Kevin Mitnick Obituary
https://www.dignitymemorial.com/obituaries/las-vegas-nv/kevin-mitnick-11371668
#cybersec
“The biggest network security threat today is a remote code execution exploit for Intel’s Management Engine.”
“Every computer with an Intel chipset produced in the last decade would be vulnerable to this exploit, and RCE would give an attacker full control over every aspect of a system.
If you want a metaphor, we are dinosaurs and an Intel ME exploit is an asteroid hurtling towards the Yucatán peninsula.” (https://hackaday.com/tag/intel-me/)
Intel might have installed – over the course of at least a decade (to this day?) a closed source backdoor in your computer’s firmware, that might never receive updates and is hard to remove.
Once this backdoor is fully cracked, everyone (Russia, China and North Korea) can use it.
Having remote control over a server down to the BIOS is a neat feature.
Hackers think so too.
Because a firmware is sometimes hard to update.
BIOS-UEFI updates need to be as easy to install than OS updates.
There are even parts of Intel ME that can not be updated at all (yet) because they are encrypted & signed and the system won’t start if they are missing (security by obscurity).
another dramatic way to put it:
“The biggest network security threat today is a remote code execution exploit for Intel’s Management Engine.”
“Every computer with an Intel chipset produced in the last decade would be vulnerable to this exploit, and RCE would give an attacker full control over every aspect of a system.
If you want a metaphor, we are dinosaurs and an Intel ME exploit is an asteroid hurtling towards the Yucatán peninsula.” (https://hackaday.com/tag/intel-me/)
Currently the OS must be hacked or USB access (“physical access equals root access”) before it is possible to malware very deeply in the system = having this guy say: “only solution” “shredder mainboard”
But it might be just a matter of time, until new attack vectors are found, that allow exploit over network, maybe even in the security-nightmare language that every browser runs: JavaScript? X-D (just turn it off globally thanks!)
https://www.golem.de/news/conti-ransomware-gruppe-arbeitet-an-exploit-fuer-intel-me-2206-165848.html
(Conti is a hacker group associated with Russia)
https://www.golem.de/news/security-das-intel-me-chaos-kommt-2003-147099.html
https://www.golem.de/news/security-hackern-gelingt-vollzugriff-auf-intel-me-per-usb-1711-131065.html
Intel ME: Will Intel deliver updates? I hope so. Otherwise: Seriously sue intel to put your IT hardware at danger of being destroyed PERMANENTLY.
As it has happened with those KA-SAT satellite modems.
solutions anyone?
Yes multiple hard one’s.
- try turning AMT BMC Intel ME off in the bios
- some BIOS even allow to disable Intel ME permanently
- some BIOS even allow to disable Intel ME permanently
- on some systems BMC can be disabled with a jumper on the motherboard
- Flash GNU Linux to the BIOS! (CoreBoot, LibreBoot with the Lenovo x60s no problem, with newer notebooks / PCs probably more effort)
- “Just use AMD”, yes better but according to this video only a partial solution?
intel needs to work with it’s damaged customers to fix this mess
Or be sued for every hack and every ransomware attack and every downtime and every destroyed motherboard.
seriously.
open source backdoors instead of closed source backdoors!
ok ideally no backdoors at all?
“Intel had already found the vulnerability (CVE-2019-0090) itself last year, described only as a privilege escalation and tried to fix a possible attack vector.
According to PT, however, there are probably other attack vectors and the real problem in ROM still remains, as this part cannot be updated.
This is the preliminary culmination of an embarrassment on the part of Intel, which the manufacturer is trying to sell as security.
By now at the latest, Intel should mothball the concept of a proprietary ME and work on the open hardware security chip that Google“
“Customers, users and Intel would be the winners.”
translated from: https://www.golem.de/news/security-das-intel-me-chaos-kommt-2003-147099.html
“Together with partners, Google has announced the Open Titan project.
