2022, Blog and Firmware - Cyber Security Informer

QNAP firmware updates fix Apache HTTP vulnerabilities in its NAS

Security Affairs

APRIL 22, 2022

Taiwanese vendor QNAP warns users to update their NAS Firmware to fix Apache HTTP flaws addressed in the Apache HTTP server last month. Taiwanese vendor QNAP warns users to update their NAS Firmware to address Apache HTTP vulnerabilities, tracked as CVE-2022-22721 and CVE-2022-23943 , addressed in the Apache HTTP server in March.

Firmware

Firmware Hacking Cybersecurity Internet

Conti leaked chats confirm that the gang’s ability to conduct firmware-based attacks

Security Affairs

JUNE 2, 2022

The analysis of the internal chats of the Conti ransomware group revealed the gang was working on firmware attack techniques. The analysis of Conti group’s chats , which were leaked earlier this year, revealed that the ransomware gang has been working on firmware attack techniques. ” reads the post published by Eclypsium.

Firmware

Firmware Engineering Ransomware Malware

CosmicStrand: the discovery of a sophisticated UEFI firmware rootkit

SecureList

JULY 25, 2022

In our APT predictions for 2022 , we noted that despite these risks, we expected more attackers to reach the sophistication level required to develop such tools. In this report, we present a UEFI firmware rootkit that we called CosmicStrand and attribute to an unknown Chinese-speaking threat actor. Affected devices. Conclusions.

Firmware

Firmware DNS Malware Technology

Webinars

Reimagining Cybersecurity Training: Driving Real Impact on Security Culture

MORE WEBINARS

Zyxel fixed a critical RCE flaw in its firewall devices and urges customers to install the patches

Security Affairs

APRIL 28, 2023

The vulnerability is an improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.50

Firewall

Firewall Firmware VPN Authentication

CISA adds CVE-2022-30525 flaw in Zyxel Firewalls to its Known Exploited Vulnerabilities Catalog

Security Affairs

MAY 17, 2022

US Critical Infrastructure Security Agency (CISA) adds critical CVE-2022-30525 RCE flaw in Zyxel Firewalls to its Known Exploited Vulnerabilities Catalog. Last week, Zyxel has addressed the critical CVE-2022-30525 (CVSS score: 9.8) If possible, enable automatic firmware updates. Commands are executed as the nobody user.”

Firewall

Firewall VPN Firmware Internet

Ransomware: April 2022 review

Malwarebytes

MAY 6, 2022

April 2022 was most notable for the emergence of three new ransomware-as-a-service ( RaaS ) groups— Onyx , Mindware , and Black Basta —as well as the unwelcome return of REvil , one of the world’s most notorious and dangerous ransomware operations. Ransomware attacks in April 2022. Known ransomware attacks in April 2022 by country.

Ransomware

Ransomware Encryption Accountability Technology

HP would take up to 90 days to fix a critical bug in some business-grade printers

Security Affairs

APRIL 5, 2023

HP would take up to 90 days to address a critical flaw, tracked as CVE-2023-1707, that resides in the firmware of some business-grade printers. The company pointed out that the information disclosure can be achieved only by exploiting the flaw on vulnerable devices running FutureSmart firmware version 5.6 and having IPsec enabled.

Firmware

Firmware Education Media Hacking

Expert found Backdoor credentials in ZyXEL LTE3301 M209

Security Affairs

DECEMBER 24, 2022

Security researcher ReSolver announced the discovery of hardcoded credentials (CVE-2022-40602) in ZyXEL LTE3301-M209 LTE indoor routers. “The firmware is basically a merge of 3 sections, the LZMA section is the kernel, at 0x148CD6 the root-fs and at 0x90BD36 the www content.” 13 Sep 2022: Details sent to ZyXEL.

Firmware

Firmware Passwords Hacking Cybersecurity

Cisco EoL SPA112 2-Port Phone Adapters are affected by critical RCE

Security Affairs

MAY 4, 2023

In order to exploit the flaw, an attacker has to upgrade an affected device to a crafted version of the firmware. “This vulnerability is due to a missing authentication process within the firmware upgrade function.” “Cisco has not released firmware updates to address this vulnerability.

Firmware

Firmware Education Media Authentication

Corsair Bug in Keyboard Causes Typing Without User’s Consent

Heimadal Security

DECEMBER 22, 2022

A firmware bug in Corsair’s K100 keyboards, rather than malware, is causing previously entered text to be auto-typed into applications days later. Initially reported on the Corsair forums in August 2022, the behavior left people puzzled and concerned that some form of keylogging or […].

