What is known about the 0.0.0.0_Day vulnerability?

Leave a reply

What is known about the 0.0.0.0_Day vulnerability?

What is known about the 0.0.0.0_Day vulnerability? The original post was published on August 7 by Oligo Security. Last year, this Israeli company released research about ShellTorch vulnerability. This time, another research on local services accessible from the outside.

When a victim visits a malicious website, this site can interact with web services on the victim's localhost at 0.0.0.0_ using JS. The trick works with Chromium, Firefox, and Safari on MacOS and Linux. This is not cool, browsers should block requests to localhost.

So, let's say the site interacts with some services on localhost (if any), so what? Well, if the service is poorly written, then this can very potentially lead to RCE. 🤷‍♂️ For demonstration, the researchers took an exploited in the wild vulnerability in the Ray AI framework (ShadowRay) and attacked the local Ray server through 0.0.0.0_Day. 🤔

So far, it doesn't look like 0.0.0.0_Day will become a trending vulnerability.

На русском

Qualys announced the TotalAI module for artificial intelligence (AI) and large language models (LLM) security

Leave a reply

Qualys announced the TotalAI module for artificial intelligence (AI) and large language models (LLM) security

Qualys announced the TotalAI module for artificial intelligence (AI) and large language models (LLM) security. The module will be available in Q4 2024 as part of the Enterprise TruRisk platform.

Announced features:

🔹 Detection and monitoring of the AI ​​infrastructure of organizations. To avoid "shadow LLM".

🔹 Vulnerability Management with a focus on AI threats. Especially on countering theft (extraction) of data and models. They will offer a variety of ways to fix vulnerabilities.

🔹 Specialized LLM scanning focussed on prompt injection, model theft, and disclosure of confidential information.

🔹 Compliance Management and risk management. They emphasize combating data leaks and mention GDPR, PCI, CCPA.

There is a screenshot of the interface with statistics on models and related threats. We can also see statistics on threats related to assets and interesting informers for AI Workloads, AI Software and GPU.

На русском

Malware delivery via automatic software updates

Leave a reply

Malware delivery via automatic software updates

Malware delivery via automatic software updates. An interesting case was published by Volexity experts. Let's say you have some software on the host. It periodically goes online to check for updates and then installs them... And instead of updating, malware is installed. 😱👾

And this is NOT a case of a compromised software vendor website. 🙂

To achieve this result, the StormBamboo bad guys carried out a DNS poisoning attack at the Internet service provider (ISP) level. The attackers changed the responses to DNS queries for certain domains. Accordingly, the "update" was downloaded from the IP addresses of the villains. 😈

Naturally, for this trick to work, the software must use insecure update mechanisms: connect via HTTP, do not check installer digital signatures, etc. 🤷‍♂️ Volexity mentions an attack via 5KPlayer media player updates. The victims were infected with MACMA and POCOSTICK / MGBot malware.

На русском

I also made a meme with the cool Yusuf Dikeç

Leave a reply

I also made a meme with the cool Yusuf Dikeç

I also made a meme with the cool Yusuf Dikeç. 😅

🔹 Every vulnerability existing in the infrastructure must be detected.
🔹 For each detected vulnerability, a patching task must be created.

This is the base. And when they tell you that you don't have to do this because there is some super-modern vulnerability assessment and prioritization tool, you should be skeptical. 😉

На русском

Regarding the Qualys Patch Management event that took place yesterday

Leave a reply

Regarding the Qualys Patch Management event that took place yesterday

Regarding the Qualys Patch Management event that took place yesterday.

I liked:

✅ Cool report by Eran Livne about Patch Management capabilities in Qualys. 👍 Especially about creating linked patching tasks (first for a test scope, and a week later for a full scope) and about the ability to isolate hosts as a mitigation option (access remains only from the Qualys cloud). The part about new TruRisk Eliminate was also interesting.
✅ Adam Gray beautifully justified the need for mandatory patching (since prevention doesn't really work 🤷‍♂️).

I didn't like:

❌ Most speakers focused on other information security topics rather than patch management. I think it would have been possible to select more thematic reports for this event.
❌ I simply can't accept theses like "you don't need to patch all vulnerabilities". 🤷‍♂️ My position: you need to patch everything. And workarounds are good for a while UNTIL a patch is installed.

На русском

Remote Code Execution - Acronis Cyber Infrastructure (CVE-2023-45249)

1 Reply

Remote Code Execution - Acronis Cyber Infrastructure (CVE-2023-45249)

Remote Code Execution - Acronis Cyber Infrastructure (CVE-2023-45249). Due to the default passwords used, a remote unauthenticated attacker can gain access to an Acronis Cyber ​​Infrastructure (ACI) server and execute arbitrary code.

ACI is a hyperconverged platform for storage, backup, computing, virtualization and networking.

🔻 Patches that fix this vulnerability were released on October 30, 2023 (❗️).
🔻 After 9-10 months, on July 24 of this year, Acronis noted in a bulletin that the vulnerability was exploited in the wild. The purpose of exploitation was to install a cryptominer. On July 29, the vulnerability was added to the CISA KEV.

Some sources report 20,000 service providers using ACI. I have not found any confirmation of this. Perhaps there is confusion with Acronis Cyber ​​Protect. However, there are probably quite a few large companies using ACI. If you work for such a company, be sure to pay attention.

На русском