Actively exploited 0-days in Ivanti VPN are letting hackers backdoor networks

Published

2 years ago

January 11, 2024

admin

UNAUTHENTICATED RCE THAT BYPASSES 2FA — Actively exploited 0-days in Ivanti VPN are letting hackers backdoor networks Organizations using Ivanti Connect Secure should take action at once.

Dan Goodin – Jan 10, 2024 10:18 pm UTC EnlargeGetty Images reader comments 7

Unknown threat actors are actively targeting two critical zero-day vulnerabilities that allow them to bypass two-factor authentication and execute malicious code inside networks that use a widely used virtual private network appliance sold by Ivanti, researchers said Wednesday.

Further ReadingMore US agencies potentially hacked, this time with Pulse Secure exploitsIvanti reported bare-bones details concerning the zero-days in posts published on Wednesday that urged customers to follow mitigation guidance immediately. Tracked as CVE-2023-846805 and CVE-2024-21887, they reside in Ivanti Connect Secure, a VPN appliance often abbreviated as ICS. Formerly known as Pulse Secure, the widely used VPN has harbored previous zero-days in recent years that came under widespread exploitation, in some cases to devastating effect. Exploiters: Start your engines

When combined, these two vulnerabilities make it trivial for attackers to run commands on the system, researchers from security firm Volexity wrote in a post summarizing their investigative findings of an attack that hit a customer last month. In this particular incident, the attacker leveraged these exploits to steal configuration data, modify existing files, download remote files, and reverse tunnel from the ICS VPN appliance. Researchers Matthew Meltzer, Robert Jan Mora, Sean Koessel, Steven Adair, and Thomas Lancaster went on to write:

Volexity observed the attacker modifying legitimate ICS components and making changes to the system to evade the ICS Integrity Checker Tool. Notably, Volexity observed the attacker backdooring a legitimate CGI file (compcheck.cgi) on the ICS VPN appliance to allow command execution. Further, the attacker also modified a JavaScript file used by the Web SSL VPN component of the device in order to keylog and exfiltrate credentials for users logging into it. The information and credentials collected by the attacker allowed them to pivot to a handful of systems internally, and ultimately gain unfettered access to systems on the network.

The researchers attributed the hacks to a threat actor tracked under the alias UTA0178, which they suspect is a Chinese nation-state-level threat actor. Advertisement

Like other VPNs, the ICS sits at the edge of a protected network and acts as the gatekeeper thats supposed to allow only authorized devices to connect remotely. That position and its always-on status make the appliance ideal for targeting when code-execution vulnerabilities in them are identified. So far, the zero-days appear to have been exploited in low numbers and only in highly targeted attacks, Volexity CEO Steven Adair said in an email. He went on to write:

However, there is a very good chance that could change. There will now be a potential race to compromise devices before mitigations are applied. It is also possible that the threat actor could share the exploit or that additional attackers will otherwise figure out the exploit. If you know the detailsthe exploit is quite trivial to pull off and it requires absolutely no authentication and can be done over the Internet. The entire purposes of these devices are to provide VPN access, so by nature they sit on the Internet and are accessible.

Further ReadingCasualties keep growing in this months mass exploitation of MOVEit 0-dayThe threat landscape of 2023 was dominated by the active mass exploitation of a handful of high-impact vulnerabilities tracked under the names Citrix Bleed or designations including CVE-2022-47966, CVE-2023-34362 and CVE-2023-49103, which resided in the Citrix NetScaler Application Delivery Controller and NetScaler Gateway, the MOVEit file-transfer service, and 24 wares sold by Zoho-owned ManageEngine and ownCloud, respectively. Unless affected organizations move more quickly than they did last year to patch their networks, the latest vulnerabilities in the Ivanti appliances may receive the same treatment.

