What’s driving job growth in cybersecurity?

/0 Comments/in /by

Supporting Cybersecurity Career Awareness Week: Explore, Experience, Share

It’s a bit strange to think that jobs in cybersecurity have suddenly gone trendy. Several years ago, few people even knew what “cyber” was and that it needed securing. But after an eye-popping record first half of 2021 for ransomware and other nefarious cybercrimes, the field is in hyperdrive.

According to data gathered under a U.S. Commerce Department grant, there are currently nearly 465,000 unfilled cybersecurity jobs all across the nation. The bulk of those jobs are in the private sector — securing networks for SMB, enterprises, MSSPs and beyond. About 8% of the projected shortage, or 36,000 positions, are for federal, state and local government agencies.

And the shortage is getting worse. According to jobs data from the U.S. Bureau of Labor Statics, the demand for cybersecurity professionals (a category that includes programmers and analysts) will jump from 1.8 million in 2020 to more than 2.3 million by 2030. That’s a 10-year growth rate of more than 22%. In addition, the mean income for this category – currently $111,000 – is among the top five highest salaries in the country.

Why the rush for jobs in cybersecurity?

When you think about it, the above-average growth in jobs in this area makes a lot of sense. Technology is so intertwined with our day-to-day living that the thought of NOT having qualified and experienced cybersecurity professionals on the job to protect scares a lot of people.

To illustrate that point, our mid-year update to the 2021 SonicWall Cyber Threat Report showed everyone that there is reason to be concerned. After soaring to 304.6 million in 2020 (an increase of 62% over 2019), ransomware attacks hit 226.3 million through May this year, up 116% over last year.

The detailed report was so eye-popping that it became a widely quoted source by the news media, including CNN, PBS News Hour and the Wall Street Journal. Some of our threat data even found its way into a Senate proposal for legislation. Hard to ignore this trend when so many people see the threat and expect more attacks are on the horizon.

Options and Career Pathway

While the future cybersecurity jobs projections forecast greater demand, the fact is, there are not enough well-qualified candidates – anywhere. This enviable situation means qualified candidates have many options for exciting positions with good salaries and benefits packages.

The traditional career path may start at a NOC or SOC (network operations center, security operations center, respectively). You find entry-level positions for security analysts, compliance coordinators, and field technicians. More advanced functions spread out to supervisory, management and executive placements.

Outside the operations center, there are positions for software design and development, project management, and implementation specialists. In law enforcement, there is a growing need for forensic analysts and specialists to help investigate cases. In addition, there is an increasing need for traditional support staff and management but for people familiar with cybersecurity concepts and terminology.

Explore. Experience. Share

Keith Trottier, SonicWall’s Chief Customer Success Officer, has been the company since 2016. He started in the high-tech industry in 1998 and migrated into cybersecurity in 2004. While his work is deeply involved with cybersecurity, he sees familiar patterns.

“Customer success – whether you’re engaging with customers, partners, or internal teams – is engaging with everyone and reducing the effort to build customer loyalty and trust,” says Trottier. “Through my career, there’s always been this methodology: if you make it easy for customers to engage and work with you, they’re going to engage and build loyalty with satisfaction.”

For the future, he notes that the cybersecurity space is constantly evolving. He weighs the significant changes of the last five years, like the COVID pandemic and how that change caused the remote workforce to increase dramatically. “Here we are now with our Boundless Security marketing, and it resonates; it’s really compelling,” he says. And as the whole industry continues to expand and grow, it’ll do so without borders. “That’s how you’re going to see the cybersecurity space genuinely evolve.”

Hyperbole or Reality?

It may feel like a bit of hyperbole to say, “America needs you,” but maybe not. Cybersecurity professionals are the new frontline of a growing battle against fraud, theft, and other criminal activities that present a real danger to our way of life. For example, during that surge in crime activity last May, we saw a ransomware attack on Colonial Pipeline that triggered a massive regional gasoline shortage and panic-buying that lasted several days. In addition, a group of “ruthless” hackers attacked 235 U.S. hospitals earlier this year, raking in more than $100 million. The new reality for cybersecurity means everything is at risk.

Ready to launch your career in cybersecurity? Check out SonicWall’s career center. Our attention to innovation and integrity has helped launch hundreds of successful careers [like Keith Trottier]. However, if your search is just beginning, check out the Cybersecurity & Infrastructure Security Agency (CISA) career awareness page, where you’ll find tools to help you map your new career pathway.

