Week in review: ChatGPT as an infosec assistant, Google offers help to EU cybersecurity startups
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-42475 | Unauthenticated Heap Overflow in Fortinet FortiOS/FortiProxy SSL-VPN (Critical RCE) CVE-2022-42475 is a critical (CVSS 9.8) heap-based buffer overflow in the SSL-VPN service of Fortinet FortiOS and FortiProxy. A remote, unauthenticated attacker can trigger it by sending specifically crafted requests to an exposed SSL-VPN interface, with no user interaction or credentials required. Successful exploitation yields arbitrary code or command execution on the appliance, giving attackers a foothold on the perimeter device from which they can pivot into internal networks. Any organization running the listed FortiOS (6.0 through 7.2) or FortiProxy (7.0/7.2) versions with SSL-VPN enabled is affected. Exploitation is confirmed in the wild: the flaw is in CISA KEV with known ransomware use, has near-certain exploitation probability (EPSS 99.5%), and has been used in targeted government attacks and a Chinese-nexus espionage campaign that compromised over 20,000 systems, with attackers also noted to retain access even after patching. Do: Upgrade FortiOS and FortiProxy to fixed releases per Fortinet advisory FG-IR-22-398 (any version beyond the listed affected ranges), and reboot the appliance after patching to clear lingering SSL-VPN sessions since attackers have been observed retaining access post-patch. Check for indicators of compromise such as unknown local accounts, unexpected processes, and anomalous historical logins, and rotate SSL-VPN credentials if compromise is suspected. If SSL-VPN is not required, disable it or restrict exposure to trusted sources until patched. | 9.8 | 99% | KEV ransomware PoC |
| masshundreds of thousands of internet-exposed FortiGate/FortiProxy SSL-VPN endpoints (well over 100,000; 20,000+ confirmed victims in a single campaign) | |
| CVE-2023-20025 +1 in the same advisory: …20026 | A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, and RV082 Routers could allow an unauthenticated, remote att A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, and RV082 Routers could allow an unauthenticated, remote attacker to bypass authentication on an affected device. This vulnerability is due to improper validation of user input within incoming HTTP packets. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface. A successful exploit could allow the attacker to bypass authentication and gain root access on the underlying operating system. NVD description · AI analysis pending | 9.8 group max | 2% |
| — | ||
| CVE-2023-20045 | A vulnerability in the web-based management interface of Cisco Small Business RV160 and RV260 Series VPN Routers could allow an authenticated, remote attacker t A vulnerability in the web-based management interface of Cisco Small Business RV160 and RV260 Series VPN Routers could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands using root-level privileges on the affected device. To exploit this vulnerability, the attacker must have valid Administrator-level credentials on the affected device. NVD description · AI analysis pending | 7.2 | <1% |
| — | ||
| CVE-2023-21549 | Windows SMB Witness Service Elevation of Privilege Vulnerability Windows SMB Witness Service Elevation of Privilege Vulnerability NVD description · AI analysis pending | 8.8 | 1% |
| — | ||
| CVE-2023-21674 | Use-After-Free Privilege Escalation in Microsoft Windows ALPC CVE-2023-21674 is a use-after-free flaw (CWE-416) in the Windows Advanced Local Procedure Call (ALPC) facility, the kernel-level mechanism Windows uses for fast communication between processes and system services. An attacker who can already run code on a Windows machine can trigger the bug by sending crafted ALPC requests, corrupting memory in a privileged process. Successful exploitation allows a local, low-privileged attacker to elevate to SYSTEM/administrator privileges, typically to gain full control of the host or to complete an exploit chain after an initial compromise. Essentially all supported Windows client and server installations from Microsoft are affected; the source data does not list specific versions, and the fix shipped with Microsoft's January 2023 Patch Tuesday, which addressed a record 974 vulnerabilities including this and one other actively exploited Windows zero-day. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2023-01-10, confirming exploitation in the wild; no public proof-of-concept is known, ransomware use is undetermined, and EPSS estimates a 41.8% probability of exploitation in the next 30 days (99th percentile). Do: Apply Microsoft's January 2023 (released 2023-01-10) or later Windows cumulative security updates to all Windows clients and servers, per CISA's required action to 'apply updates per vendor instructions.' Because this is a local privilege escalation, prioritize hosts where low-privileged users or untrusted code execute, such as endpoints, RDS/VDI servers, and multi-user systems, and verify installation via your update-management inventory. Treat this as actively exploited; with no public PoC or documented workaround, timely patching is the primary mitigation. | 8.8 | 42% | KEV |
| mass≈1 billion+ Windows installations (Windows active installed base, nearly all unpatched-at-time systems in scope) |
Full article898 words · extracted from helpnetsecurity.com · click to collapse
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos:
Google is calling EU cybersecurity founders
Google announced that the Google for Startups Growth Academy: Cybersecurity program now accepts applications from EU companies.
