FIDO Alliance Announced New Passkey Initiatives; Old Fortinet and Log4J Vulnerabilities are Still Lurking

The FIDO Alliance has announced two supplementary projects meant to address current challenges putting its passkey authentication method into widespread practice. The first is a set of technical standards drafted collaboratively with researchers from major tech firms and password manager companies: The Credential Exchange Protocol (CXP). CXP "aims to standardize the technical process for securely transferring [passkeys] between platforms," avoiding the risk of "user lock-in" and the unsecure migration process of exporting credentials from a conventional password manager. The second project is Passkey Central, a website offering an implementation guide and set of informational resources and tools for supporting and facilitating passkey adoption. Among other materials, the site contains basic introductory guides and use cases, business metrics, and technical documentation for developers.

According to data gathered by Shadowserver, more than 86,000 Fortinet instances remain vulnerable to a known format string flaw in FortiOS fgfmd daemon. The critical vulnerability (CVE-2024-23113) was disclosed in February 2024, more than eight months ago. The majority of unpatched instances (38,778) are in Asia, followed by North America (21,262) and Europe (16,381). The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to their Known Exploited Vulnerabilities (KEV) catalog last week; Federal Civilian Executive Branch (FCEB) agencies have until October 30 to mitigate the issue.

According to Sonatype's 10th Annual State of the Software Supply Chain report, 13 percent of Log4J open-source logging utility installations are unpatched nearly three years after the Log4Shell vulnerability was disclosed. In 2022, Sonatype found that 40 percent of Log4J downloads were vulnerable. Ken Dunham, Director of Threat Research at Qualys' Threat Research Unit, noted that 'Some vulnerabilities are easy to patch and to mitigate and remove, and others are more integrated and multilayered and various dependencies.'

As of the evening of Sunday, October 13, the Internet Archive's Wayback Machine is back online, albeit 'in a provisional, read-only manner,' according to a social media post from Internet Archive founder Brewster Kahle. The site was offline last week after suffering a spate of distributed denial-of-service (DDoS) attacks. They also experienced a data breach in September, which affected 31 million user records.

A researcher in the Netherlands discovered that thousands of traffic lights in that country are vulnerable to remote hijacking. The researcher was able to access the network emergency services use to connect to traffic lights to change lights on their route to green to expedite their arrival at emergencies or hospitals. By manipulating a mechanism used in older traffic signals, they were able to remotely change the lights to green. The Dutch government plans to replace the affected traffic signals, a task which will likely not be completed until 2030.

The Massachusetts state "HR/CMS Employee Self-Service Time and Attendance (SSTA) system" was offline from October 8 to October 9, 2024 following a breach which the Office of the Comptroller described as "credential harvesting." While it is unclear how the phishing attack was delivered, an announcement on October 9 reported that a number of employees entered credentials into a counterfeit login page, exposing their account and direct deposit information. The system was temporarily taken down for further investigation, but apart from certain affected employees receiving paper checks, payroll will proceed unaffected. The announcement recommends employees vet and bookmark any portal links, change their passwords, and take basic anti-phishing precautions.

India's Star Health insurance provider has acknowledged that cyber threat actors gained 'unauthorized and illegal access to certain data' in earlier this year but maintain that the incident has not affected business operations. The breach made news in September when threat actors claimed to have posted data belonging to more than 30 million individuals. The data were being leaked through two Telegram chatbots. After being notified of the situation, Telegram removed the bots and moderators are monitoring activity to ensure they are not recreated.

Axis Health System, which operates 13 healthcare facilities in western and southwestern Colorado has acknowledged that they 'experienced a cyber incident.' The incident has disrupted the portal that patients use to communicate with healthcare providers. A ransomware group known for targeting healthcare organizations claimed responsibility for the attack on Thursday, October 10.

Two separate US healthcare entities recently began notifying affected patients that their personal information was compromised. In information provided to the Maine Attorney General's office, Texas-based Gryphon Healthcare indicated that the breach of their systems affected more than 390,000 patients; California-based Tri-City Healthcare District indicated that a breach of their systems compromised information of more than 108,000 patients. In a patient notification letter, Gryphon wrote that they 'became aware of a data security incident involving a partner that Gryphon provides medical billing services for, which resulted in unauthorized access to certain personal and/or protected health information maintained by Gryphon.'

The Tor Project has updated Tor Browser to version 14.0a9 to include a fix for a critical use-after-free vulnerability in Firefox. (Tor Browser is based on Firefox ESR). The vulnerability could be exploited 'to achieve code execution in the content process by exploiting a use-after-free in Animation timelines.' Mozilla released updates to address the flaw last week.