Citrix Releases Security Updates - Updated July 23, 2020
July 23, 2020
Cybersecurity
Schneider Electric Triconex TriStation and Tricon Communication Module (ICSA-20-205-01)
CISA has published an advisory on cleartext transmission of sensitive information, uncontrolled resource consumption, hidden functionality, and improper access control vulnerabilities in Schneider Electric Triconex TriStation and Tricon Communication Module. Numerous versions of TriStation and Tricon Communication Module are affected. Successful exploitation of these vulnerabilities may allow an attacker to view clear text data on the network, cause a denial-of-service condition, or allow improper access.
CISA Alert: Threat Actor Exploitation of F5 BIG-IP CVE-2020-5902
The U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) has published a new alert in response to recently disclosed exploits that target F5 BIG-IP devices that are vulnerable to CVE-2020-5902. As the alert states, F5 Networks, Inc. (F5) released a patch for CVE-2020-5902 on June 30, 2020. Unpatched F5 BIG-IP devices are an attractive target for malicious actors.
CISA Alert: NSA and CISA Recommend Immediate Actions to Reduce Exposure across Operational Technologies and Systems
The U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) has published a new alert recommending critical infrastructure owners and operators take immediate steps to reduce exposure of operational technology (OT) and control systems. The alert notes that due to the increase in adversary capabilities and activity, the criticality to U.S. national security and way of life, and the vulnerability of OT systems, civilian infrastructure makes attractive targets for foreign powers attempting to do harm to U.S. interests or retaliate for perceived U.S.
When Technology Fails, Phishing Evades Security
It is well-known that phishing is purposefully designed to evade security tools and target humans, so when it does it should come as no surprise. Likewise, when security technology fails humans need to be able to recognize suspicious activity such as phishing emails and report them accordingly. Cybersecurity firm Cofense recently analyzed phishing messages that evaded Proofpoint’s Secure Email Gateway (SEG). The platform/vendor should not be the point, because it happens to (dare I say) every platform.
Who Doesn’t Like a Story about Stuxnet?
Members of WaterISAC are no strangers to Stuxnet. Uncovered in 2010, Stuxnet was the first of what was anticipated, if not expected, to be the beginning of a “cyber warfare” era. Stuxnet marked the first true cyber weapon in history designed to physically attack a military target. For those not intimately familiar with its background, Ralph Langner, the foremost authority on Stuxnet, recounts the backstory and enriched technical details of the autonomous, stealthy, patient, calculating, uber-virus. Mr.
Two More Attacks on Israeli Water Infrastructure – Israeli Government Advises Securing Cellular Communications Equipment
Another round of cyber attacks reportedly targeted Israeli water infrastructure in June. According to officials, two cyber attacks took place. Reports state that one of the attacks hit agricultural water pumps in upper Galilee, while the other one hit water pumps in the central province of Mateh Yehuda.
Experiencing an Inbox Influx? – It’s Probably Emotet, Again
Last week, researchers observed Emotet awake from its 160 day slumber. The “public cyber enemy,” as Malwarebytes is calling it, seemed to warm-up as it began lightly populating inboxes on July 13. But by July 17, the malspam onslaught commenced with nearly a quarter million messages. Emotet usually emerges out of hibernation with a new tactic in its arsenal, but so far nothing remarkable.
CISA Alert: Malicious Cyber Actor Use of Network Tunneling and Spoofing to Obfuscate Geolocation
The U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) has published a new alert about malicious cyber actors using network tunneling and spoofing to obfuscate geolocation. According to the alert, attributing malicious cyber activity that uses network tunneling and spoofing techniques to a specific threat actor is difficult. Attribution requires analysis of multiple variables, including location.
Beware, More OT-Aware Ransomware – Recent Research Discovers Financially Motivated Threat Actors Dying to Kill More OT Processes
Prior reporting in multiple Security & Resilience Updates, most recently on June 18, 2020, has covered OT-aware ransomware families, notably EKANS, MegaCortex, and LockerGoga. Newly published research from FireEye suggests additional families are now incorporating common OT processes in their kill list.
Pages