Researcher Kevin Beaumont, who proposed Connect Around as a moniker for tracking the zero-days, posted results from a scan that showed there were roughly 15,000 affected Ivanti appliances around the world exposed to the Internet. Beaumont said that hackers backed by a nation-state appeared to be behind the attacks on the Ivanti-sold device. Enlarge / Map showing geographic location of ICS deployments, led by the US, Japan, Germany, France, and Canada.Shodan Page: 1 2 Next → reader comments 7 Dan Goodin Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Advertisement Channel Ars Technica ← Previous story Next story → Related Stories Today on Ars

World

Migrants locked up in notorious El Salvador jail released in Venezuela-US prisoner swap

Published

3 hours ago

July 20, 2025

admin

Migrants locked up in notorious El Salvador jail released in Venezuela-US prisoner swap

On Friday, Paola Paiva waited in a hotel near Caracas airport, nervous but giddy with excitement to be reunited with her brother, finally.

For five months, Arturo Suarez has been detained in a notorious prison in El Salvador.

“I am going to wait for my brother to call me,” she told Sky News, “and after giving him a hug, I want to just listen to him, listen to his voice. Let him talk and tell us his story.”

Suarez was one of the more than 250 Venezuelan migrants who had been living in America but were arrested in immigration raids by the Trump administration and sent to El Salvador, a showpiece act in the president’s promise to deport millions of migrants.

Most of the men had never even been to El Salvador before. Their detention has been controversial because the White House claims the men are all part of the dangerous Tren de Aragua gang but has provided little evidence to support this assertion.

The only evidence Paola had that Suarez was still alive was a picture of him published on a news website showing the inside of the maximum security CECOT jail.

He is one of dozens of men with their hands and feet cuffed, heads shaved and bodies shackled together.

Now he is returning to his home country, one of the bargaining chips in a deal that saw the release of ten Americans and US permanent residents who had been seized by the Venezuelan authorities.

Paola had tried to go to the airport to greet her brother as he disembarked a charter plane bringing the men back from El Salvador but authorities told her to wait at a nearby hotel.

“They told us they are taking them all to a hotel to rest,” she said.

“But I managed to get someone to give my phone number on a piece of paper to my brother, so I am expecting his call tomorrow, as soon as he can access a phone.

“We heard they are going to perform some medical exams on them and check their criminal records,” she added. “I’m not afraid; I’m not worried since my brother has a clean record.

“I am so happy. I knew this day would happen, and that it would be unexpected, that no one was going to notify us. I knew it was going to be a total surprise.”

The Trump administration had paid the El Salvador government, led by President Nayib Bukele, millions of dollars to imprison the men.

Homeland security secretary Kristi Noem visited CECOT last month, posing in front of prisoners for a photo opportunity.

But Cristosal, an international human rights group based in El Salvador, says it has “documented systematic physical beatings, torture, intentional denial of access to food, water, clothing, health care,” inside the prison.

A video which was seemingly filmed aboard the charter flight bringing the Venezuelan migrants back to Caracas shows Arturo briefly talking about his experience inside.

He looks physically well but speaks into the camera and says: “We were four months with no communication, no phone calls, kidnapped, we didn’t know what (the) day was, not even the time.

“We were beat up at breakfast, lunch and dinner,” he continues.

Sky News interviewed Arturo Suarez‘s brother Nelson near his home in the US in April, weeks after Arturo – an aspiring singer – had been arrested by immigration and customs enforcement (ICE) agents while filming a music video inside a house.

Nelson said he believed Arturo’s only crime was “being Venezuelan and having tattoos.” He showed me documents that indicate Arturo has no criminal record in Venezuela, Chile, Colombia or the United States, the four countries he has lived in.

Now Nelson is delighted Arturo is being released – but worries for his future.

“The only thing that casts a shadow in such a moment of joy is that bit of anger when I think that all the governments involved are going to use my brother’s story, and the others on that flight, as political gain,” he said.

“Each of them will tell a different story, making themselves the heroes, when the reality is that many innocent people suffered unfairly and unnecessarily, and many families will remain separated after this incident due to politics, immigration and fear.”

World

Ha Long Bay: At least 34 dead after tourist boat capsizes in Vietnam

Published

3 hours ago

July 20, 2025

admin

Ha Long Bay: At least 34 dead after tourist boat capsizes in Vietnam

At least 34 people have died after a tourist boat capsized in Vietnam, according to state media reports.

