Security Affairs

OCTOBER 8, 2023

Researchers warn that more than 70,000 Android smartphones, CTV boxes, and tablets were shipped with backdoored firmware as part of BADBOX network. Cybersecurity researchers at Human Security discovered a global network of consumer products, dubbed BADBOX, with firmware backdoors installed and sold through a compromised hardware supply chain.

Firmware 145

Firmware Mobile Malware Architecture 145

SecureList

JULY 25, 2022

One of the main draws towards malware nested in such low levels of the operating system is that it is extremely difficult to detect and, in the case of firmware rootkits, will ensure a computer remains in an infected state even if the operating system is reinstalled or the user replaces the machine’s hard drive entirely. Infrastructure.

Firmware 145

Firmware DNS Malware Internet 145

Security Affairs

JULY 25, 2022

Kaspersky uncovered a new UEFI firmware rootkit, tracked as CosmicStrand, which it attributes to an unknown Chinese-speaking threat actor. Researchers from Kaspersky have spotted a UEFI firmware rootkit, named CosmicStrand, which has been attributed to an unknown Chinese-speaking threat actor. ” concludes the report.

Firmware 100

Firmware Malware Hacking Information Security 100

Security Affairs

NOVEMBER 11, 2021

Ax with firmware 1.04b12 and earlier CVE-2016-1555 Netgear WN604 before 3.3.3 CVE-2017-6077 NETGEAR DGN2200 devices with firmware through 10.0.0.50 CVE-2020-9054 Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.2, Affected products include: NAS326 before firmware V5.21(AAZF.7)C0

IoT 142

IoT Firmware Malware Wireless 142

SC Magazine

JUNE 2, 2021

ReFirm provides drag-and-drop automated firmware analysis, which Microsoft hopes will provide security insight for industrial IoT products, where security personnel often struggle to look inside built-in hardware. ReFirm was founded in 2017 as an offshoot of the popular open-source Binwalk product. (Photo by Drew Angerer/Getty Images).

Firmware 77

Firmware IoT Technology Media 77

CyberSecurity Insiders

JULY 27, 2022

A novel malware named CosmicStrand is said to be targeting the old motherboards offered by Asus and Gigabyte and the crux is that it can survive operating system re-installs and it survives in Unified Extensible Firmware Interface (UEFIs) unlike just the storage drive.

Malware 129

Malware Firmware Antivirus Marketing 129

Security Affairs

AUGUST 31, 2020

Hackers target QNAP NAS devices running multiple firmware versions vulnerable to a remote code execution (RCE) flaw addressed by the vendor 3 years ago. QNAP addressed the vulnerability with the release of firmware version 4.3.3 on July 21, 2017. ” reads the report published by 360 Netlab. 0,” continues 360 Netlab.

Firmware 145

Firmware Advertising Malware Internet 145

Security Affairs

OCTOBER 5, 2020

The experts were investigating several suspicious UEFI firmware images when discovered four components, some of which were borrowing the source code a Hacking Team spyware. The firmware malware is based on code associated with HackingTeam’s VectorEDK bootkit, with minor changes. ” concludes the report.

Firmware 145

Firmware Spyware Surveillance Hacking 145

Security Affairs

AUGUST 16, 2024

Many Google Pixel devices shipped since September 2017 have included a vulnerable app that could be exploited for malicious purposes. Many Google Pixel devices shipped since September 2017 have included dormant software that could be exploited by attackers to compromise them. ” reads the report. ” reads the report.

Hacking 144

Hacking Firmware Mobile Penetration Testing 144

Security Affairs

AUGUST 11, 2023

A variant of the Gafgyt botnet is actively attempting to exploit a vulnerability, tracked as CVE-2017-18368 (CVSS v3: 9.8), impacting the end-of-life Zyxel P660HN-T1A router. The vulnerability impacts devices running firmware versions 7.3.15.0 Additionally, the P660HN-T1A running the latest generic firmware, version 3.40(BYF.11),

Firmware 98

Firmware Hacking Cybercrime Information Security 98

Security Affairs

JANUARY 15, 2021

Cisco announced it will no longer release firmware updates to fix 74 vulnerabilities affecting its RV routers, which reached end-of-life (EOL). Cisco will no longer release firmware updates to address 74 vulnerabilities affecting some of its RV routers that reached end-of-life (EOL). ” reads the advisory.

Small Business 126

Small Business Firmware Hacking Software 126

Security Affairs

JULY 28, 2020

The first campaign likely began in early 2014 and continued until mid-2017, while the second started in late 2018 and was still active in late 2019. The experts observed that once a device has been infected, the malicious code can prevent the installation of firmware updates.

