for IoT devices but also has a direct impact on OT such as the fuel pumps that are heavily used in gas stations.” The malware has been deployed by a threat actor tracked as the “CyberAv3ngers,” which is believed to have ties to Iran’s Islamic Revolutionary Guard Corps Cyber Electronic Command (IRGC-CEC). (Claroty)

 

South Carolina credit union suffers cyberattack

SRP Federal Credit Union, one of the largest credit unions in South Carolina, filed breach notification documents with regulators in Maine and Texas on Friday following suspicious activity detected on its network. Initial investigations show that threat actors accessed the network at times between September 5 and November 4, of this year, and “potentially acquired certain files…during that time.” The Texas filing stated that the stolen data included names, Social Security numbers, driver’s license numbers, dates of birth and financial information like account numbers as well as credit or debit card number. The Nitrogen ransomware gang has claimed responsibility for the attack and for the theft of 650GB of customer data. The credit union company has not yet confirmed that it was a ransomware attack.(The Record)

 

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts or schedule a demo today.

Tales from the Trenches: The Other F-word

/by

Today’s Tales from the Trenches is brought to you by Bill Burge, Senior Security Solutions Consultant.

When you’re first diving into network modeling with RedSeal, one of the initial tasks is connecting to network devices to gather their configurations. It’s a step that seems simple enough, but that elusive F-word, “Failed” becomes an all-too-familiar sight. But here’s the thing—each network has its own set of requirements, and once you crack the code, things move pretty smoothly.

That is, unless one device (or a whole set of them) decides to be a rebel. Suddenly, you’re stuck with the F-word. But wait—could that “F” word actually stand for something else? Could it be “Finding” instead of “Failed”? Maybe, just maybe, while you’re trying to pull configurations to find potential network issues, you’ve already stumbled upon something valuable about the network itself.

Customer 1: The Vegas Shuffle

Imagine this: a major Las Vegas resort and casino is trying to connect a seemingly simple firewall to a T1 for their “deal of the day” promotions. Sounds straightforward, right? Well, don’t get too excited yet. Despite repeated efforts, all they get is that dreaded “Failed.” The firewall team insists it’s up and running, and they’re logged in. Still, nothing but failure.

A bit of digging reveals the issue—turns out the IP address we’re trying to connect to is on the inside transit network of the firewall. The same subnet is defined as the failover link between the two core routers. When asked, NetOps (with a few “C” titles sprinkled in) were asked what would happen if one core router failed. Their response? The entire internal data traffic would reroute to the T1 link, leading to the “deal of the day” server. Suddenly, “Failed” isn’t just a failure—it’s a crucial finding that was previously unknown to the team.

Customer 2: The European Firewall Fiasco

Now let’s talk about a hardware and software manufacturer with a global presence. They’ve got firewalls scattered worldwide, and I’m given a list of firewalls along with a TACACS credential that’s “good for every firewall in the network.” Sounds too good to be true, doesn’t it?

After creating a couple thousand data collection tasks, everything seems to be humming along—until we hit the dreaded F-word again. But this time, something strange happens: the failed devices share a pattern. Upon investigating, we uncover that all the firewalls in Europe are pointed to the wrong TACACS server. That’s a major design flaw that had slipped under the radar, and it only came to light when RedSeal couldn’t pull the necessary data.

In each of these cases, what appeared initially to be failures, turned out to be incredibly valuable findings. We were able to uncover network design issues that had gone unnoticed until the F-word reared its head.

So, next time you see “Failed,” don’t just assume it’s the end of the world. It might just be the beginning of a crucial network discovery!

Reach out to RedSeal or schedule a demo today today for a personalized walkthrough and discover how RedSeal can revolutionize your approach to cybersecurity.

Proactive Cybersecurity: Defending Against Neighbor-Based WiFi Attacks

/by

The ever-evolving tactics of cyber adversaries highlight the need for organizations to remain vigilant. A recent example of this sophistication is the “Nearest Neighbor Attack,” (covered in our Cyber News Roundup) orchestrated by the advanced persistent threat (APT) group, APT-28. In this attack, APT-28 bypassed traditional multi-factor authentication (MFA) defenses by exploiting physical proximity and infiltrating a neighboring WiFi network. This case underscores the critical need for proactive cybersecurity measures, including robust network segmentation and continuous validation.

What happened? A breakdown of the nearest neighbor attack.

The Nearest Neighbor Attack demonstrated a clever exploitation of physical proximity to compromise security. APT-28 infiltrated a WiFi network belonging to a neighbor of their target organization. By leveraging pre-obtained WiFi credentials, they bypassed MFA—a safeguard typically effective for internet-facing systems. Once inside, they exploited the trust inherent in internal network communications to move laterally and achieve their objectives.

What makes this attack particularly concerning is its reliance on non-internet-facing vulnerabilities. Instead of attacking through traditional remote means, APT-28 circumvented MFA by exploiting internal network trust, a strategy that many organizations overlook. This approach highlights a growing trend: attackers targeting physical access points to bypass otherwise robust security measures.

Lessons learned: The gaps in network security

The Nearest Neighbor Attack reveals several gaps in conventional cybersecurity strategies:

  • Over-reliance on MFA: While MFA is effective for internet-facing systems, it does not protect against threats that exploit internal network weaknesses.
  • Lack of network segmentation: Without segmentation, a compromised WiFi network can provide attackers with unimpeded access to critical systems.
  • Insufficient monitoring: Many organizations fail to detect anomalous activity originating from unexpected physical locations, such as neighboring WiFi networks.

Key takeaway: Physical proximity is an increasingly viable attack vector. Relying on assumed trust within internal systems leaves organizations vulnerable to breaches, reinforcing the need for comprehensive, proactive defenses.

Proactive defense strategies: Why segmentation matters

Network segmentation is a fundamental strategy in proactive cybersecurity. By dividing a network into isolated segments, segmentation limits an attacker’s ability to move laterally and access sensitive systems. This approach creates barriers that prevent attackers from reaching critical assets, even if they breach a less secure segment. Additionally, segmentation minimizes the exposure of sensitive systems to potential threats, effectively reducing the overall attack surface. Practical applications of segmentation include maintaining separate WiFi networks for guests, employees, and IoT devices to restrict entry points, as well as using VLANs and firewalls to enforce strict access controls between segments. These measures collectively strengthen an organization’s defenses against cyber threats.

Solutions like RedSeal enhance segmentation by automating and continuously validating compliance with predefined and custom policies. It simplifies regulatory adherence to standards like GDPR, HIPAA, and PCI DSS while reducing manual errors and inefficiencies.

A pioneer in cybersecurity, RedSeal will:

  • Validate segmentation policies for internal and regulatory compliance.
  • Automate vendor best practices, such as Cisco SAFE.
  • Reduce your attack surface by ensuring segmentation success.
  • Save time and resources through automation.

Expanding the security framework beyond segmentation is essential for a comprehensive defense strategy. While segmentation provides a critical layer of protection, it must be combined with other measures to create a robust, multi-layered security approach. This includes using intrusion detection systems (IDS) and endpoint protection to monitor and respond to threats in real time, conducting regular WiFi audits to identify weak or shared networks that could be exploited, and implementing behavioral analytics tools to detect and address unusual access patterns. Additionally, physical security plays a crucial role in preventing unauthorized access to buildings and network devices. By securing critical infrastructure, organizations can stop attacks like the Nearest Neighbor Attack before they begin, adding an extra layer of protection to their cybersecurity posture.