The goal is a completely openly designed chip based on RISC-V, which is to be used as root-of-trust in many different devices.”
links:
https://www.rapid7.com/blog/post/2013/07/02/a-penetration-testers-guide-to-ipmi/
#linux #gnu #gnulinux #opensource #administration #sysops #cybersec #itsec #cyber #intel #intel-me #intelme
Originally posted at: https://dwaves.de/2022/06/10/russias-conti-working-on-exploits-for-intel-me-bmc-amt-ipmi-intel-me-the-biggest-security-fuck-up-in-computing-history-sue-intel/
Intel might have installed – over the course of at least a decade (to this day?) a closed source backdoor in your computer’s firmware, that might never receive updates and is hard to remove.
Once this backdoor is fully cracked, everyone (Russia, China and North Korea) can use it.
Having remote control over a server down to the BIOS is a neat feature.
Hackers think so too.
Because a firmware is sometimes hard to update.
BIOS-UEFI updates need to be as easy to install than OS updates.
There are even parts of Intel ME that can not be updated at all (yet) because they are encrypted & signed (security by obscurity).
Currently the OS must be hacked or USB access (“physical access equals root access”) before it is possible to malware very deeply in the system = having this guy say: “only solution” “shredder mainboard”
But it might be just a matter of time, until new attack vectors are found, that allow exploit over network, maybe even in the security-nightmare language that every browser runs: JavaScript? X-D (just turn it off globally thanks!)
https://www.golem.de/news/conti-ransomware-gruppe-arbeitet-an-exploit-fuer-intel-me-2206-165848.html
(Conti is a hacker group associated with Russia)
https://www.golem.de/news/security-das-intel-me-chaos-kommt-2003-147099.html
https://www.golem.de/news/security-hackern-gelingt-vollzugriff-auf-intel-me-per-usb-1711-131065.html
Intel ME: Will Intel deliver updates? I hope so. Otherwise: Seriously sue intel to put your IT hardware at danger of being destroyed PERMANENTLY.
As it has happened with those KA-SAT satellite modems.
solutions anyone?
Yes multiple hard one’s.
- try turning AMT BMC Intel ME off in the bios
- some BIOS even allow to disable Intel ME permanently
- some BIOS even allow to disable Intel ME permanently
- on some systems BMC can be disabled with a jumper on the motherboard
- Flash GNU Linux to the BIOS! (CoreBoot, LibreBoot with the Lenovo x60s no problem, with newer notebooks / PCs probably more effort)
- “Just use AMD”, yes better but according to this video only a partial solution?
intel needs to work with it’s damaged customers to fix this mess
Or be sued for every hack and every ransomware attack and every downtime and every destroyed motherboard.
seriously.
open source backdoors instead of closed source backdoors!
ok ideally no backdoors at all?
“Intel had already found the vulnerability (CVE-2019-0090) itself last year, described only as a privilege escalation and tried to fix a possible attack vector.
According to PT, however, there are probably other attack vectors and the real problem in ROM still remains, as this part cannot be updated.
This is the preliminary culmination of an embarrassment on the part of Intel, which the manufacturer is trying to sell as security.
By now at the latest, Intel should mothball the concept of a proprietary ME and work on the open hardware security chip that Google“
“Customers, users and Intel would be the winners.”
translated from: https://www.golem.de/news/security-das-intel-me-chaos-kommt-2003-147099.html
“Together with partners, Google has announced the Open Titan project. The goal is a completely openly designed chip based on RISC-V, which is to be used as root-of-trust in many different devices.”
#linux #gnu #gnulinux #opensource #administration #sysops #cybersec #itsec #cyber #intel #intel-me #intelme
Originally posted at: https://dwaves.de/2022/05/17/russias-conti-working-on-exploits-for-intel-me-bmc-amt-intel-me-the-biggest-security-fuck-up-in-computing-history-sue-intel/
Open Source is about enabling users "Amazon, Microsoft, Google" and the White House, want to help make Open Source more secure... [caption id="attachment_26251" align="alignnone" width="430"] https://www.youtube.com/watch?v=U-8KopUKMzA\[/caption\] https://www.golem.de/news/openssf-150-millionen-us-dollar-sollen-open-source-absichern-2205-165382.html https://www.golem.de/news/openssf-linux-foundation-will-security-praxis-vereinheitlichen-2008-150036.html src of src: "White House OSS Mobilization Plan" 2022: https://openssf.org/blog/2022/05/11/testimony-to-the-us-house-committee-on-science-and-technology/ 2020: "The OpenSSF is[...]
