Security Leftovers
-
Hackaday ☛ This Week In Security: Traingate, DNS, And JMP Slides
Remember Dieselgate, the scandal where certain diesel vehicles would detect an emissions test, and run cleaner for it, “cheating” the test? Traingate may just put that one into perspective. We’ll tell the story from the beginning, but buckle up for a wild and astonishing ride. It all starts with Polish trains getting a maintenance overhaul. These trains were built by Newag, who bid on the maintenance contract, but the contract was won by another company, SPS. This sort of overhaul involves breaking each train into its components, inspecting, lubricating, etc, and putting it all back together again. The first train went through this process, was fully reassembled, and then refused to move. After exhausting all of the conventional troubleshooting measures, SPS brought in the hackers.
-
SANS ☛ An Example of RocketMQ Exploit Scanner, (Sat, Dec 16th)
-
Dark Reading ☛ Complex 'NKAbuse' Malware Uses Blockchain to Hide on Linux, IoT Machines [Ed: This does not explain how it gets installed in the first place and why]
A sophisticated and versatile malware called NKAbuse has been discovered operating as both a flooder and a backdoor, targeting Linux desktops in Colombia, Mexico, and Vietnam.
According to a report this week from Kaspersky, this cross-platform threat, written in Go, exploits the NKN blockchain-oriented peer-to-peer networking protocol. NKAbuse can infect Linux systems, as well as Linux-derived architectures like MISP and ARM — which places Internet of Things (IoT) devices at risk as well.
The decentralized NKN network hosts more than 60,000 official nodes, and employs various routing algorithms to streamline data transmission by identifying the most efficient node pathway toward a given payload's destination.
-
The Register UK ☛ NKabuse backdoor harnesses blockchain brawn to hit several architectures [Ed: So the issue here is NIST ☛ actually unpatched Apache]
NKAbuse apparently exploits an old Apache Struts 2 vulnerability (CVE-2017-5638) and can target eight different architectures, although Linux appears to be the priority.
-
Ziff Davis ☛ Windows and Linux Systems at Risk to PyPI Repository Malware Packages [Ed: The issue here is a lack of repo audits]
Cybersecurity researchers have discovered a group of 116 malware packages in PyPI, the Python Package Index repository, capable of infecting Linux and Windows systems through custom backdoors. According to the researchers, the malicious packages have already been downloaded 10,000 times since May 2023.
-
Welltok databreach affects CHI St. Alexius patients
Patients at CHI St. Alexius are receiving letters from Welltok, Inc., a third-party vendor, about a significant data breach. Welltok said it learned at the end of July about a data leak that had taken place during the summer.
Welltok said it notified St. Alexius about the extent of the leak on November 7.