U.S. agency cautions employees to limit phone use due to Salt Typhoon hack of telco providers
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-20399 | Authenticated Command Injection in Cisco NX-OS Grants Root Privileges CVE-2024-20399 is a command injection flaw (CWE-78) in the CLI of Cisco NX-OS Software, caused by insufficient validation of arguments passed to specific configuration CLI commands. An authenticated attacker who already holds Administrator credentials can trigger it by submitting crafted input as the argument of an affected configuration command, gaining the ability to execute arbitrary commands as root on the device's underlying operating system. Because Administrator access is required, the flaw is effectively a privilege-escalation issue following credential compromise, and it grants no additional privilege on Nexus 3000 Series, Nexus 7000 Series running NX-OS 8.1(1) or later, and Nexus 9000 Series in standalone NX-OS mode, which already allow administrative bash-shell access to the OS. Any organization running affected NX-OS on Cisco Nexus switching is in scope, with the practical risk concentrated in environments where admin credentials may have been stolen. Exploitation has been observed in the wild: the China-linked group 'Velvet Ant' (associated with Salt Typhoon) used it as a zero-day to compromise U.S. ISPs and telecom providers, and CISA added it to the Known Exploited Vulnerabilities catalog on 2024-07-02. Do: Upgrade affected Nexus switches to a fixed NX-OS release per Cisco's security advisory, as required by the CISA KEV listing (apply mitigations per vendor instructions or discontinue use if fixes are unavailable). Restrict and audit Administrator-level CLI access on NX-OS devices, and hunt for suspicious configuration-command activity or unexplained root-level actions, given Velvet Ant/Salt Typhoon targeting of telecom and ISP networks. For Nexus 3000, Nexus 7000 (8.1(1)+), and Nexus 9000 standalone-mode devices the flaw adds no privilege, but patching is still recommended. | 6.7 | 4% | KEV |
| masshundreds of thousands of NX-OS/Nexus devices deployed across enterprise and data-center networks (no authoritative public install count) |
Full article817 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
November 10, 2024
US CFPB warns employees to avoid work-related mobile calls and texts following China-linked Salt Typhoon hack over security concerns.
The US government’s Consumer Financial Protection Bureau (CFPB) advises employees to avoid using cellphones for work after China-linked APT group Salt Typhoon hackers breached major telecom providers.
The Consumer Financial Protection Bureau (CFPB) is a U.S. government agency created in 2011 to protect consumers in the financial sector, ensuring fair, transparent, and competitive financial markets
The agency has issued a directive to employees to reduce the use of their phones and invite them to use Microsoft Teams and Cisco WebEx for their meetings and conversations that involve nonpublic data.
“In an email to staff sent Thursday, the chief information officer at the Consumer Financial Protection Bureau warned that internal and external work-related meetings and conversations that involve nonpublic data should only be held on platforms such as Microsoft Teams and Cisco WebEx and not on work-issued or personal phones.” reads the article published by the Wall Street Journal.
“Do NOT conduct CFPB work using mobile voice calls or text messages,” reads the email sent to the employees referencing a recent government statement acknowledging the telecommunications infrastructure attack. “While there is no evidence that CFPB has been targeted by this unauthorized access, I ask for your compliance with these directives so we reduce the risk that we will be compromised,” said the email, which was sent to all CFPB employees and contractors.
China-linked threat actors have breached several U.S. internet service providers in recent months as part of a cyber espionage campaign code-named Salt Typhoon.
The state-sponsored hackers aimed at gathering intelligence from the targets or carrying out disruptive cyberattacks.
The Wall Street Journal reported that experts are investigating into the security breached to determine if the attackers gained access to Cisco Systems routers, which are core network components of the ISP infrastructures.
A Cisco spokeswoman confirmed the investigation and said that “at this time, there is no indication that Cisco routers are involved” in the Salt Typhoon activity, the spokeswoman said.
The cyber campaign is attributed to the China-linked APT group Salt Typhoon, which is also known as FamousSparrow and GhostEmperor.
“Hackers linked to the Chinese government have broken into a handful of U.S. internet-service providers in recent months in pursuit of sensitive information, according to people familiar with the matter.” Wall Street Journal reported.
“The hacking campaign, called Salt Typhoon by investigators, hasn’t previously been publicly disclosed and is the latest in a series of incursions that U.S. investigators have linked to China in recent years. The intrusion is a sign of the stealthy success Beijing’s massive digital army of cyberspies has had breaking into valuable computer networks in the U.S. and around the globe.”
China has long targeted global internet service providers and recent attacks are aligned with past operations linked to Beijing.
Intelligence and cybersecurity experts warn that Chinese nation-state actors have shifted from stealing secrets to infiltrate critical U.S. infrastructure, suggesting that they are now targeting the core of America’s digital networks.
The Salt Typhoon hacking campaign, linked to China, appears focused on intelligence gathering rather than crippling infrastructure, unlike the attacks carried out by another China-linked APT group called Volt Typhoon. Chris Krebs from SentinelOne suggested that the group behind Salt Typhoon may be affiliated with China’s Ministry of State Security, specifically the APT40 group, which specializes in intelligence collection. This group was publicly called out by the U.S. and its allies for hacking activities in July.
In July, Cisco fixed an actively exploited NX-OS zero-day that was exploited to install previously unknown malware as root on vulnerable switches.
Cisco addressed an NX-OS zero-day, tracked as CVE-2024-20399 (CVSS score of 6.0), that the China-linked group Velvet Ant exploited to deploy previously unknown malware as root on vulnerable switches.
Cybersecurity firm Sygnia observed the attacks on April 2024 and reported them to Cisco.
“Sygnia identified that CVE-2024-20399 was exploited in the wild by a China-nexus threat group as a ‘zero-day’ and shared the details of the vulnerability with Cisco. By exploiting this vulnerability, a threat group – dubbed ‘Velvet Ant’ – successfully executed commands on the underlying operating system of Cisco Nexus devices.” reads the report published by Sygnia. “This exploitation led to the execution of a previously unknown custom malware that allowed the threat group to remotely connect to compromised Cisco Nexus devices, upload additional files, and execute code on the devices.“
In August, Volexity researchers reported that a China-linked APT group, tracked as StormBamboo (aka Evasive Panda, Daggerfly, and StormCloud), successfully compromised an undisclosed internet service provider (ISP) in order to poison DNS responses for target organizations.
The threat actors targeted insecure software update mechanisms to install malware on macOS and Windows victim machines.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Salt Typhoon)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/170737/hacking/u-s-agency-limit-phone-use-due-to-salt-typhoon-hack.html