#linux #gnu #gnulinux #opensource #administration #sysops #dev #c #development #rust #go #google #security #itsec #cybersec #cybersecurity #kernel #linus #torvalds #mozilla #licence #licencing #patents #patent
Originally posted at: https://dwaves.de/2022/05/16/rust-vs-go-open-source-is-about-enabling-users-rust-lang-will-complement-c-around-the-gnu-linux-kernel-for-better-safety-amazon-microsoft-google-and-the-white-house-want-to-make-open-sour/
Open Source is about enabling users
“Amazon, Microsoft, Google” and the White House, want to help make Open Source more secure…
- https://www.golem.de/news/openssf-150-millionen-us-dollar-sollen-open-source-absichern-2205-165382.html
-
- src of src: “White House OSS Mobilization Plan”
- 2022: https://openssf.org/blog/2022/05/11/testimony-to-the-us-house-committee-on-science-and-technology/
- 2020: “The OpenSSF is a cross-industry collaboration that brings together leaders to improve the security of open source software (OSS) by:
- building a broader community with targeted initiatives and best practices
- It combines efforts from the Core Infrastructure Initiative, GitHub’s Open Source Security Coalition and other open source security work from founding governing board members GitHub, Google, IBM, JPMorgan Chase, Microsoft, NCC Group, OWASP Foundation and Red Hat, among others.
- Additional founding members include ElevenPaths, GitLab, HackerOne, Intel, Okta, Purdue, SAFECode, StackHawk, Trail of Bits, Uber and VMware.
- Open source software has become pervasive in data centers, consumer devices and services, representing its value among technologists and businesses alike.
- Because of its development process, open source that ultimately reaches end users has a chain of contributors and dependencies.
- It is important that those responsible for their user or organization’s security are able to understand and verify the security of this dependency chain.” (src linuxfoundation.org)
so far so good eh?
How will this exactly play out? What will be the “modi operandi”? (Pentagon & JP Morgan Bank, are interested in making the software supply chain more secure, as the IT of banks (!!!) not very good (say the banks THEMSELVES (that fired a lot of IT staff to save on money))
Just an idea for the govs & big corps with the money:
- put up a “Open Source” “kickstarter” like website
- where companies & gov can put up their requirements
- Open Source developers either accept to tackle those requirements
- or:
- post their own projects & investors can allocate their resorces to Open Source
- ABSOLUTE transparency is critical here, not a “pay to play” “taking power” “taking over” “Open Source” “influencing” sealing deals behind closed doors.
long version:
https://peertube.co.uk/w/jKvQozs7xDqpQvbwQFdKbF
The Star Trek economy: will it ever exist?
Afaik Dutch historian Rutger Bregman confirms in his book “Humankind: A Hopeful History” (BE WARNED: it is a realist’s thriller!), that “the nature” of humans (also under constant development), is as such, that only a small percentage are reckless “psychopaths”,
the majority of mankind rather wants to help each other, than shoot each other.
Rust “second in command” around the GNU Linux Kernel
Because Rust lang promises improvements around cyber/itsecurity (no more buffer over/underruns), it might become “second in command” around the Kernel.
The cons: Rust is more C++ than C, which might be a problem for the (long term) C nerds.
Unless (Linus?) & Greg (or someone else) wants to develop a brand new “C” “2.0” lang + compiler designed around security…
Unless Google wants to change it’s Go lang licence…
…Rust it is.
Is Go (a more C like) alternative?
