Actively exploited 0-days in Ivanti VPN are letting hackers backdoor networks

Published

10 months ago

January 11, 2024

admin

UNAUTHENTICATED RCE THAT BYPASSES 2FA — Actively exploited 0-days in Ivanti VPN are letting hackers backdoor networks Organizations using Ivanti Connect Secure should take action at once.

Dan Goodin – Jan 10, 2024 10:18 pm UTC EnlargeGetty Images reader comments 7

Unknown threat actors are actively targeting two critical zero-day vulnerabilities that allow them to bypass two-factor authentication and execute malicious code inside networks that use a widely used virtual private network appliance sold by Ivanti, researchers said Wednesday.

Further ReadingMore US agencies potentially hacked, this time with Pulse Secure exploitsIvanti reported bare-bones details concerning the zero-days in posts published on Wednesday that urged customers to follow mitigation guidance immediately. Tracked as CVE-2023-846805 and CVE-2024-21887, they reside in Ivanti Connect Secure, a VPN appliance often abbreviated as ICS. Formerly known as Pulse Secure, the widely used VPN has harbored previous zero-days in recent years that came under widespread exploitation, in some cases to devastating effect. Exploiters: Start your engines

When combined, these two vulnerabilities make it trivial for attackers to run commands on the system, researchers from security firm Volexity wrote in a post summarizing their investigative findings of an attack that hit a customer last month. In this particular incident, the attacker leveraged these exploits to steal configuration data, modify existing files, download remote files, and reverse tunnel from the ICS VPN appliance. Researchers Matthew Meltzer, Robert Jan Mora, Sean Koessel, Steven Adair, and Thomas Lancaster went on to write:

Volexity observed the attacker modifying legitimate ICS components and making changes to the system to evade the ICS Integrity Checker Tool. Notably, Volexity observed the attacker backdooring a legitimate CGI file (compcheck.cgi) on the ICS VPN appliance to allow command execution. Further, the attacker also modified a JavaScript file used by the Web SSL VPN component of the device in order to keylog and exfiltrate credentials for users logging into it. The information and credentials collected by the attacker allowed them to pivot to a handful of systems internally, and ultimately gain unfettered access to systems on the network.

The researchers attributed the hacks to a threat actor tracked under the alias UTA0178, which they suspect is a Chinese nation-state-level threat actor. Advertisement

Like other VPNs, the ICS sits at the edge of a protected network and acts as the gatekeeper thats supposed to allow only authorized devices to connect remotely. That position and its always-on status make the appliance ideal for targeting when code-execution vulnerabilities in them are identified. So far, the zero-days appear to have been exploited in low numbers and only in highly targeted attacks, Volexity CEO Steven Adair said in an email. He went on to write:

However, there is a very good chance that could change. There will now be a potential race to compromise devices before mitigations are applied. It is also possible that the threat actor could share the exploit or that additional attackers will otherwise figure out the exploit. If you know the detailsthe exploit is quite trivial to pull off and it requires absolutely no authentication and can be done over the Internet. The entire purposes of these devices are to provide VPN access, so by nature they sit on the Internet and are accessible.

Further ReadingCasualties keep growing in this months mass exploitation of MOVEit 0-dayThe threat landscape of 2023 was dominated by the active mass exploitation of a handful of high-impact vulnerabilities tracked under the names Citrix Bleed or designations including CVE-2022-47966, CVE-2023-34362 and CVE-2023-49103, which resided in the Citrix NetScaler Application Delivery Controller and NetScaler Gateway, the MOVEit file-transfer service, and 24 wares sold by Zoho-owned ManageEngine and ownCloud, respectively. Unless affected organizations move more quickly than they did last year to patch their networks, the latest vulnerabilities in the Ivanti appliances may receive the same treatment.

Researcher Kevin Beaumont, who proposed Connect Around as a moniker for tracking the zero-days, posted results from a scan that showed there were roughly 15,000 affected Ivanti appliances around the world exposed to the Internet. Beaumont said that hackers backed by a nation-state appeared to be behind the attacks on the Ivanti-sold device. Enlarge / Map showing geographic location of ICS deployments, led by the US, Japan, Germany, France, and Canada.Shodan Page: 1 2 Next → reader comments 7 Dan Goodin Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Advertisement Channel Ars Technica ← Previous story Next story → Related Stories Today on Ars

World

Under siege in Ukraine, schools go underground to keep life as normal as possible for children

Published

40 mins ago

November 17, 2024

admin

Under siege in Ukraine, schools go underground to keep life as normal as possible for children

If you know a teacher, or you are a teacher, you’ll understand that many in the profession consider their jobs one of the best in the world, while also acknowledging it can be one of the most stressful.

