Aggregator

Sinon is an open-source, modular tool for the automatic burn-in of Windows-based deception hosts. It aims to reduce the difficulty of orchestrating deception hosts at scale while enabling diversity and randomness through generative capabilities. Sinon is designed to automate the setup of deception hosts by performing various actions that simulate actual user activity. The goal is to create a realistic environment that can deceive potential intruders. Sinon’s modular and configurable nature allows for easy adjustments … More →

The post Sinon: Open-source automatic generative burn-in for Windows deception hosts appeared first on Help Net Security.

Fortra 称，FileCatalyst Workflow 中存在一个严重的硬编码密码漏洞，攻击者可以利用该漏洞未经授权访问内部数据库，从而窃取数据并获得管理员权限。

任何人都可以使用该硬编码密码远程访问暴露的 FileCatalyst Workflow HyperSQL (HSQLDB) 数据库，从而未经授权访问潜在的敏感信息。

此外，数据库凭据可能会被滥用来创建新的管理员用户，因此攻击者可以获得对 FileCatalyst Workflow 应用程序的管理级访问权限并完全控制系统。

在最近发布的安全公告中，Fortra 表示该问题被跟踪为 CVE-2024-6633（CVSS v3.1：9.8，“严重”），影响 FileCatalyst Workflow 5.1.6 Build 139 及更早版本。建议用户升级到 5.1.7 或更高版本。

Fortra 在公告中指出，HSQLDB 仅用于简化安装过程，并建议用户在安装后设置替代解决方案。因为没有按照建议配置 FileCatalyst Workflow 使用备用数据库的用户很容易受到任何可以到达 HSQLDB 的来源的攻击。暂时还没有缓解措施或解决方法，因此建议系统管理员尽快应用可用的安全更新。

缺陷发现和细节

Tenable 于 2024 年 7 月 1 日发现了 CVE-2024-6633，当时他们在所有 FileCatalyst Workflow 部署中都发现了相同的静态密码“GOSENSGO613”。Tenable 解释说，在产品的默认设置下，可以通过 TCP 端口 4406 远程访问内部 Workflow HSQLDB，因此暴露程度很高。

一旦登录到 HSQLDB，攻击者就可以在数据库中执行恶意操作。例如，攻击者可以在 DOCTERA_USERS 表中添加管理员级别的用户，从而允许以管理员用户身份访问 Workflow Web 应用程序。

高访问级别、易利用性以及利用 CVE-2024-6633 的网络犯罪分子的潜在收益使得此漏洞对 FileCatalyst Workflow 用户来说极其危险。Tenable 指出，最终用户无法通过常规方式更改此密码，因此升级到 5.1.7 或更高版本是唯一的解决方案。

Fortra 产品因为其中的严重漏洞可能导致多个高价值企业网络同时遭受大规模攻击因此始终是攻击者的主要目标之一。

Global cybercrime has shown no sign of decline and is expected to grow strong per year over the next five years. To identify the most urgent cybersecurity threats of the first half of 2024, the Critical Start Cyber Research Unit (CRU) analyzed 3,438 high and critical alerts generated by 20 supported EDR solutions, as well as 4,602 reports detailing ransomware and database leak activities across 24 industries in 126 countries. The first half of 2024 … More →

The post Cyber threats that shaped the first half of 2024 appeared first on Help Net Security.

Here’s a look at the most interesting products from the past week, featuring releases from Bitwarden, Dragos, Fortinet, HYCU, and Rezonate. Fortinet introduces sovereign SASE and GenAI capabilities Fortinet announced the addition of sovereign SASE and GenAI capabilities to its unified SASE solution. With Fortinet Sovereign SASE, customers can determine how their data is routed and where security inspections occur, whether to a data center owned by Fortinet, a partner, or the customer, while ensuring … More →

The post New infosec products of the week: August 30, 2024 appeared first on Help Net Security.