(2018: developer Voit wrote a Network driver (GNU Linux kernel module) in Go)
https://www.net.in.tum.de/fileadmin/bibtex/publications/theses/2018-ixy-go.pdf
C ixy vs Go ixy: performance (only) “10% slower then the C implementation under optimal circumstance” (optimal meaning: system’s CPU needs fast single threading)
“One of the biggest problem during development was low-level memory management.”
“Specifically register access has proven itself to be difficult in Go”
“On the other hand we were surprised about the garbage collection.”
“Originally named as the reason why Go is nor suited for systems programming, our analysis has proven otherwise”
“easier to read and does not require much understanding of the language itself in order to understand the code, especially compared to some C constructs like function pointer, pointer casting and other more intricate operations” (src)
the Go lang licencing MumboJumbo:
“Copyright (c) 2009 The Go Authors. All rights reserved.”
“Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
* Neither the name of Google Inc. nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
“AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.”
that’s not all… there is more licencing mumbojumbo for all those Free Software Foundation & lawyerzzz:
‘Additional IP Rights Grant (Patents)’
‘”This implementation” means the copyrightable works distributed by Google as part of the Go project.
Google hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section)
patent license to make, have made, use, offer to sell, sell, import, transfer and otherwise run, modify and propagate
the contents of this implementation of Go,
where such license applies only to those patent claims,
both currently owned or controlled by Google and acquired in the future,
licensable by Google that are necessarily infringed by this implementation of Go.
This grant does not include claims that would be infringed only as a consequence of further modification of this implementation.
If you or your agent or exclusive licensee institute or order or agree to the institution of patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that this implementation of Go or any code incorporated within this implementation of Go constitutes direct or contributory patent infringement,
or inducement of patent infringement, then any patent rights granted to you under this License for this implementation of Go shall terminate as of the date such litigation is filed.’
src: https://raw.githubusercontent.com/golang/go/master/PATENTS
While the sources of the Go lang are indeed accessible via github, it’s licence is neither GPL 2.0 nor GPL 3.0 nor Apache licence nor MIT licence and thus questionable if:
- Google can be trusted (?)
- the Go lang licence is “compact” but (currently) not at all Open Source compatible (not a word about if modifcations are allowed)
- why did Google not simply pick a “well known” Open source licence? https://opensource.org/licenses
One fine day, Google might to decide, to change the licence, and from this to:
- stop providing the (latest) source code (the old one yes, not the new one)
- re-distribute Go only in it’s binary form
- charge licence fees for it’s usage
- it is called: “building up dependencies, then cashing in on something that used to be free” (as Oracle did with Java)
- until it was out of the testing-phase
- and every developer and every company was using it/became dependant on it
- it is called: “building up dependencies, then cashing in on something that used to be free” (as Oracle did with Java)
Next problem: Rust (src here) was started by Mozilla, is used by Mozilla for Firefox, but Mozilla has build up financial dependencies to Google.
(Rust in contrast is licenced under MIT & Apache licence https://www.rust-lang.org/policies/licenses)
While this is all not really: K.I.S.S (the UNIX philosophy of Keep it Super Simple)
No dispair, just do your best.
Sticking to the default?
The problem is that systems designed & “Made in the 1970s” (C compiler, Phones, Mail), were not designed around security (because it was not really a problem in those days).
So…
- unless Google won’t change the Go lang licence to something Open Source compatible
- unless Linus & Greg or someone else wants to build a C 2.0 around security, Rust is it.
The Go lang licencing problem is the ZFS Oracle licencing problematic all over again:
In other words: Licences (money) have more than once, instead of enabling developers & users, have hindered developers & users.
Another company that M$ successfully killed by buying it…
Another example how Microsoft successfully made this planet worse:
IT WAS AN EXCELLENT learning platform, with high quality video learning courses with…
- 2000 courses in German
- 1200 courses in Spanish
- 1300 courses in French
- 500 courses in Japanese (as of September 2017)
- 0 in English? (a bit strange, but this company was from Austria and has focused on the EU market, that might be one reason)
Microsoft bought it up… now it is… dead? MS killed it. #wtf?