Malware 143

Malware Firmware Advertising Manufacturing 143

Security Affairs

FEBRUARY 23, 2022

The group is also the author of the NotPetya ransomware that hit hundreds of companies worldwide in June 2017, causing billions worth of damage. “The actor has so far primarily deployed Cyclops Blink to WatchGuard devices, but it is likely that Sandworm would be capable of compiling the malware for other architectures and firmware.”

Malware 115

Malware Firmware Architecture Firewall 115

Malwarebytes

AUGUST 1, 2022

This web server is present in Arris firmware which can be found in several router models. Unfortunately the Arris firmware is based on the vulnerable version of muhttpd. In 2017 for example, experts discovered easily exploitable flaws in Arris modems distributed by AT&T. muhttpd web server. The muhttpd server 1.1.5

Firmware 145

Firmware Internet Internet Passwords 145

Security Affairs

JUNE 13, 2019

The company has already fixed the issues with the release of firmware versions 1.2.2.S0, “The industrial managed switch series 852 from WAGO is affected by multiple vulnerabilities such as old software components embedded in the firmware. The expert also found hardcoded private keys for the SSH daemon in the device’s firmware.

Firmware 101

Firmware Passwords Advertising IoT 101

SiteLock

AUGUST 27, 2021

Food and Drug Administration (FDA) announced an upgrade to the firmware installed on certain vulnerable cardiac devices. Tune in this week on Decoding Security as Security Analysts Jessica Ortega and Ramuel Gall discuss cybersecurity laws including Net Neutrality, Mainstreet Cybersecurity Act of 2017, and GDPR.

Hacking 98

Hacking Firmware Cybersecurity 98

Security Affairs

FEBRUARY 6, 2020

Below the attack chain that was visible in the video PoC: The attacker takes control over the smart bulb by exploiting a vulnerability in smart light bulbs in 2017. The bridge discovers the hacker-controlled bulb with updated firmware, and the user adds it back onto their network.

Hacking 143

Hacking IoT Wireless Firmware 143

Security Affairs

JANUARY 1, 2019

The group of researchers presented called “ wattet.fail ” firmware, side-channel, microcontroller and supply-chain attacks that impact most popular hardware-based cryptocurrency wallets, including Trezor One, Ledger Nano S, and Ledger Blue. Experts exploited a vulnerability in the Trezor One that was found in 2017 and patched by the vendor.

Cryptocurrency 111

Cryptocurrency Hacking Firmware Advertising 111

SecureList

OCTOBER 25, 2023

Subsequent analysis revealed earlier instances of suspicious code dating back to 2017. Importantly, our investigation, which considered binary timestamps, indicated that this exploit was created prior to April 2017. It is worth noting that the EternalBlue exploit was publicly disclosed by the Shadow Brokers group on April 14, 2017.

Malware 144

Malware DNS Encryption Cryptocurrency 144

eSecurity Planet

FEBRUARY 15, 2022

Update and patch operating systems, software, and firmware as soon as updates and patches are released. CVE-2017-8464 : The LNK Remote Code Execution Vulnerability is an RCE vulnerability in Microsoft Windows via crafted.LNK files, which attackers can exploit to gain local user rights on a victim’s system.

Ransomware 128

Ransomware Encryption Backups Accountability 128

Security Affairs

DECEMBER 22, 2022

includes several new flaws, including: Vulnerability Affected software CVE-2017-17105 Zivif PR115-204-P-RS CVE-2019-10655 Grandstream CVE-2020-25223 WebAdmin of Sophos SG UTM CVE-2021-42013 Apache CVE-2022-31137 Roxy-WI CVE-2022-33891 Apache Spark ZSL-2022-5717 MiniDVBLinux. “Since the release of Zerobot 1.1,

IoT 129

IoT DDOS Malware Firmware 129

Security Affairs

AUGUST 29, 2024

The vulnerability impacts Avtech AVM1203 IP cameras running firmware versions FullImg-1023-1007-1011-1009 and prior. The malware exploits several vulnerabilities, including CVE-2017-17215 in Huawei devices, using hard-coded command and control IPs. reads the advisory published by CISA.

Firmware 128

Firmware Malware Security Intelligence Authentication 128

Security Affairs

AUGUST 27, 2020

Example of available open printers on a single IoT search engine (Shodan.io): As we can see, many users and organizations still use internet-connected devices without thinking about security, installing firmware updates, or taking into account the implications of leaving their devices publicly accessible. Change the default password.

Hacking 145

Hacking IoT Firmware Internet 145

CyberSecurity Insiders

JUNE 25, 2021

Going with the technical terms, the vulnerability was impacting a feature called BIOS Connect that allows users to perform system recovery and update firmware by connecting the device BIOS setup with the backend servers of Dell on a remote node.

