Network Security

  • Comcast RF Attack Leveraged Remotes for Surveillance

    September 2, 2021

    More details about a now-patched vulnerability in Comcast’s XR11 voice remotes have emerged, which would have made it easy for a threat actor to intercept radio frequency (RF) communications between the remote and the set-top box, effectively turning the remote into a surveillance device. The XR11 remotes are some of the most common around, with more ...

  • DNS Rebinding Attack: How Malicious Websites Exploit Private Networks

    August 31, 2021

    Web-based consoles are widely adopted by management software and smart devices to provide interactive data visualization and user-friendly configuration. This is gaining momentum as enterprises’ computer systems become more complex and more modern internet of things (IoT) devices are used at home. These web applications are usually located in internal environments or private networks protected ...

  • Major websites hit by global outage

    July 22, 2021

    Visitors attempting to reach some sites received DNS errors, meaning their requests could not reach the websites. Affected services included Airbnb, UPS, HSBC bank, British Airways and the PlayStation network used for online games. One popular DNS provider, Akamai, reported “an emerging issue” with its Edge DNS service. Read more… Source: BBC News  

  • Industrial Networks Exposed Through Cloud-Based Operational Tech

    July 22, 2021

    The benefits of using a cloud-based management platform to monitor and configure industrial control systems (ICS) devices are obvious — efficiency, cost-savings and better diagnostics just for starters. But new research found critical vulnerabilities in these platforms that could be used to paralyze operations if left unmitigated. An analysis by Claroty’s newly branded Team82 research team ...

  • Fortinet fixes bug letting unauthenticated hackers run code as root

    July 20, 2021

    Fortinet has released updates for its FortiManager and FortiAnalyzer network management solutions to fix a serious vulnerability that could be exploited to execute arbitrary code with the highest privileges. Both FortiManager and FortiAnalyzer are enterprise-grade network management solutions for environments with up to 100,000 devices. They are available as a physical appliance, as a virtual machine, ...

  • SonicWall releases urgent notice about ‘imminent’ ransomware targeting firmware

    July 14, 2021

    Networking device maker SonicWall sent out an urgent notice to its customers about “an imminent ransomware campaign using stolen credentials” that is targeting Secure Mobile Access (SMA) 100 series and Secure Remote Access (SRA) products running unpatched and end-of-life 8.x firmware. In addition to the notice posted to its website, SonicWall sent an email to anyone ...

  • Network Attack Trends: February-April 2021

    July 1, 2021

    Unit 42 researchers observed network attack trends, February-April 2021. In the following sections, we present our analysis of the most recently published vulnerabilities, including the severity and category. Additionally, we provide insight into how the vulnerabilities are actively exploited in the wild based on real-world data collected from Palo Alto Networks Next-Generation Firewalls. We then ...

  • EUROPOL: Coordinated Action Cuts Off Access To Vpn Service Used By Ransomware Groups

    June 30, 2021

    Takedown of DoubleVPN makes it harder for criminal hackers to cover their tracks This week, law enforcement and judicial authorities in Europe, the US and Canada have seized the web domains and server infrastructure of DoubleVPN. This is a virtual private network (VPN) service which provided a safe haven for cybercriminals to attack their victims. This coordinated ...

  • Sophisticated hackers are targeting these Zyxel firewalls and VPNs

    June 25, 2021

    Zyxel, a manufacturer of enterprise routers and VPN devices, has issued an alert that attackers are targeting its devices and changing configurations to gain remote access to a network. In a new support note, the company said that a “sophisticated threat actor” was targeting Zyxel security appliances with remote management or SSL VPN enabled. Read more… Source: ZDNet  

  • Analyzing SonicWall’s Unsuccessful Fix for CVE-2020-5135

    June 22, 2021

    By Craig Young, a computer security researcher with Tripwire’s Vulnerability and Exposures Research Team Back in September 2020, I configured a SonicWall network security appliance to act as a VPN gateway between physical devices in my home lab and cloud resources on my Azure account. As I usually do with new devices on my network, I ...

