UK Fintech Company Finastra hit by a cyber attack
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-11510 | Unauthenticated Arbitrary File Read in Ivanti Pulse Connect Secure VPN Ivanti Pulse Connect Secure, an enterprise SSL VPN appliance, contains an arbitrary file read vulnerability (CWE-22, path traversal) that requires no authentication. An unauthenticated remote attacker with network access to the appliance over HTTPS can send a specially crafted URI containing traversal sequences to read arbitrary files from the device. The attacker gains access to sensitive appliance files, potentially including configuration or credential material useful for further compromise, and CISA records known ransomware use of this flaw. Any organization running Pulse Connect Secure, especially gateways exposed to the internet for remote access, is affected. Exploitation is established: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, EPSS assigns a 100% probability of exploitation in the next 30 days, and no public PoC is known. Do: Apply updates per Ivanti's instructions, the required action in the CISA KEV entry, prioritizing internet-facing Pulse Connect Secure gateways, and consult the vendor advisory for the applicable fixed release since no version range is provided here. Where patching is not immediate, restrict HTTPS access to the appliance and hunt for signs of exploitation (unexpected file reads, anomalous VPN logins or sessions, and follow-on ransomware activity), as CISA reports known ransomware use. | 10.0 | 100% | KEV ransomware PoC ×2 |
| largeTens of thousands of internet-exposed gateways (order of 10,000-100,000 systems; each typically serves hundreds of VPN users, so potentially millions of users) |
Full article405 words · extracted from securityaffairs.com · click to collapse
The financial technology firm Finastra announced it has suffered a ransomware attack that took down its some of its systems.
Finastra, the UK leading financial technology provider, announced that some of its servers were shut down in response to a ransomware attack that the company detected.
Finastra provides financial software and services to more than 9,000 customers worldwide, it has over 10,000 employees and $1.9 billion in revenues.
The company did not disclose details of the attack, it only announced to have detected an anomalous activity on its systems.
Cybersecurity blogger Brian Krebs reported that the company suffered a security breach that led to the disruption of some services. Krebs said the company’s response to the incident suggests that it was a ransomware attack.
“Earlier today, our teams learned of potentially anomalous activity on our systems. Upon learning of the situation, we engaged an independent, leading forensic firm to investigate the scope of the incident. Out of an abundance of caution and to safeguard our systems, we immediately acted to voluntarily take a number of our servers offline while we continue to investigate.” reads the data breach notification published by the company.
“At this time, we strongly believe that the incident was the result of a ransomware attack and do not have any evidence that customer or employee data was accessed or exfiltrated, nor do we believe our clients’ networks were impacted.”
The company immediately started the activities to resolve the problem and launched an internal investigation. Finastra also engaged a leading forensic firm to investigate the extent of the incident. The company also informed the relevant authorities and impacted customers.
“Following Friday’s incident, and detection of potentially anomalous activity in our systems, we have successfully contained the threat. At this time, we do not have any evidence that customer or employee data was accessed or exfiltrated.” reads an update provided today. “Remediation work is continuing around the clock, and Finastra aims to restart production in a controlled manner as soon as is safe to do so. We will keep you fully informed as we progress.”
Experts from cyber-security firm Bad Packets speculate attackers might have exploited the CVE-2019-11510 vulnerability to compromise unpatched Pulse Secure VPN servers at the Fintech firm.
https://twitter.com/bad_packets/status/1241057036168646656
Bad Packets revealed that at least until January 11, 2020, four Citrix vulnerable servers were exposed online.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Finastra, cybercrime)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/100130/data-breach/finastra-hacked.html