Monthly Archives: February 2022

News

AT&T Cybersecurity announces 2022 ‘Partner of the Year Awards’ winners

Read Time:4 Minute, 12 Second

We are thrilled to announce that Softcat is the AT&T Cybersecurity 2022 Global Partner of the Year for the second year in a row! Softcat aggressively grew their business and achieved truly impressive results in 2021.

At AT&T Cybersecurity we will continue to focus on enhancing our channel programs to provide partners the ability to not only scale their businesses and increase profitability, but most importantly deliver on their infosec promise to their client base. Together we will do so in both a consistent and progressive manner, evolving with the ever-changing security market we all serve. We look forward to another year of success working closely with our partners.

We are proud to recognize not only our Global Partner of the year in Softcat, but also the exceptional partners in seven additional categories. Our complete list of award winners and their reactions below:

Global Awards

Global Partner of the Year: Softcat

We are absolutely delighted to be named AT&T Cybersecurity’s Global Partner of the Year 2022. We are so proud of the collaborative partnership we have developed with them over the last 4 years and this award is a testament to that and the significant growth we have delivered with them during what has been a challenging year. It also reflects our ambition to always provide our customers with the best Managed SIEM solution available in the marketplace.

Matthew Helling | Head of Cyber Security Services | Softcat

                             —————————————————————-

Growth Partner of the Year: STN Incorporated

I must say our initial reaction was pure excitement! Our sales and service delivery teams have worked tirelessly to build and improve our SIEM practice. Being recognized as the partner of the year validates we are moving in the right direction and will continue to build upon this momentum. We look forward to another successful year of growth in 2022.

Shanelle Frisbie | Vice President of Operations | STN Incorporated

                             —————————————————————-

New Partner of the Year: Brennan IT

We are pleased to have received this award from AT&T. This, along with other recent award wins reaffirms the significant steps Brennan have taken in maturing our capabilities into a tier 1 security provider. Our teams remain focused on helping customers achieve a secure IT environment in an increasingly challenging cyber and business landscape.

Daniel Hayes | Head of Cybersecurity | Brennan IT

                             —————————————————————-

Distributor of the Year: CMS Distribution

CMS are delighted to have been announced as AT&T’s Distributor of the Year for 2022! Our partnership continues to grow, and we are pleased to be recognized for our proactive and collaborative approach working with an industry leading vendor such as AT&T and we will continue to build on this award going forwards to accelerate the sales needle.

Nick Bailey | Alliance Director | CMS Distribution

                             —————————————————————-

Regional Awards

These awards recognize partners that had the highest sales bookings in each of the 4 regions during last year.

North American Partner of the Year: Binary Defense

We are honored to receive the North American Partner of the Year award from AT&T and look forward to a continued successful partnership in 2022 and beyond. The pairing of AT&T’s USM Anywhere technology with Binary Defense’s experts delivers a best-in-class experience for our customers and keeps them safe from cyberattacks. Together, we help make the world a safer place.

Mike Valentine | Chief Executive Officer | Binary Defense

                             —————————————————————-

EMEA Partner of the Year: Six Degrees

Six Degrees is delighted to be awarded AT&T Cybersecurity Partner of the Year for a second year in a row!

The Six Degrees team continues to work closely with AT&T to deliver AlienVault solutions and to provide fully managed 24×7 Cyber Security Operations Centre managed services to clients in both the public and private sectors.

It was great to receive recognition as AT&T’s Cybersecurity Partner of the Year for 2021 and through our continued delivery of AlienVault services to again receive this accolade now, in 2022.

A massive thank you to everyone that continues to make our services and solutions great!

Robert Sugrue | Cyber Security Product Director | Six Degrees

                             —————————————————————-

APAC Partner of the Year: Kordia

Kordia is delighted to be named AT&T Cybersecurity’s APAC Partner of the Year for 2022. We’ve been extremely focused on helping our customers achieve a more robust and responsive approach to cyber security. This award recognises the strength of our partnership, specifically our joint dedication to bringing comprehensive solutions to our market.

Julie Ware | Head of Security Products | Kordia

                             —————————————————————-

Latin American Partner of the Year: GB Advisors

Working with the outstanding professionals at AT&T Cybersecurity has been one of the joys of this partnership. The care and dedication for ensuring leading edge cybersecurity solutions to help our clients innovate safer has been at the core of our shared success. At GB Advisors we are honored to be named AT&T Cybersecurity LATAM partner of the year for 2022.

Alexander Guedez Barefield | CEO | GB Advisors  

                             —————————————————————-

Read More

Advisories

USN-5299-1: Linux kernel vulnerabilities

Read Time:2 Minute, 28 Second

Mathy Vanhoef discovered that the Linux kernel’s WiFi implementation could
reassemble mixed encrypted and plaintext fragments. A physically proximate
attacker could possibly use this issue to inject packets or exfiltrate
selected fragments. (CVE-2020-26147)

It was discovered that the bluetooth subsystem in the Linux kernel did not
properly perform access control. An authenticated attacker could possibly
use this to expose sensitive information. (CVE-2020-26558, CVE-2021-0129)

It was discovered that the RPA PCI Hotplug driver implementation in the
Linux kernel did not properly handle device name writes via sysfs, leading
to a buffer overflow. A privileged attacker could use this to cause a
denial of service (system crash) or possibly execute arbitrary code.
(CVE-2021-28972)

It was discovered that a use-after-free existed in the Bluetooth HCI driver
of the Linux kernel. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2021-33034)

Norbert Slusarek discovered that the CAN broadcast manger (bcm) protocol
implementation in the Linux kernel did not properly initialize memory in
some situations. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2021-34693)