Stay ahead with proactive security

The Nearest Neighbor Attack serves as a stark reminder of the evolving tactics used by cyber adversaries. Organizations must not only address current vulnerabilities but also anticipate future threats.

By adopting proactive measures like network segmentation, leveraging tools like RedSeal for continuous validation, and implementing multi-layered defenses, businesses can stay one step ahead. The key to modern cybersecurity lies in preparation and adaptability—ensuring that no weak link, physical or digital, can compromise the network.

The lesson is clear: vigilance, innovation, and proactive strategies are essential in today’s ever-changing threat landscape. Don’t wait for the next attack to act—secure your networks now. Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts or schedule a demo today.

Cyber News Roundup for December 13, 2024

/by

In this week’s cybersecurity news roundup, we cover a range of critical vulnerabilities and ongoing threats. Highlights include the disclosure of a severe Apache Struts 2 vulnerability with a high CVSS score, a potential shift in U.S. Cyber Command and NSA leadership, and a Microsoft MFA bypass attack named AuthQuake. We’re also seeing a series of high-stakes cyberattacks, including the exploitation of AWS misconfigurations, a ransomware assault on Electrica Group, and a breach at Krispy Kreme. As cyber risks continue to evolve, these incidents serve as a stark reminder of the need for robust security measures.

 

A critical vulnerability in Apache Struts 2 has been disclosed

A critical vulnerability in Apache Struts 2, CVE-2024-53677, has been disclosed with a near-maximum severity score: 9.5 (CVSSv4) and 9.8 (CVSSv3). This flaw allows remote code execution via malicious file uploads and lacks a workaround, making patching to Struts 6.4.0 or higher essential. Applications not using the deprecated File Upload Interceptor are unaffected. Updating requires rewriting actions for compatibility. Despite alternatives, Struts 2 remains popular, with significant downloads monthly. The vulnerability underscores risks, recalling Struts’ role in the 2017 Equifax breach. (The Register)

 

Trump advisors explore splitting NSA and CyberCom leadership roles

Advisers to President-elect Donald Trump are revisiting plans to separate U.S. Cyber Command (CyberCom) and the National Security Agency (NSA), currently led under a “dual-hat” structure. This idea, previously explored during Trump’s first term, has resurfaced within the transition team and right-wing think tanks. Proponents argue the roles are too vast for one leader, while critics warn of operational inefficiencies and risks to NSA’s intelligence-gathering integrity.

The arrangement, established in 2010, has sparked debates across administrations, with President Biden’s 2022 review favoring its retention. Legal hurdles exist, but Trump could bypass Congress with executive actions. A split would raise complex restructuring questions and could dilute CyberCom’s and NSA’s effectiveness. Lawmakers remain skeptical, emphasizing the need for clear justification. Critics also highlight the irony of Trump’s anti-bureaucracy stance driving a move that could create new administrative challenges. For now, the dual-hat structure remains intact. (The Record)

 

Microsoft MFA bypassed in AuthQuake PoC

Researchers at Oasis Security presented details of an attack technique that could have given threat actors access to Outlook emails, OneDrive files, Teams chats, and Azure cloud instances. Needing only an hour to execute, it required no user interaction, and it would not trigger any notification to the victim. The attack is based on exploitation of the authenticator app process, in which a user to obtains a six-digit MFA code on their app. The researchers saw that one session supports up to 10 failed attempts to prevent brute-force attacks, but they then saw that an attacker could execute multiple attempts simultaneously, enabling them to go through possible combinations relatively fast. Oasis named this attack method AuthQuake, and reported it to Microsoft in late June. A temporary fix was deployed a few days later, followed by a permanent fix in October. (Security Week)

 

Ivanti reports multiple critical vulnerabilities in its Cloud Services Application

Ivanti has issued a security advisory for three critical vulnerabilities in its Cloud Services Application (CSA), including a maximum CVSS 10-rated flaw, CVE-2024-11639, which allows unauthenticated attackers to gain administrative privileges via authentication bypass in the admin web console. Two additional vulnerabilities, both rated 9.1, include a command injection flaw (CVE-2024-11772) enabling remote code execution and an SQL injection bug (CVE-2024-11773) that allows arbitrary SQL commands. These flaws are exploitable in CSA versions 5.0.2 and earlier, with patches available in version 5.0.3. Ivanti stated there is no evidence of exploitation but urges immediate updates to prevent potential attacks. This follows previous high-profile CSA vulnerabilities flagged by CISA due to active exploitation risks. (The Register)

 

Chinese APT abuses Visual Studio Code Tunnels for C2 purposes

SentinelOne has published a report on a Chinese cyberespionage campaign that targeted “large business-to-business IT service providers in Southern Europe” from late June to mid-July 2024. The threat actor used SQL injection against Internet-facing web and database servers to gain initial access. The campaign was detected and disrupted during its early stages. Notably, the operation abused Visual Studio Code Remote Tunnels for command-and-control purposes. The researchers explain, “Originally designed to enable remote development, this technology provides full endpoint access, including command execution and filesystem manipulation. Additionally, Visual Studio Code tunneling involves executables signed by Microsoft and Microsoft Azure network infrastructure, both of which are often not closely monitored and are typically allowed by application controls and firewall rules. As a result, this technique may be challenging to detect and could evade security defenses. Combined with the full endpoint access it provides, this makes Visual Studio Code tunneling an attractive and powerful capability for threat actors to exploit.” (SentinelOne)

 

Operation PowerOFF hits DDoS sites

Europol announced that a coordinated law enforcement effort across Finland, Australia, Brazil, Canada, the UK, and US led to the shutdown of 27 popular DDoS attack platforms. Dubbed Operation PowerOFF, the effort identified over 300 users of these platforms and the arrests of three administrators. Europol said it timed the takedowns ahead of the December holiday season to prevent the typical spike in DDoS attacks that cause “severe financial loss, reputational damage, and operational chaos for their victims.” (The Record)

 

AI voice generation likely used in influence operation 

Researchers at Recorded Future cited the use of generative AI voice generation technology in a recent Russian-tied campaign to weaken Europe’s support for Ukraine. The researchers found it “very likely” the campaign used commercial AI voice generation products in their efforts, including tech from ElevenLabs. These voices were used over supposed news clips to present Ukranian politicians as corrupt. The tech allowed the campaign to produce videos quickly in various languages across the EU using native speech patterns and dialects. Recorded Future concluded the actual impact of the campaign on public opinion was minimal. (TechCrunch)

 

Krispy Kreme hit with cyberattack

In “affront to all that is sacred” news, the US donut chain Krispy Kreme confirmed it suffered a cyberattack in an SEC filing. The attack began on November 29th, with ongoing impacts on online ordering in the US as of this recording. The attack did not impact in-person ordering and retail deliveries. In its Q3 earnings, the company reported digital orders represented 15.5% of sales. Krispy Kreme immediately sought outside expertise after discovering the attack, but no other details have been released. So far, no threat actors have taken credit for the attack. (Bleeping Computer)

 

Contenders for top cyber roles in the next Trump administration visit Mar-a-Lago

Brian Harrell, a seasoned veteran of the Department of Homeland Security (DHS) under the Trump administration, is reportedly a leading contender for high-ranking cybersecurity roles in the next administration, The Record reports. Sources familiar with the situation reveal that Harrell has been invited to Mar-a-Lago in the coming weeks to interview for roles such as director of the Cybersecurity and Infrastructure Security Agency (CISA) and DHS undersecretary for strategy, policy, and plans. Harrell, who previously served as DHS assistant secretary for infrastructure protection, is well-regarded for his expertise in safeguarding critical infrastructure. Recorded Future News first reported his candidacy for these prominent positions.

