Security Affairs

OCTOBER 5, 2020

The experts are monitoring the Mirai-based botnet since November 2019 and observed it exploiting two Tenda router 0-day vulnerabilities to spread a Remote Access Trojan (RAT). ” When the botnet was first detected in 2019, experts noticed it was exploiting the Tenda zero-day flaw tracked as CVE-2020-10987.

IoT 140

IoT Firmware DNS Advertising 140

Krebs on Security

APRIL 26, 2019

iLnkP2p is bundled with millions of Internet of Things (IoT) devices, including security cameras and Webcams, baby monitors, smart doorbells, and digital video recorders. “In reality, enumeration of these prefixes has shown that the number of online devices was ~1,517,260 in March 2019.

IoT 258

IoT Firewall Manufacturing Computers and Electronics 258

Security Affairs

JULY 28, 2020

In November 2019, security experts first spotted the QSnatch malware that at the time infected thousands of QNAP NAS devices worldwide. Weitere Informationen von unseren Kollegen bei @CERTFI : [link] — CERT-Bund (@certbund) October 31, 2019. Webshell functionality for remote access. ” reads the alert.

Malware 106

Malware Firmware Advertising Manufacturing 106

Security Affairs

MARCH 31, 2022

The three flaws reported by the cybersecurity firm are: An authentication bypass tracked CVE-2019-9564 A stack-based buffer overflow, tracked as CVE-2019-12266 , which could lead to remote control execution. A remote attacker could exploit the CVE-2019-9564 flaw to take over the device, including turning on/off the camera.

IoT 80

IoT Firmware Marketing Authentication 80

Malwarebytes

FEBRUARY 24, 2022

Cyclops Blink has been found in WatchGuard’s firewall devices since at least June 2019. But the NCSC warns that it is likely that Sandworm is capable of compiling the same or very similar malware for other architectures and firmware. Internet access to the management interface of any device is a security risk.

Malware 145

Malware Firewall Firmware DDOS 145

Security Affairs

FEBRUARY 3, 2020

L inear eMerge E3 smart building access systems designed by N ortek Security & Control (NSC) are affected by a severe vulnerability (CVE-2019-7256) that has yet to be fixed and attackers are actively scanning the internet for vulnerable devices. CVE-2019-7256 is actively being exploited by DDoS botnet operators.

DDOS 83

DDOS Hacking Internet Internet 83

Security Affairs

MARCH 23, 2020

According to the Chinese security firm Qihoo 360’s Netlab team, operators of several botnets , including Chalubo , FBot , and Moobot , targeting LILIN DVRs at least since August 30, 2019. The new firmware released by the vendors validated the hostname passed as input to prevent command execution. ” Netlab concludes.

Firmware 107

Firmware Surveillance Manufacturing Advertising 107

eSecurity Planet

APRIL 28, 2022

Malicious actors tend to focus on internet-facing systems to gain entry into a network, such as email and virtual private network (VPN) servers, using exploits targeting newly disclosed vulnerabilities. CVE-2019-11510. CVE-2019-19781. CVE-2019-18935. Also read: Best Patch Management Software & Tools. “U.S.,

Cybersecurity 106

Cybersecurity Software Firmware Internet 106

Security Affairs

AUGUST 10, 2021

The eCh0raix ransomware has been active since at least 2019, when eExperts from security firms Intezer and Anomali separately discovered sample of the ransomware targeting Network Attached Storage (NAS) devices. Independent experts observed a surge in eCh0raix ransomware infection reports between April 19 and April 26.

Ransomware 125

Ransomware Encryption Firmware Passwords 125

Malwarebytes

JULY 15, 2021

The exploitation targets a known vulnerability that has been patched in newer versions of SonicWall firmware. x versions of the firmware. x firmware. x firmware versions. The notice mentions the following products along with recommended actions: SRA 4600/1600 (EOL 2019) disconnect immediately and reset passwords.

Ransomware 80

Ransomware Firmware VPN Firewall 80

Security Affairs

AUGUST 13, 2023

To overcome the user authentication, we used a known vulnerability, CVE-2019-9013 , which allows us to perform a replay attack against the PLC using the unsecured username and password’s hash that were sent during the sign-in process , allowing us to bypass the user authentication process.” ” continues the report.

Authentication 92

Authentication Firmware Hacking Passwords 92

Security Affairs

FEBRUARY 15, 2020

These issues usually occur due to some improper synchronization between user code and the SDK firmware distributed by the SoC vendor, Security Bypass : Vulnerabilities that could be exploited by attackers in radio range to bypass the latest secure pairing mode of BLE. 2.60 (CVE-2019-16336) and NXP KW41Z 3.40 SDK (CVE-2019-17519).

