CISA Spreads FUD About "Open Source" While Microsoft is the Problem
-
Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization | CISA [Ed: Microsoft CISA tries to blame "open source" for merely being used to construct things that exploit holes/back doors in proprietary stuff]
CISA, the Federal Bureau of Investigation (FBI), and the National Security Agency (NSA) have released a joint Cybersecurity Advisory (CSA), Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization, highlighting advanced persistent threat (APT) activity observed on a Defense Industrial Base (DIB) Sector organization’s enterprise network. ATP actors used the open-source toolkit, Impacket, to gain a foothold within the environment and data exfiltration tool, CovalentStealer, to steal the victim’s sensitive data.
-
CISA Releases Five Industrial Control Systems Advisories [Ed: Some of these are specific to Microsoft]
CISA has released five (5) Industrial Control Systems (ICS) advisories on October 04, 2022. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.
-
Johnson Controls Metasys ADX Server [Ed: Microsoft Windows TCO]
Successful exploitation of this vulnerability could allow an Active Directory user to execute validated actions without providing a valid password.
-
Horner Automation Cscape | CISA
The affected product does not properly validate user-supplied data. If a user opens a maliciously formed FNT file, then an attacker could execute arbitrary code within the current process by accessing an uninitialized pointer, leading to an out-of-bounds memory read.
-
OMRON CX-Programmer [Ed: Microsoft Windows TCO]
The affected product is vulnerable to an Out-of-Bounds Write in CX-P.exe, which may allow an attacker to execute arbitrary code.
UPDATE:
More FUD today.
-
ZINC Hackers Leverage Open-source Software to Lure IT Pros [Ed: Linux Today relays Microsoft lies and FUD against "Open Source"]
Microsoft team published a detailed schema that explains how the ZINC group compromised targeted engineers in 2022...