Now a high quality Video2Brain Rust videos would be needed (luckily – again – Youtube volunteers are chipping in THANKS! (MS maybe transfer some money to them? eh? thanks!))
PS: so that’s my take, could not ask that question via…
stackoverflow.com and serverfault.com suck and DESPERATELY needs competition
#linux #gnu #gnulinux #opensource #administration #sysops #dev #c #development #rust #go #google #security #itsec #cybersec #cybersecurity #kernel #linus #torvalds #mozilla #licence #licencing #patents #patent
Originally posted at: https://dwaves.de/2022/05/16/rst-vs-go-open-source-is-about-enabling-users-rust-lang-will-complement-c-around-the-gnu-linux-kernel-for-better-safety-amazon-microsoft-google-and-the-white-house-want-to-make-open-sourc/
how much is the phish? The phone-system but also the E-Mail system, are amongst the oldest, digital systems still in use today (the first E-Mail was send 1971). Unfortunately both systems - back then - were not designed with security in mind.[...]
#linux #gnu #gnulinux #opensource #administration #sysops #cyber #itsec #cybersec #itsecurity #dkb #bank #banking #phishing #phish #yandex #sdk #privacy
Originally posted at: https://dwaves.de/2022/05/10/cyber-it-security-news-dkb-phishing-fake-mails-and-sms-software-minimalism-is-data-protection-is-privacy-is-key-36-of-android-apps-build-with-yandex-sdk/
cyber it-security news - DKB phishing fake mails AND sms
how much is the phish? The phone-system but also the E-Mail system, are amongst the oldest, digital systems still in use today (the first E-Mail was send 1971). Unfortunately both systems - back then - were not designed with security in mind.[...]
#linux #gnu #gnulinux #opensource #administration #sysops #cyber #itsec #cybersec #itsecurity #dkb #bank #banking #phishing #phish
Originally posted at: https://dwaves.de/2022/05/10/cyber-it-security-news-dkb-phishing-fake-mails-and-sms/
“The Duri malware, for example, uses the Javascript blob technique.
The attacks are triggered by visiting a website with the malicious code.”
(this could be a well known, sincere, but hacked website)
“By downloading, the malware can install itself on the target device.”
“HTML smuggling is also made possible by the HTML5 “Download” attribute for anchor tags.”
“When a user clicks the HTML link, a download of the file is triggered.”
“The attack therefore uses conventional HTML5 and JavaScript functions.”
“The attack occurs especially in email campaigns.”
“That is, users with Exchange Online mailboxes are also affected.”
“Spear phishing campaign can ransomware”
“This technique was noticed in a spear phishing campaign in May 2021.
“As part of these attacks, the banking Trojan Mekotio as well as AsyncRAT/NJRAT and Trickbot were infiltrated – this also means remote code execution and complete takeover of computers is possible.”
“Ransomware also enters networks in this way.”
“The Microsoft 365 Defender Threat Intelligence Team shows what such an attack looks like in a Twitter post.
“ISOMorph Infection: In-Depth Analysis of a New HTML Smuggling Campaign”
src: translated from https://www.security-insider.de/html-smuggling-greift-netzwerke-von-innen-an-a-1109311/
Links:
https://dwaves.de/2018/09/10/javascript-is-evil-a-major-security-problem/
https://dwaves.de/2021/02/26/the-evilness-of-javascript-dont-be-evil-twitter-strikes-again/
https://dwaves.de/2019/12/17/mail-thunderbird-disable-javascript/
#linux #gnu #gnulinux #opensource #administration #sysops #itsec #itsecurity #js #html5 #html #javascript #cyber #cybersecurity #cybersec
Originally posted at: https://dwaves.de/2022/04/13/from-html5-javascript-blob-technique-to-ransomeware-js-is-evil-when-it-is-allowed-to-do-more-than-gui-animations/
privacy in peril - criminals abusing tor for malicous behavior should be blocked, right?
criminals abusing tor for malicous behavior should be blocked, right?