The Wonder Sea boat was reportedly carrying 53 people, including five crew members, when it capsized due to strong winds in Ha Long Bay on Saturday.

It happened at roughly 2pm local time (7am GMT). Rescue teams have found 11 survivors and recovered 34 bodies, eight of them children, the state-run Vietnam News Agency said, citing local authorities.

The People’s Army Newspaper, which cited local border guards, said authorities have not yet confirmed details about the tourists, including their nationalities, as the rescue operation continues.

Most of the passengers were tourists, including about 20 children, from the country’s capital city, Hanoi, the newspaper said.

The incident comes shortly after the arrival of Storm Wipha in the South China Sea, bringing strong winds, heavy rain and lightning to the area.

The named storm is the third typhoon to hit the South China Sea this year, and is expected to make landfall along the northern coast of Vietnam early next week.

Disruptions linked to the storm have also had an impact on air travel, according to Noi Bai Airport.

The airport reported that nine incoming flights were diverted to other airports, while three outgoing flights were temporarily grounded due to adverse weather conditions.

The winds brought by Storm Wipha reached up to 63mph (101kmph) and gusts of up to 68mph (126kmph) as it passed south of Taiwan on Saturday, according to the island’s Central News Agency.

Ha Long Bay is around 125mi (200km) north east of Hanoi and attracts tens of thousands of visitors each year.

Of those who visit Ha Long Bay, many choose to take overnight boat tours to further explore the area.

World

Gaza: More than 30 people killed ‘as Israeli troops open fire towards Palestinians waiting for aid’

Published

3 hours ago

July 20, 2025

admin

Gaza: More than 30 people killed 'as Israeli troops open fire towards Palestinians waiting for aid'

More than 30 people have been killed after Israeli troops opened fire towards crowds of Palestinians waiting for aid, according to witnesses and hospital officials.

The deaths occurred near distribution hubs operated by the US-Israeli-backed Gaza Humanitarian Foundation (GHF), which began distributing food packages in Gaza at the end of May, after Israel eased its 11-week blockade of aid into the territory.

At least 32 people were killed on Saturday, according to the Hamas-run Gaza health ministry, while a further 100 people were injured, according to local reports.

Most of the deaths came as Palestinians massed in the Teina area, around 3km (2 miles) away from a GHF aid distribution centre east of the city of Khan Younis.

Mahmoud Mokeimar said he was walking with crowds of people – mostly young men – towards the food hub when troops fired warning shots as the crowd advanced, before opening fire towards the marching people.

“It was a massacre… the occupation opened fire at us indiscriminately,” he said.

Akram Aker said troops fired machine guns mounted on tanks and drones.

“They encircled us and started firing directly at us,” he said.

The Nasser Hospital in Khan Younis said it received 25 bodies, along with dozens of wounded.

Seven other people, including one woman, were killed in the Shakoush area, hundreds of yards north of another GHF hub in Gaza’s southernmost city of Rafah, the hospital said.

The army and GHF did not immediately comment on Saturday’s violence.

The GFH, which has four distribution centres, three of which are in the southern Gaza Strip, says it has distributed millions of meals to hungry Palestinians.

But local health officials and witnesses say hundreds of people have been killed by Israeli army fire as they try to reach the distribution hubs.

The GHF, which employs private armed guards, says there have been no deadly shootings at its sites, though this week, 20 people were killed at one of its locations, most of them in a stampede.

The group accused Hamas agitators of causing a panic, but gave no evidence to back the claim.

The army, which is not at the sites but secures them from a distance, says it only fires warning shots if crowds get too close to its forces.

The 21-month war in Gaza was triggered when Hamas militants stormed into southern Israel on 7 October 2023, killing 1,200 people and taking 250 others hostage.

An Israeli military offensive has killed more than 58,000 Palestinians, according to the Gaza health ministry, while Gaza’s more than two million Palestinians are living through a catastrophic humanitarian crisis.

Israel and Hamas have been holding ceasefire talks in Qatar in recent weeks, but international mediators say there have been no breakthroughs.

US President Donald Trump said another 10 hostages will be released from Gaza shortly, without providing details.