Tag Archive for: discovered

8 zero-day vulnerabilities discovered in popular industrial control system from Carrier

/in


Eight zero-day vulnerabilities affecting a popular industrial control provided by Carrier have been identified and patched, according to security researchers from Trellix who discovered the issues.

The vulnerabilities affect the LenelS2 Mercury access control panel, which is used to grant physical access to facilities and integrate with more complex building automation deployments. 

Carrier’s LenelS2 Mercury access control panels are widely used across hundreds of companies in the healthcare, education, and transportation industries as well as federal government agencies and organizations. 

Trellix said they combined both known and novel techniques that allowed them to hack the system, achieve root access to the device’s operating system and pull firmware for emulation and vulnerability discovery. 

Carrier associate director of product security architecture Joshua Jessurun disputed the idea that these are zero-day vulnerabilities but told The Record that his team worked with Trellix on remediating the issues and released an advisory with detailed guidelines on what users need to do to address the vulnerabilities. Some of the issues need to be mitigated while most are addressed in firmware updates.

The Cybersecurity and Infrastructure Security Agency (CISA) released its own advisory on the issues – which are tagged as CVE-2022-31479, CVE-2022-31480, CVE-2022-31481, CVE-2022-31482, CVE-2022-31483, CVE-2022-31484, CVE-2022-31485, CVE-2022-31486 – with most carrying CVSS scores above 7.5. 

A chart of the vulnerabilities from Trellix.

CISA explained that exploitation of the bugs would give “an attacker access to the device, allowing monitoring of all communications sent to and from the device, modification of onboard relays, changing of configuration files, device instability, and a denial-of-service condition.”

Trellix security researchers Steve Povolny and Sam Quinn said they “anticipated a strong potential for finding vulnerabilities, knowing that the access controller was running a Linux Operating System and root access to the board could be achieved by leveraging classic hardware hacking techniques.” 

“While we believed flaws could be found, we did not…

Source…

Cyber Security Today, April 15, 2022 – A new botnet discovered, low MFA adoption and a Struts bug finally patched

/in


A new botnet discovered, low MFA adoption and a Struts bug finally patched.

Welcome to Cyber Security Today. It’s Friday April 15th, 2022. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com. Thanks for taking the time to tune in if this is a holiday Friday for you.

&nbsp

 

 

A new denial of service botnet has been discovered by security researchers in China. Called Fodcha, it’s adding 100 new infected devices to the estimated 62,000 enslaved devices already on the network. Most are in China. Devices are being compromised by Fodcha malware either through known vulnerabilities or weak passwords on Android servers, GitLab accounts and certain brands of routers. Some are made by Totolink. Last week I reported that another botnet was also compromised of certain unpatched models of Totolink routers.

I regularly quote cybersecurity experts saying implementing multifactor authentication is one of the best things IT leaders can do to lower the risk of a successful cyberattack through compromised passwords. So, here are some disturbing numbers from a report released this week by Trellix: Less than half of U.S. government agency respondents to a survey said their organization has fully developed MFA. At least that’s better than the critical infrastructure sector — which includes banks, transportation companies and utilities. Only 37 per cent of American firms in that sector had implemented MFA. Guest commentator Terry Cutler and I will talk about MFA and other identity management technologies in the Week in Review podcast later today.

Apache has admitted a fix for the Struts Java web application development platform issued two years ago didn’t do the job. It has now put out what it says is a patch that solves the problem. It’s serious enough that the U.S. Cybersecurity and Infrastructure Security Agency is urging users to upgrade to version 2.5.30.

Attention hospital IT administrators: If your facility uses the Aethon TUG wireless smart robot cart for delivering medicine or maintenance supplies, the Homebase server needs to be patched. Researchers at Cynerio have discovered five vulnerabilities that could allow an attacker to take remote…

Source…

New Destructive Wiper Malware Discovered By Cyber-Security Researchers

/in


New Destructive Wiper Malware Discovered By Cyber-Security Researchers – Sentinelassam

Begin typing your search above and press return to search.

Source…

Another Chinese Hacking Tool Discovered By Symantec

/in


Recently, some researchers US cybersecurity firm Symantec announced that they found a “highly sophisticated” Chinese hacking tool. It turns out the latter has been used in the past decade but no one could catch it. Symantec call it Daxin and published its research earlier today.

Also Read: Pavel Durov: Apple And Google Are Guilty Of Hacking Smartphones

As a US government official said, they have got it from Symantec recently and shared the information with their foreign partners.

“It’s something we haven’t seen before,” said Clayton Romans, associate director with the US Cybersecurity Infrastructure Security Agency (CISA). “This is the exact type of information we’re hoping to receive.”

Joint Cyber Defence Collaborative Works Effectively

With this statement, Symantec also confirmed its cooperation with the government. We are talking about a public-private cybersecurity information-sharing partnership, JCDC. The latter, which stands for Joint Cyber Defence Collaborative, is a collective of government defense agencies. That’s not difficult to guess that it includes the FBI and National Security Agency as well as 22 US technology companies. Within the cooperation, they share information concerning active cyberattacks.

As expected, the Chinese embassy in Washington did not respond to scmp’s request for comment.

“The capabilities of this malware are remarkable and would be extremely difficult to detect without this public research,” said Neil Jenkins, chief analytics officer at the Cyber Threat Alliance, a non-profit group that brings together cybersecurity experts to share data.

Is This Hacking Tool From China?

Well, many people might think why this hacking tool should come our way from China. In this regard, as Symantec explains, components of Daxin were combined with another Chinese-linked computer hacker infrastructure. So…

Source…