Skip to main content

Industry News

Let's talk shop!

325 Topics
Brittany
BrittanyPro
published in Vulnerabilities
VULNERABILITY UPDATE: Adobe Patches 2nd Magento Zero Day This Week

It wouldn’t be the Friday before a three-day weekend without a new vulnerability. Or, a new vulnerability from a familiar face. Last week, @Peter-Automox wrote about Adobe’s out-of-band updates to patch a critical vulnerability in Adobe Commerce and Magento Open Source. That vulnerability, CVE-2022-24086, is an improper input validation flaw that allows arbitrary code execution and nets a 9.8/10 CVSS score. For this vulnerability, Adobe has released an out-of-band update on Monday, February 14th to remediate the vulnerability.But the fun doesn’t stop there! Adobe has revised the initial security bulletin to include another emergency patch for another zero-day discovered in Magento and Commerce. This new vulnerability, CVE-2022-24087, is also an improper input validation issue similar to their previous vulnerability.This new vulnerability is equally as severe, with a 9.8/10 CVSSv3.1 score, but Adobe is not aware of any exploitation in the wild of this vulnerability. We recommend priorit

950
Brittany
2 years ago
A
Anonymous
published in Patch Tuesday
Weekly Security Wrap-Up (February 15th, 2022)News

Happy Tuesday, folks! This week we’ll bite the bullet and finally have to discuss Russia vs. Ukraine, as some new things have like, come to light, man. But first...I refuse to be denied the opportunity to type “squirrelwaffle” on the internet, so let’s start there: Squirrelwaffle, Microsoft Exchange Server vulnerabilities exploited for financial fraudFinancial fraud is [almost] never a laughing matter, and leaving servers unpatched for years is even worse, and this story has both. “Squirrelwaffle” is basically just a malicious document (“MalDoc”) that gets downloaded and runs a script that just downloads payloads in a loop. From the article, “The combination of Squirrelwaffle, ProxyLogon, and ProxyShell against Microsoft Exchange Servers is being used to conduct financial fraud through email hijacking.” IF ONLY THERE WERE SOME WAY TO AUTOMATE PATCHING. Ukrainian military agencies, banks hit by DDoS attacks, defacementsWelp...here it comes. From the article: “Starting from the afternoon

550
A
2 years ago
A
Anonymous
published in Vulnerabilities
VULNERABILITY UPDATE: Google Issues Emergency Chrome Patch for Actively Exploited Zero-DayNews

 It must be a day that ends in “y”, because...Guess who? Anyways, last night Google issued an emergency patch for a zero-day Chrome exploit that’s already been actively exploited in the wild. From the AX blog: “On Monday evening, Google released an emergency Chrome update to patch an actively-exploited zero-day, along with ten other security fixes in Chrome 98.0.4758.102.The zero-day, CVE-2022-0609, is a high severity use-after-free vulnerability in Animation, which is pretty much all that is known right now. We can expect more details to come as the patch rolls out to all Chrome users in the next few weeks...If you use Automox, Chrome patching is natively supported for Windows, macOS, and Linux systems.”A ‘Patch All’ policy will help ensure that your endpoints are covered, but you could also create a policy exclusively for Chrome by following the steps listed in Peter’s article: https://www.automox.com/blog/google-issues-emergency-chrome-patch-for-actively-exploited-zero-day 

1630
A
2 years ago
A
Anonymous
published in Vulnerabilities
VULNERABILITY UPDATE: Adobe Magento Vulnerability Scores a 9.8 out of 10Blog

Oh good, a 9.8-score vulnerability on a Sunday! Our own top-researcher, @Peter-Automox, has full details on the AX blog: “On Sunday, Adobe released out of band updates to patch a critical vulnerability in Adobe Commerce and Magento Open Source. CVE-2022-24086 is an improper input validation flaw that allows an attacker to execute arbitrary code without credentials or administrative privileges.We recommend prioritizing patching as soon as possible (today, ideally), since exploits are being seen in the wild and Magento has previously been a target for attackers. The patch from Adobe is available here for download.If you’re running Adobe Magento or Commerce 2.4.3p1 and earlier, or 2.3.7-p2 and earlier, you are vulnerable to attack. Versions 2.3.3 and lower are not affected, though eCommerce security firm Sansec recommends manually implementing the patch anyways.”As always, head over to the blog to read Peter’s full post...but patch Magento first!   

