article thumbnail

VulnRecap 2/19/2024: News from Microsoft, Zoom, SolarWinds

eSecurity Planet

The problem: Zoom recently patched a flaw that affected three of its Windows-facing software products: Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows. Appliances with affected software must have Anyconnect SSL VPN enabled on whichever interface is exposed to the internet for an attack to occur.

VPN 112
article thumbnail

Blister malware using code signing certificates to evade anti malware detection

CyberSecurity Insiders

As some hackers have developed a malware that uses code signing certificates to avoid detection by security defenses and has the tendency to download payloads onto a compromised system. And the certification is linked to a Russian company titled Blist LLC that delivers payloads such as Cobalt Strike and BitRAT on demand.

Malware 124
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Vulnerability Recap 4/15/24 – Palo Alto, Microsoft, Ivanti Exploits

eSecurity Planet

Threats range from severe weaknesses in Ivanti’s VPN appliances to zero-day exploits in popular software such as Palo Alto Networks’ PAN-OS and Telegram’s Windows client. Typically, these vulnerabilities result in remote code execution or denial-of-service attacks, posing major dangers to users’ data security.

Firewall 108
article thumbnail

VulnRecap 2/12/24: Ivanti, JetBrains, Fortinet, Linux Issues

eSecurity Planet

The problem: Linux distributions have seen a new vulnerability, a remote code execution in the Shim software Secure Boot process. This code exists in all software that uses Secure Boot, like SUSE, Red Hat, and Debian. The fix: Fortinet told users to disable SSL VPN. Connect Secure 9.1R17.3 versions 7.4.0

VPN 108
article thumbnail

Weekly Vulnerability Recap – September 4, 2023 – Attackers Hit Network Devices and More

eSecurity Planet

Unpatched devices can give attackers privileged access to networks, particularly those set up as VPN virtual servers, ICA proxies, RDP proxies, or AAA servers. Admins can apply the security updates, upgrade their JunOS software to the current version, or disable Internet access to the J-Web interface to eliminate the attack vector.

VPN 104
article thumbnail

What Is Secure Remote Access?

eSecurity Planet

Note that not all of these venues are inherently or perfectly secure — they have vulnerabilities and require additional protective measures. Even VPN, while marketed as a security tool, has weaknesses of its own. Why Is Securing Access for Remote Workers So Important? Read more about the different types of remote access.

VPN 98
article thumbnail

Why BYOD Is the Favored Ransomware Backdoor

eSecurity Planet

The best practice for security software installation starts with the primary user devices. Basic VPN and IPS focus on the connections between internal resources and external threats, which ignores network devices or trusted VPN connections.