Firmware

Firmware Malware Cybersecurity

TP-Link High-Severity Flaw Added to Mirai Botnet Arsenal

Heimadal Security

APRIL 27, 2023

The flaw in the TP-Link Archer AX21 firmware was discovered back in December 2022, and the company released a patch in March.

Firmware

Firmware DDOS IoT Cybersecurity

D-Link fixes two critical flaws in D-View 8 network management suite

Security Affairs

MAY 25, 2023

The vulnerabilities were reported to the company on December 23, 2022 through Trend Micro’s Zero Day Initiative (ZDI). “Please note that this is a device beta software, beta firmware, or hot-fix release which is still undergoing final testing before its official release. ” We are in the final!

Firmware

Firmware Authentication Software Hacking

HID Mercury Access Controller flaws could allow to unlock Doors

Security Affairs

JUNE 12, 2022

By using the manufacturer’s built-in ports, we were able to manipulate on-board components and interact with the device.Combining both known and novel techniques, we were able to achieve root access to the device’s operating system and pull its firmware for emulation and vulnerability discovery.” Overall 4.8. Overall 4.8.

Firmware

Firmware Penetration Testing Manufacturing Authentication

Zyxel fixed firewall unauthenticated remote command injection issue

Security Affairs

MAY 13, 2022

Zyxel has moved to address a critical security vulnerability (CVE-2022-30525, CVSS score: 9.8) Zyxel silently addressed the flaw by releasing security updates on April 28, 2022, Rapid7 pointed out that this choice leaves defenders in the dark and only advantage the attackers. If possible, enable automatic firmware updates.

Firewall

Firewall Firmware VPN Wireless

Experts show how to run malware on chips of a turned-off iPhone

Security Affairs

MAY 16, 2022

Researchers devised an attack technique to tamper the firmware and execute a malware onto a Bluetooth chip when an iPhone is “off.” Unlike NFC and UWB chips, the Bluetooth firmware is neither signed nor encrypted opening the doors to modification. To nominate, please visit:?

Malware

Malware Wireless Firmware Mobile

Vulnerabilities in the iBoot Power Distribution Unit Let Hackers Remotely Shut Down Devices

Hacker Combat

SEPTEMBER 22, 2022

CVE-2022-3183 through CVE-2022-3189 are the CVE identifiers given to the seven vulnerabilities. A blog article from Claroty outlines the more critical vulnerabilities. The vendor has released firmware version 1.42.06162022 to address the problem.

Firmware

Firmware Firewall Manufacturing Internet

Expert found Backdoor credentials in ZyXEL LTE3301 M209

Security Affairs

DECEMBER 24, 2022

Security researcher ReSolver announced the discovery of hardcoded credentials (CVE-2022-40602) in ZyXEL LTE3301-M209 LTE indoor routers. “The firmware is basically a merge of 3 sections, the LZMA section is the kernel, at 0x148CD6 the root-fs and at 0x90BD36 the www content.” 13 Sep 2022: Details sent to ZyXEL.

Firmware

Firmware Passwords Hacking Cybersecurity

Cyber Threats to the FIFA World Cup Qatar 2022

Digital Shadows

NOVEMBER 10, 2022

Sporting events, like the upcoming FIFA World Cup Qatar 2022 (Qatar 2022 World Cup), attract massive attention from every corner of the world. After triaging said incidents to remove false positives, we collected the true positive incidents to analyze them and better comprehend how attackers were targeting the Qatar 2022 World Cup.

Cyber threats

Cyber threats Media Social Engineering Mobile

Experts share details of five flaws that can be chained to hack Netgear RAX30 Routers

Security Affairs

MAY 11, 2023

.” The vulnerabilities, tracked as CVE-2023-27357 , CVE-2023-27367 , CVE-2023-27368 , CVE-2023-27369 , CVE-2023-27370 , were demonstrated by Claroty researchers during the 2022 Pwn2Own Toronto hacking contest as part of an exploit. “NETGEAR strongly recommends that you download the latest firmware as soon as possible.”

Hacking

Hacking Firmware Authentication DNS

Synology and QNAP warn of critical Netatalk flaws in some of their products

Security Affairs

MAY 1, 2022

Critical Ongoing VS Firmware 2.3 Synology also warns customers of other three flaws, tracked as CVE-2022-23125 , CVE-2022-23122 , CVE-2022-0194 that could allow remote attackers to run arbitrary code on affected devices. Synology products affected by the flaw are: Product Severity Fixed Release Availability DSM 7.1

Firmware

Firmware Hacking Cybersecurity Internet

A new Mirai botnet variant targets TP-Link Archer A21

Security Affairs

APRIL 25, 2023

The vulnerability was first reported to ZDI during the Pwn2Own Toronto 2022 event. In March, TP-Link released a firmware update to address multiple issues, including this vulnerability. A remote attacker can trigger the issue to inject commands that should be executed on the device.