SonicWall Earns Its Third Perfect Score In A Row From ICSA Labs

/0 Comments/in /by

SonicWall Capture ATP earns a third perfect score in ICSA Labs Advanced Threat Detection (ATD) certification.

For many years, the goal of cybersecurity was relatively simple: shield enterprise networks and connected assets from known malicious threats. But as we’ve learned, protection from known threats is not enough.

Our mid-year update to the 2021 SonicWall Cyber Threat Report showed that existing cybersecurity methods are under direct attack by highly organized hackers and scammers. The report presented such eye-popping data that it was a widely quoted source by the news media, including the Wall Street Journal, PBS News Hour, and CNN. Data from our study even found its way into proposed legislation in the U.S. Senate.

The new challenge is defending networks against new or little-known threats without hampering network performance. Unfortunately, while many protection products and services promise they’re up to the task, only a few are proven to do so – until now.

A Perfect Score – Again!

ICSA Labs just released the latest result from their coveted Advanced Threat Defense report – the same report that so many IT managers look to help them strengthen their network frontiers. In this report, SonicWall’s Capture ATP (Advanced Threat Protection) was the only solution to receive a perfect score. This is the third time that SonicWall has received a perfect score in this category. It also marks the seventh consecutive ICSA certification for SonicWall Capture ATP.

It is rare for any security solution to receive a perfect score, let alone earn three in series. However, Capture ATP uses patented RTDMITM (Real-Time Deep Memory Inspection) technology designed to do one thing: surpass expectations. In our own tests, the technology catches more malware faster than traditional behavior-based sandboxing methods, with a lower false-positive rate. ICSA Labs test results qualify the success of this design.

During 28 days, ICSA Labs subjected Capture ATP to 653 malicious samples and 695 innocuous apps. As a result, Capture ATP detected 100% of malicious files sent through the system while ignoring harmless apps, thus generating zero false positives. The full report can be downloaded from ICSA Labs.

ICSA Labs Advanced Thread Defense (ATD) Result

According to the report, “SonicWall Capture ATP did remarkably well during this test cycle-detecting 100% of previously unknown threats while having zero false positives,” proving the effectiveness of the solution against unknown threats.

Times Such as These…

ICSA Labs ATD Certification takes direct aim at the weakest link in traditional cybersecurity models: the nexus point where unknown and little-known threats can do the most damage. But, if our Cyber Threat Report is any evidence, we live in times when tests such as what organizations like ICSA Labs offer are necessary.

Through third-party testing, network managers can learn how well protections work in realistic environments. SonicWall submits products such as Capture ATP to lab testing because we also want to see a third-party validation of our engineering. Programs such as ICSA Labs ATD Certification are vital if we make cybersecurity an actual priority, not just a marketing promise.

What is ICSA Advanced Threat Defense?

Standard ICSA Labs Advanced Threat Defense (ATD) testing is aimed at vendor solutions designed to detect new threats that other traditional security products miss. Thus, the focus is on how effectively vendor ATD solutions detect these unknown and little-known threats while minimizing false positives.

Cybersecurity News & Trends – 10-15-21

/0 Comments/in /by

SonicWall’s push for the cloud generated quite a bit of attention. The company’s growing virtual, cloud, and hybrid offerings leverage the best of SonicWall’s Boundless Cybersecurity approach and return choice to the customer. In industry news, the unfortunate rise of “killware,” the world is talking about Russian hackers without Russia, Verizon’s Visible problem, Quest fertility clinic has a breach, and a Pentagon cyber official quits.

SonicWall in the News

SonicWall Returning Choice to Customers by Securing Any Mix of Cloud, Hybrid and Traditional Networks

ITNews: SonicWall, a global leader in physical, virtual and cloud-focused cybersecurity solutions, emphasizes the return of customer choice for securing and scaling a mix of cloud, hybrid and traditional environments.

SonicWall Returning Choice to Customers by Securing Any Mix of Cloud, Hybrid and Traditional Networks

BusinessInsider: SonicWall’s growing virtual, cloud and hybrid offerings leverage the best of the company’s Boundless Cybersecurity approach returning deployment choices to the customer.

SonicWall Secures Mix of Cloud, Hybrid and Traditional Networks

TheHackPosts: SonicWall’s cloud innovation and collaboration with organizations worldwide to build some of the safest and strongest hybrid networks.