He is not the only one under consideration. Matt Hayden, former DHS assistant secretary for cyber, infrastructure, risk, and resilience, and Sean Plankey, a former National Security Council cyber team member and acting assistant secretary at the Department of Energy’s cybersecurity office, are also being discussed for potential leadership at CISA. Two sources confirmed Plankey’s name in the mix for the top CISA role. The forthcoming Mar-a-Lago interviews are part of broader plans to fill key positions within DHS, not only in cybersecurity but also in areas such as immigration enforcement and leadership roles at the Transportation Security Administration (TSA). This diverse hiring strategy reflects the transition team’s focus on securing leadership across various critical sectors. (The Record)

 

A Dell Power Manager vulnerability lets attackers execute malicious code

A critical vulnerability (CVE-2024-49600) in Dell Power Manager, used to manage power settings on Dell systems, allows attackers with local access and low privileges to execute malicious code and escalate privileges. Affecting versions prior to 3.17, the flaw stems from improper access control, enabling unauthorized access to sensitive system functions and potential full system compromise. Rated with a CVSS score of 7.8 (high severity), the vulnerability requires local access but is low in complexity and does not need user interaction. Dell has released version 3.17 to address the issue, urging users to update immediately. No workarounds exist, emphasizing the need for timely patching and robust endpoint security to mitigate risks. (Cyber Security News)

 

Hackers exploit AWS misconfigurations in massive data breach

Independent cybersecurity researchers, Noam Rotem and Ran Locar, uncovered a significant cyber operation exploiting vulnerabilities in public websites hosted on Amazon Web Services (AWS). Researchers linked the campaign to the Nemesis and ShinyHunters hacking groups who used tools like Shodan to scan AWS public IP ranges for application vulnerabilities or misconfigurations. They then scanned exposed endpoints for sensitive data, including credentials for popular platforms like GitHub, Twilio and cryptocurrency exchanges. Verified credentials were later marketed on Telegram channels for hundreds of euros per breach. The researchers and AWS advised customers to avoid use of hard-coded credentials by using services like AWS Secrets Manager, periodically rotating keys and secrets, deploying Web Application Firewalls (WAFs), and using CanaryTokens as tripwires for sensitive information. (Infosecurity Magazine and Dark Reading)

 

Romanian energy giant battles ongoing attack

A cyberattack is in progress—that’s the note investors for the Electrica Group received on Monday. Electrica Group provides energy to more than 3.8 million customers in Romania and is considered one of the most important energy service companies in the country. Providing limited details, a statement from the company’s CEO said they are working to resolve the issue and identify the source of the attack. While not confirmed, the attack is believed to be tied to ransomware. The statement went on to say that critical systems have not been affected, but customers may notice disruptions in service that were purposely implemented to protect internal infrastructure. Some are speculating Russia may have had a hand in the attack after Romania blamed pro-Russian hackers last week for interfering in their presidential election, ultimately forcing the country to annul the results. (The Record)

 

Ransomware disrupts medical device maker

Medical device maker Artivion reports they are still working to restore systems following a November ransomware attack that encrypted files and disrupted order, shipping, and corporate operations. The medical device company, which makes and distributes aortic-centric cardiac and vascular medical products—think mechanical human heart valves and stent grafts to over 100 countries—said the attack has caused disruptions to some order and shipping processes, though the company has largely mitigated most disruptions. As of this recording, no ransomware group has claimed responsibility for the attack. (Security Week)

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts or schedule a demo today.

Mobilizing Teams for Consensus on Continuous Threat Exposure Management

/by

Managing threat exposures requires more than just identifying risks—it demands a coordinated, proactive approach to mitigation and remediation given an organization’s risk appetite and business priorities. This is where Continuous Threat Exposure Management (CTEM) comes into play, guiding organizations through a comprehensive process that culminates in the mobilization step—where plans and tools come to life. This stage focuses on bringing together diverse teams to assess, document, and operationalize strategies for managing threat exposures. While automation is invaluable for clear-cut issues, gray areas demand human expertise and cross-team collaboration to ensure the most effective and appropriate response for the business.

Why mobilization matters

Not all exposures are created equal. Some can be resolved with automated processes, but many others require careful deliberation and strategic planning. For these complex scenarios, mobilization is essential—it fosters communication and collaboration across teams, ensuring that all stakeholders are aligned in their approach. This not only addresses current challenges, but it creates a documented playbook that benefits the organization in the future. Mobilization transforms exposure management from a reactive process to a proactive, scalable practice.

 RedSeal: Your partner in CTEM mobilization

Unlike other platforms, RedSeal provides a unified source of truth for all stakeholders, delivering the insights and tools needed for effective collaboration:

  • Actionable evidence: RedSeal delivers detailed remediation guidance, including the logical and physical locations of affected assets and their access paths. This ensures that teams know exactly where to focus their efforts.
  • Unpatchable exposure management: For exposures that cannot be fixed, RedSeal provides containment strategies, helping teams mitigate risks while avoiding unnecessary downtime.
  • Proactive alerts: RedSeal notifies relevant stakeholders when policy violations are detected, enabling swift action and minimizing potential impact.
  • Executive-level insights: With an executive dashboard and a Digital Resilience Score, RedSeal helps measure CTEM progress over time. This ensures that leadership has the visibility needed to guide strategic decisions.

Building a culture of collaboration

Mobilizing teams for CTEM isn’t just about tools; it’s about creating a culture where collaboration and communication are prioritized. RedSeal bridges the gap between technical teams and business stakeholders, ensuring everyone is on the same page. With RedSeal, organizations can operationalize their CTEM strategies, not only addressing immediate threats but also building resilience for the future.

In a world where threats evolve rapidly, effective mobilization ensures that organizations stay one step ahead. With RedSeal, mobilizing your teams becomes not just a task but a strategic advantage.

Read about all steps of CTEM in our past blogs:

Critical to CTEM Success: Driving Effective Scoping

Navigating Cybersecurity Risks: RedSeal’s Discovery Solutions for CTEM

Prioritize to Protect: RedSeal’s Methodology for Effective Threat Exposure Management

Validating Threat Exposures: Strengthening Your CTEM Strategy

 

Reach out to RedSeal or schedule a demo today to learn how to bolster your cybersecurity efforts and enhance your CTEM program.