DDOS

DDOS Engineering Firmware Architecture

ESET warns of three flaws that affect over 100 Lenovo notebook models

Security Affairs

APRIL 19, 2022

Lenovo warns of vulnerabilities in its Unified Extensible Firmware Interface (UEFI) shipped with at least 100 notebook models. The vulnerabilities affecting the Lenovo UEFI result from the use of two UEFI firmware drivers, named SecureBackDoor and SecureBackDoorPeim respectively. ” reads the advisory published by Lenovo.

Firmware

Firmware Manufacturing Hacking Cybersecurity

MSI confirms security breach after Money Message ransomware attack

Security Affairs

APRIL 7, 2023

MSI is urging users to obtain firmware/BIOS updates only from its official website fearing that threat actors could circulate malware-laced versions of the company’s BIOS. In response to the incident, the company announced it is enhancing the information security control measures of its network and infrastructure.

Ransomware

Ransomware Firmware Hacking Manufacturing

Google TAG shares details about exploit chains used to install commercial spyware

Security Affairs

MARCH 29, 2023

The first campaign was spotted in November 2022, the exploit chains discovered by TAG researchers were affecting Android and iOS and were delivered via bit.ly The initial landing page was observed hosting the exploits for a WebKit remote code execution zero-day ( CVE-2022-42856 ) and a sandbox escape ( CVE-2021-30900 ) issue.

Spyware

Spyware Surveillance Firmware Internet

A new wave of DeadBolt Ransomware attacks hit QNAP NAS devices ?

Security Affairs

MARCH 22, 2022

At the end of January, QNAP forced the firmware update for its Network Attached Storage (NAS) devices to protect its customers against the DeadBolt ransomware. “At its peak on January 26th, 2022, Censys observed 4,988 Deadbolt-infected services out of the 130,000 QNAP devices currently on the internet.

Ransomware

Ransomware Firmware Internet Internet

Security Affairs newsletter Round 368 by Pierluigi Paganini

Security Affairs

JUNE 5, 2022

Security Affairs is one of the finalists for the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS. sections “The Underdogs – Best Personal (non-commercial) Security Blog” and “The Tech Whizz – Best Technical Blog”) To nominate, please visit:? Follow me on Twitter: @securityaffairs and Facebook.

Spyware

Spyware Firmware Ransomware Scams

CISA adds WatchGuard flaw to its Known Exploited Vulnerabilities Catalog

Security Affairs

APRIL 12, 2022

CISA added the CVE-2022-23176 flaw in WatchGuard Firebox and XTM appliances to its Known Exploited Vulnerabilities Catalog. Cybersecurity and Infrastructure Security Agency (CISA) added the CVE-2022-23176 flaw in WatchGuard Firebox and XTM appliances to its Known Exploited Vulnerabilities Catalog.

Firmware

Firmware Malware Cybersecurity Hacking

Russia-linked APT28 compromised Ubiquiti EdgeRouters to facilitate cyber operations

Security Affairs

FEBRUARY 28, 2024

“As early as 2022, APT28 actors had utilized compromised EdgeRouters to facilitate covert cyber operations against governments, militaries, and organizations around the world.” Since September 2022, Moobot botnet was spotted targeting vulnerable D-Link routers. Upgrade to the latest firmware version.

Energy and Utilities

Energy and Utilities Government Firewall Malware

Security Affairs newsletter Round 362 by Pierluigi Paganini

Security Affairs

APRIL 24, 2022

Please vote for Security Affairs as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS Vote for me in the sections “The Underdogs – Best Personal (non-commercial) Security Blog” and “The Tech Whizz – Best Technical Blog” and others of your choice.

Cyber Insurance

Cyber Insurance Spyware Firmware Insurance

QNAP warns of a new wave of DeadBolt ransomware attacks against its NAS devices

Security Affairs

MAY 20, 2022

At the end of January, QNAP forced the firmware update for its Network Attached Storage (NAS) devices to protect its customers against the DeadBolt ransomware. Ransomware operators are also offering for sale the QNAP the master decryption key for 50 BTC which could allow all the victims of this ransomware family to decrypt their files.