720
A
2 years ago
A
Anonymous
published in Vulnerabilities
VULNERABILITY UPDATE: Apple Patches Its Third Zero-Day In 2022News

Eww.Hi, folks. What would Friday be without a fun new zero-day? From the AX blog: On Thursday, Apple patched another zero-day, its third this year after patching CVE-2022-22587 (an arbitrary code execution with kernel privileges vulnerability) and CVE-2022-22594 (a vulnerability allowing users browsing activities to be tracked and identified in real-time) in January. The vulnerability impacts all iPhone models from 6s forward, iPad Pro, iPad Air 2 and later, 5th generation iPads and later, iPad mini 4 and later, and iPod touch in addition to the macOS Monterey operating system. Organizations with macOS Monterey devices, iPhones, or iPads should patch immediately, since the vulnerability could already be exploited in the wild. To read the article in full and get links to Apple’s updates, just head over to the AX Blog!

720
A
2 years ago
A
Anonymous
published in Vulnerabilities
VULNERABILITY UPDATE: CISA Has Issued Alert for Critical SAP VulnerabilitiesNews

Hey look!!This week, SAP released security updates to address three critical vulnerabilities dubbed Internet Communication Manager Advanced Desync (ICMAD), and found by security research firm Onapsis: CVE-2022-22536, CVE-2022-22532, and CVE-2022-22533, sporting CVSS scores of 10 (the highest possible), 8.1, and 7.5, respectively. Over on the blog, leading AX researcher @Peter-Automox has written a piece with some great details and remediation tips, which you can read in full right here. If you have any questions, let us know in the comments.

1840
A
2 years ago
JessicaS-Automox
JessicaS-AutomoxAutomox Employee
published in Patch Tuesday
Patch Tuesday Rundown - February 2022

Happy February everybody! I can’t believe it’s already February, where did the time go?? It’s time for a Patch Tuesday rundown, so let’s get into it! This month we do have some good news - Microsoft had zero critical vulnerabilities this month, yay! They did, however, release 48 high severity patches, which will keep folks busy this month for sure. One of these vulnerabilities was publicly disclosed, CVE-2022-21989.Adobe released security bulletins for five of their products, with 17 CVEs in total.Apple’s updates included fixes for 16 CVEs, one of with is critical for iOS and may have been exploited already.Google released a new version of Chrome for Mac, Windows and Linux to address a security vulnerability whereby an attacker could gain control of a system.Mozilla released two security advisories, both with a high rating, addressing 13 CVEs. For more information on these updates, you can check out our Patch Tuesday Index, our blog that breaks down these vulnerabilities in more detail

920
JessicaS-Automox
2 years ago
A
Anonymous
published in Patch Tuesday
Weekly Security Wrap-Up (February 8th, 2022)News

Happy Patch Tuesday, y’all! Don’t forget to head over to the AX Patch Tuesday Rapid Response Center for everything you need to stay up to date. This month is pretty light, but as soon as I typed that, there were onehunnerdbillion* infections due to unpatched systems.*Possible exaggeration IRS to End Use of Facial Recognition to Identify TaxpayersIt’s about d*ng time, y’all! I’m tired of constantly getting asked to pay Kevin Smith’s taxes. All joking aside, an IRS commissioner is quoting in the article as saying, “Everyone should feel comfortable with how their personal information is secured, and we are quickly pursuing short-term options that do not involve facial recognition.” [CLAPPING.GIF] ExpressVPN offering $100,000 to first person who hacks its serversWhoa. Welp, as secure as TrustedServer is, this is a pretty big flag to plant in the ground. From the article, “The bug bounty program is run through BugCrowd, which offers a safe harbor for researchers who attempt to breach Expres

