Week in review: Malware targeting Linux-based OSes, Log4j exploitation risk
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-44228 | JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell) Apache Log4j2, an extremely widely used Java logging library, fails to protect its JNDI lookup feature against attacker-controlled JNDI-related endpoints (CWE-20, CWE-502), so crafted text processed by the logger causes the Java runtime to fetch and load attacker-supplied objects, leading to remote code execution. The flaw is triggered whenever attacker-controlled input reaches the logging API and is parsed for JNDI lookups, a pattern common in web servers and enterprise Java applications that log user-supplied fields such as headers or form values. Successful exploitation yields arbitrary code execution under the privileges of the affected application, giving attackers a foothold for lateral movement, data theft, and ransomware deployment. Any Java application or product that ships or bundles an affected Apache Log4j2 release is exposed, making this one of the most broadly deployed vulnerabilities ever disclosed. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2021-12-10 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days. Do: Inventory all Java applications and dependencies for Apache Log4j2 and apply the vendor's patched updates, or remove affected assets from the network, as required by CISA's KEV catalog. Where updates are not yet available, use the temporary mitigations in CISA's ED-22-02 recommended-mitigation guidance, such as disabling message lookups, only until patches are applied. Prioritize internet-facing and business-critical systems and hunt for exploitation activity given known ransomware use. | 10.0 | 100% | KEV ransomware PoC ×9 |
| masshundreds of millions of Java applications/devices, with hundreds of thousands of internet-exposed services | |
| CVE-2022-22620 | WebKit Use-After-Free (CVE-2022-22620) Enables RCE on iOS, iPadOS, and macOS CVE-2022-22620 is a use-after-free (CWE-416) in Apple's WebKit browser engine, the component that renders web content on iPhones, iPads, Macs, and Safari. An attacker triggers it by getting a victim to process maliciously crafted web content, such as visiting an attacker-controlled webpage, requiring no privileges and only user interaction with the content. Successful exploitation may lead to arbitrary code execution in the context of the browser, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8 High). All devices running iOS or iPadOS before 15.3.1, macOS Monterey before 12.2.1, or Safari before 15.3 are affected, which effectively means the broad Apple user base at the time of disclosure. Apple reported the issue may have been actively exploited in the wild; it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-02-11 and carries a 16.2% EPSS probability of exploitation in the next 30 days (97th percentile). Do: Update iPhones and iPads to iOS/iPadOS 15.3.1, Macs to macOS Monterey 12.2.1, and Safari to version 15.3 (builds 16612.4.9.1.8 or 15612.4.9.1.8), per Apple's vendor instructions. Inventory for devices still on pre-patch versions, prioritizing user workstations and mobile devices that browse web or HTML email content, since WebKit loads content automatically. Note the vulnerability is listed in CISA's KEV catalog with 'apply updates per vendor instructions' as the required action, so patching is the only reliable mitigation. | 8.8 | 16% | KEV |
| mass≈1 billion+ Apple devices (WebKit is the system web engine on every iPhone, iPad, and Mac) |
Full article1,297 words · extracted from helpnetsecurity.com · click to collapse
Here’s an overview of some of last week’s most interesting news, articles and interviews:
Log4j exploitation risk is not as high as first thought, cyber MGA says
When the Log4Shell vulnerability (CVE-2021-44228) was publicly revealed in December 2021, CISA Director Jen Easterly said that it is the “most serious” vulnerability she has seen in her decades-long career and it could take years to address.
Apple fixes actively exploited iOS, macOS zero-day (CVE-2022-22620)
Another month, another zero-day (CVE-2022-22620) exploited in the wild that has been fixed by Apple.
A “light” February 2022 Patch Tuesday that should not be ignored
February 2022 Patch Tuesday is here and it’s all-around “light” – light in fixed CVE-numbered vulnerabilities (51), extremely light in critical fixes (50 are “important” and one is “moderate”), and light in exploited vulnerabilities (none of the vulnerabilities are listed as under active attack).
End of 2021 witnessed an explosion of RDP brute-force attacks
RDP brute-force attacks escalated throughout all of 2020 and 2021, and the last four months of 2021 brought a further acceleration, with an increase of 274% (from 55 billion in T2 2021 to 206 billion in T3 2021).
Why identity and access management strategies need a booster
In this interview with Help Net Security, Miles Hutchinson, CISO of Jumio, talks about the pain points of identity and access management and the importance of strenghtening identity strategies.
Most breaches largely caused by staff working from home
Diligent announces a survey of 450 senior finance and risk professionals in UK-listed businesses. The results show that UK businesses lost £374 million in 2021, largely due to cyberbreaches caused by staff having to work from home.
Contextualizing supply chain risks in a SaaS environment
In the wake of the SolarWinds and Kaseya attacks, third-party cybersecurity risks remain top of mind for security leaders. Nonetheless, CISOs continue to experience significant friction with third-party risk management (TPRM).
MFA still offers the best chance of keeping data secure
Keyavi Data issued a set of best practices for keeping personal and business data out of criminal hands using multi-factor authentication (MFA).
The four types of remote workers your security awareness program must address
No matter how much technology you acquire or how many specific technical controls you install, when it comes to your information security awareness program, the most important control to tune within your environment is your people.