Ransomware

Ransomware Internet Internet Firmware

DeadBolt Ransomware Decryption Key Released

SecureWorld News

FEBRUARY 2, 2022

Thankfully, Emsisoft CTO Fabian Wosar came to the rescue and shared this tweet: QNAP users who got hit by DeadBolt and paid the ransom are now struggling to decrypt their data because a forced firmware update issued by @QNAP_nas removed the payload that is required for decryption. January 30, 2022. link] — Fabian Wosar (@fwosar).

Ransomware

Ransomware Firmware Encryption Internet

Remotely Accessing Secure Kali Pi

Kali Linux

NOVEMBER 27, 2022

In Secure Kali Pi (2022) , the first blog post in the Raspberry Pi series, we set up a Raspberry Pi 4 with full disk encryption. author: Broadcom Corporation firmware: brcm/brcmfmac*-sdio.*.bin bin firmware: brcm/brcmfmac*-sdio.*.txt We mentioned that we can leave it somewhere as a drop box. wireless LAN fullmac driver.

Firmware

Firmware Wireless Passwords VPN

BlackCat Ransomware gang breached over 60 orgs worldwide

Security Affairs

APRIL 25, 2022

The alert includes indicators of compromise (IoCs) associated with BlackCat/ALPHV, as of mid-February 2022. Install updates/patch operating systems, software, and firmware as soon as updates/patches are released. Ransom demands range from a few hundreds of thousands up to $3M worth of Bitcoin or Monero. To nominate, please visit:?

Ransomware

Ransomware Antivirus Passwords Malware

Secure Kali Pi (2022)

Kali Linux

AUGUST 1, 2022

This is the first part of a 3 part series of blog posts surrounding Kali usage on Raspberry Pi devices. The /boot/cmdline.txt file on a RPi device is used to pass the kernel command line options.

Encryption

Encryption Passwords Backups Firmware

Multiple flaws in Teltonika industrial cellular router expose OT networks to hack

Security Affairs

MAY 16, 2023

The platform provides real-time monitoring and control, it also supports advanced features such as device management, software and firmware updates, GPS tracking, and data visualization. ” reads the advisory from CISA.

Hacking

Hacking Internet Internet Manufacturing

US and UK agencies warn of Russia-linked APT28 exploiting Cisco router flaws

Security Affairs

APRIL 19, 2023

The agencies recommend updating to the latest firmware and switching from SNMP to NETCONF or RESTCONF for network management. It includes discovery of other devices on the network by querying the Address Resolution Protocol (ARP) table to obtain MAC addresses. ” continues the report.

Malware

Malware Firmware Government Education

Money Message gang leaked private code signing keys from MSI data breach

Security Affairs

MAY 8, 2023

The authenticity of the leaked private key was confirmed by Alex Matrosov, founder of firmware security firm Binarly. Now the ransomware gang has leaked the company’s private code signing keys on their darkweb leaksite. Confirmed, Intel OEM private key leaked, causing an impact on the entire ecosystem.

Data breaches

Data breaches Ransomware Firmware Manufacturing

US dismantled the Russia-linked Cyclops Blink botnet

Security Affairs

APRIL 6, 2022

“The Justice Department today announced a court-authorized operation, conducted in March 2022, to disrupt a two-tiered global botnet of thousands of infected network hardware devices under the control of a threat actor known to security researchers as Sandworm, which the U.S. ” reads the press release published by DoJ.

Malware

Malware Government Firmware Firewall

Security Affairs newsletter Round 420 by Pierluigi Paganini – International edition

Security Affairs

MAY 21, 2023

Please vote for Security Affairs ( [link] ) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS Vote for me in the sections where is reported Securityaffairs or my name Pierluigi Paganini Please nominate Security Affairs as your favorite blog.

Data breaches

Data breaches Cybercrime Ransomware Passwords

Lapsus$: The New Name in Ransomware Gangs

Security Boulevard

MARCH 15, 2022

Tue, 03/15/2022 - 17:20. Code signing certificates assign a digital signature on executable software and firmware to allow them and mark them as trusted. Lapsus$: The New Name in Ransomware Gangs. brooke.crothers. Lapsus$ arrives. Impresa owns the country's largest TV channel and newspaper, SIC and Expresso. But first things first.

Ransomware

Ransomware Telecommunications Firmware Media

JekyllBot:5 flaws allow hacking TUG autonomous mobile robots in hospitals

Security Affairs

APRIL 13, 2022

Cynerio ethically disclosed the issues to Aethon and the vendor addressed it with the release of firmware updates.