 

Cyber News Roundup for December 6, 2024

/by

Cybersecurity continues to be a critical focus in the face of ever-evolving threats. This week, several major incidents and advisories highlight the increasing risks across multiple sectors. From the FBI and CISA urging the use of encrypted messaging apps to protect personal communications, to the revelations of hacking groups targeting U.S. telecom networks and companies facing vulnerabilities, these developments underscore the importance of robust security measures. Notable incidents include Cloudflare’s service disruption, the rise of sophisticated phishing tools bypassing multi-factor authentication, and ongoing concerns over legacy vulnerabilities in widely used devices. In this roundup, we take a closer look at these stories and the implications for both individuals and organizations in securing their digital environments.

 

FBI and CISA urge Americans to use encrypted apps rather than calling

Further developments from the Salt Typhoon attack on U.S. telecommunications companies, officials from both agencies are recommending that Americans use start using encrypted messaging apps. Speaking to the media on Tuesday, Jeff Greene, executive assistant director for cybersecurity at CISA, along with a senior FBI official who asked not to be named, said they plan to use the same message as they do inside their respective organizations: Encryption is your friend,” whether it’s on messaging or encrypted voice communication. They also suggest people considering using a cellphone that “automatically receives timely operating system updates, responsibly managed encryption and phishing resistant multi-factor authentication for email, social media, and collaboration tool accounts.” (NBC News)

 

Cloudflare says it lost 55% of logs pushed to customers for 3.5 hours

This story pertains to a bug that appeared on November 14 in the internet security company’s log collection service, one that allows its customers to monitor the traffic on their websites and filter it based on certain criteria. They are also used to investigate security incidents, DDoS attacks, traffic patterns, and to perform site optimizations. This is a big service, amounting to over 50 trillion customer event logs every day, of which around 4.5 are sent to customers. The incident was caused by a misconfiguration in a log forwarder component in Cloudflare’s pipeline. The pause then created a massive spike once the system tried to resolve itself. Cloudflare has now implemented several measures to prevent future occurrences. (BleepingComputer)

 

Phishing tool Rockstar 2FA targets Microsoft 365 creds

Researchers at Trustwave are warning of a Phishing-as-a-service toolkit named Rockstar 2FA, which apparently targets Microsoft 365 accounts and bypasses multi-factor authentication via adversary-in-the-middle attacks. It is an updated version of the DadSec/Phoenix phishing kit. The attacks involve theft of a victim’s password and session cookie though the creation of a proxy server between a target user and the website the user wishes to visit, which itself is a phishing site. Trustwave points out a unique feature of this current campaign being websites whose common theme is cars. (Cybersecurity News)

 

FBI advises telecoms to boost security following Chinese hacking campaign

Since October, we’ve been covering ongoing reports that China-backed hacking group, Salt Typhoon, was reportedly in the networks of AT&T, Verizon, and Lumen (formerly CenturyLink), among others. These attacks are thought to be part of a broad Chinese espionage campaign targeting U.S. officials and also wiretap systems that might identify Chinese individuals under U.S. surveillance. On Tuesday, U.S. government officials warned that Salt Typhoon is still inside networks of some phone and internet providers. Additionally on Tuesday, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) issued guidance to telecommunication companies to bolster their defenses through deployment of encryption as well as centralized and consistent monitoring. The government’s guidance was issued jointly with security agencies and organizations in New Zealand, Australia, Canada, and Britain. (SecurityWeek and TechCrunch)

 

Decade-old Cisco vulnerability under active exploit

Cisco is warning customers that an input validation vulnerability (CVE-2014-2120) in its Adaptive Security Appliance (ASA) WebVPN login page is now actively being exploited by threat actors. Cisco documented the bug back in 2014 and exploitation could allow an unauthenticated remote attacker to launch cross-site scripting (XSS) attacks. Cisco discovered exploitation attempts in November 2024 and said customers should upgrade to a fixed software release. The company added that there are no workarounds for this flaw. This issue highlights how implementing legacy security fixes can get lost in the sea of security priorities that organizations are facing. (Dark Reading)

 

Misconfigured WAFs heighten security risks

According to a report from Zafran, nearly 40% of Fortune 100 companies leveraging their content delivery network (CDN) providers for Web Application Firewall (WAF) services may be exposing back-end servers to attacks. WAFs act as intermediaries between users and Web applications, inspecting traffic for an array of threats and blocking malicious activity. In total, Zafran found 2,028 domains belonging to 135 companies exposing at least one supposedly WAF-protected server. This means attackers could access the servers over the Internet to launch attacks like denial-of-service (DoS) and ransomware. The researchers explained that the issues stem from organizations not following best practices including adequately validating Web requests to back-end origin servers, filtering IP addresses and establishing encrypted TLS connections between the CDN provider and their servers. While some responsibility does lie with customers, the researchers said, “CDN providers who offer WAF services share some responsibility as well for failing to offer customers proper risk avoidance measures and for not building their networks and services to circumvent misconfigurations in the first place.” (Dark Reading)

 

Japan warns of I-O Data zero-day router flaws exploited in attacks

Japan’s Computer Emergency Response Team aka CERT, is warning of a zero-day vulnerabilities in I-O Data router devices. These can be exploited to modify device settings, execute commands, or even turn off the firewall. “The vendor has acknowledged the flaws in a security bulletin published on its website.” But, the fixes are only expected to land on December 18, which means users will be exposed to risks until then unless mitigations are enabled. The three flaws, which were identified on November 13, and which all have CVE numbers, relate to information disclosure, remote arbitrary OS command execution, and the ability to disable firewalls. (BleepingComputer)

 

Microsoft stands firm on TPM requirements for Windows 11

Microsoft is pushing hard on its upgraded security culture by dashing the hopes some may have about lower hardware requirements for Windows 11. Windows 10 end of support is approaching in October 2025, and Microsoft says that its Trusted Platform Module (TPM) 2.0 requirement for Windows 11 is “non-negotiable.” PM 2.0. It’s a hardware-level chip or firmware capability that helps encrypt or decrypt data, confirm digital signatures, and assist with any other cryptographic operations. (The Verge)

 

Senators fume over response to ‘disturbing and widespread’ Chinese hack of US telecoms

Senators have expressed deep frustration over the Biden administration’s handling of a significant cyberattack by the Chinese government-linked group “Salt Typhoon,” which infiltrated numerous U.S. and global telecommunications systems. This breach, considered the most severe in telecom history, compromised the phones of officials, including President-elect Donald Trump, and potentially exposed the communications of a vast number of Americans. During a Capitol Hill briefing, lawmakers criticized the lack of accountability and demanded more transparency. Senator Rick Scott (R-Fla.) questioned the absence of preventive measures, while Senator Josh Hawley (R-Mo.) described the breach as “breathtaking” and called for declassification of details to inform the public about the potential exposure of their communications.

Senate Intelligence Committee Chair Mark Warner (D-Va.) highlighted the failure of telecom companies to secure critical systems, noting that the hackers remain embedded in these networks.  In response, the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI are collaborating with telecom providers to address the breach, though the full extent of the infiltration remains uncertain. CISA Director Jen Easterly announced that the Department of Homeland Security’s Cyber Safety Review Board would formally investigate the hack, with recommendations expected next year.

