Aggregator

看雪论坛作者ID：0xEEEE

By pushing past the hurdles that can make threat modeling challenging, business leaders can take full advantage of threat models to give their organizations a leg up in the battle against cyberattacks.

The post Putting Threat Modeling Into Practice: A Guide for Business Leaders appeared first on Security Boulevard.

Bij de berging van de Duitse Messerschmitt Bf 109 zijn stoffelijke resten gevonden. Ze zijn waarschijnlijk van de piloot die tijdens de Tweede Wereldoorlog met zijn toestel neerstortte. Een overzicht van Defensieoperaties in de week van 7 tot en met 13 augustus 2024.

The threat group is disrupting healthcare organizations. Victims can help themselves, though, even after compromise, by being careful in the decryption process.

The Democratic National Convention soon to take place in Chicago, already under heavy security, faces an additional threat in the form of stolen credentials for delegates.

Authors: Rui Ataide, Hermes Bojaxhi GuidePoint’s DFIR team is frequently called upon to respond to Ransomware incidents. While many such […]

The post Update from the Ransomware Trenches appeared first on Security Boulevard.

Ivanti released a patch for a critical severity authentication bypass vulnerability and a warning that exploit code is publicly available

Background

On August 13, Ivanti released a security advisory to address a critical severity authentication bypass vulnerability in its Virtual Traffic Manager (vTM) product, a software-based application delivery controller (ADC).

CVEDescriptionCVSSv3CVE-2024-7593Ivanti Virtual Traffic Manager (vTM) Authentication Bypass Vulnerability9.8Analysis

CVE-2024-7593 is a critical severity authentication bypass vulnerability. Exploitation of this flaw could allow an unauthenticated, remote attacker to create an administrator user. According to the advisory, access to the management interface of vTM is required in order to exploit this vulnerability.

While Ivanti notes that no known exploitation has been observed for CVE-2024-7593, their advisory makes special note of publicly available exploit code.

Historical exploitation of Ivanti vulnerabilities

Ivanti has had a history of threat actors targeting their products, with one of the most prolific being attacks against their Ivanti Connect Secure (ICS) product, previously known as Pulse Connect Secure and Ivanti Policy Secure. In January, two zero-day vulnerabilities (CVE-2023-46805, CVE-2024-21887) were exploited against ICS in a chained attack. Coincidentally enough, one of these vulnerabilities (CVE-2023-46805) was an authentication bypass flaw. Within a few weeks of this release, Ivanti found several additional vulnerabilities impacting ICS, including another zero-day vulnerability (CVE-2024-21893) that had also been exploited in the wild. CVE-2023-46805 and CVE-2024-21887 were reportedly exploited by a threat actor tracked as UTA0178 and is believed to be a “Chinese nation-state level threat actor.” With threat actors, including nation-state aligned actors actively targeting Ivanti devices, it’s imperative that patching is prioritized.

Hundreds of Internet Facing Instances May Be Affected

Adding to the concern over the potential to exploit this vulnerability, a FOFA search lists more than 400 results tied to over 200 unique IPs that might be affected if patches or mitigations are not applied.

Image source: https://en.fofa.info/

Proof of concept

According to Ivanti’s security advisory, a public proof-of-concept (PoC) is available for this vulnerability. While Tenable Research has not tested and confirmed a working exploit, we are aware of exploit code found on a popular site for public exploit scripts. As attackers are keen to abuse targets with readily available exploit code, immediate patching or application of mitigation steps is recommended.

Solution

Ivanti has released some patches to address this vulnerability, with additional patch versions expected to be released the week of August 19. A summary of the patched versions can be found in the table below:

Affected VersionFixed VersionAvailability22.222.2R1Available now22.322.3R3Upcoming- Week of August 1922.3R222.3R3Upcoming- Week of August 1922.5R122.5R2Upcoming- Week of August 1922.6R122.6R2Upcoming- Week of August 1922.7R122.7R2Available now

For organizations that are not able to immediately patch this vulnerability, Ivanti does offer mitigation guidance. As access to the management interface is a requirement for exploitation, limiting access to this interface is recommended. Ivanti recommends to ensure that the management interface is bound to an internal network or private IP address. We recommend referring to Ivanti’s security advisory for the most up to date information on patch availability and mitigation guidance.

Identifying affected systems

A list of Tenable plugins for this vulnerability can be found on the individual CVE page for CVE-2024-7593 as they’re released. This link will display all available plugins for this vulnerability, including upcoming plugins in our Plugins Pipeline.

Get more information

• Ivanti Security Advisory: Ivanti Virtual Traffic Manager (vTM ) (CVE-2024-7593)

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.

运动员为国争光拿下金牌，迎接她的不是鲜花与掌声，而是无端的网络霸凌和质疑。如此荒唐而滑稽的事情，竟然就这样上演了，一如娱乐圈中那些让人匪夷所思的闹剧。

随着互联网的迅猛发展，网络暴力问题也日益凸显，成为时下社会治理的一大难题。近日，国家互联网信息办公室联合公安部、文化和旅游部、国家广播电视总局公布《网络暴力信息治理规定》。

随着网络技术的发展，“AI换脸拟声”、虚假网络投资理财等新型电信网络诈骗不断翻新花样，伪装性越来越强，侵害人民群众生命财产安全。

生成式人工智能的通用性、交互性、深度合成性等技术特征和传播模式对传统网络空间治理体系提出了挑战，应构建符合生成式人工智能产业链分布规律、产业形态并能嵌入现有网络空间治理体系的人工智能治理体系。

云计算是信息技术发展和服务模式创新的集中体现，是信息化发展的重要变革和必然趋势。随着企业数字化转型的逐步深入，如何深化用云的应用、进一步提升云计算的使用效能成为现阶段云计算发展的重点。

欢迎订阅《中国信息安全》杂志！

NIST выпускает первые в мире стандарты постквантового шифрования.

NetSPI discovered that Microsoft Outlook is vulnerable to authenticated remote code execution (CVE-2024-21378) due to improper validation of synchronized form objects.  By manipulating a configuration file, attackers can automatically register and instantiate a custom form, specifying a malicious executable as the form server, which bypasses Outlook‘s faulty allow-listing mechanism, enabling remote code execution on the […]

The post 0-Click Outlook RCE Vulnerability Triggered When Email is Clicked – Technical Analysis appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

Российские видеосервисы, такие как «VK Видео», начали активно набирать аудиторию за счет сбоя.