Teaching in a war zone takes it to another level on both fronts.

But imagine teaching in a war zone in say the London Underground or the Paris or New York metros?

Follow latest: Ukraine live blog

Well, that’s exactly what is happening in Kharkiv, Ukraine’s second largest city – a city attacked by Russia on a constant basis.

In 2023, the authorities banned children from being taught in regular school buildings here because of the threat they were under from missile strikes.

So Kharkiv city and its education department started working on a plan.

That plan has concluded with the construction of six schools in six metro stations, teaching 4,800 children daily whose families haven’t fled the war.

Intrigued by this new educational experiment, as it’s still considered, we were told to meet at the University metro station in the centre of the city and wait to be taken to the school.

Soviet-era metro stations, and particularly the platforms, are universally grand and ornate, although Ukraine’s are slightly more modest.

Pedestrian walkways though are always crammed with florists, newspaper stands, mobile phone shops and cafes, and Kharkiv’s are no different.

What is different though is that next to the main platform entrance, an adjacent passageway has been sealed off by a white wall with three doors built into it.

We were ushered inside, past a guard and into a concourse with two desks.

In front of us, we could see a wide staircase leading to a long corridor. Above us, large, shiny silver metal tubes stretched into the distance, pumping in air from above ground.

Lining the corridor, we could see a series of white interconnecting cabins, all brightly lit, and from them, we could hear the sounds of children laughing, music, and teachers conducting class in this strange subterranean school.

Perhaps the only school in the world with one corridor.

A door to one of the classes opened, and in pairs, a class of six and seven-year-olds emerged – their teacher at the front and an assistant at the rear.

They’re heading to the bathroom for a toilet break, the staff must keep an eye on them.

If any of the children were to make it out of the school, they could easily get lost in the underground system.

The pupils are spread across seven classrooms with a mix of yellow and green desks and chairs, and walls decorated with bright pictures like rainbows, sunshine and sunflowers, to try to create a cheery atmosphere.

“At first, the children were bewildered by studying here, it felt unfamiliar to them, but interacting with each other and with their teachers helped them to adapt,” Iryna Tarasenko from Kharkiv’s education department told me.

Iryna is showing me around the school. They feel it’s their way of contributing to the war effort.

She said: “In the summer of 2023, the Defence Council didn’t permit children to study in regular school buildings, so, we had to find a solution. This is our frontline – our educational frontline.”

There are of course health concerns for both the teachers and the pupils spending so much time underground, so medical examinations are done on a regular basis.

It is an opportunity for doctors and behavioural specialists to monitor the effects of this war on them.

Dmytro Mitelyov is the neurologist on duty monitoring the children’s behaviour, checking for any signs of stress – physical and mental.

He gently asks each child how they’re feeling, and asks if they have any aches and pains.

“These are children who haven’t left Kharkiv since the war began, they live in a constant state of stress, multifaceted stress caused by a range of factors. They are exposed to things they see and hear, like alarms, explosions, and they feel it all,” Dmytro told me.

“When these children grow older, all the trauma they’ve endured during their formative years can, unfortunately, leave a lasting and serious imprint on their mental health. They haven’t had a healthy, carefree childhood – the kind where they can learn, play, and feel safe as children normally would.”

As the first group’s school day ends, children from one of Kharkiv’s most bombed districts, wrap up warm before being led to the surface to catch a school bus to their old school – which was hit by a missile.

It’s still where they meet their parents for normal pick-up.

👉 Listen to Sky News Daily on your podcast app 👈

We jump on the bus with them for the journey past destroyed government buildings, shopping centres and restaurants.

When the air raid suddenly sounds, I look around to see how the children and teachers on this bus will react.

They barely flinch it’s so common.

“People have, to some extent, adapted,” one of the headmistresses, Olena Nikolienko, said.

“If we see missiles coming, heaven forbid, we’ll stop near a designated shelter, following our evacuation plan, and that’s where the children will go for cover.”

Remember, these children are safe underground at school, up here they are not.

During the bus ride, 10-year-old Alisa began quietly sobbing. Her teacher told me her grandfather was killed four months ago on the frontline, and since then she has been prone to tears.

Alisa’s teacher comforted her and told her everything would be ok.

It feels like everyone here has to carry their own sadness.

Everyone.

Parents, standing in the first snowfall of the season, greet the children as they get off the bus.

The kids run off the bus, and start throwing snowballs at each other, enjoying this precious moment.

It will be the last time they’re outside today.