Risk 87

Risk Firmware DNS Cyber Risk 87

CyberSecurity Insiders

NOVEMBER 11, 2021

Ax with firmware 1.04b12 and earlier. CVE-2017-6077. NETGEAR DGN2200 devices with firmware through 10.0.0.50. Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.2, Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 7)C0 NAS520 before firmware V5.21(AASZ.3)C0

IoT 85

IoT Malware Firmware Authentication 85

Security Affairs

APRIL 2, 2022

The threat actors added TOTOLINK exploits just a week after the exploit codes were publicly released on GitHub in the attempt to compromise the largest number of devices as possible before the owners upgrade to the latest firmware releases. TOTOLINK has already addressed these flaws with the release of new firmware for vulnerable devices.

DDOS 98

DDOS Firmware Surveillance IoT 98

The Last Watchdog

SEPTEMBER 5, 2023

Then in 2017, clever attackers managed to compromise a smart thermometer in a fish tank, thereby gaining access to the high-roller database of a North American casino. The Mirai botnet, initially discovered in October 2016 , infected Internet-connected routers, cameras and digital video recorders at scale.

IoT 220

IoT Government Manufacturing Internet 220

eSecurity Planet

APRIL 28, 2022

Three of these vulnerabilities — CVE-2019-19781, CVE-2019-18935, and CVE-2017-11882 — were also routinely exploited in 2020. CVE-2017-11882. CVE-2017-0199. Vendor and Product. CVE-2021-42237. Sitecore XP. CVE-2021-35464. ForgeRock OpenAM server. CVE-2021-27104. CVE-2019-18935. Progress Telerik UI for ASP.NET AJAX. CVE-2018-0171.

Cybersecurity 113

Cybersecurity Software Firmware Internet 113

Security Affairs

APRIL 12, 2022

The group is also the author of the NotPetya ransomware that hit hundreds of companies worldwide in June 2017, causing billions worth of damage. The malware leverages the firmware update process to achieve persistence. Cyclops Blink is sophisticated malware with a modular structure.

Firmware 98

Firmware Malware Cybersecurity Hacking 98

Security Affairs

OCTOBER 27, 2018

” Back in December 2017, Apple apologized for slowing down older iPhones, the company introduced features, that impacted the iPhone 6, 6S, 7 and SE, to cope with aging batteries. . ” ” AGCM said in a statement. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Mobile 103

Mobile Firmware Advertising Software 103

Security Affairs

APRIL 16, 2021

Gafgyt also uses some of the existing exploits (CVE-2017-17215, CVE-2018-10561) to download the next stage payloads, which we will discuss further on. Figure 6: Huawei Exploit inside binary (CVE-2017-17215). Keep systems and firmware updated with the latest releases and patches. Some of the recent Gafgyt variants (e.g.,

DDOS 134

DDOS Malware IoT Firmware 134

Security Affairs

SEPTEMBER 20, 2020

“Once the attacker gains full access to the device through the botnet, the firmware level can be changed and additional malware can be planted on the device.” This is an extension understood by machines running reduced instruction set computer (RISC) architecture, which is prevalent on many IoT devices.”

IoT 145

IoT DDOS Architecture Passwords 145

Security Affairs

DECEMBER 11, 2018

Since its first discovery in August 2017, experts observed three variants of the exploit kit, including one involved in the DNSChanger system of a recent GhostDNS campaign. Currently, Novidade is used in different campaigns, experts believe it has been sold to multiple threat actors or its source code leaked.

DNS 111

DNS Firmware Advertising Banking 111

Security Affairs

JUNE 26, 2019

The only way to recover infected devices is to manually reinstall the device’s firmware. Silex is not the first IoT malware with this behavior, back in 2017 BrickerBot bricked millions of devices worldwide. It's trashing the storage, dropping the iptables rules, removing the network configuration and then halting the device.

IoT 111

IoT Malware Firmware Advertising 111

Security Affairs

MARCH 7, 2019

The campaign observed by Akamai in December tracked as EternalSilence, was targeting millions of machines living behind the vulnerable routers by leveraging the EternalBlue and EternalRed (CVE-2017-7494) exploits. allows attackers to cause a denial of service (DoS) • CVE-2017-1000494 , an uninitialized stack variable flaw in MiniUPnPd.

Cyber Attacks 107

Cyber Attacks Advertising Firmware Data collection 107

Security Affairs

DECEMBER 17, 2019

TP-Link addressed a critical zero-day vulnerability ( CVE-2017-7405 ) in its TP-Link Archer routers that could be exploited by attackers to remotely take their control over LAN via a Telnet connection without authentication. “This is a zero-day flaw that was not previously reported and can affect both home and business environments.”

Passwords 98

Passwords Firmware Advertising Authentication 98

Security Affairs

AUGUST 13, 2018

The affected models are NetComm 4G LTE Light industrial M2M routers running firmware version 2.0.29.11 Sood reported the flaws to the ICS-CERT in October 2017. NetComm has released a firmware update that addresses the security vulnerabilities in mid-May 2018.

Wireless 72

Wireless Firmware Manufacturing Advertising 72