Lawmakers are also considering legislation to enhance cybersecurity in telecommunications, aiming to implement measures before year’s end. Senator Mike Rounds (R-S.D.) emphasized the need for enforceable cybersecurity standards for telecom companies, acknowledging that addressing these security concerns will require time. The bipartisan concern underscores the necessity for stringent cybersecurity protocols and potential retaliatory actions against China, as the administration continues to investigate and seek long-term solutions to this critical national security threat.  (Politico, Reuters, Yahoo)

 

Russian hackers hack hackers

In No Honor Among Thieves News, a new report from Lumen’s Black Lotus Labs details how the Russian cyber-espionage group Turla used the infrastructure of the Pakistani-linked group Storm-0156 to launch their attacks. Researchers had been observing operations by Storm-0156, finding a C2 server on an Indian government network. This server began interacting with three IP addresses known to be linked to Turla. Further research shows Turla has been using the Pakistani group’s infrastructure since 2022, using the servers to launch various backdoors and other malware. Eventually, Turla became more ambitious, moving laterally into Storm-0156’s workstation and gaining direct access to its data and tooling. Researchers at Microsoft contributing to the report said Turla used this access to target Afghan government agencies. This isn’t a new tactic for Turla. Back in 2019, the NSA put out an advisory that it hijacked infrastructure by the Iran-backed group OilRig to carry out attacks. (Bleeping Computers)

 

Cisco switches hit with bootloader vulnerability

The flaw impacts over 100 device models across Cisco’s MDS, Nexus, and UCS Fabric Interconnect lines, allowing attackers to bypass the bootloader verification process and load software. The flaw doesn’t require authentication but physical access to the switches. Cisco released several NX-OS updates to patch the flaws and will roll out the updates for all devices by the end of the month, excluding one discontinued Nexus model. It cautioned that no mitigations for this flaw will be provided in the interim other than preventing physical access to the switches. (Security Week)

 

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts or schedule a demo today.

Validating Threat Exposures: Strengthening Your CTEM Strategy

/by

In our blog, Prioritize to Protect: RedSeal’s Methodology for Effective Threat Exposure Management, we discussed how organizations can prioritize their vulnerabilities to reduce risk. The next critical step in the CTEM process is validation. Once vulnerabilities are scoped, discovered, and prioritized, it is essential to validate them and assess the potential impact on the organization. This ensures that resources are focused on threats that are actually exploitable and that remediation efforts are both effective and feasible.

The importance of validation in CTEM

At the core of CTEM validation is thinking like an attacker. Rather than focusing solely on detection, shift your perspective to understanding exploitation and impact. This approach allows you to refine prioritization by asking critical questions:

  • How likely is it that an adversary would exploit a given exposure?
  • Is it technically possible to exploit the exposure?
  • What is the potential blast radius and extent of lateral movement once an attacker gains access?
  • How do those downstream exposures change our risk level and response tactics?
  • Are we concentrating resources where they matter most?

However, validation isn’t just about simulated attacks. It’s also about ensuring that remediation measures are both technically and operationally feasible. Verifying that suggested fixes won’t conflict with existing policies, infrastructure, or workflows is essential for building a solid business case for remediation and fostering collaboration across teams.

How RedSeal drives CTEM validation

RedSeal strengthens CTEM by offering tools for thorough validation at every stage. In our previous blog on prioritization, we wrote about how RedSeal takes exploitability and impact into account when prioritizing exposures—essentially combining the prioritization and validation steps of the CTEM process. However, RedSeal offers more to support the validation step specifically.

Through virtual, passive red teaming tests, RedSeal confirms the exploitability of exposures and provides in-depth analysis of lateral movement (evaluating the blast radius and all possible attack paths). This approach not only helps determine how far a threat could spread but also highlights which vulnerabilities could have the most devastating impact.

In addition to validating attack paths, RedSeal validates the scope of vulnerability scans and assesses the effectiveness of security controls, such as network segmentation and device configurations. The platform simulates “what-if” scenarios to predict how proposed changes might affect the environment and whether new risks could be introduced.

With RedSeal’s support, organizations gain clarity around the true risks of their attack surface, empowering them to make informed decisions about where to allocate resources and how to manage their security posture more effectively.

By validating exposures through both technical assessments and feasibility checks, RedSeal helps ensure that organizations are addressing the right threats, taking appropriate steps to minimize risk, and improving their overall cybersecurity resilience.

Reach out to RedSeal or schedule a demo today to learn how to bolster your cybersecurity efforts and make the strategic move that promises long-term benefits and peace of mind.

 

Cyber News Roundup for November 26, 2024

/by

As you gather around the Thanksgiving table later this week, the last thing you want is to be the one out of the loop on the latest cybersecurity headlines. Trust us, your friends and family will never let you live it down! From new attack techniques to massive outages and government recommendations on password legacies, we’ve rounded up the must-know news so you can stay informed and keep the dinner table chatter on point. Read on to get the full scoop—because you don’t want to be left in the digital dust this holiday season!

 

APT28 uses novel technique to breach organizations via nearby WiFi networks

Volexity has published a report on a novel attack vector used by the Russian threat actor GruesomeLarch (commonly known as “APT28” or “Fancy Bear”) to breach enterprise Wi-Fi networks. The threat actor first compromised vulnerable organizations in close proximity to the targeted entity until they found a system that had both wired and wireless network connections. They would then use this system’s Wi-Fi adapter to connect to the SSID of the targeted organization’s Wi-Fi and authenticate to it, granting them access to the target’s network.

The researchers note, “Volexity believes this represents a new class of attack that has not previously been described, in which a threat actor compromises one organization and performs credential-stuffing attacks in order to compromise other organizations in close physical proximity via their Wi-Fi networks. To reiterate, the compromise of these credentials alone did not yield access to the customer’s environment, as all Internet-facing resources required use of multi-factor authentication (MFA). However, the Wi-Fi network was not protected by MFA, meaning proximity to the target network and valid credentials were the only requirements to connect.” Volexity adds, “The Nearest Neighbor Attack effectively amounts to a close access operation, but the risk of being physically identified or detained has been removed. This attack has all the benefits of being in close physical proximity to the target, while allowing the operator to be thousands of miles away.” Volexity says the threat actor used this technique to steal information on Ukrainian matters just before Russia’s invasion of Ukraine in February 2022. (Volexity)

 

Microsoft 365 outage update

If you were wondering whether Microsoft’s outages on Monday should have been your cue to start your Thanksgiving vacation early, you weren’t alone. Microsoft addressed widespread Microsoft 365 outages affecting services like Exchange Online, Microsoft Teams, SharePoint Online, and Outlook. The issue, caused by a “recent change,” has led to difficulties accessing these platforms and performing certain actions within Microsoft Fabric and Defender for Office 365. Microsoft deployed a fix to the affected environments, initiated manual restarts on impacted systems, and, as of this recording, is monitoring progress. While this follows a major outage in July caused by a DDoS attack, Microsoft has not attributed the current incident to any malicious activity. (Bleeping Computer)

 

“Hair on Fire” over China’s cyber campaign

The Biden administration met with telecom executives to discuss the impact of China’s cyber espionage campaign targeting U.S. telecommunications networks, which may require a large-scale rebuild of infrastructure.Senator Mark Warner, chair of the Senate Intelligence Committee, has raised alarms over China’s persistent cyberattacks on U.S. telecommunications networks, describing their severity as far exceeding previous incidents. He said China’s actions make Russia-linked incidents like the SolarWinds hack and Colonial Pipeline attack look like “child’s play.” Warner highlighted that attackers exploited wiretapping capabilities and stole extensive data from U.S. networks, while the administration’s meeting emphasized sharing intelligence on the ongoing threat. China denies these claims, but U.S. officials have described the activity as significant and unresolved. (The Register)

 

Meta takes down millions of accounts linked to pig-butchering scams

Facebook’s parent company Meta has taken down over two million accounts this year tied to pig-butchering scams, CyberScoop reports. Pig butchering is a form of investment scam that involves forming a long-term, trusted relationship with the victim and tricking them into pouring a great deal of money into a phony investment scheme, usually involving cryptocurrency. The scams often begin on dating apps or social media sites.

