Displaying items by tag: Vulnerability Management

When I was in the military, one of the things that I noticed was a massive reluctance to create new and unusual scenarios for war games. Instead, we always seemed to train for the last major combat theater. When going to the National Training Center the OpFor (opposing force) team would just run circles around the visiting units. This is because they were always looking at new strategies, tactics, and logistical methods to support them. The visitors would come in with ideas that things would be the same as last time and just get their asses handed to them. There were rare occasions when the visiting units won, but they were the exception and not the rule.

One of the most commonly asked questions in cybersecurity is “where do I start?” This common question shows just how overwhelmed many organizations are when faced with the reality of the threats that are out there. From ransomware to business email compromise, the threat actors certainly seem to be ahead of the implementations when it comes to securing the data that organizations are responsible for. So where should an organization start when it comes to building or optimizing their cybersecurity program?

This one goes in both the “failure of imagination” and “this is why we can’t have nice things” category. It seems that Gigabyte, for some reason, decided to embed an insecure update function into the UEFI BIOS of their motherboards, then shipped roughly 7 million of them to customers. The fatal flaw? Well, this is an update function that runs on startup. It writes a file to disk, reaches out to update servers over open HTTP then downloads any updates and installs them.

On May 19th 2023 Barracuda disclosed that there was a critical vulnerability in their Email Security Gateway appliances. This vulnerability is tracked under CVE-2023-2868 and is listed as a remote command injection vulnerability. The flaw is present in software versions 5.1.3.001 up to 9.2.0.006 for the ESG appliances only. As this was disclosed as a Zero-Day vulnerability there was an accelerated patch release schedules with the first patches made available on May 20th.

Apple’s System Integrity Protocol (SIP) has been something of a mix bag when it comes to security. It is a great feature from a raw and basic security viewpoint, but the same feature also has created challenges for the installation of third-party anti-malware and other security tools since its launch. All that aside, Microsoft, of all people, has shared details on a vulnerability that can be used by attackers to completely bypass the protections that SIP is supposed to offer.

There is an old adage that says compliance is not a substitute for security. You can check all the compliance check boxes, pass audits, and still end up with an insecure environment. Level Finance Crypto found this out the hard way after they were hacked due to a vulnerability in how some of their smart contracts were set up, despite passing more than one IT Security Audit.

PatchStack has pushed out a report that shows that a shocking 30% of vulnerabilities in WordPress sites are left unpatched. This is not to say that people are not patching (they are not), but the report illustrates that vendors for plugins are not properly updating their own tools and software to address security issues. WordPress is one of the most popular content management systems available and has a very broad ecosystem of plug-ins, themes, and other bolt-on components to make it even more flexible and usable.

IoT devices in general are the bane of most security teams. Typically, they lack basic security features and are complicated at best to keep patched. Much of this is due to the process needed to patch them and the rest of due to vendors being slow to push out the updated/patched images. To further complicate this, in the medical world you have the demand for 100% uptime and the ever-popular FDA exclusions that far too many vendors operate under. This usually means that on any given day Medical IoT devices are an attack surface waiting to be attacked.

Cisco has announced that a series of vulnerabilities along with the associated patches that go with them for some of the Nexus Series Switches based on NX-OS. Cisco’s NX-OS is the heart of their data center line of switches like the Nexus 3k, 5500 and 5600, as well as the 6k and 9k series. These switches are often deployed inside large data centers or used as core switches for data and storage networks. Because of this large and critical deployment footprint the new flaw (tracked as CVE-2022-20650) is a rather dangerous one.

Linux has always had something of a mystique about it. Regardless of the distro (flavor) of Linux there simply certain misconception around Linux that are both entertaining and concerning. One of my all-time favorites was/is that it is a “hacker” OS. This fun little misunderstand was so bad at one point that it was part of a parent’s guide on how to tell if your child is a hacker. Nothing says out of touch like labelling an entire OS line as a “hacker” OS. The other side of the coin is the belief that it is secure out of the box. In simple terms, no OS is secure out of the box, all of them have vulnerabilities including serious ones that allow for complete compromise.