Rackspace ransomware attack was executed by using previously unknown security exploit
The MS Exchange exploit chain recently revealed by Crowdstrike researchers is how the Play ransomware gang breached the Rackspace Hosted Exchange email environment, the company confirmed last week.
Vulnerabilities in cryptographic libraries found through modern fuzzing
Recently patched vulnerabilities in MatrixSSL and wolfSSL, two open-source TLS/SSL implementations / libraries for embedded environments, have emphasized the great potential of using fuzzing to uncover security holes in implementations of cryptographic protocols.
Microsoft plugs actively exploited zero-day hole (CVE-2023-21674)
To mark the January 2023 Patch Tuesday, Microsoft has released patches for 98 CVE-numbered vulnerabilities, including one exploited in the wild (CVE-2023-21674) and one (CVE-2023-21549) that’s been publicly disclosed.
Crypto audit of Threema revealed many vulnerabilities
Researchers have discovered cryptographic vulnerabilities in Swiss-based secure messaging application Threema that may have allowed attackers to do things like break authentication or recover users’ long-term private keys.
Cisco won’t fix router flaws even though PoC exploit is available (CVE-2023-20025, CVE-2023-20026)
Cisco has acknowledged one critical (CVE-2023-20025) and two medium-severity (CVE-2023-20026, CVE-2023-20045) vulnerabilities affecting some of its Small Business series of routers, but won’t be fixing them as the devices “have entered the end-of-life process.”
FortiOS flaw was exploited to compromise governmental targets (CVE-2022-42475)
A critical vulnerability in FortiOS SSL-VPN (CVE-2022-42475) that Fortinet has issued patches for in November 2022 has been exploited by attackers to compromise governmental or government-related targets, the company has shared.
4 identity security trends to watch in 2023
While many of the tried and true best security hygiene practices remain, we’ll face new and complex business challenges related to how we work, the systems we use, threats and compliance issues we face.
You must build a security team. Where do you start?
Security veteran Chris Deibler, the new VP of Security at DataGrail, has been brought in to build the company’s security team to support its growth.
Attackers abuse business-critical cloud apps to deliver malware
Over 400 distinct cloud applications delivered malware in 2022, nearly triple the amount seen in the prior year, and 30% of all cloud malware downloads in 2022 originated from Microsoft OneDrive, according to Netskope.
Why FIDO and passwordless authentication is the future
In this Help Net Security video, Jason Kent, Director at Open Seas, explains why FIDO and passwordless authentication is the future.
It’s official: Digital trust really matters to everyone online
In an environment with an expanded threat surface and a simple but powerful motivation for bad actors (financial reward), it is clear why digital trust is necessary.
Organizations are adopting SSE technology to secure hybrid work
With 88% of organizations supporting a hybrid or remote work model, it’s clear that the way people work has changed.
How to gain security consciousness through cost
In this Help Net Security video, Karthik Kannan, CEO at Anvilogic, talks about predictions for the cybersecurity world in 2023 and how to gain security consciousness through cost.
How to improve your incident response plan for 2023
Many organizations are confident in the existence of their incident response plan (IRP), but they are often not entirely sure what to do with it.
6 oversights that enable data breaches
Personal employee or customer data accounted for nearly 45% of all data stolen between July 2021 and June 2022, while companies’ source code and proprietary information accounted for a further 6.7% and 5.6% respectively, according to Imperva.
ChatGPT: The infosec assistant that is jack of all trades, master of none
ChatGPT from OpenAI is a conversational chatbot that was recently released in preview mode for research purposes.
The most significant DDoS attacks in the past year
In this Help Net Security video, Steve Winterfeld, Advisory CISO at Akamai, discusses the most powerful DDoS attacks in the past 12 months.
4 key shifts in the breach and attack simulation (BAS) market
The increase in the number of attack surfaces along with the rise in cybercriminal sophistication is generating technical debt for security operations centers (SOCs), many of which are understaffed and unable to dedicate time to effectively manage the growing number of security tools in their environment.
Why the atomized network is growing, and how to protect it
In this Help Net Security video, Martin Roesch, CEO of Netography, discusses the rise of the atomized network and the connected implications.
Maximizing data value while keeping it secure
How can organizations create an environment that allows the broadest access across distributed warehouses, databases, object stores and data exchanges, while at the same time maintaining consistent data oversight?
How to protect yourself from bot-driven account fraud
In this Help Net Security video, Nick Rieniets, Field CTO at Kasada, talks about this threat and offers tips on how to protect yourself from bot-driven account fraud.
7 security predictions for 2023
With online platforms and social media fully integrated into our daily routine, phishing and social engineering will continue to be a common cause of data breaches.
Guide: How virtual CISOs can efficiently extend their services into compliance readiness
While compliance used to be mainly the province of large enterprises, times have changed, and it is now a day-to-day concern for a growing number of small and medium businesses.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/01/15/week-in-review-chatgpt-as-an-infosec-assistant-google-offers-help-to-eu-cybersecurity-startups/