Many of these scams are run out of criminal forced-labor operations in Myanmar, Laos, Cambodia, the United Arab Emirates, and the Philippines. Meta states, “During the COVID-19 pandemic, scam compounds run by organized crime emerged in the Asia Pacific region as one of the major sources of ‘pig butchering’ and other scam activity. And while they are mostly based in Asia, scam centers target people across the globe. These criminal scam hubs lure often unsuspecting job seekers with too-good-to-be-true job postings on local job boards, forums, and recruitment platforms to then force them to work as online scammers, often under the threat of physical abuse.” (Cyberscoop, Meta)

 

DoJ seizes credit card marketplace PopeyeTools

The dark web marketplace that specialized in selling stolen credit cards long with cybercrime tools, and which has been in business 2016 was taken down by agents of the Department of Justice last week with three of its key operators now facing fraud-related charges, and the websites and hosting services seized. According to court documents, the PopeyeTools marketplace offered services such as “unauthorized payment card data and PII for cards that were marketed as ‘live’ as well as logs of stolen bank account information, email spam lists, scam pages, and guides and tutorials.” (Department of Justice announcement)

 

North Korean front companies impersonate U.S. IT firms for military funding

According to researchers at SentinelOne, as well as a report form Palo Alto Networks, threat actors connected to North Korea continue to impersonate U.S.-based software and technology consulting businesses. In a global campaign, which Palo Alto Networks Unit 42 is tracking as Wagemole, the actors use forged identities to get hired obtain employment at companies in the U.S. and elsewhere, sending most of their salary back to their home country. This most recent chapter in this ongoing story identifies some front companies by name, analyzed by SentinelOne, which were “all registered through NameCheap and claimed to be development outsourcing, consulting, and software businesses, while copying their content from legitimate companies.” The list is available in the show notes to this episode. (The Hacker News)

 

Volunteer DEFCON hackers take on U.S. water infrastructure concerns

The Franklin project, launched at this year’s DEFCON, is intended to employ the skills of top hackers to “not only … strengthen U.S. resilience to online attacks, but also to chronicle what is being done in a yearly Hacker’s Almanack so that others can learn essential skills. The program is partnered with the Harris School of Public Policy’s Cyber Policy Initiative at the University of Chicago, as well as the National Rural Water Association (NRWA). Together they are using the coders’ talents to investigate water companies in Utah, Vermont, Indiana, and Oregon, to fix any issues they find, and then pass the knowledge on. (The Register)

 

VMware vCenter Server flaws are being actively exploited

The US Cybersecurity and Infrastructure Security Agency (CISA) warns that two vulnerabilities affecting VMware vCenter Server are being actively exploited. One of the flaws (CVE-2024-38812) has been assigned a CVSS score of 9.8 and can allow an attacker to achieve remote code execution. Broadcom issued updated patches in October after determining that its September patches didn’t fully address the vulnerability. The company strongly encourages customers to ensure they’ve applied the new patches. The vulnerabilities affect “VMware vCenter and any products that contain vCenter, including VMware vSphere and VMware Cloud Foundation.” (CISA, vmware)

 

MITRE offers updated list of most dangerous software vulnerabilities

MITRE, the not-for-profit organization that oversees federally funded R&D centers with an eye to cybersecurity, has updated its “Common Weakness Enumeration Top 25 Most Dangerous Software Weaknesses” list, reflecting the newest developments in the cyber threat landscape. At the top of the list is cross-site scripting in top place followed by out-of-bounds write flaws, SQL injection bugs. Missing authorization comes in at number 10. CISA, which worked with a branch of MITRE in putting together the report, is now urging organizations to “review the list and prioritize these weaknesses in development and procurement processes.” (Security Week and MITRE)

 

Easily exploitable bugs found in Ubuntu Server utility after 10 years

The researchers at Threat Research Unit of Qualys, say they refuse to release exploit code for five bugs in Ubuntu Server’s needrestart utility. They state they were “able to develop a working exploit but wouldn’t release it, describing the findings as alarming.” The five vulnerabilities described by the researchers were actually introduced in April 2014. They reside in the needrestart utility of Ubuntu Server, which is designed to determine if a restart is needed following, for example, a critical library update or an upgrade is made. All five vulnerabilities have CVE numbers and four of them have a 7.8 CVSS score. (The Register)

 

Japan’s government suggests putting your usernames and passwords in your will

Described as “digital end of life planning” Japan’s National Consumer Affairs Center on Wednesday released a collection of suggestions to help avoid the complications and costs associated with passing to the great beyond with passwords still hidden. Helping loved ones deal with a digital legacy can include: ensuring family members can unlock your smartphone or computer; maintaining a list of subscriptions with user IDs and passwords; adding these details to a document intended for the person or persons responsible for managing such affairs, and designate a person to have access to the smartphone and other accounts. (The Register)

 

Oracle patches zero-day flaw

Oracle has issued a patch for an actively exploited vulnerability (CVE-2024-21287) affecting its Agile Product Lifecycle Management software, BleepingComputer reports. Oracle stated, “This vulnerability is remotely exploitable without authentication, i.e., it may be exploited over a network without the need for a username and password. If successfully exploited, this vulnerability may result in file disclosure.” The flaw was assigned a CVSS score of 7.5. (Bleepingcomputer, Oracle)

 

Chinese threat actors infiltrate more telcos

CrowdStrike has published a report on LIMINAL PANDA, a Chinese threat actor targeting telecommunications companies in countries associated with China’s Belt and Road Initiative. The researchers note, “The adversary targets these organizations to directly collect network telemetry and subscriber information or to breach other telecommunications entities by exploiting the industry’s interoperational connection requirements.” The goal of the operation is likely cyberespionage. CrowdStrike explains, “LIMINAL PANDA has previously focused on telecommunications providers in southern Asia and Africa, suggesting that their final targets likely reside in these regions; however, individuals roaming in these areas may also be targeted depending on the compromised network’s configuration and LIMINAL PANDA’s current access. Equally, depending on their current collection requirements, the adversary could employ similar TTPs to target telecoms in other regions.” (Axios, CrowdStrike)

 

Apple issues emergency security update

The company issued a patch for two vulnerabilities impacting most of Apple’s portfolio, including iOS, iPadOS, macOS Sequoia, Safari, and visionOS. Researchers at Google’s Threat Analysis Group initially disclosed the issues to Apple. One flaw impacts JavaScriptCore; the other is a “cookie management issue” in WebKit. The company said it found signs of active exploitation on Intel-based Mac systems, although no details on any threat actors targeting the vulnerabilities were released. These mark the sixth zero-day vulnerabilities disclosed by Apple this year. (Infosecurity Magazine)

 

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts or schedule a demo today.

