Multiple Botnets Exploiting Critical Oracle WebLogic Bug — PATCH NOW
Multiple botnets are targeting thousands of publicly exposed and still unpatched Oracle WebLogic servers to deploy crypto miners and steal sensitive information from infected systems.
Stantinko Botnet Now Targeting Linux Servers to Hide Behind Proxies
An adware and coin-miner botnet targeting Russia, Ukraine, Belarus, and Kazakhstan at least since 2012 has now set its sights on Linux servers to fly under the radar.
Critical Unpatched VMware Flaw Affects Multiple Corporates Products
VMware has released temporary workarounds to address a critical vulnerability in its products that could be exploited by an attacker to take control of an affected system.
Microsoft Releases Windows Security Updates For Critical Flaws
Microsoft formally released fixes for 112 newly discovered security vulnerabilities as part of its November 2020 Patch Tuesday, including an actively exploited zero-day.
Researcher Discloses Critical RCE Flaws In Cisco Security Manager
Cisco has published multiple security advisories concerning critical flaws in Cisco Security Manager (CSM) a week after the networking equipment maker quietly released patches with version 4.22 of the platform.
Cisco warns of actively exploited IOS XR zero-days
Cisco warned on Saturday about two zero-day vulnerability impacting the Internetwork Operating System (IOS) that ships with its networking equipment.
New Chrome 0-day Under Active Attacks – Update Your Browser Now
Attention readers, if you are using Google Chrome browser on your Windows, Mac, or Linux computers, you need to update your web browsing software immediately to the latest version Google released earlier today.
Google Warns of Zero-Click Bluetooth Flaws in Linux-based Devices
Google security researchers are warning of a new set of zero-click vulnerabilities in the Linux Bluetooth software stack that can allow a nearby unauthenticated, remote attacker to execute arbitrary code with kernel privileges on vulnerable devices.
India Witnessed Spike in Cyber Attacks Amidst Covid-19 - Here's Why?
The COVID-19 outreach is turning out to be not only health, social, and economic hazard but also a cybersecurity crisis. The pandemic has presented new challenges for businesses in the areas of remote collaboration and business continuity.
FIN11 Hackers Spotted Using New Techniques In Ransomware Attacks
A financially-motivated threat actor known for its malware distribution campaigns has evolved its tactics to focus on ransomware and extortion. "Recent FIN11 intrusions have most commonly led to data theft, extortion and the disruption of victim networks via the distribution of CLOP ransomware".
Warning — Unpatched Critical 'Wormable' Windows SMBv3 Flaw Disclosed
Shortly after releasing its monthly batch of security updates, Microsoft late yesterday separately issued an advisory warning billions of its Windows users of a new critical, unpatched, and wormable vulnerability affecting Server Message Block 3.0 (SMBv3) network communication protocol.
It appears Microsoft originally planned to fix the flaw as part of its March 2020 Patch Tuesday update only, but, for some reason, it pulled the plug at the last minute, which apparently did not stop a tech company from accidentally leaking the existence of the unpatched flaw.
The yet-to-be patched flaw (tracked as CVE-2020-0796), if exploited successfully, could allow an attacker to execute arbitrary code on the target SMB Server or SMB Client.
The belated acknowledgment from Microsoft led some researchers to call the bug "SMBGhost."
"To exploit the vulnerability against an SMB Server, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv3 Server," Microsoft disclosed in an advisory. "To exploit the vulnerability against an SMB Client, an unauthenticated attacker would need to configure a malicious SMBv3 Server and convince a user to connect to it."
Server Message Block protocol provides the basis for file sharing, network browsing, prinAccording to a now-removed Cisco Talos post, the flaw opens vulnerable systems to a "wormable" attack, making it easy to propagate from one victim to the other.
Although it's unclear when Microsoft plans to patch the flaw, the company is urging users to disable SMBv3 compression and block TCP port 445 on firewalls and client computers as a workaround.
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force
Furthermore, Microsoft has cautioned that disabling SMBv3 compression will not prevent the exploitation of SMB clients.
It's worth pointing out that the flaw impacts only Windows 10 version 1903, Windows 10 version 1909, Windows Server version 1903, and Windows Server version 1909. But it's possible more versions are affected as SMB 3.0 was introduced with Windows 8 and Windows Server 2012.
Despite the severity of the SMB bug, there's no evidence that it's being exploited in the wild. But it's also necessary to draw attention to the fact that this is far from the only time SMB has been exploited as an attack vector for intrusion attempts.
In the past few years alone, some of the major ransomware infections, including WannaCry and NotPetya, have been the consequence of SMB-based exploits.
For now, until Microsoft releases a security update designed to patch the CVE-2020-0796 RCE flaw, it's recommended that the system administrators implement the workarounds to block attacks attempting to exploit the vulnerability.ting services, and interprocess communication over a network.