Tag Archive for: compromised

Juniper firewalls compromised by bad code: What you need to know

Juniper Networks is warning customers to patch their NetScreen enterprise firewalls against bad code that enables attackers to take over the machines and decrypt VPN traffic among corporate sites and with mobile employees.

The danger is that attackers could exploit the code “to gain administrative access to NetScreen devices and to decrypt VPN connections,” Juniper says in a security announcement.

It would enable smart attackers to exploit the vulnerability and wipe out log files, making compromises untraceable, the company says.

To read this article in full or to leave a comment, please click here

Network World Tim Greene

Russian cybercrime group compromised half a million computers

A mistake by a suspected Russian-speaking cybercriminal group allowed a security vendor to peep on a campaign that stole login credentials for hundreds of thousands of online bank accounts.

In a new report, Proofpoint said it found a large number of WordPress websites that had been compromised to perform a drive-by download of Qbot, also known as Qakbot, a malicious software program.

Proofpoint analyzed the malware and found an unprotected control panel on a server used by the gang to control the computers, a dumb but not uncommon mistake.

To read this article in full or to leave a comment, please click here

Network World Security

Many home routers supplied by ISPs can be compromised en masse, researchers say

Specialized servers used by many ISPs to manage routers and other gateway devices provisioned to their customers are accessible from the Internet and can easily be taken over by attackers, researchers warn.

By gaining access to such servers, hackers or intelligence agencies could potentially compromise millions of routers and implicitly the home networks they serve, said Shahar Tal, a security researcher at Check Point Software Technologies. Tal gave a presentation Saturday at the DefCon security conference in Las Vegas.

At the core of the problem is an increasingly used protocol known as TR-069 or CWMP (customer-premises equipment wide area network management protocol) that is leveraged by technical support departments at many ISPs to remotely troubleshoot configuration problems on routers provided to customers.

To read this article in full or to leave a comment, please click here

Network World Security