Yearly Archives: 2024

News

IoT Devices in Password-Spraying Botnet

Read Time:57 Second

Microsoft is warning Azure cloud users that a Chinese controlled botnet is engaging in “highly evasive” password spraying. Not sure about the “highly evasive” part; the techniques seem basically what you get in a distributed password-guessing attack:

“Any threat actor using the CovertNetwork-1658 infrastructure could conduct password spraying campaigns at a larger scale and greatly increase the likelihood of successful credential compromise and initial access to multiple organizations in a short amount of time,” Microsoft officials wrote. “This scale, combined with quick operational turnover of compromised credentials between CovertNetwork-1658 and Chinese threat actors, allows for the potential of account compromises across multiple sectors and geographic regions.”

Some of the characteristics that make detection difficult are:

The use of compromised SOHO IP addresses
The use of a rotating set of IP addresses at any given time. The threat actors had thousands of available IP addresses at their disposal. The average uptime for a CovertNetwork-1658 node is approximately 90 days.
The low-volume password spray process; for example, monitoring for multiple failed sign-in attempts from one IP address or to one account will not detect this activity.

Read More

Advisories

USN-7088-3: Linux kernel vulnerabilities

Read Time:3 Minute, 51 Second

Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the
Linux kernel contained an integer overflow vulnerability. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2022-36402)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
– ARM64 architecture;
– PowerPC architecture;
– User-Mode Linux (UML);
– x86 architecture;
– Block layer subsystem;
– Cryptographic API;
– Android drivers;
– Serial ATA and Parallel ATA drivers;
– ATM drivers;
– Drivers core;
– CPU frequency scaling framework;
– Device frequency scaling framework;
– GPU drivers;
– HID subsystem;
– Hardware monitoring drivers;
– InfiniBand drivers;
– Input Device core drivers;
– Input Device (Miscellaneous) drivers;
– IOMMU subsystem;
– IRQ chip drivers;
– ISDN/mISDN subsystem;
– LED subsystem;
– Multiple devices driver;
– Media drivers;
– EEPROM drivers;
– VMware VMCI Driver;
– MMC subsystem;
– Network drivers;
– Near Field Communication (NFC) drivers;
– NVME drivers;
– Device tree and open firmware driver;
– Parport drivers;
– PCI subsystem;
– Pin controllers subsystem;
– Remote Processor subsystem;
– S/390 drivers;
– SCSI drivers;
– QCOM SoC drivers;
– Direct Digital Synthesis drivers;
– TTY drivers;
– Userspace I/O drivers;
– DesignWare USB3 driver;
– USB Gadget drivers;
– USB Serial drivers;
– BTRFS file system;
– File systems infrastructure;
– Ext4 file system;
– F2FS file system;
– JFS file system;
– NILFS2 file system;
– BPF subsystem;
– Core kernel;
– DMA mapping infrastructure;
– Tracing infrastructure;
– Radix Tree data structure library;
– Kernel userspace event delivery library;
– Objagg library;
– Memory management;
– Amateur Radio drivers;
– Bluetooth subsystem;
– CAN network layer;
– Networking core;
– Ethtool driver;
– IPv4 networking;
– IPv6 networking;
– IUCV driver;
– KCM (Kernel Connection Multiplexor) sockets driver;
– MAC80211 subsystem;
– Netfilter;
– Network traffic control;
– SCTP protocol;
– Sun RPC protocol;
– TIPC protocol;
– TLS protocol;
– Wireless networking;
– AppArmor security module;
– Simplified Mandatory Access Control Kernel framework;
– SoC audio core drivers;
– USB sound devices;
(CVE-2021-47212, CVE-2024-44965, CVE-2024-46676, CVE-2024-41091,
CVE-2024-44946, CVE-2024-43894, CVE-2024-26668, CVE-2024-42259,
CVE-2024-42295, CVE-2024-46685, CVE-2024-46722, CVE-2024-45028,
CVE-2024-46815, CVE-2024-41081, CVE-2024-41022, CVE-2024-44948,
CVE-2024-42301, CVE-2024-43914, CVE-2024-46771, CVE-2024-42289,
CVE-2024-43841, CVE-2024-41042, CVE-2024-44999, CVE-2024-43893,
CVE-2024-46758, CVE-2024-46828, CVE-2024-36484, CVE-2024-26669,
CVE-2024-44952, CVE-2024-42265, CVE-2024-42311, CVE-2024-43880,
CVE-2024-41070, CVE-2024-46829, CVE-2024-42292, CVE-2024-46719,
CVE-2024-41020, CVE-2024-41015, CVE-2024-42283, CVE-2024-46744,
CVE-2024-46679, CVE-2024-46800, CVE-2024-46777, CVE-2024-43835,
CVE-2024-42271, CVE-2024-43882, CVE-2024-41072, CVE-2024-35848,
CVE-2024-43860, CVE-2024-38611, CVE-2024-26607, CVE-2024-47663,
CVE-2024-46780, CVE-2024-46675, CVE-2024-45003, CVE-2024-44969,
CVE-2024-42244, CVE-2024-43856, CVE-2024-46755, CVE-2024-42286,
CVE-2024-41063, CVE-2024-41068, CVE-2024-46743, CVE-2024-43839,
CVE-2024-41065, CVE-2023-52531, CVE-2024-41090, CVE-2024-46747,
CVE-2023-52614, CVE-2024-43853, CVE-2024-46737, CVE-2024-45021,
CVE-2024-41012, CVE-2024-41064, CVE-2024-26800, CVE-2024-42246,
CVE-2024-43908, CVE-2024-46723, CVE-2024-42310, CVE-2024-46781,
CVE-2023-52918, CVE-2024-42313, CVE-2024-45006, CVE-2024-43890,
CVE-2024-44954, CVE-2024-43858, CVE-2024-41098, CVE-2024-41071,
CVE-2024-26641, CVE-2024-42280, CVE-2024-46673, CVE-2024-43846,
CVE-2024-46721, CVE-2024-47667, CVE-2024-26885, CVE-2024-42304,
CVE-2024-46745, CVE-2024-26640, CVE-2024-43861, CVE-2024-42287,
CVE-2024-44998, CVE-2024-40929, CVE-2024-41073, CVE-2024-46689,
CVE-2024-44944, CVE-2024-46756, CVE-2024-42305, CVE-2024-42284,
CVE-2024-42281, CVE-2024-42288, CVE-2024-41011, CVE-2024-47668,
CVE-2024-43830, CVE-2024-46740, CVE-2024-46677, CVE-2024-43867,
CVE-2024-46783, CVE-2024-46844, CVE-2024-43854, CVE-2024-42297,
CVE-2024-46738, CVE-2024-46739, CVE-2024-44947, CVE-2024-43883,
CVE-2024-43884, CVE-2024-46798, CVE-2024-46757, CVE-2024-43879,
CVE-2024-47659, CVE-2024-46817, CVE-2024-45008, CVE-2024-47669,
CVE-2024-43871, CVE-2024-44960, CVE-2024-27051, CVE-2024-44988,
CVE-2024-46840, CVE-2024-41059, CVE-2024-46822, CVE-2024-42276,
CVE-2024-45026, CVE-2024-46761, CVE-2024-44995, CVE-2024-44987,
CVE-2024-26891, CVE-2024-46782, CVE-2024-42309, CVE-2024-42131,
CVE-2024-46759, CVE-2024-42229, CVE-2024-46714, CVE-2024-42290,
CVE-2024-44935, CVE-2024-42285, CVE-2024-38602, CVE-2024-43829,
CVE-2024-42306, CVE-2024-41017, CVE-2024-45025, CVE-2024-46818,
CVE-2024-46750)