580
A
2 years ago
A
Anonymous
published in Patch Tuesday
Weekly Security Wrap-Up (February 1st, 2022)News

Domo arigato, I’m using Roboto!Hi, y’all! Another Tuesday is upon us, and I can’t help but feel adrift in a sea of scary cyber security stories and sibilant “s”s. What? There’s a lot of stories to cover this week, but we’re not going to talk about Ukraine vs. Russia, so that should free up a ton of space. Here’s a couple of good ones:FBI urges temporary phones for Olympic athletesWell...yeah. Look, there’s really no way to talk about China and cybersecurity and/or the Olympics without it turning political. In lieu of that, let’s focus on the tech: everyone attending the Olympics in China will be required to download the Olympics app for COVID tracking, apparently among other things. You can imagine the security risks of running that app on your device, but don’t worry, because “China dismissed the concerns.” 277,000 routers exposed to Eternal Silence attacks via UPnP Dang, y’all! If you’re not familiar with Universal Plug and Play, you’re better off: “UPnP is a connectivity protocol op

590
A
2 years ago
A
Anonymous
published in Vulnerabilities
VULNERABILITY UPDATE: Samba ‘Fruit’ Vulnerability Allows RCENews

Hey, folks - Chad here with a quick yet important vulnerability update. A new CVSS 9.9 critical vulnerability in the Samba platform allows remote code execution with root privileges.  Over on the AX blog, our own @JayG-Automox writes: “ This vulnerability is similar to SambaCry in 2017 which also targeted Samba. This vulnerability is likely more critical as it does not require valid credentials to a writable share making it easier to use as a springboard within the network….The criticality of this vulnerability combined with the wide potential impact makes this a must-remediate for organizations.” So before you go read the blog, get to patching! However, “If patching immediately isn’t an option, Samba recommends a temporary workaround to remediate: Remove the fruit VFS module from the list of configured VFS objects in any "vfs objects" line in the Samba configuration smb.conf file.”You can read Jay’s piece in full here: https://blog.automox.com/samba-fruit-critical-vulnerability  

1260
A
2 years ago
A
Anonymous
asked in Patch Tuesday
QUESTION: How do you find out about the most relevant security news?

Politely, though!Hi, y’all - Chad here. We thought we’d take a minute today to throw out a question. Every week, we post our Security News Wrap-Up from sources we know and trust, but there’s a lot going on in the CyberWorld and we no doubt could miss stories here and there. While we rely on a few tried and true various publications, the more sources we can well, source, the better! Let us know - unless the “source” you trust is just your friend Shawn down in Florida who “works on computers” - let’s keep this sophisticated. So we’d like to ask: where do you get your security news?

0
A
2 years ago
A
Anonymous
published in Vulnerabilities
VULNERABILITY UPDATE: Linux PwnKitNews

Hi, y’all - quick update for all you #Linux admins. The Linux PwnKit vulnerability is a nasty one, giving an attacker full root access on most major Linux distros. Over on the Automox Blog, our very own @Peter-Automox has written a piece that includes a worklet for quick remediation.Note: the evaluation script simply passes to remediation, which will disable pkexec's ability to operate as intended. Again, please thoroughly test before applying to systems in production. Check out Peter’s blog for the complete worklet: Linux PwnKit Vulnerability Gives Full Root Access on Most Major Distributions