Mastering Cybersecurity Change Management with Confidence

/by

Making changes to your network infrastructure can feel like navigating a minefield. One wrong move can lead to unexpected vulnerabilities, policy violations, or consequences that could compromise the security of your entire system. That’s where RedSeal steps in—taking the guesswork out of network changes with a predictive, security-driven approach to change management.

 Cybersecurity change management matters…but why?

When it’s time to make updates or changes to your network—whether you’re updating software, adding new endpoints, or reconfiguring firewall rules—it’s critical to understand the potential impacts of those changes before they go live. Even small changes can introduce new risks that leave your system vulnerable.

With the right tools, you can avoid common pitfalls and ensure that every change you make is in line with your cybersecurity policies and goals. RedSeal offers a proactive, data-driven approach that lets you see the full picture before and after implementing changes.

 What can you do with RedSeal?

  1. Model proposed changes before implementation
    RedSeal allows you to run a detailed security impact analysis (a “what-if” analysis) of proposed changes to your network. By modeling the change first, you can predict how it will affect your security posture before anything is actually altered.
  2. Predict exposures and policy violations
    Before deploying changes, RedSeal helps you foresee potential vulnerabilities, hosts that might become reachable, downstream access issues, and new attack surfaces that could arise, so that you can better prepare to mitigate these risks.
  3. Get detailed path status reports
    With RedSeal, you can visualize the current state and potential outcomes of paths between hosts, endpoints, and subnets. It shows you whether specific ports and protocols are open or in use, helping you verify that nothing unauthorized is exposed.
  4. Verify and document post-change status
    After changes have been made, RedSeal helps you ensure that they are properly documented. It provides clear insights into whether the changes align with your security protocols and flags any discrepancies in the implementation process.
  5. Integrate with ITSM platforms
    RedSeal integrates seamlessly with IT service management platforms like ServiceNow, providing an additional layer of confidence in the change management process. It helps reviewers verify that a change request is necessary, while auditors can quickly confirm whether the implementation aligns with authorized tickets.

The RedSeal advantage

RedSeal simplifies and strengthens your network change management by integrating predictive network context into your workflows. Here’s how that benefits your organization:

  • Save time and resources: By predicting the potential impacts of changes and integrating with your existing workflows, RedSeal helps save thousands of man hours. You can avoid unnecessary backtracking and revisions after changes are made, reducing the need for manual oversight.
  • Accelerate change windows: With clearer insights into the potential impact of changes, you can reduce the time spent in maintenance windows, helping minimize business disruption. This means faster deployments and updates without sacrificing security.
  • Ensure compliance: RedSeal helps you make network changes with confidence, knowing that you’re complying with all relevant security policies and regulations. It ensures that all modifications align with your compliance requirements, reducing the risk of errors or oversights.

Final thoughts

Change management must be more than just a reactive process—it should be a proactive, predictive part of your security strategy. RedSeal makes this possible by offering a clear, data-backed view of how changes will affect your network. With RedSeal’s predictive analytics, your team can confidently manage change, mitigate risks, and ensure that security remains intact.

By integrating RedSeal into your cybersecurity change management workflow, you’ll not only save time and resources but also make more informed, safer decisions that keep your network secure and your business running smoothly.

 

Reach out to RedSeal or schedule a demo today to learn how to bolster your cybersecurity efforts and make the strategic move that promises long-term benefits and peace of mind.

Cyber News Roundup for November 15, 2024

/by

Still using 123456 as your password? If so, it’s time to rethink your approach to security. Cyber threats are evolving rapidly, and the risks are only growing. In this week’s roundup, we cover the latest developments, from the industries most at risk of cyber attacks to critical vulnerabilities you need to address immediately. Read on for essential insights into the cybersecurity landscape.

 

Moody’s designates the industries at highest risk of cyber attack

Moody’s has assigned a “very high” cyber risk rating to the telecommunications, airline, and power generation sectors due to increasing digitization and weak cybersecurity practices. These industries collectively face $7.1 trillion in debt. Telecommunications, notably vulnerable, has seen major breaches, including attacks on AT&T, Lumen, and Verizon by China’s Salt Typhoon group. Airlines’ cyber risk rose after a CrowdStrike software update failure exposed their reliance on tech. Other sectors, including automotive, education, manufacturing, energy, and ports, also saw risk levels increase to “high.” (scworld)

NIST misses its deadline for clearing the NVD backlog

NIST announced it’s working through a large backlog of over 18,000 vulnerabilities in the National Vulnerability Database (NVD) but missed its original goal of clearing it by September 30. Despite hiring more analysts and addressing all Known Exploited Vulnerabilities (KEV), NIST struggled due to incompatible data formats from Authorized Data Providers (ADPs). NIST is developing new systems to streamline data processing and pledged to provide updates on further progress, though it hasn’t set a new deadline for clearing the entire backlog. (SecurityWeek)

 

China threat actors breached U.S. broadband providers to spy on U.S. government officials

The US FBI and the Cybersecurity and Infrastructure Security Agency (CISA) have confirmed that Chinese government hackers conducted a “broad and significant cyber espionage campaign” that compromised several US telecom companies, TechCrunch reports. The Wall Street Journal reported last month that the breached companies include AT&T, Lumen, and Verizon. The hackers targeted systems used by the Federal government to carry out court-authorized network wiretapping requests.

The FBI and CISA stated, “[W]e have identified that PRC-affiliated actors have compromised networks at multiple telecommunications companies to enable the theft of customer call records data, the compromise of private communications of a limited number of individuals who are primarily involved in government or political activity, and the copying of certain information that was subject to U.S. law enforcement requests pursuant to court orders. We expect our understanding of these compromises to grow as the investigation continues.” (Security Affairs)

 

123456 tops the list of most popular passwords again

NordPass, maker of a password manager and sister company of NordVPN, has announced its list of the 200 most common passwords and the results are disappointing. In this sixth year of publishing its list derived from a 2.5TB database of passwords, personal and professional, from around the world, including on the dark web, comes to a single conclusion: people are really bad at choosing hard-to-crack passwords. The list contains variations on the 123456 theme and the qwerty theme as well as single word passwords like “password” and “secret,” all of which can be cracked in less than a second. “The personal and corporate passwords analyzed by NordPass were stolen by malware or exposed in data breaches. In most cases, the email addresses were leaked along with the passwords, helping NordPass determine which ones were for personal use and which ones were for business use.” The company says there really hasn’t been any improvement over these six years. A link to the NordPass report is available in the show notes to this episode. (NordPass)

 

Hackers use macOS extended file attributes to hide malicious code

This new technique abuses extended attributes for macOS files in order to deliver a new trojan that researchers call RustyAttr. In this procedure, threat actors “hide malicious code in custom file metadata and also use decoy PDF documents to help evade detection.” MacOS extended attributes (EAs) handle hidden metadata which is most often associated with files and directories, and is not directly visible with Finder. In the case of RustyAttr attacks, the EA name is ‘test’ and holds a shell script. To avoid detection during this process, some samples launch decoy PDF files or display error dialogs. (BleepingComputer)

