kpatch bug fix and enhancement update

An update is available for kpatch. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kpatch management tool provides a kernel patching infrastructure which...

Is 85% of US Critical Infrastructure in Private Hands?

Most US critical infrastructure is run by private corporations. This has major security implications, because its putting a random power company in -- say -- Ohio -- up against the Russian cybercommand, which isnt a fair fight. When this problem is discussed, people regularly quote the statistic...

CIMplant - C# Port Of WMImplant Which Uses Either CIM Or WMI To Query Remote Systems

C port of WMImplant which uses either CIM or WMI to query remote systems. It can use provided credentials or the current user's session. Note: Some commands will use PowerShell in combination with WMI, denoted with in the --show-commands command. Introduction CIMplant is a C rewrite and expansion...

DarkSide Suffers ‘Oh, Crap!’ Server Shutdowns

DarkSide, the ransomware-as-a-server RaaS gang that crippled Colonial Pipeline Co. a week ago, extorted around $5 million, and sent the fuel company a decryption tool that reportedly could barely limp through the process of unlocking files, has now been paralyzed itself. In the wee hours of Frida...

CISA Publishes Eviction Guidance for Networks Affected by SolarWinds and AD/M365 Compromise

CISA has released an analysis report, AR21-134A Eviction Guidance for Networks Affected by the SolarWinds and Active Directory/M365 Compromise. The report provides detailed steps for affected organizations to evict the adversary from compromised on-premises and cloud environments. Additionally,...

Security Bulletin: A security vulnerability in Node.js lodash module affects IBM Cloud Pak for Multicloud Management Managed Service

Summary A security vulnerability in Node.js lodash module affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details CVEID: CVE-2020-28500 DESCRIPTION: Node.js lodash module is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS in...

Pipeline Update: Biden Executive Order, DarkSide Detailed and Gas Bags

Colonial Pipeline Co. may have turned off the tap following Friday’s ransomware attack, but the news about the devastating assault keeps gushing. In the wake of the DarkSide cyberattack, President Biden signed an executive order Wednesday aimed at bolstering the federal government’s cyber defense...

How ViacomCBS Digital delivers uninterrupted content streaming to millions of fans without compromising security: Lessons for enterprise CISOs

Each day, ViacomCBS Digital sees a growing surge in digital content demand—from MTV and Comedy Central to CBS Sports, rushing across its Paramount+ formerly CBS All Access streaming platform. Delivering digital content to millions of users on a daily basis doesn’t happen on its own—it makes it to...

U.S. Declares Emergency in 17 States Over Fuel Pipeline Cyber Attack

The ransomware attack against Colonial Pipeline's networks has prompted the U.S. Federal Motor Carrier Safety Administration FMCSA to issue a regional emergency declaration in 17 states and the District of Columbia D.C.. The declaration provides a temporary exemption to Parts 390 through 399 of t...

Siemens SNMP Implementation of WinCC Runtime

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SNMP Implementation of WinCC Runtime Vulnerability: Out-of-bounds Write 2. RISK EVALUATION Successful exploitation of this vulnerability could crash the SNMP service and require a...

Joint CISA-FBI Cybersecurity Advisory on DarkSide Ransomware

CISA and the Federal Bureau of Investigation FBI have released a Joint Cybersecurity Advisory CSA on a ransomware-as-a-service RaaS variant—referred to as DarkSide—recently used in a ransomware attack against a critical infrastructure CI company. Cybercriminal groups use DarkSide to gain access t...

Cisco Nexus 9000 Series Fabric Switches ACI Mode Fabric Infrastructure VLAN Unauthorized Access (cisco-sa-n9kaci-unauth-access-5PWzDx2w)

According to its self-reported version, the fabric infrastructure VLAN connection establishment of Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure ACI is affected by unauthorized access vulnerability due to insufficient security requirements during the Link Layer...

How a DDoS Attack on an Internet Service Provider Can Paralyze Critical Infrastructure

The motivation behind Distributed Denial of Service DDoS attacks is often unknown. In some cases it might be cyber-vandalism, causing disruption for disruption’s sake. In other cases it might be down to hactivism, reaction to a cause or an event. And while DDoS attacks on business enterprises can...

Colonial Pipeline’s Ransomware Attack Sparks Emergency Declaration

The Biden administration has declared a state of emergency that covers 17 states and Washington D.C. in the wake of the ransomware attack on the Colonial Pipeline Co., and is working with Colonial to restart operations. On Monday morning, FireEye also confirmed to Threatpost that it’s been called...

Lemon Duck Cryptojacking Botnet Changes Up Tactics

The Lemon Duck cryptocurrency-mining botnet has added the ProxyLogon group of exploits to its bag of tricks, targeting Microsoft Exchange servers. That’s according to researchers at Cisco Talos, who said that the cybercrime group behind Lemon Duck has also added the Cobalt Strike attack framework...

SQL Injection

odata4j-core is vulnerable to SQL injection. An attacker is able to modify or delete, causing persistent changes to the queries that the application makes to its database, mainly SQL, to compromise the underlying server or other back-end infrastructure...

Ransomware Cyber Attack Forced the Largest U.S. Fuel Pipeline to Shut Down

Colonial Pipeline, which carries 45% of the fuel consumed on the U.S. East Coast, on Saturday said it halted operations due to a ransomware attack, once again demonstrating how critical infrastructure is vulnerable to cyber attacks. "On May 7, the Colonial Pipeline Company learned it was the vict...

Command Execution Vulnerability in MIG 5.3 of Deepcore Technology Co.

DeepSign Technology Corporation is a provider of products, services and solutions focused on enterprise-class security, cloud computing and infrastructure. A command-and-execute vulnerability exists in MIG 5.3 of DeepService Technology Corporation, which can be exploited by an attacker to gain...

The Colonial Pipeline Hack Is a New Extreme for Ransomware

An attack has crippled the company’s operations—and cut off a large portion of the East Coast’s fuel supply—in an ominous development for critical infrastructure...

Security Bulletin: A security vulnerability in Node.js urijs module affects IBM Cloud Pak for Multicloud Management Infrastructure management.

Summary A security vulnerability in Node.js urijs module affects IBM Cloud Pak for Multicloud Management Infrastructure management. Vulnerability Details CVEID: CVE-2020-26291 DESCRIPTION: Node.js urijs module could allow a remote attacker to conduct spoofing attacks, caused by improper input...