Szolgáltatóknak

BleepingComputer reports that IxMetro PowerHost, a Chile-based data center and hosting provider, had its VMware ESXi servers and backups compromised by a novel SEXi ransomware attack during the weekend, which has resulted in website and service disruptions.

Data allegedly stolen from a breach of U.S. federal technology consulting firm Acuity, which was claimed to include communications between the Five Eyes Intelligence Group composed of the U.S., Canada, Australia, New Zealand, and the UK, and other U.S. allies, has been leaked by IntelBroker, Hackread reports.

Introducing the latest Cisco Catalyst 1200 and 1300 series switches, enhancing our SMB portfolio with advanced network performance, management simplicity, and robust security features for seamless business growth and transformation.

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-29745 Android Pixel Information Disclosure Vulnerability CVE-2024-29748 Android Pixel Privilege Escalation Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

CISA released two Industrial Control Systems (ICS) advisories on April 4, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-095-01 Hitachi Energy Asset Suite 9 ICSA-24-095-02 Schweitzer Engineering Laboratories SEL CISA encourages users and administrators to review the newly released ICS advisory for technical details and mitigations.

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 6.9 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: Asset Suite 9 Vulnerability: Improper Authentication 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to use an authentication anomaly to successfully invoke the REST service. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following versions of Hitachi Energy's Asset Suite, an enterprise asset management tool, are affected: Asset Suite: Versions prior to 9.6.3.13 Asset Suite: Versions prior to 9.6.4.1 3.2 Vulnerability Overview 3.2.1 IMPROPER AUTHENTICATION CWE-287 REST service authentication anomaly with "valid username/no password" credential combination for batch job processing may result in successful service invocation. The anomaly doesn't exist with other credential combinations. CVE-2024-2244 has been assigned to this vulnerability. A CVSS v3.1 base score of 5.3 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). A CVSS v4 score has also been calculated for CVE-2024-2244. A base score of 6.9 has been calculated; the CVSS vector string is ( CVSS4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N). 3.3 BACKGROUND CRITICAL INFRASTRUCTURE SECTORS: Energy COUNTRIES/AREAS DEPLOYED: Worldwide COMPANY HEADQUARTERS LOCATION: Switzerland 3.4 RESEARCHER Hitachi Energy reported this vulnerability to CISA. 4. MITIGATIONS Hitachi Energy recommends users apply the following mitigations where available: Update to version 9.6.3.13 or 9.6.4.1 For more information, see Hitachi Energy advisory 8DBD000195. CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. 5. UPDATE HISTORY April 4, 2024: Initial Publication

Ivanti has released security updates to address vulnerabilities in all supported versions (9.x and 22.x) of Ivanti Connect Secure and Policy Secure gateways. A cyber threat actor could exploit one of these vulnerabilities to take control of an affected system. Users and administrators are encouraged to review the following Ivanti advisory and apply the necessary updates: SA:CVE-2024-21894 (Heap Overflow), CVE-2024-22052 (Null Pointer Dereference), CVE-2024-22053 (Heap Overflow) and CVE-2024-22023 (XML entity expansion or XXE) for Ivanti Connect Secure and Ivanti Policy Secure Gateways

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 5.9 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schweitzer Engineering Laboratories Equipment: SEL 700 series relays Vulnerability: Inclusion of Undocumented Features 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to make modifications or cause a denial-of-service condition. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following Schweitzer Engineering Laboratories products are affected: SEL-700BT Motor Bus Transfer Relay: R301-V0 up to but not including R301-V6 SEL-700BT Motor Bus Transfer Relay: R302-V0 up to but not including R302-V1 SEL-700G Generator Protection Relay: R100-V0 up to but not including R301-V6 SEL-700G Generator Protection Relay: R302-V0 up to but not including R302-V1 SEL-710-5 Motor Protection Relay: R100-V0 up to but not including R302-V1 SEL-751 Feeder Protection Relay: R101-V0 up to but not including R302-V3 SEL-751 Feeder Protection Relay: R400-V0 up to but not including R400-V2 SEL-787-2/-3/-4 Transformer Protection Relay: R100-V0 up to but not including R302-V1 SEL-787Z High-Impedance Differential Relay: R302-V0 up to but not including R302-V3 3.2 Vulnerability Overview 3.2.1 INCLUSION OF UNDOCUMENTED FEATURES CWE-1242 Inclusion of undocumented features vulnerability accessible when logged on with a privileged access level on the following Schweitzer Engineering Laboratories relays could allow the relay to behave unpredictably. CVE-2024-2103 has been assigned to this vulnerability. A CVSS v3.1 base score of 6.5 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H). A CVSS v4 score has also been calculated for  CVE-2024-2103. A base score of 5.9 has been calculated; the CVSS vector string is ( CVSS4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N). 3.3 BACKGROUND CRITICAL INFRASTRUCTURE SECTORS: Energy COUNTRIES/AREAS DEPLOYED: Worldwide COMPANY HEADQUARTERS LOCATION: United States 3.4 RESEARCHER An anonymous researcher reported this vulnerability to CISA. 4. MITIGATIONS Schweitzer Engineering Laboratories recommends updating to the latest versions: SEL-700BT Motor Bus Transfer Relay: R301-V6 SEL-700BT Motor Bus Transfer Relay: R302-V1 SEL-700G Generator Protection Relay: R301-V6 SEL-700G Generator Protection Relay: R302-V1 SEL-710-5 Motor Protection Relay: R302-V0 SEL-751 Feeder Protection Relay: R302-V3 SEL-751 Feeder Protection Relay: R400-V2 SEL-787-2/-3/-4 Transformer Protection Relay: R302-V1 SEL-787Z High-Impedance Differential Relay: R302-V3 CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPNs are only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. 5. UPDATE HISTORY April 4, 2024: Initial Publication

Russia won’t change its tactics, but we can expect they will use tools like deepfakes to influence elections.

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.