ArcaneDoor Uses Novel Cisco Bugs for Persistence; Cybersecurity Practitioner Licensing; PAN-OS Updated Remediation Knowledge Base; President's Cup Cybersecurity Competition Winners

The flaws patched by Cisco require authentication. Cisco states that they do not know how the attacker obtained initial access, but verify that authentication is configured properly and verify the password security for any devices. There have been persistent brute force attacks against these devices in the past.

The attackers are using an in-memory implant called Line Dancer which is used to disable syslog, exfiltrate the configuration, create packet captures, write to memory, and hook the crash dump and AAA processes to allow authentication and bypass/disable crash dumps needed for forensic analysis. Persistence is maintained with a backdoor called "Line Runner" which leverages the legacy capability to pre-load updated VPN clients and plugins on ASA devices. The update from Cisco prevents this technique from working, however it doesn't remove Line Runner so you need to check for new or unusual zip files, copying them off and reporting to Cisco as requested. Details on removing them are in the Talos blog.

Brute force attacks against operator-less public network facing devices have been increasing. It is important to know if your devices are seeing and resisting such attack traffic.

Businesses in general would never use an electrician or plumber that wasn't licensed and didn't carry an active business insurance policy. The same should certainly be true in selecting cybersecurity service providers. But in the US, states generally determine standards of workmanship as well as apprenticeship/licensing/certification requirements for skills/capabilities that are judged to be needed to adhere to those standards of workmanship. Federal requirements in the US for cybersecurity workmanship (let alone software quality and liability) aren't likely to happen anytime soon, if ever, in the US.

This will be worth watching. Licensing has benefits as it validates a certain level of knowledge by individuals (certification) and business process by companies (accreditation). The devil will be in the details as the requirements for licensing comes later and whether they will grandfather in existing certification schemes.

The idea is to offset risks of hiring unqualified professionals, possibly resulting in a registry of talent to draw upon, but the regulations also strengthen government oversight and regulation capabilities related to cyber activities, in some cases allowing for unlimited search and seizure powers as well as making activities by non-licensed cyber security researchers difficult if not illegal.

It is not clear what problem such licensing is intended to solve, though our field is rife with pretenders. One recalls the abortive attempt by the state of New Jersey to license software "engineers" that was killed by the opposition of mere "programmers." One supports a requirement that one who holds oneself out as an engineer be held to the traditional standards of that profession, including licensing.

Restart your browser at least once a day, and once a week, double check if your browser is up to date. Restarting your browser is the simplest way to make sure automatic updates are applied.

Of the fixes, CVE-2024-4058 (ANGLE type confusion) is rated a critical while CVE-2024-4059 (out of bounds read in V8) and CVE-2024-4060 (use after free om Dawn) are rated high. Chromium-based browsers have become really good at restoring your windows and tabs after a restart, so encourage users not to hesitate to click the restart/relaunch button when it appears. Your managed Chrome install should have an enforced time limit for that relaunch, a 48-72 hours max.

There are not a lot of examples of insecure update mechanisms being exploited by bad actors. Interesting to see this product being affected.

The attackers were able to MITM the antivirus service, which used HTTP to deliver updates, allowing them to infect end-users with malware. For. Five. Years. Beyond not using HTTPS, the AV client didn't sufficiently enforce digital signing of updated content, so the replacement malicious content wasn't detected. My gut says when they started deploying crypto miners, the resource hit gave them away. That gives you a couple of pointed questions to ask your EDR provider.

This attack exposed two secure by design flaws by the vendor: 1) updates not digitally signed, and 2) using HTTP vice HTTPS. Both are common design principles and would have significantly raised the cybersecurity bar for the cybercriminal to execute the attack.

Evilgrade is still a thing. It's also a thing that we barely test for anymore, isn't it?

The Siemens Ruggedcom APE 1808 integrates security solutions from Palo Alto Networks, Fortinet and Nozomi Networks, and is an industrial application hosting platform for edge computing and cyber security in an industrial environment. As such, vulnerabilities in those components apply, in this case the updates to GlobalProtect which are pending release from Siemens. The workaround is to disable GlobalProtect gateway and portal, (these are disabled by default) until the update can be applied.

Cisco, Palo Alto, and others have OEM agreements with Siemens and other vendors. Expect that as firewall issues occur (or switching issues occur), there will be some lag time for these OEMs to roll them into the equipment upgrade paths. That alone does not mean that they will be immediately pushed out to these OT systems.