760
A
2 years ago
A
Anonymous
published in Patch Tuesday
Security Wrap-Up (January 25th, 2022)News

Happy Tuesday, y’all! While we’ve all been busy this week debating the merit of single-possession overtime in organized ball sports (the correct answer is: “it’s stupid; fix it”), quite a few interesting things have been going on in the security world. I guess that’s becoming standard, but there were reports of some pretty newsworthy stories that I didn’t see on either the 7am, 10am, Noon, 4pm, 5pm, 6pm, or 10pm news - and as a middle-aged white dude, I watch them all!So here are a few stories that seemed worthy of mention this week, at least by me:Google Drive now warns you of suspicious phishing, malware docsToday in “Lol, it’s about time”-news...Google has announced that Drive will finally start showing warnings about malicious files that are shared with your account. From the article: "Google will automatically evaluate any files that are shared with you from outside of your organization for phishing or malware. If detected, Google will block your access to the file in order to pro

520
A
2 years ago
A
Anonymous
published in Patch Tuesday
Security Wrap-Up (January 18th, 2022)News

Happy Tuesday, folks! It’s Tuesday, right? We had a long weekend in recognition of MLK Day here in the states, so I’m a little out of sorts. There are plenty of security stories to talk about this week, from the more-than-mildly-annoying to the downright scary. But we’re focusing on one story this week, because of its ability to be both annoying and terrifying. Yeehaw, Tuesdays!  How Brainjacking Became a New Cybersecurity Risk in Health Care How about no, Science!? I know you’re currently screaming internally “What the h*ck is brainjacking anyway!?”, so from the article: “Brainjacking is a kind of cyberattack in which a hacker obtains unauthorized access to neural implants in a human body.” That’s pretty bonkers. And cool. And terrifying. But, research has shown the possibility/feasibility of it, in scientific ways! A recent article titled Brainjacking: Implant Security Issues in Invasive Neuromodulation has such scary initiatives as “...illustrate the potential severity of this risk,

580
A
2 years ago
DavidRies
DavidRiesRookie
posted in Patch Tuesday
Log4Shell / Log4J Detection Scripts

Hi Everyone,Some of my Arctic Wolf customers and colleagues asked me to post here and share our Log4Shell vulnerability detections scripts with the Automox community:GitHub: https://github.com/rtkwlf/wolf-tools/tree/main/log4shell Windows PowerShell: https://github.com/rtkwlf/wolf-tools/blob/main/log4shell/log4shell_deep_scan.ps1 Linux/macOS sh: https://github.com/rtkwlf/wolf-tools/blob/main/log4shell/log4shell_deep_scan.shThe Arctic Wolf Log4Shell Deep Scan is designed to detect Java application packages subject to CVE-2021-44228 and CVE-2021-45046. The scripts search the system for Java applications that contain the Log4J class JndiLookup.class which is the source of the Log4Shell vulnerabilities. If this class is found within an application, the script looks for updates to Log4J that indicate the application has been updated to use Log4J 2.16+ or Log4J 2.12.2+. If the application contains JndiLookup.class but does not appear to have been updated, the application is vulnerable. If yo

2
A
2 years ago
Pablo_1010
Pablo_1010Rookie
posted in Vulnerabilities
Windows domain controller boot loops

Hi, the latest Windows Server updates are causing severe issues for administrators, with domain controllers having spontaneous reboots, Hyper-V not starting, and inaccessible ReFS volumes until the updates are rolled backYesterday, Microsoft released the Windows Server 2012 R2 KB5009624 update, the Windows Server 2019 KB5009557 update, and the Windows Server 2022 KB5009555 update as part of the January 2022 Patch Tuesday.After installing these updates, administrators have been battling multiple issues that are only resolved after removing the updates. Here is the source of the newshttps://www.bleepingcomputer.com/news/microsoft/new-windows-server-updates-cause-dc-boot-loops-break-hyper-v/ 

