Security Leftovers

posted by Roy Schestowitz on Jun 09, 2023

• Barracuda Urges Replacing — Not Patching — Its Email Security Gateways

  It’s not often that a zero-day vulnerability causes a network security vendor to urge customers to physically remove and decommission an entire line of affected hardware — as opposed to just applying software updates. But experts say that is exactly what transpired this week with Barracuda Networks, as the company struggled to combat a sprawling malware threat which appears to have undermined its email security appliances in such a fundamental way that they can no longer be safely updated with software fixes.

• Web shells persist days after MOVEit mitigation

  Exploiting a zero-day vulnerability in MOVEit Transfer, criminals have deployed web shells on vulnerable file transfer servers and gained access to a variety of high-profile organizations. More than a week since remediation instructions were published, Netcraft has discovered web shells still present on servers associated with energy, healthcare, and finance companies.

  Web shells are control panels used by criminals to exfiltrate data from compromised servers, run exploits, and maintain remote access, often persisting long after the original vulnerability has been fixed.

  Using zero-day vulnerabilities to install web shells is not a new tactic. We previously reported on web shells installed via the Microsoft Exchange ProxyLogon and ProxyShell vulnerabilities in 2021. Two years later, Netcraft continues to detect new installations of web shells on still-vulnerable Microsoft Exchange servers.

• Russians charged with hacking Mt. Gox crypto exchange, running BTC-e

• North Korean Hackers Blamed for $35 Million Atomic Wallet Crypto Theft

  Researchers believe North Korea-linked Lazarus Group has stolen at least $35 million in cryptocurrency from Atomic Wallet.

• Vulnerabilities in Honda eCommerce Platform Exposed Customer, Dealer Data

  Vulnerabilities found by a researcher in a Honda ecommerce platform used for equipment sales exposed customer and dealer information.

• Cisco Patches Critical Vulnerability in Enterprise Collaboration Solutions

  Cisco releases fixes for a critical-severity vulnerability in Expressway series and TelePresence Video Communication Server (VCS).