IoT 112

IoT Firmware Advertising Hacking 112

Security Affairs

DECEMBER 22, 2022

Microsoft Threat Intelligence Center (MSTIC) researchers discovered a new variant of the Zerobot botnet (aka ZeroStresser) that was improved with the capabilities to target more Internet of Things (IoT) devices. Maintain device health with updates: Make sure devices are up to date with the latest firmware and patches.

IoT 114

IoT DDOS Malware Firmware 114

Security Affairs

APRIL 4, 2019

Firmware updates that address this vulnerability are not currently available. The first one could be exploited by a remote and unauthenticated attacker with admin privileges to obtain sensitive information ( CVE-2019-1653 ), while the second one can be exploited for command injection ( CVE-2019-1652 ). through 1.4.2.20.

Small Business 80

Small Business Firmware Advertising VPN 80

Security Affairs

OCTOBER 7, 2019

Security experts at Fortinet’s FortiGuard Labs disclosed a remote code execution vulnerability tracked as CVE-2019-16920. The vulnerability is an unauthenticated command injection issue that was discovered on September 2019. The flaw has received a CVSS v31 base score of 9.8 and a CVSS v20 base score of 10.0.

Authentication 98

Authentication Firmware Advertising Hacking 98

CyberSecurity Insiders

NOVEMBER 11, 2021

Ax with firmware 1.04b12 and earlier. NETGEAR DGN2200 devices with firmware through 10.0.0.50. CVE-2019-19824. Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.2, Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 7)C0 NAS520 before firmware V5.21(AASZ.3)C0

Malware 85

Malware IoT Firmware Authentication 85

Security Affairs

SEPTEMBER 9, 2019

In May, the Department of Energy confirmed that on March 5, 2019, between 9 a.m. “Have as few internet facing devices as possible,” NERC urged in its report.” “ After seeing no adverse effects, the entity deployed the firmware patch at an operational generation site that night.” and 7 p.m.,

Energy and Utilities 85

Energy and Utilities Firewall Firmware Advertising 85

Security Affairs

NOVEMBER 1, 2021

The number of infected devices is impressive, on 2019-11-30 a trusted security partner in the US informed Qihoo 360’s Netlab Cybersecurity reported to have observed 1,962,308 unique daily active IPs from the Pink botnet targeting its systems. According to the experts, Pink is the largest botnet they have observed in the last six years.

Architecture 126

Architecture DDOS Advertising DNS 126

Security Affairs

AUGUST 20, 2021

Mozi is an IoT botnet that borrows the code from Mirai variants and the Gafgyt malware , it appeared on the threat landscape in late 2019. According to the researchers, in the last months of 2019, the botnet was mainly involved in DDoS attacks. Follow me on Twitter: @securityaffairs and Facebook. Pierluigi Paganini.

IoT 103

IoT DNS Manufacturing Firmware 103

Security Affairs

MARCH 30, 2019

The first one could be exploited by a remote and unauthenticated attacker with admin privileges to obtain sensitive information ( CVE-2019-1653 ), while the second one can be exploited for command injection ( CVE-2019-1652 ). Firmware updates that address this vulnerability are not currently available.

Small Business 75

Small Business Firmware Advertising Engineering 75

Security Affairs

SEPTEMBER 20, 2020

The Mozi botnet accounted for 90% of the IoT network traffic observed between October 2019 and June 2020, IBM reported. Mozi is an IoT botnet that borrows the code from Mirai variants and the Gafgyt malware , it appeared on the threat landscape in late 2019. ” continues the analysis.

IoT 129

IoT DDOS Architecture Passwords 129

eSecurity Planet

APRIL 5, 2023

Tens of thousands of new security vulnerabilities are discovered each year; the value of CISA’s KEV catalog is that it helps organizations prioritize the software and firmware flaws that threat groups are actively exploiting — and many of those exploited flaws are older ones that users have failed to apply patches for.

Ransomware 106

Ransomware Cybersecurity Firmware Healthcare 106

Security Affairs

SEPTEMBER 10, 2019

The vulnerabilities have been tracked as CVE-2019-13473 and CVE-2019-13474. . The hardware of the terminals is equipped with Shenzen technology, while the firmware is based on BusyBox Linux Debian. . The devices have httpd web server , Web GUI, Wifi, or Bluetooth on board. ” continues the experts.

IoT 87

IoT Hacking Firmware Advertising 87

SecureList

JANUARY 20, 2022

At the end of 2021, we were made aware of a UEFI firmware-level compromise through logs from our Firmware Scanner , which has been integrated into Kaspersky products since the beginning of 2019. This one is made up of implants found in the UEFI firmware within the SPI flash, a non-volatile storage external to the hard drive.