Mobile

Mobile Hacking Firmware Surveillance

Critical fixed critical flaws in Cisco Small Business Switches

Security Affairs

MAY 18, 2023

Please vote for Security Affairs ( [link] ) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS Vote for me in the sections where is reported Securityaffairs or my name Pierluigi Paganini Please nominate Security Affairs as your favorite blog.

Small Business

Small Business Firmware Hacking Cybersecurity

US gov agencies e private firms warn nation-state actors are targeting ICS & SCADA devices

Security Affairs

APRIL 14, 2022

According to the advisory that was issued with the help of leading cybersecurity firms (Dragos, Mandiant, Microsoft, Palo Alto Networks, and Schneider Electric), nation-state hacking groups were able to hack multiple industrial systems using a new ICS-focused malware toolkit dubbed PIPEDREAM that was discovered in early 2022.

Passwords

Passwords Architecture Backups Cyber Attacks

Security Affairs newsletter Round 419 by Pierluigi Paganini – International edition

Security Affairs

MAY 14, 2023

Please vote for Security Affairs ( [link] ) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS Vote for me in the sections where is reported Securityaffairs or my name Pierluigi Paganini Please nominate Security Affairs as your favorite blog.

Data breaches

Data breaches DDOS Artificial Intelligence Ransomware

QNAP firmware updates fix Apache HTTP vulnerabilities in its NAS

Conti leaked chats confirm that the gang’s ability to conduct firmware-based attacks

Webinars

Trending Sources

CosmicStrand: the discovery of a sophisticated UEFI firmware rootkit

Webinars

Zyxel fixed a critical RCE flaw in its firewall devices and urges customers to install the patches

CISA adds CVE-2022-30525 flaw in Zyxel Firewalls to its Known Exploited Vulnerabilities Catalog

Ransomware: April 2022 review

HP would take up to 90 days to fix a critical bug in some business-grade printers

Expert found Backdoor credentials in ZyXEL LTE3301 M209

Cisco EoL SPA112 2-Port Phone Adapters are affected by critical RCE

Corsair Bug in Keyboard Causes Typing Without User’s Consent

TP-Link High-Severity Flaw Added to Mirai Botnet Arsenal

D-Link fixes two critical flaws in D-View 8 network management suite

HID Mercury Access Controller flaws could allow to unlock Doors

Zyxel fixed firewall unauthenticated remote command injection issue

Experts show how to run malware on chips of a turned-off iPhone

Vulnerabilities in the iBoot Power Distribution Unit Let Hackers Remotely Shut Down Devices

Expert found Backdoor credentials in ZyXEL LTE3301 M209

Cyber Threats to the FIFA World Cup Qatar 2022

Experts share details of five flaws that can be chained to hack Netgear RAX30 Routers

Synology and QNAP warn of critical Netatalk flaws in some of their products

A new Mirai botnet variant targets TP-Link Archer A21

ESET warns of three flaws that affect over 100 Lenovo notebook models

MSI confirms security breach after Money Message ransomware attack

Google TAG shares details about exploit chains used to install commercial spyware

A new wave of DeadBolt Ransomware attacks hit QNAP NAS devices ?

Security Affairs newsletter Round 368 by Pierluigi Paganini

CISA adds WatchGuard flaw to its Known Exploited Vulnerabilities Catalog

Russia-linked APT28 compromised Ubiquiti EdgeRouters to facilitate cyber operations

Security Affairs newsletter Round 362 by Pierluigi Paganini

QNAP warns of a new wave of DeadBolt ransomware attacks against its NAS devices

DeadBolt Ransomware Decryption Key Released

Remotely Accessing Secure Kali Pi

BlackCat Ransomware gang breached over 60 orgs worldwide

Secure Kali Pi (2022)

Multiple flaws in Teltonika industrial cellular router expose OT networks to hack

US and UK agencies warn of Russia-linked APT28 exploiting Cisco router flaws

Money Message gang leaked private code signing keys from MSI data breach

US dismantled the Russia-linked Cyclops Blink botnet

Security Affairs newsletter Round 420 by Pierluigi Paganini – International edition

Lapsus$: The New Name in Ransomware Gangs

JekyllBot:5 flaws allow hacking TUG autonomous mobile robots in hospitals

Critical fixed critical flaws in Cisco Small Business Switches

US gov agencies e private firms warn nation-state actors are targeting ICS & SCADA devices

Security Affairs newsletter Round 419 by Pierluigi Paganini – International edition

Stay Connected