Read More

News

Enhancing Cyber Resilience in Energy and Utilities Organizations

Read Time:2 Minute, 31 Second

2024 Cyber Resilience Research Unveils Energy and Utilities Industry Challenges

New data illuminates how energy and utilities leaders can prioritize resilience.

Energy and utilities organizations find themselves at the intersection of progress and peril in the rapidly evolving digital landscape. The latest data underscores that the trade-offs are significant and pose substantial risks to utility providers.

Download the report today

One of the foremost obstacles is the disconnect between senior executives and cybersecurity priorities. Despite recognizing cyber resilience as a crucial imperative, many energy and utilities organizations struggle to secure the support and resources from top leadership. This lack of engagement hinders progress and leaves institutions vulnerable to potential breaches.

Meanwhile, technology continues to advance at an astonishingly rapid rate, as do the risks posed by cyber threats. The 2024 LevelBlue Futures™ Report reveals this delicate balancing act between innovation and security within the energy and utilities industry. Our comprehensive analysis identifies opportunities for deeper alignment between executive leadership and technical teams.

The Elusive Quest for Cyber Resilience in Energy and Utilities

Imagine a world where energy and utilities organizations are impervious to cyber threats—where every aspect of an operation is fortified against disruptions. This is the lofty ideal of cyber resilience, yet it remains an elusive goal for many energy and utilities providers. The rapid evolution of computing has transformed the IT landscape, blurring the lines between legacy systems, cloud computing, and digital transformation initiatives. While these advancements bring undeniable benefits, they also introduce unprecedented risks.

Our research indicates that 85% of energy and utilities IT leaders acknowledge and agree that dynamic computing increases their risk exposure. In a world where cybercriminals are becoming increasingly sophisticated, the need for cyber resilience has never been more urgent. From ransomware attacks to crippling DDoS incidents, energy and utilities organizations operate in a climate where a single breach can have catastrophic and cascading consequences.

Exploring the Relationship Between Leadership and Cyber Resilience

Our survey of 1,050 C-suite and senior executives, including 150 from the energy and utilities industry across 18 countries, highlights the pressing need for cyber resilience. The report is designed to foster thoughtful discussions about vulnerabilities and improvement opportunities.

In the report, you’ll:

Discover why energy and utilities leaders and technology teams must prioritize cyber resilience.
Learn about the critical barriers to achieving cyber resilience.
Uncover the importance of business context and operational issues in prioritizing resilience.

Recognizing the Imperative of Cyber Resilience

Energy and utilities leaders are called to chart a course toward greater security and preparedness. Reacting to cyber threats as they arise is no longer enough; organizations must proactively bolster their defenses and cultivate a culture of resilience from within.

Our research delves into the multifaceted challenges facing energy and utilities organizations in their quest for cyber resilience. From limited visibility into IT estates to the complexity of integrating new technologies with legacy systems, energy and utilities providers grapple with deep-seated barriers that hinder their ability to withstand cyber threats.

Download the report today

Read More