SonicWall Gives Organizations Freedom of Choice In All Types Of Security Architectures 

Byte (Spain): With its virtual, cloud and hybrid offerings, SonicWall takes full advantage of the enterprise’s unlimited cybersecurity approach to return deployment choice options to the customer.

A Brief Insight into The Complex Topic Of IoT Security

Industry of Things (Germany): This article deals with attacks on IoT devices and the complex issue of defending networks. It cites the SonicWall mid-year update on the 2021 Cyber Threat Report to raise the urgency.

SonicWall Is a Company Highly Valued by The Channel

Newsbook (Spain): SonicWall’s Sergio Martinez was interviewed about the company’s great first fiscal semester in Spain.

Industry News

The Next Big Cyberthreat Isn’t Ransomware. It’s Killware.

USA Today: The headline is just as bad as it sounds. As most Americans are still learning about ransomware, USA Today says our top security experts are worried about an even more dire development: killware, cyberattacks that can literally end lives. While the Colonial Pipeline ransomware attack in April triggered a region-wide shortage of gasoline, another earlier attack tried to distribute contaminated water to residents. According to this news outlet and others, the Oldsmar Water Treatment facility’s attempted hack in Florida came “very close” to achieving its goal. The fact that the attack was not for financial gain but instead purely to harm, Homeland Security Secretary Alejandro Mayorkas remarked that the incident “should have gripped our entire country.” Mayorkas and cybersecurity experts said the Oldsmar intrusion indicates that hackers are targeting critical parts of the nation’s infrastructure – everything from hospitals and water supplies to banks, police departments and transportation – in ways that could injure or even kill people.

U.S. talks global cybersecurity without a key player: Russia

A.P. News: The U.S. got into a week-long huddle with 30 other countries to discuss a unified cybersecurity strategy. Obviously absent: Russia. Russia is one country that, unwittingly or not, hosts many of the criminal syndicates behind the recent rise of ransomware attacks. The fact that none of the other participants invited Russia to the two-day meeting marks a big move to publicize the growing disapproval of Russia’s inability (or unwillingness) to reel in cybercrime gangs. White House national security adviser Jake Sullivan likened gathering “like-minded” governments as an urgent attempt to protect citizens and businesses. The virtual discussions will focus in part on efforts to disrupt and prosecute ransomware networks like the one that attacked a major U.S. pipeline company in May.

High-Profile Breaches Are Shifting Enterprise Security Strategy

DarkReading: The attacks against Microsoft Exchange and SolarWinds highlighted enterprise concerns over supply chain vulnerabilities and attack visibility. Dark Reading’s 2021 Strategic Security Survey shows that high-profile incidents drove changes in enterprise security strategies over the past year. In the survey, 54% of respondents describe top executives as paying more attention and prioritizing cybersecurity because of the increased media attention around incidents.

Verizon-owned Visible network suffers suspected data breach.

XDA: Visible, a Verizon-owned company, says that it is aware of an issue where some member accounts were accessed and charged without authorization. It’s not clear if Visible itself suffered a data breach or if the attackers used usernames and passwords obtained from other data breaches to log in — a tactic known as credential stuffing. Some Visible subscribers claim that they have randomly generated passwords for their accounts and that they are not used elsewhere, which would indicate Visible itself had a security breach.

Quest-owned fertility clinic announces data breach after August ransomware attack.

ZDNet: Quest Diagnostics informed the SEC about a ransomware attack in August that hit ReproSource, a fertility clinic owned by the company. The attack led to a data breach that exposed a significant amount of health and financial information for about 350,000 ReproSource patients. Quest released a statement to ZDNet, saying that ReproSource notified patients that it experienced a data security incident and that an unauthorized party may have accessed or acquired some patients’ protected health information and personally identifiable information.

Israel on heightened alert after hospital hit with a ransomware attack

Times of Israel: After a ransomware cyberattack targeted the Hillel Yaffe Medical Center in Hadera Wednesday, Israel’s National Cyber Directorate said there were heightened fears of other hospitals being targeted. The directorate also issued a general warning to Israeli businesses to be aware of potential cyberattacks as the country faces an uptick in hacking attempts. Separately, in a letter to hospitals around the country, the Health Ministry urged them to print out patients’ medical files amid the fear of more cyberattacks.