  • Email Bug Allows Message Snooping, Credential Theft

    June 22, 2021

    Researchers warn hackers can snoop on email messages by exploiting a bug in the underlying technology used by the majority of email servers that run the Internet Message Access Protocol, commonly referred to as IMAP. The bug, first reported in August 2020 and patched Monday, is tied to the email server software Dovecot, used by ...

  • Researchers create an ‘un-hackable’ quantum network over hundreds of kilometers using optical fiber

    June 10, 2021

    Researchers from Toshiba have successfully sent quantum information over 600-kilometer-long optical fibers, creating a new distance record and paving the way for large-scale quantum networks that could be used to exchange information securely between cities and even countries. Working from the company’s R&D lab in Cambridge in the UK, the scientists demonstrated that they could transmit ...

  • CVE-2021-22909- Digging Into A Ubiquiti Firmware Update Bug

    May 25, 2021

    Back In February, Ubiquiti released a new firmware update for the Ubiquiti EdgeRouter, fixing CVE-2021-22909/ZDI-21-601. The vulnerability lies in the firmware update procedure and allows a man-in-the-middle (MiTM) attacker to execute code as root on the device by serving a malicious firmware image when the system performs an automatic firmware update. The vulnerability was discovered ...

  • Bluetooth flaws allow attackers to impersonate legitimate devices

    May 24, 2021

    Attackers could abuse vulnerabilities discovered in the Bluetooth Core and Mesh Profile specifications to impersonate legitimate devices during the pairing process and launch man-in-the-middle (MitM) attacks. The Bluetooth Core and Mesh Profile specifications define requirements needed by Bluetooth devices to communicate with each other and for Bluetooth devices using low energy wireless technology to enable interoperable ...

  • NAME:WRECK DNS Bugs: What You Need to Know

    May 9, 2021

    For most internet users, there’s not much of a perceivable difference between the domain name they want to visit and the server that the domain queries. That’s because the Domain Name System (DNS) protocol does a good job of seamlessly routing users to different IP addresses that are all associated with a single domain name. The ...

  • New TsuNAME DNS bug allows attackers to DDoS authoritative DNS servers

    May 6, 2021

    Attackers can use a newly disclosed domain name server (DNS) vulnerability publicly known as TsuNAME as an amplification vector in large-scale reflection-based distributed denial of service (DDoS) attacks targeting authoritative DNS servers. In simpler terms, authoritative DNS servers translate web domains to IP addresses and pass this info to recursive DNS servers that get queried by ...

  • US Department of Defense expands its bug hunting programme to networks, IoT and more

    May 5, 2021

    The US Department of Defense (DOD) has significantly expanded its bug bounty program to all publicly accessible information systems, including not just websites but also networks, frequency-based communication, Internet of Things, and industrial control systems. The DoD bug bounty, which is overseen by the DoD’s Cyber Crime Center (DC3), is now much broader than the “Hack ...

  • The big Pentagon internet mystery now partially solved

    April 24, 2021

    A very strange thing happened on the internet the day President Joe Biden was sworn in. A shadowy company residing at a shared workspace above a Florida bank announced to the world’s computer networks that it was now managing a colossal, previously idle chunk of the internet owned by the U.S. Department of Defense. That real ...

  • Malware and ransomware gangs have found this new way to cover their tracks

    April 22, 2021

    Theres’s been a huge uptick in the proportion of malware using TLS or the Transport Layer Security to communicate without being spotted, cybersecurity firm Sophos reports. While HTTPS helps prevent eavesdropping, man-in-the-middle attacks, and hijackers who try to impersonate a trusted website, the protocol has also offered cover for cybercriminals to privately share information between a ...

  • HTTPS over HTTP: A Supply Chain Attack on Azure DevOps Server 2020

    April 13, 2021

    The need for data encryption during transmission has paved the way for organizations to rely on TLS — not just for sending data through the internet, but even within trusted corporate environments. Without the use of TLS or SSL, the authenticity of transmitted data and the identity of endpoint can’t be verified. In this blog, we ...