Ransomware groups and APT actors laser-focused on financial services
Trellix released a report, examining cybercriminal behavior and activity related to cyber threats in the third quarter (Q3) of 2021.
Google announces threat detection for virtual machines in its cloud
Google is adding a new defensive layer to protect enterprise workloads running in Google Cloud. It’s called Virtual Machine Threat Detection (VMTD), and will help select Security Command Center customers detect cryptomining malware inside their virtual machines.
Attacks against health plans up nearly 35%
Critical Insight announced the release of a report which analyzes breach data reported to the U.S. Department of Health and Human Services by healthcare organizations.
Microsoft: Enterprise MFA adoption still low
While two-factor authentication usage in the consumer space is climbing quickly, enterprises are still straggling when it comes to using multi-factor authentication (MFA) to protect crucial accounts, despite the fact that compromised credentials are the starting point of most cyber-attacks.
Why cybersecurity and anti-fraud teams need to collaborate
For years, many of the world’s largest financial institutions treated financial fraud and cybersecurity as separate departments with differing roles, responsibilities, and threats.
Highly Evasive Adaptive Threats (HEAT) bypassing traditional security defenses
Menlo Security announced it has identified a surge in cyberthreats, termed Highly Evasive Adaptive Threats (HEAT), that bypass traditional security defenses.
Why security strategies need a new perspective
When it comes to designing a cybersecurity strategy, it makes sense to move beyond all the noise about the latest and most sophisticated attacks and the latest and most sophisticated security solutions, and focus attention on the employees instead – but not necessarily on the current staff.
Disaster recovery is critical for business continuity
In this interview with Help Net Security, Joe Noonan, a product executive that oversees the full backup and disaster recovery suite at Kaseya, which includes Unitrends, Spanning and all Kaseya-branded backup solutions, talks about the present and future of BCDR.
Low code applications are essential for cybersecurity development in applications
One of the biggest changes to the cybersecurity landscape is that developers are now often expected to implement security directly into the applications they’re building as part of the automated development lifecycle, rather than relying on security or ops teams configuring policies for them after they are built. In fact, some industry sources estimate that roughly half of a developer’s time is now spent on security issues.
2021 was the most prolific year on record for data breaches
Spirion released a guide which provides a detailed look at sensitive data breaches in 2021 derived from analysis conducted against the Identity Theft Resource Center (ITRC) database of publicly reported data breaches in the United States.
Tips to mitigate public-key cryptography risk in a quantum computing world
Quantum computing is poised to transform the industry over the next decade. With its promise of breakthrough speed and power, it’s easy to understand why there is so much hype around this new technology.
How cybercriminals are using malware to target Linux-based operating systems
As malware targeting Linux-based operating systems increases in both volume and complexity amid a rapidly changing threat landscape, organizations must place a greater priority on threat detection.
Cloud security training is pivotal as demand for cloud services explode
Even before the pandemic, cloud-based tools were very popular. The pandemic has further accelerated the adoption of these tools and services, as the global workforce converted to remote employees overnight.
The most common cyber gaps threatening supply chain security
Panorays has identified the top five most common cyber gaps among third-party organizations over 2021. Analyzing data gathered from cyber posture evaluations of tens of thousands of vendors across various industries, Panorays pinpointed compromised credentials as among the most common issues impacting supply chain security, with 44% of companies affected.
Product showcase: Group-IB Atmosphere
This article looks at three real-life attacks attempted via corporate email, all of which were stopped by Group-IB’s cloud email protection system Atmosphere. The attacks serve as an example of how cybercriminals exploit weaknesses in the current approach to email security. In this regard, properly built corporate email security is the first line of cyberdefense.
3 key elements of a strong cybersecurity program
The world relies on technology. So, a strong cybersecurity program is more important than ever. The challenge of achieving good cyber hygiene can be especially acute for small- and medium-sized businesses. This is particularly true for those with fully remote or hybrid work environments. Add to the mix limited resources and limited talent focused on cybersecurity, and the challenges can seem overwhelming.
Product showcase: Oxeye.io – Cloud native application security testing
Delivering secure applications requires tooling built for automation in the modern tech stack. Oxeye provides a cloud-native application security testing solution that is designed to overcome the challenges imposed by the complex nature of modern architectures. Given the distributed cloud-native architecture, traditional testing methodologies simply aren’t enough to address security holistically.
Product showcase: Sniper – automatically detect and exploit critical CVEs in minutes
When a CVE like Log4Shell (CVE-2021-44228) surfaces, Sniper automatically finds systems vulnerable to its targeted intrusion techniques. By automating how you validate widespread CVEs with Sniper, you minimize the window of opportunity for attackers. This helps avoid aggressive exploitation campaigns that always follow high-risk vulnerability disclosures.
New infosec products of the week: February 11, 2022
Here’s a look at the most interesting products from the past week, featuring releases from Cofense, Cybellum, DataStax, Federal Reserve, Gigamon, Qualys, Runecast, and Spin Technology.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2022/02/13/week-in-review-malware-targeting-linux-based-oses-log4j-exploitation-risk/