“50% of the attacks are leveraging the Tor anonymity service to mask their true origins”
https://thehackernews.com/2021/12/new-local-attack-vector-expands-attack.html
this could destroy the “honest” part of the network that truly exists, because it could criminalize the honest users, that want nothing but avoid a #1984 style of digital dictatorship.
or is malbehaving small group found in every nation just something that the tor network / democracy has to tolerate for the sake of freedom of speech & privacy?
There are many many attacks on Tor in order to try to break it
(just recently a probably gov sponsored group called KAX17)
“Given the number of servers run by KAX17 the calculated probability of a Tor user connecting to the Tor network through one of KAX17’s servers was 16%, there was a 35% chance they would pass through one of its middle relays, and up to 5% chance to exit through one.” (src)
This is a problem that probably can be fixed, but what about the first one?
#linux #gnu #gnulinux #opensource #administration #sysops #tor #log4j #attacks #cybersec #cyber #itsec #privacy #KAX17 #1984
Originally posted at: https://dwaves.de/2021/12/21/privacy-in-peril-criminals-abusing-tor-for-malicous-behavior-should-be-blocked-right/
https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
- “log4j is a reliable, fast and flexible logging framework (APIs) written in Java, which is distributed under the Apache Software License. log4j has been ported to the C, C++, C#, Perl, Python, Ruby, and Eiffel languages.” (src: tutorialspoint.com)
- easy exploitable security problem in Java library Log4j (run the search)
- worst case scenario: a widely used and publicly accessible (internet communication message handling) software allows loading and running code from a remote site (this is not a feature, this is CyberSec madness, deseriously wtf!?)
- JavaUpdates? some do them some don’t because it could break functionality (vendor will have to update and re-test the program’s functionalities)
- Log4Shell, the widespread Apache Log4j vulnerability
- Microsoft’s threat intelligence teams reported on Saturday that they’ve seen Log4Shell exploited to install Cobalt Strike, a popular tool with cybercriminals that is often seen as a precursor to deploying ransomware.
- (src: venturebeat.com)
- “The vulnerability affects any application that uses Apache Log4j, an open source logging library, and many applications and services written in Java are potentially vulnerable”
- “The Log4Shell vulnerability has impacted version 2.0 through version 2.14.1 of Apache Log4j, and organizations are advised to update to version 2.15.0 as quickly as possible. Vendors including Cisco, VMware, and Red Hat have issued advisories about potentially vulnerable products.”
- (src: venturebeat.com)
https://www.tagesschau.de/inland/bsi-schadsoftware-103.html
the “runs everywhere” JavaScript attack vector:
the once hailed cross-platform language is allowed to do too much, as often mentioned the security implications of #evilness of a JavaScript that allows more than nicely render text is massive, it goes as far as attacking not-so-up-to-date devices within the user’s network, simply by visiting a (hacked? or just hosted with great content but evil intentions) website.
https://thehackernews.com/2021/12/new-local-attack-vector-expands-attack.html
what software was/is affected?
https://security.googleblog.com/2021/12/understanding-impact-of-apache-log4j.html
https://www.securityweek.com/google-finds-35863-java-packages-using-defective-log4j
https://www.rumble.run/blog/finding-log4j/
already hacked: belgian military
“The breach reportedly targeted a security flaw in a widely used utility known as Log4j, a fault that was first observed by cyber experts earlier this month, stoking fears that hackers could use the vulnerability to compromise millions of devices. While many attackers have exploited the flaw to install cryptocurrency mining software on computers without the owners’ knowledge, others have taken aim at businesses and even government agencies, according to Check Point, an Israel-based cyber security firm.
Companies and officials in Belgium and beyond have raced to patch up the vulnerability, with Google reportedly tasking 500 engineers to ensure its code is airtight, while the US Cybersecurity and Infrastructure Security Agency issued an emergency directive last week urging other federal agencies to fix the flaw.”
https://www.rt.com/news/543825-belgium-military-cyber-attack/
was affected but now fixed: server side of TeamViewer: (written in Java?)
