You are here

Home » Cybersecurity

Cybersecurity

CISA Alert: Malicious Cyber Actor Use of Network Tunneling and Spoofing to Obfuscate Geolocation

The U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) has published a new alert about malicious cyber actors using network tunneling and spoofing to obfuscate geolocation. According to the alert, attributing malicious cyber activity that uses network tunneling and spoofing techniques to a specific threat actor is difficult. Attribution requires analysis of multiple variables, including location.

Beware, More OT-Aware Ransomware – Recent Research Discovers Financially Motivated Threat Actors Dying to Kill More OT Processes

Prior reporting in multiple Security & Resilience Updates, most recently on June 18, 2020, has covered OT-aware ransomware families, notably EKANS, MegaCortex, and LockerGoga. Newly published research from FireEye suggests additional families are now incorporating common OT processes in their kill list.

SIGRed - Wormable DNS Vulnerability

As included in the Spotlight section of the Security & Resilience Update on Tuesday, Microsoft released a patch for CVE-2020-1350, a critical remote code execution (RCE) vulnerability dubbed SIGRed. All Windows Server versions from 2008 to the present are vulnerable. SIGRed only affects Windows DNS Servers; Windows DNS clients are not susceptible. However, SIGRed is wormable so it can be spread between vulnerable devices without user interaction.

The Tweets Heard ‘round the World – High-Profile Twitter Accounts Used to Send Fake Cryptocurrency Messages

Yesterday afternoon fake Tweets began circumnavigating the Twitter-sphere after a malicious actor presumably gained access to Twitter’s internal systems and tools. In what is believed to be a coordinated social engineering attack, several high-profile and Twitter-verified globally influential accounts tweeted fake cryptocurrency messages among millions of followers.

Siemens LOGO! Web Server (ICSA-20-196-08) – Products Used in the Water and Wastewater and Energy Sectors

CISA has published an advisory on a classic buffer overflow vulnerability in Siemens LOGO! Web Server. Numerous versions are affected. Successful exploitation of this vulnerability could allow remote code execution. Should the attacker gain access to the session cookies, they could then hijack the session and perform arbitrary actions in the name of the victim. Siemens recommends users apply upgrades. It has also identified specific workarounds and mitigations customers can apply to reduce the risk. CISA also recommends a series of measures to mitigate the vulnerability.

Siemens SIMATIC S7-200 SMART CPU Family (ICSA-20-196-06) – Products Used in the Water and Wastewater and Energy Sectors

CISA has published an advisory on an uncontrolled resource consumption vulnerability in Siemens SIMATIC S7-200 SMART CPU family. Versions 2.2 and later, prior to v2.5.1, are affected. Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. Siemens recommends users update to v2.5.1 and limit network access to device to trusted sources. CISA also recommends a series of measures to mitigate the vulnerability.

Siemens SIMATIC HMI Panels (ICSA-20-196-04) – Products Used in the Water and Wastewater and Energy Sectors

CISA has published an advisory on a cleartext transmission of sensitive information vulnerability in Siemens SIMATIC HMI Panels. Numerous products and versions of these products are affected. Successful exploitation of these vulnerabilities could allow an attacker to affect the availability, read sensitive data, and gain remote code execution on the affected devices. Siemens has identified the following specific workarounds and mitigations users can apply to reduce the risk. CISA also recommends a series of measures to mitigate the vulnerability.

Siemens SICAM MMU, SICAM T, and SICAM SGU (ICSA-20-196-03) – Products Used in the Water and Wastewater and Energy Sectors

CISA has published an advisory on out-of-bounds read, missing authentication for critical function, missing encryption of sensitive data, use of password hash with insufficient computational effort, cross-site scripting, classic buffer overflow, basic XSS, and authentication bypass by capture-replay vulnerabilities in Siemens SICAM MMU, SICAM T, and SICAM SGU. For SICAM MMU, all versions prior to 2.05 are affected. For SICAM SGU, all versions are affected. And for and SICAM T, all versions prior to 2.18 are affected.

Moxa EDR-G902 and EDR-G903 Series Routers (ICSA-20-196-02) – Product Used in the Energy Sector

CISA has published an advisory on a stack-based buffer overflow vulnerability in Moxa EDR-G902 and EDR-G903 series routers. For EDR-G902 series, firmware versions 5.4 and prior are affected. For EDR-G903, firmware versions 5.4 and prior are affected. Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution. Moxa recommends users implement a patch to mitigate the vulnerability. CISA also recommends a series of measures to mitigate the vulnerability.

Pages

Subscribe to Cybersecurity