 

In Switzerland, malware now arrives by postal mail

Switzerland’s Federal Office for Cybersecurity (OFCS) has issued a warning about letters being sent via regular post that pretend to be from the country’s meteorological agency, MeteoSwiss and which are being used to spread malware. These postal letters, with dates up to November 12, appear to offer access to a new weather app via a printed QR code. In reality this link downloads the stealer malware ‘Coper’ and ‘Octo2’, which seek out login details for more than 383 mobile apps, including e-banking apps.” Although this is not the first time a postal service has been used to deliver malware, experts note that the additional overhead, namely postage, mean it is still rare. (The Record)

 

Zoom discloses multiple vulnerabilities

Zoom disclosed multiple vulnerabilities in its applications, including a critical buffer overflow flaw (CVE-2024-45421) with a CVSS score of 8.5, allowing authenticated users to execute remote code. Another significant issue (CVE-2024-45419) involves improper input validation, which could lead to unauthorized information disclosure. Affected products include the Workplace App, Rooms Client, Video SDK, and Meeting SDK across Windows, macOS, iOS, Android, and Linux. Users are advised to update to the latest versions (6.2.0 or later) to mitigate risks. (Cyber Security News)

 

Federal agencies and Five Eyes partners list the past year’s most exploited vulnerabilities

CISA, the FBI, NSA, and Five Eyes intelligence agencies have identified the top 15 most exploited security vulnerabilities from last year, urging organizations to patch these flaws immediately. In a joint advisory, they emphasized the critical need for effective patch management to reduce network exposure. The report highlights an increase in zero-day exploits in 2023 compared to 2022, noting that the majority of frequently targeted vulnerabilities were zero-days, which allowed attackers to infiltrate high-value targets more effectively. Twelve of the top 15 vulnerabilities had patches released last year, underscoring the importance of swift patch deployment as cybercriminals continue targeting unpatched flaws.

Leading the list is CVE-2023-3519, a code injection vulnerability in NetScaler ADC/Gateway. This vulnerability, exploited by state actors, enabled remote code execution on unpatched servers, compromising U.S. critical infrastructure. By mid-August, hackers had used this flaw to backdoor over 2,000 Citrix servers worldwide. The advisory also mentions 32 additional vulnerabilities frequently exploited in 2023, offering guidance on minimizing risk. Meanwhile, MITRE recently updated its list of dangerous software weaknesses, underscoring ongoing challenges. Jeffrey Dickerson, NSA’s cybersecurity director, warned that exploitation of known vulnerabilities will persist, urging network defenders to remain vigilant and proactive through 2024 and beyond. (Bleepingcomputer)

 

Volt Typhoon rebuilding botnet

In early 2024, the US government announced it had disrupted the botnet used by Volt Typhoon, a threat actor with suspected links to the Chinese government. This botnet predominantly used unpatched Cisco, Fortinet, and Netgear devices. We’re not seeing signs that the group is building a new botnet. Researchers at SecurityScorecard saw a cluster tied to the group covertly routing traffic, primarily made up of compromised Netgear ProSafe, Mikrotik, and Cisco RV320 devices. This appears to be using the same core infrastructure and techniques previously used by Volt Typhoon. (Security Week)

 

DoD leaker sentenced

The US attorney for Massachusetts announced it sentenced former Massachusetts Air National Guardsman Jack Teixeira to 15 years in prison for stealing and leaking classified information. Court documents show Teixeira shared classified documents on Discord sometime in 2022, including troop movements and information on equipment provided to Ukraine. The leaks were discovered in March 2023. Teixeira pleaded guilty to six counts related to that in March 2024 as part of a plea deal. (NBC)

 

End-of-life D-Link NAS devices under attack

Researchers at Netsecfish discovered a command injection vulnerability on D-Link NAS devices that allows an unauthenticated attacker to use GET requests to inject shell commands. This flaw has been under active exploitation since November 8th. However, the impacted models, DNS-320, 325, and 340L, are now end-of-life, and D-Link said it had no plans to release a patch. Researchers found over 41,000 unique IP addresses for vulnerable devices found online. D-Link advises customers to replace the devices or, at the very least, restrict them from open internet access.  (Bleeping Computer)

 

Cybercriminals use game-related apps to distribute Winos4.0

Cybercriminals are using game-related apps to distribute Winos4.0, a malware framework that grants full control over infected Windows systems. Rebuilt from the Gh0strat malware, Winos4.0 was detected in various gaming tools and optimization utilities, which lure users into downloading the infection. Similar to Cobalt Strike, the malware enables cyber espionage, ransomware deployment, and lateral movement. Once executed, the malware downloads a fake BMP file from a malicious server, beginning a multi-stage infection. The first DLL file establishes persistence and injects shellcode, while the second stage connects to a command-and-control server. Subsequent stages gather system details, check for anti-virus software, and capture sensitive information, including crypto wallet data and screenshots. This final stage sets up a persistent backdoor, allowing the attacker long-term access. Fortinet warns users to download apps only from trusted sources to mitigate risk. (The Register)

Hewlett Packard Enterprise (HPE) patches multiple vulnerabilities in its Aruba Networking access points

Hewlett Packard Enterprise (HPE), a major tech company specializing in enterprise hardware and software, announced patches this week for multiple vulnerabilities in its Aruba Networking access points, widely used in business networks. Among the vulnerabilities are two critical command injection flaws (CVE-2024-42509, CVE-2024-47460), which could allow remote, unauthenticated attackers to execute code as privileged users by sending specially crafted packets to UDP port 8211. These flaws impact Aruba devices running Instant AOS-8 and AOS-10, including some end-of-life versions. HPE advised that enabling cluster security on AOS-8 and blocking access to UDP/8211 for AOS-10 can mitigate risks. Additionally, three high-severity remote code execution (RCE) vulnerabilities could allow authenticated attackers to compromise system files and execute commands. The patches, included in AOS-10.7.0.0, AOS-10.4.1.5, Instant AOS-8.12.0.3, and Instant AOS-8.10.0.14, were released through Aruba’s bug bounty program, with no evidence of active exploitation. (SecurityWeek)

 

CISA issues a warning about a critical security flaw in Palo Alto Networks’ Expedition tool

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a critical security flaw (CVE-2024-5910) in Palo Alto Networks’ Expedition tool, used for firewall migration and configuration. The flaw, classified as a “Missing Authentication” vulnerability (CWE-306), enables attackers with network access to potentially hijack the Expedition admin account. This could grant cybercriminals access to sensitive configuration data, including credentials and highly privileged information.

CISA stresses that the vulnerability poses a significant risk due to the level of access it grants, although there is no confirmation yet of active exploitation. Organizations using the Expedition tool are urged to apply Palo Alto’s recommended mitigations. If these aren’t feasible, CISA advises discontinuing the tool’s use to prevent potential compromise. The deadline for federal agencies addressing this vulnerability is November 28, as CISA emphasizes immediate action to mitigate any potential threat. (gbhackers)

 

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts or schedule a demo today.