CVE-2021-44228, CVE-2021-45046, CVE-2021-45105
Impacted productsRemediationRemediation statusUser ActionTeamViewer IoTServer-side hot fixdonenot requiredTeamViewer EngageServer-side hot fixdonenot requiredTeamViewer FrontlineServer-side hot fixdonenot required*(2021-12-20) Update on* CVE-2021-45105:
In the night between the 17th and 18th of December a third vulnerability in the log4J library (tracked as CVE-2021-45105) has been disclosed. The version, with the provided fix for the previously disclosed CVEs (CVE-2021-44228, CVE-2021-45046), has been found vulnerable to a DoS attack. A new version has been provided by the project maintainers. TeamViewer again has deployed a server-side hotfix for all affected products. User action is not required.
(2021-12-15) Update on CVE-2021-45046:
After it was found that the third-party provided fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete, we have deployed an additional server-side hotfix to address the new CVE-2021-45046. User action is not required. We will continue to monitor the situation closely.
(2021-12-13) Statement on CVE-2021-44228:
The third-party Java library Log4J2, which is widely used in the software industry, is subject to a critical vulnerability tracked as CVE-2021-44228. For our potentially impacted services including TeamViewer IoT, TeamViewer Engage, and TeamViewer Frontline, we have deployed an immediate server-side hotfix. User action is not required.
Other TeamViewer products are not impacted. Furthermore, we have diligently investigated our IT infrastructure and taken appropriate steps to mitigate any supply chain risks. TeamViewer will continue to monitor the situation closely.
#linux #gnu #gnulinux #opensource #administration #sysops #java #cyber #itsec #log4j #cybersec #javascript #Log4Shell
Originally posted at: https://dwaves.de/2021/12/13/cyberinsecurity-ah-oh-its-java-time-log4j-called-log4shell-dynamically-remote-loading-code-or-any-other-resources-is-always-a-bad-cybersec-idea/
CyberInSecurity - Ah Oh it's Java time
https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
“log4j is a reliable, fast and flexible logging framework (APIs) written in Java, which is distributed under the Apache Software License.
log4j has been ported to the C, C++, C#, Perl, Python, Ruby, and Eiffel languages.” (src: tutorialspoint.com)
- easy exploitable security problem in Java library Log4j (run the search)
- worst case scenario: a widely used and publicly accessible (internet communication message handling) software, for which no easy update mechanism exists (updates to Java Framework are possibly, but not automated because upgrades may break functionality)
- Log4Shell, the widespread Apache Log4j vulnerability
- Microsoft’s threat intelligence teams reported on Saturday that they’ve seen Log4Shell exploited to install Cobalt Strike, a popular tool with cybercriminals that is often seen as a precursor to deploying ransomware.
- (src: venturebeat.com)
- “The vulnerability affects any application that uses Apache Log4j, an open source logging library, and many applications and services written in Java are potentially vulnerable”
- “The Log4Shell vulnerability has impacted version 2.0 through version 2.14.1 of Apache Log4j, and organizations are advised to update to version 2.15.0 as quickly as possible. Vendors including Cisco, VMware, and Red Hat have issued advisories about potentially vulnerable products.”
- (src: venturebeat.com)
https://www.tagesschau.de/inland/bsi-schadsoftware-103.html
#linux #gnu #gnulinux #opensource #administration #sysops #java #cyber #itsec #log4j #cybersec
Originally posted at: https://dwaves.de/2021/12/13/cyberinsecurity-ah-oh-its-java-time/
just for info: this is NOT my PC, not using Windows 10 (Windows 7 only for gaming X-D) what the user sees is a perfectly windows fake update message, that says "Edge Update Version 94.0.4577 (official Version)" so the user thinks "this[...]
#linux #gnu #gnulinux #opensource #administration #sysops #ransomeware #fake #messages #web #edge #windows #cyber #cybersec #itsec #catastrophe
Originally posted at: https://dwaves.de/2021/11/26/fake-windows-update-messages-in-windows-10-edge-browser-via-google-picture-search-searchterm-cosmos/