Make Sure You Know Who Your Remote Employees Are; FreeBSD Updates Address OpenSSH Vulnerability; Microsoft Office Zero-Day

Understand how this fraud works to prevent falling for it: Knoot was hired by dozens of firms using a stolen identity; the firms then sent him laptops that he connected in Nashville and which the North Korean workers would VPN into and use. At times this scenario also includes cameras which are pointed at MFA tokens so the remote worker can enter the code. His undoing was likely his reporting income, against the stolen identity, in Nashville, which didn't mesh with the actual taxes filed. Due care must be made to ensure remote workers are who they claim to be, and that additional connections, with corresponding RDP services, to remote laptops are not in play.

It's not clear how technical this person was or if they were a hobbyist who got duped into some type of fraud. It is a strange case, and I am going to look further into it. If this has happened once, it may have been happening in more places.

In my 90th year, I may yet live long enough to see the day when the risk of cyber crime exceeds its return.

This update addresses the regreSSHion vulnerability made public a couple weeks ago. Exploitation is not trivial, but given the severity, the vulnerability should be addressed quickly.

There are two mechanisms to mitigate FreeBSD: either update to the latest supported version of FreeBSD OS 13 or 14, which includes the binary patch, or download and deploy the source for the affected products. Even if you're compiling from source, get on the current versions so you get updated/fixed source for all your packages.

I am not sure if this is related to HDMoore's thing around SSHamble, but SSH is getting a closer look lately.

The exploit patterns around tricking Windows into establishing SMB connections with no or little user interaction is probably not going away until NTLM is removed from Windows. There appears to be an inexhaustible reservoir of vulnerabilities. By now, you hopefully have at least outbound port 445 blocked.

While mitigations to this flaw were published in July, applying the update, scheduled for August 13th, provides the full fix to the flaw. If you've not yet deployed the mitigations, make sure all your endpoints are ready to automatically deploy the update when it is released today.

Two vulnerabilities, CVE-2024-21302 and CVE-2024-38202, need to be chained to exploit this attack, and Microsoft has not yet released a patch to mitigate these flaws. In the interim, follow the guidance in the linked Microsoft advisories to enabling auditing of file access use, and check your EDR provider for their ability to detect attempted exploitation of these flaws.

Typically, one or more product vulnerabilities are announced at BlackHat/DefCon. And often, Microsoft is a target. This year is no different. While the vulnerability requires local access and admin privileges to implement, do follow the mitigation guidance provided by Microsoft until a patch is released.

I saw this at DefCon this weekend. It's an interesting attack vector. It makes you feel more confident when Apple removes the ability to Downgrade. This issue is happening because Windows can downgrade. The toolchain allows for downgrade attacks that enable further exploitations. Interesting vectors, difficult problem for Microsoft.

Two vulnerabilities, CVE-2024-21302 and CVE-2024-38202, need to be chained to exploit this attack, and Microsoft has not yet released a patch to mitigate these flaws. In the interim, follow the guidance in the linked Microsoft advisories to enabling auditing of file access use, and check your EDR provider for their ability to detect attempted exploitation of these flaws.

Typically, one or more product vulnerabilities are announced at BlackHat/DefCon. And often, Microsoft is a target. This year is no different. While the vulnerability requires local access and admin privileges to implement, do follow the mitigation guidance provided by Microsoft until a patch is released.

CVE-2023-31315 has a CVSS score of 7.5, and is not remotely exploitable. Fixes have been released to OEMs for distribution. Note that some of the fixes werenÕt available until this August. The fix is a firmware flash, although some CPUs have a mitigation 2 option of installing updated microcode, for consistency the best bet is to do the FW update across your affected AMD processors. This would be a good time to make sure all your AMD CPUs are running the latest firmware.

The latest Intel CPUs have CPU bugs, which is why people are running to AMD. AMD is not bug-free either. I'm just watching this space.

It is sad that so much time and talent is wasted exposing obscure vulnerabilities while we do not have enough to implement strong authentication, structured networks, cryptography, and least privilege access control, much less develop and apply novel security measures.

Score one for the good guys. That said, ransomware purveyors have demonstrated a penchant for reestablishing themselves quickly after loss of infrastructure. The best long-term bet is to put maximum pressure on how the ransom is transacted.

Indications are Radar/Disposessor is an outgrowth from the displaced LockBit ransomware gang members under the guidance of ÒBrain.Ó They have been in existence since August 2023, and target small to mid-sized businesses. This ransomware operates in two steps, first as a data stealer and second as an encryptor, and has many parallels to LockBit.

While not much can be said about the actual cyber incident, a lot can be said about the amount and type of data maintained. Maintaining up to 48 different data types seems excessive but then as you look at the potential make-up of the student population, on-site medical support, and faculty it makes sense. Now comes the rub: what is the data retention policy and how much is required by regulation? Organizations should always look for ways to minimize what data is collected and retained while still complying with laws.

Application fraud is far more serious than transaction fraud. The collection and use of multiple forms of identifying information may be justified to resist it. However, retaining such data after a decision has been made on the application is reckless.

Key in the notification, besides offering credit monitoring to affected individuals, are clear instructions on freezing your credit, something we all need to do, particularly our younger generation who haven't yet experienced ID theft or other consequences when it's not frozen.