1
M
2 years ago
A
Anonymous
published in Patch Tuesday
Security Wrap-Up (January 11th, 2022)News

 Hi, everybody! On this Wednesday after #PatchTuesday, I thought we’d cover a few stories that have been swirling around the weblogosphere this week. Here we are, what - twelve days into 2022 and we’re already seeing warnings from the gov’t, mass outages, and I just finished up Ted Lasso but now….what, I just have to wait for more episodes to get made?? This is not the future I signed up for, y’all. Let’s check out some stories: Europol Ordered to Delete Data of Individuals With No Proven Links to CrimesI think the headline there tells the story, but yup - pretty awesome win for personal privacy in the EU! From the article: “Datasets older than six months that have not undergone this Data Subject Categorisation must be erased," the European Data Protection Supervisor said in a press statement. "This means that Europol will no longer be permitted to retain data about people who have not been linked to a crime or a criminal activity for long periods with no set deadline.” I hope you’re p

520
A
2 years ago
EricF-Automox
EricF-AutomoxAutomox Employee
posted in Patch Tuesday
Video: Apache Log4j and the Log4Shell Vulnerability

Interested in learning more about Apache Log4j and the Log4Shell vulnerability? Automox just posted a video where we review Log4j and how it is used, and the timeline of events of the Log4Shell vulnerability and how it works. We also, of course, provide detailed instructions on how to remediate the vulnerability.Apache Log4j and the Log4Shell Vulnerability 

0
EricF-Automox
2 years ago
A
Anonymous
published in Patch Tuesday
Weekly Security Wrap-Up (January 5th, 2022)News

Happy midweek, y’all! I’m just getting back from my first week off in about a decade, and I may have forgotten how to use 2/3 of the apps we use every day here at AX. Has anyone seen my Post-It® full of passwords? Sigh, this is a disaster. Speaking of disasters…Unfortunately, the cybersecurity world didn’t stop being scary in my absence. Rather than try to go back to everything I missed, let’s just talk about a couple of this week’s big stories.  The jerk store called... Okay, as offensive as that attack was, I don’t have time to rant about it. Instead:iOS malware can fake iPhone shut downs to snoop on camera, microphoneI’m already pretty paranoid about mobile devices and there are some specific tools that I use on every device I own. That being said, there’s just really no end to the layers required for good cyber-hygiene these days. While you shouldn’t assume your mic and camera aren’t already spying on you, this is a pretty nasty piece of malware. All you iOS users who download apps

470
A
2 years ago
JessicaS-Automox
JessicaS-AutomoxAutomox Employee
published in Vulnerabilities
Patch Tuesday Rundown - December 2021

Let’s wrap up 2021 with one more look at vulnerabilities for the month of December. Microsoft didn’t hold back, releasing 67 vulnerability patches. Adobe takes second place, patching 60 vulnerabilities across 11 products. Mozilla patched 35 vulnerabilities, one of which is critical. Google rounds it out by patching 5 vulnerabilities this month. But we all know who took the cake – the Log4Shell vulnerability.Let’s address the one we all know and (don’t really) love – the Log4Shell zero-day. An RCE vulnerability was patched with 2.15.0 on December 6, but a new vulnerability was found in that release. It was originally given a CVSS score of 3.7 and 2.16.0 was delivered. Shortly thereafter, a new bypass was found that allows full RCE in 2.15.0, upping the score to 9.0. Do not remain on 2.15.0, you are not fully protected. Upgrade to 2.16.0 to be fully patched. For more details on this vulnerability, check out our blog.Even though our focus was mainly on Log4Shell, let’s review what else ca

960
JessicaS-Automox
2 years ago
Brittany
BrittanyPro
posted in Vulnerabilities
[UPDATE] New Log4j Critical Vulnerability Scores a 10/10 (So Act Fast)