US

Xi Jinping says China is ‘ready to work’ with Donald Trump during last meeting with Joe Biden

Published

40 mins ago

November 17, 2024

admin

Xi Jinping says China is 'ready to work' with Donald Trump during last meeting with Joe Biden

Joe Biden has met with Xi Jinping for the last time as US president, where the Chinese leader said he is “ready to work” with Donald Trump.

Speaking at the Asia-Pacific Economic Cooperation forum in Lima, Peru, Mr Biden said the US and China’s relationship should be about “competition, not conflict”.

“We haven’t always agreed, but our conversations have always been candid and always been frank,” he said.

“We’ve never kidded one another. These conversations prevent miscalculations, and they ensure the competition between our two countries will not veer into conflict.

“We’ve been level with one another. I think that’s vital.”

Their last-ever meeting comes as president-elect Donald Trump vows to introduce blanket 60% tariffs on US imports of Chinese goods as part of a series of “America First” trade measures.

But despite Mr Trump’s proposed measures, Mr Xi said his country’s goal “of a stable, healthy and sustainable China-US relationship remains unchanged”.

“Our commitment to mutual respect, peaceful coexistence and… cooperation as principles for handling China-US relations remains unchanged,” he added.

The Chinese president then said the country is “ready to work with the new US administration to maintain communication, expand cooperation and manage differences, so as to strive for a steady transition”.

Neither Mr Xi nor Mr Biden responded to a question about whether there were concerns about Mr Trump’s proposed tariffs.

The president-elect has also named several China hawks to his transition team, such as Senator Marco Rubio as secretary of state and Representative Mike Waltz as national security adviser.

Under Mr Biden, Washington has introduced restrictions on US investment in Chinese artificial intelligence, quantum computing and semiconductors.

Former house speaker Nancy Pelosi also visited the island of Taiwan – which China views as a breakaway province – in April 2022.

In their meeting at this time last year – which followed a surge in tensions when an alleged Chinese spy balloon was shot down over the US – both leaders said direct communication between American and Chinese military forces would be restored.

US

Mike Tyson reveals he ‘almost died’ ahead of fight with YouTuber-turned-boxer Jake Paul

Published

40 mins ago

November 17, 2024

admin

Mike Tyson reveals he 'almost died' ahead of fight with YouTuber-turned-boxer Jake Paul

Former heavyweight champion Mike Tyson says the health scare in June, which forced the postponement of his boxing match with Jake Paul, almost cost him his life.

“I almost died in June,” Tyson wrote on X, adding that he “had 8 blood transfusions. Lost half my blood and 25lbs in hospital”.

The 58-year-old, who lost to the YouTuber-turned-boxer in a unanimous points decision in Texas, tweeted that the situation was far worse than people had realised.

Following Tyson’s recovery, after reportedly suffering an ulcer flareup, he reflected on the result of the fight.

“This is one of those situations when you lost but still won… no regrets to get in the ring one last time,” he said.

That contrasts with Tyson’s comments after the match in which he refused to confirm whether it would be his last fight.

“It depends on the situation,” Tyson said before suggesting a fight with Paul’s older brother, Logan Paul, who was standing near him in the ring.

Critics argued that the revised match – which involved fewer and shortened rounds, as well as heavier gloves – fell short of entertaining.

Some claimed it appeared more like a glorified sparring session.

It was Tyson’s first sanctioned pro bout since 2005, when he lost to Kevin McBride and then went into retirement – only briefly reappearing for an exhibition match in 2020 against Roy Jones Jr.

Paul has plenty to prove

Paul, 27, still has plenty to prove. The social media influencer wants to be a championship fighter and compete for a championship belt within two years. “I think it could happen in the next 24 months,” Paul said.

“I truly, truly believe in my skills and my ability and my power. And the cruiserweight division is seemingly open for the taking on that timeline,” he added.

The only professional match he has lost so far has been to Tommy Fury, the less-accomplished brother of former heavyweight champion Tyson Fury.

But there are questions about when Paul will fight a contender in his prime, as opposed to former champions or mixed martial artists.

Could Paul really take on Alvarez?

Intriguingly, in the days before his fight with Tyson, Paul mentioned super middleweight champion Canelo Alvarez, considered one of the best boxers in the world.

According to reports, the Texas bout earned Paul $40m (£31.7m) versus $20m (£15.8m) for Tyson.

Netflix said 60 million households worldwide viewed the contest on its streaming platform, and nearly 50 million tuned in to watch the undercard which saw Ireland’s Katie Taylor beat Puerto Rico’s Amanda Serrano.

Even so there were some technical glitches. More than 90,000 users reported problems on Netflix at its peak, according to the website Downdetector, which tracks outages.