Hackers penetrated NEC defense business division in 2016
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-18187 | Directory Traversal RCE in Trend Micro OfficeScan Trend Micro OfficeScan contains a directory traversal flaw (CWE-22) in its handling of ZIP archives: when a zip file is extracted to a designated folder on the OfficeScan server, archive entries can escape that folder, allowing an attacker to place files at exploitable locations and achieve remote code execution. The flaw is triggered by getting the server to extract an attacker-influenced ZIP archive into the specific folder on the OfficeScan server. Successful exploitation yields arbitrary code execution on the OfficeScan management server, which typically holds broad control over the managed endpoint fleet and can serve as a foothold for lateral movement. Any organization running an on-premises Trend Micro OfficeScan deployment is affected; the source data does not specify affected version ranges. The vulnerability was added to the CISA KEV catalog on 2021-11-03 (indicating observed exploitation, with ransomware use unknown), and EPSS assigns a 25.1% probability of exploitation within 30 days (98th percentile); no public PoC is known. Do: Apply Trend Micro's updates per vendor instructions, as required by CISA's KEV listing, and verify the patched build against Trend Micro's advisory since specific version numbers are not provided here (note that OfficeScan was succeeded by Trend Micro Apex One, so confirm patched status on migrated installs). Inventory for internet-exposed OfficeScan/Apex One management consoles and restrict access to trusted networks, and hunt for evidence of exploitation given the confirmed in-the-wild status. | 7.5 | 25% | KEV |
| large≈10k–100k on-premises OfficeScan management server deployments (estimate; millions of managed endpoints) |
Full article474 words · extracted from securityaffairs.com · click to collapse
Japanese electronics and IT giant NEC confirmed a security breach suffered by its defense business division in December 2016.
The IT giant NEC confirmed that the company defense business division has suffered a security breach back in December 2016.
The Japanese firm confirmed the unauthorized access to its internal network after Japanese newspapers disclosed the security incident citing sources informed of the event.
NEC is a contractor for Japan’s defense industry and was involved in various defense projects.
Roughly 28,000 files were found by the company on one of the compromised servers, some of them containing info about defense equipment.
“In July 2018, we succeeded in decrypting encrypted communication with an infected server and an external server that was performing unauthorized communication, and stored it on our internal server for information sharing with other departments used by our defense business division 27,445 files were found to have been accessed illegally.
As a result of investigations conducted by the Company and external specialized organizations, no damage such as information leakage has been confirmed so far.” reads the statement from the company.
“These files do not contain confidential information or personal information. In addition, since July 2018, the situation has been individually explained to customers related to files that have been accessed illegally,”
The situation is different according to the Nikkei newspaper that reported that the Japanese Ministry of Defense said that the exposed files contained “information on contracts with NEC, not defense secrets, and there is no impact on Japan’s defense system.”
NEC was informed of the intrusion in July 2017 by a security company contracted by the electronics company to investigate alleged unauthorized accesses to the internal network.
In July 2018, the company was able to decrypt unauthorized communications between an internal server and an external machine and discovered further compromise.
NEC announced it has taken steps to improve the security of its infrastructure and prevent future intrusions.
Recently another Japanese multinational electronics giant disclosed a data breach, last week Mitsubishi Electric disclosed a security breach that might have exposed personal and confidential corporate data. According to the company, attackers did not obtain sensitive information about defense contracts.
The breach was detected almost eight months ago, on June 28, 2019, with the delay being attributed to the increased complexity of the investigation caused by the attackers deleting activity logs. Mitsubishi Electric disclosed the security incident only after two local newspapers, the Asahi Shimbun and Nikkei, reported the security breach.
Trend Micro has now addressed the vulnerability, but we cannot exclude that the hackers have exploited the same issue in attacks against other targets. After the security firm patched the CVE-2019-18187 flaw in October, it warned customers that the issue was being actively exploited by hackers in the wild.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – NEC, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/97104/data-breach/nec-security-breach-2016.html