马哲宇 discovered that the IEEE 1394 (Firewire) nosy packet sniffer driver in
the Linux kernel did not properly perform reference counting in some
situations, leading to a use-after-free vulnerability. A local attacker
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2021-3483)

It was discovered that the bluetooth subsystem in the Linux kernel did not
properly handle HCI device initialization failure, leading to a double-free
vulnerability. An attacker could use this to cause a denial of service or
possibly execute arbitrary code. (CVE-2021-3564)

Murray McAllister discovered that the joystick device interface in the
Linux kernel did not properly validate data passed via an ioctl(). A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code on systems with a joystick device
registered. (CVE-2021-3612)

It was discovered that the tracing subsystem in the Linux kernel did not
properly keep track of per-cpu ring buffer state. A privileged attacker
could use this to cause a denial of service. (CVE-2021-3679)

It was discovered that the MAX-3421 host USB device driver in the Linux
kernel did not properly handle device removal events. A physically
proximate attacker could use this to cause a denial of service (system
crash). (CVE-2021-38204)

It was discovered that the 6pack network protocol driver in the Linux
kernel did not properly perform validation checks. A privileged attacker
could use this to cause a denial of service (system crash) or execute
arbitrary code. (CVE-2021-42008)

Amit Klein discovered that the IPv6 implementation in the Linux kernel
could disclose internal state in some situations. An attacker could
possibly use this to expose sensitive information. (CVE-2021-45485)

Read More

News

Drop the SBOM

Read Time:50 Second

There’s a big movement afoot to move to an SBOM-oriented world.  If you’re new to this acronym, an SBOM is a “Software Bill of Materials.”  The idea is that any piece of software, or service, should come with the equivalent of an ingredients label, itemizing the component pieces of software included in the manufacture of the product.  That way, any vulnerability in a component that you don’t fix becomes visible to your customers.  It sounds simple, right?  Just write down the software you used in assembling your system!

Just.

“Just” is the most dangerous word in cybersecurity.  In any complex system, there is an impulse to use a much simpler model to describe the system.  Sometimes, this can be helpful because it makes the system easier to think about.  Unfortunately, solutions that apply in simple systems are not usually as easy to apply to—and certainly rarely as effective in—more complex systems.

To read this article in full, please click here

Read More

News

Why DevOps pipelines are under attack and how to fight back

Read Time:27 Second

In mid-2017, Russian state-sponsored attackers installed a malicious worm in a Ukrainian financial software package. When businesses updated their software, it became infected. The worm, NotPetya, spread quickly, doing billions of dollars of damage around the world. The White House called it “the most destructive and costly cyberattack in history.”

Three years later, Russia-linked attackers hijacked the software upgrade process of another piece of enterprise software, SolarWinds’ Orion network monitoring toolset. Again, the impact was widespread.

To read this article in full, please click here

Read More

Advisories

USN-5298-1: Linux kernel vulnerabilities

Read Time:2 Minute, 11 Second

It was discovered that the Packet network protocol implementation in the
Linux kernel contained a double-free vulnerability. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2021-22600)

Jürgen Groß discovered that the Xen subsystem within the Linux kernel did
not adequately limit the number of events driver domains (unprivileged PV
backends) could send to other guest VMs. An attacker in a driver domain
could use this to cause a denial of service in other guest VMs.
(CVE-2021-28711, CVE-2021-28712, CVE-2021-28713)

Jürgen Groß discovered that the Xen network backend driver in the Linux
kernel did not adequately limit the amount of queued packets when a guest
did not process them. An attacker in a guest VM can use this to cause a
denial of service (excessive kernel memory consumption) in the network
backend domain. (CVE-2021-28714, CVE-2021-28715)

Szymon Heidrich discovered that the USB Gadget subsystem in the Linux
kernel did not properly restrict the size of control requests for certain
gadget types, leading to possible out of bounds reads or writes. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2021-39685)

Jann Horn discovered a race condition in the Unix domain socket
implementation in the Linux kernel that could result in a read-after-free.
A local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2021-4083)

Kirill Tkhai discovered that the XFS file system implementation in the
Linux kernel did not calculate size correctly when pre-allocating space in
some situations. A local attacker could use this to expose sensitive
information. (CVE-2021-4155)

Lin Ma discovered that the NFC Controller Interface (NCI) implementation in
the Linux kernel contained a race condition, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2021-4202)

Sushma Venkatesh Reddy discovered that the Intel i915 graphics driver in
the Linux kernel did not perform a GPU TLB flush in some situations. A
local attacker could use this to cause a denial of service or possibly
execute arbitrary code. (CVE-2022-0330)

It was discovered that the VMware Virtual GPU driver in the Linux kernel
did not properly handle certain failure conditions, leading to a stale
entry in the file descriptor table. A local attacker could use this to
expose sensitive information or possibly gain administrative privileges.
(CVE-2022-22942)

Read More

Advisories

varnish-4.0.5-3.el7

Read Time:40 Second

FEDORA-EPEL-2022-18ac3af1c8

Packages in this update:

varnish-4.0.5-3.el7

Update description:

This release includes a security update with mitigation instructions for VSV00008 aka CVE-2022-23959

PLEASE NOTE: varnish-4.0.5 is marked END OF LIFE from the Varnish Cache upstream project. Please consider upgrading to varnish-6.0 LTS. See https://varnish-cache.org/ for updated packages compatible with VCL 4.0 on el7.

Other updates:
– Workaround for systemd race
– Dropped el6 support

A security update. Includes mitigation instructions for VSV00008 aka CVE-2022-23959

PLEASE NOTE: varnish-4.0.5 is marked END OF LIFE from the Varnish Cache upstream project. Please consider upgrading to varnish-6.0 LTS. See https://varnish-cache.org/ for updated packages compatible with VCL 4.0 on el7.

Read More