Firmware 144

Firmware Malware Encryption Passwords 144

Security Affairs

APRIL 2, 2021

The threat actors are actively exploiting the following vulnerabilities in Fortinet FortiOS: CVE-2018-13379 ; CVE-2020-12812 ; CVE-2019-5591. In March 2021, government experts observed state sponsored hackers scanning the internet for servers vulnerable to the above flaws, the attackers were probing systems on ports 4443, 8443, and 10443.

Passwords 67

Passwords Government Firmware Accountability 67

Security Affairs

FEBRUARY 6, 2020

The bridge discovers the hacker-controlled bulb with updated firmware, and the user adds it back onto their network. ” Check Point reported the issue to Philips and Signify (owner of the Philips Hue brand) in November 2019. The company released firmware p atches for the device in January.

Hacking 121

Hacking IoT Wireless Firmware 121

Security Affairs

APRIL 25, 2019

The vulnerabilyt was tracked as CVE-2019-10955 and received a CVSS score of 7.1 Rockwell has released firmware updates that address the vulnerability for the affected controllers. Minimize network exposure for all control system devices and/or systems, and ensure that they are not accessible from the Internet.

Firmware 74

Firmware Social Engineering Advertising Malware 74

Security Affairs

JULY 13, 2019

In April 2019, experts at Bad Packets uncovered a new wave of attacks mainly aimed at compromising D-Link routers, many of them hosted belonging to Brazilian users. . According to Avast, in the first half of 2019, hackers have modified the DNS settings of over 180,000 Brazilian routers with even more complex attacks. concludes Avast.

DNS 75

DNS Passwords Advertising Banking 75

Security Affairs

MAY 19, 2020

which is a product that became end-of-life (EOL) in 2015 and end-of-support-life (EOSL) in 2019.” “There is no evidence to support any other firmware versions are vulnerable at this point in time and these findings have been shared with Symantec.” ” reads the analysis published by Palo Alto Networks.

IoT 109

IoT DDOS Authentication Firmware 109

Google Security

JULY 15, 2021

Certificate Transparency is a great example of a non-blockchain use of these verifiable data structures at scale to secure core internet infrastructure. To this end, in 2019, we used this platform to bring supply chain integrity to the Go language ecosystem via the Go Checksum Database.

Firmware 95

Firmware Accountability Software Financial Services 95

Security Affairs

APRIL 6, 2022

“The operation copied and removed malware from vulnerable internet-connected firewall devices that Sandworm used for command and control (C2) of the underlying botnet.” The malware leverages the firmware update process to achieve persistence. ” reads the press release published by DoJ.

Malware 84

Malware Government Firmware Firewall 84

eSecurity Planet

JANUARY 20, 2022

Incidents of malware targeting Linux-based Internet of Things (IoT) devices jumped by more than a third in 2021, with three malware families the primary drivers behind the increase. However, with more than 30 billion IoT devices expected to be connected to the internet by 2026, attacks against them can have wide-ranging impacts.

IoT 133

IoT DDOS Malware Internet 133

Troy Hunt

NOVEMBER 23, 2020

Let's drill into all that and then go deeper into custom firmware and soldering too. I can easily block a device from talking to the internet, throttle its connection, see which online services it's communicating with and access a whole host of other information about it. Why is this so hard?!

Firmware 342

Firmware IoT Wireless Manufacturing 342

SecureList

JULY 19, 2023

While the threat actor infrastructure might request Net-NTLMv2 authentication, Windows will honor the defined internet security zones and will not send (leak) Net-NTLMv2 hashes. msg VT First Submission 2022-10-25 10:00:00 UTC UNC path 168.205.200.55test (reminder time set to 2019-02-17 19:00) Sent by: 168.205.200.55 No Info 61.14.68[.]33

Firmware 85

Firmware Internet Internet Government 85

Security Affairs

JULY 31, 2019

The most severe vulnerability, tracked as CVE-2019-7670, is an OS command injection flaw. Another issue, tracked as CVE-2019-7669, is an improper validation of file extensions when uploading files that was rated as CVSS score of 9.1. Another critical issue, tracked as CVE-2019-7672, received a CVSS score of 8.8.

Backups 58

Backups Authentication Advertising Firmware 58

Kali Linux

FEBRUARY 27, 2024

For anyone interested in Internet infrastructure, we encourage you to read it, that’s a well-written blog post right there, waiting for you. We are lucky to benefit from a very generous sponsorship from Cloudflare since 2019. the Fremont Cabal Internet Exchange. So what is the Micro Mirror CDN exactly?

Software 145

Software Firmware VPN Internet 145

SecureList

JULY 6, 2022

As a rule, this means that the source code of the device’s firmware is unavailable and all the researcher can use is the user manual and a few threads on some user forum discussing the device’s operation. The vulnerability assessment of IoT/IIoT devices is based on analyzing their firmware.

Firmware 90

Firmware IoT Architecture Manufacturing 90