 UPDATE (12/17/21) - includes new Remediation Code: On December 6, version 2.15.0 was released to address CVE-2021-44228, the now infamous 10/10 CVSS remote code execution (RCE) vulnerability in Log4Shell. Shortly after, CVE-2021-45046 was discovered in version 2.15.0, with a CVSS of 3.7. Version 2.16.0 was released on December 13 to address the new vulnerability.However, on December 17 a researcher discovered a new bypass to allow full RCE once again, which resulted in a CVSS increase from 3.7 to 9.0. If you only upgraded to version 2.15.0, you are not protected from possible RCE, upgrade to 2.16.0 immediately. Visit the Apache website for additional information.Log4Shell is a zero-day unauthenticated Remote Code Execution (RCE) vulnerability in Log4j versions 2.0-beta9 up to 2.14.1 identified as CVE-2021-44228.--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

2
Snovak
2 years ago
A
Anonymous
published in Patch Tuesday
Weekly Security Wrap-Up (December 14th, 2021)News

 Happy Tuesday, folks - Chad here. Yup, I’ll just shut up now, and we can start screaming about Log4j. There are obviously other stories in security news this week, but man...never mind those for today. Let’s get the obvious part for Admins out of the way:Sigh, yup!That pretty much sums up how most of my friends in Security feel this week. So now that we’re all laughing instead of crying, it’s alphabet soup time, I guess: WTAH*eck is Log4j? Well, if you haven’t read by now, here’s a TL;DR: Log4j is an open-source Java library from Apache. It’s been downloaded ~500k times from GitHub and is pretty widely-used for things like event logging in applications. Among other things. It’s already being exploited, and could get pretty wild if not widely remediated ASAFrigginP. @Brittany  recently posted a thread that contains a “quick fix” worklet, so be sure to check that out. “10 out of 10” is like, pretty bad, y’all. Even the government has taken quick action. I mean, read that last sentence a

710
A
2 years ago
A
Anonymous
published in Patch Tuesday
Security Wrap-Up (December 7th, 2021)News

Hi, everybody - Chad here. Happy Wednesday morning! Well, unless you’ve recently been victimized by worldly, ultra-sophisticated cybercriminals. Couple of pretty scary stories in the news this week, especially if you still get all itchy in the scalp when you hear “SolarWinds”. Let’s go see.. SolarWinds Attackers Spotted Using New Tactics, MalwareWell, it’s been a year, so these jerks are back. But this time, they’re getting creative - one newtechnique researchers observed the group using in the attacks is the abuse of repeated MFA push notifications to gain access to corporate accounts, according to the article. Most MFA providers send users a push notification or a phone call where they then enter a code/press a key as a second factor to authenticate access to an account.From the article: “Using a valid username and password combination, the researchers said that the attackers issued multiple MFA requests to an end user’s legitimate device until the target accepted the authentication.

530
A
2 years ago
EricF-Automox
EricF-AutomoxAutomox Employee
posted in Patch Tuesday
New Blog: Who’s Minding the Store? How to Protect Against Cybersecurity Threats This Holiday Season

We are into the 2021 Holiday Season. Beginning with Thanksgiving, millions of people take time off from their jobs and schools to spend time with relatives, eat lots of good food, watch "Miracle on 34th Street" on repeat, and shop Black Friday deals.Unfortunately, the holidays have become a magical time for hackers and cybercriminals, too.Be sure to read our blog “Who’s Minding the Store? How to Protect Against Cybersecurity Threats This Holiday Season.” Included is a list of best practices and recommendations for organizations to follow to help address the risk posed by all cyber threats, including ransomware during the holidays. 

0
EricF-Automox
2 years ago
EricF-Automox
EricF-AutomoxAutomox Employee
posted in Patch Tuesday
The Best Practices in Out-of-Band Patch Management

Want to lean about best practices for managing out-of-band vulnerabilities through cloud-native patch management and endpoint management? Be sure to join Marina Liang, Senior Security Engineer from Automox as she gives you all the details in this informative video. The Best Practices in Out-of-Band Patch Management - YouTube

0
EricF-Automox
2 years ago
Terms & ConditionsCookie settings