PatchStack has pushed out a report that shows that a shocking 30% of vulnerabilities in WordPress sites are left unpatched. This is not to say that people are not patching (they are not), but the report illustrates that vendors for plugins are not properly updating their own tools and software to address security issues. WordPress is one of the most popular content management systems available and has a very broad ecosystem of plug-ins, themes, and other bolt-on components to make it even more flexible and usable.

IoT devices in general are the bane of most security teams. Typically, they lack basic security features and are complicated at best to keep patched. Much of this is due to the process needed to patch them and the rest of due to vendors being slow to push out the updated/patched images. To further complicate this, in the medical world you have the demand for 100% uptime and the ever-popular FDA exclusions that far too many vendors operate under. This usually means that on any given day Medical IoT devices are an attack surface waiting to be attacked.

Cisco has announced that a series of vulnerabilities along with the associated patches that go with them for some of the Nexus Series Switches based on NX-OS. Cisco’s NX-OS is the heart of their data center line of switches like the Nexus 3k, 5500 and 5600, as well as the 6k and 9k series. These switches are often deployed inside large data centers or used as core switches for data and storage networks. Because of this large and critical deployment footprint the new flaw (tracked as CVE-2022-20650) is a rather dangerous one.

Linux has always had something of a mystique about it. Regardless of the distro (flavor) of Linux there simply certain misconception around Linux that are both entertaining and concerning. One of my all-time favorites was/is that it is a “hacker” OS. This fun little misunderstand was so bad at one point that it was part of a parent’s guide on how to tell if your child is a hacker. Nothing says out of touch like labelling an entire OS line as a “hacker” OS. The other side of the coin is the belief that it is secure out of the box. In simple terms, no OS is secure out of the box, all of them have vulnerabilities including serious ones that allow for complete compromise.

Life would not be the same without new popping up that one state level threat actor or another was attacking and compromising US defense contractors or other businesses linked to US national security and defense. The counties of origin for these actors become a blur over time, although you do see some highlighted depending on current political trends. The two most often bandied about are Russia and China with North Korea getting an honorable mention.

Apache and their open-source tools have gotten a lot of press lately. After the Lgo4Shell vulnerability in their Log4J tool, and the massive response from vendors and security organizations we are now learning that researchers have discovered a remote code execution flaw in the NoSQL database management tool Cassandra. This time, unlike Log4J flaw the disclosure comes with a patch already available for installation.

The Threat Landscape is an interesting topic of discussion. It is a constantly changing thing and even the best predictions can often fall short of the actual threat. This is because in most cases, the attackers are a step ahead of the defenders. They have the advantage, to coin a D&D phrase, they won the initiative roll. Defenders are always waiting to see what might happen, they plan without really knowing what the attackers are going to do which means they have to be secure everywhere (not really a possibility). To help them put their resources in the right places, most security teams rely on threat intelligence feeds and an understanding of the Threat Landscape.

A vulnerability disclosed and patched in January is rearing its ugly head. Identified as CVE-2022-21882, this vulnerability affects Windows 10, 11 and Windows Server. On its own it is a significant threat since is allows for a privilege escalation that can turn into a complete compromise of the targeted device. Not exactly what you want to leave open. The good news is that Microsoft released a patch for it in January.

We first talked about the using the UEFI firmware as an attack vector (At Def Con 22 in 2014). Since that time there have been three identified and disclosed versions of malware that directly targeted this critical subsystem. That would seem to be a relatively small percentage given the time since it was first uncovered, the number of devices that operate using the UEFI firmware subsystem, and the time between then and now. However, this is only ones identified and in most of the identified cases were found because of the method of delivery for the OS payload. This begs the question, are there more out there that just have not been found?

Samba has released several updates that patch critical flaws in their popular Sever Message Block (SMB) freeware implementation. SMB is a protocol that allows for simple sharing of network resources and has had its share of critical vulnerabilities in the past. The sharing of network resources is a common target for attackers as it can be a quick an easy way to compromise a system. One of the vulnerabilities includes all versions of Samba before 4.13.17 (CVE-2021-44142).