A Pentagon official said he resigned because U.S. cybersecurity is no match for China.

BusinessInsider: “We have no competing fighting chance against China in fifteen to twenty years,” said Nicolas Chaillan, formerly a high-ranking member of the software and security teams for the U.S. Pentagon and the U.S. Air Force. He quit in September and told the Financial Times last week that the U.S. was far behind China on A.I. security development, commenting that the U.S. capabilities and cyber defenses of some government departments were at “kindergarten level.”

In Case You Missed It

 

SonicWall Delivers Choice, Flexibility as Part of Cloud Evolution

/0 Comments/in /by

The performance and efficacy of cybersecurity solutions are important. But so are choice and flexibility, which are often lost as vendors force deployment options into customer environments.

Building and deploying sound cybersecurity controls is no easy task. Most organizations have hybrid networks and, hence, need a combination of on-premises, virtual, and as-a-service security solutions. Vendors that provide only one choice for the deployment model increase complexity for the customers. SonicWall’s customer-first approach aims to change that paradigm.

“Too many times organizations have been forced to change the way they operate in order to secure access to their networks, data, devices and people,” SonicWall President and CEO Bill Conner said in an official statement. “We’ve been busy innovating cloud and virtual solutions that help organizations secure complex blends of networks, including virtual, hybrid, cloud and on-premises deployments.”

SonicWall’s growing virtual, cloud and hybrid offerings leverage the best of the company’s Boundless Cybersecurity approach to provide deployment choices to the customer while solving real-world use cases faced by SMBs, enterprises, governments and MSSPs. SonicWall’s core cloud solution offerings:

  • Solve security and connectivity challenges for cloud-native and hybrid environments.
  • Secure access to cloud and on-premises applications and virtualized workloads through modern zero-trust capabilities.
  • Protect increasingly distributed and remote workforces through powerful virtualized security layers and zero-touch capabilities.
  • Simplify threat detection and response by unifying security events and analytics in a single cloud-based dashboard, allowing easy visualization and management of high-risk alerts.
  • Provide consistent security across networks — regardless of how it is deployed

While these are just a few foundational use cases to showcase ability, SonicWall has been busy designing, deploying, scaling, optimizing and securing a wide range of networks, including the most complex cloud-native and hybrid environments. Today’s announcement illustrates how SonicWall continues to evolve a set of cloud-centric security solutions for customers at various stages of their cloud journey.

A Lesson in Hybrid Security

One such success case is the University of Pisa, which is leveraging SonicWall cloud and virtual offerings to manage complex and distributed infrastructure, as well as secure on-campus and remote learning and working.

“The University of Pisa connects and secures a wide and distributed network of systems, users, applications and services to ensure our institution can provide the highest levels of on-campus and remote learning,” said University of Pisa CIO Antonio Cisternino. “It’s imperative that we’re able to use the same trusted security controls, regardless of how we deploy them. Through their growing range of virtual, cloud and hybrid offerings, SonicWall gives us that choice and flexibility without sacrificing the security standards we require to protect and enable students, faculty and staff.”

SonicWall ensures organizations like the University of Pisa are able to set their own deployment paths and cloud migration timelines — not forcing them into a rigid vendor-first approach.

Don’t Get ‘Boxed In’

Every day, SonicWall secures real-world hybrid environments using a cohesive mix of virtual, cloud and on-premises offerings, including SonicWall NSv virtual firewalls, Cloud Edge Secure Access zero-trust security, Cloud App Security to protect SaaS applications and appliance-free SMA virtual private networks (VPN).

However, because of the choices we offer, customers are free to deploy what works best for their networks, move to the cloud at their pace and obtain consistent security everywhere. Customers can easily manage SonicWall’s solutions from a cloud-delivered single-pane-of-glass called Capture Security Center (CSC). It centralizes management and aids in detecting and responding to threats across hybrid networks.

To learn more about SonicWall cloud solutions, please visit SonicWall.com/cloud.

Microsoft Security Bulletin Coverage for October 2021

/in /by

SonicWall Capture Labs threat research team has analyzed and addressed Microsoft’s security advisories for the month of October 2021. A list of issues reported, along with SonicWall coverage information, is as follows:

CVE-2021-40443 Windows Common Log File System Driver Elevation of Privilege Vulnerability
ASPY 230:Malformed-File exe.MP_205

CVE-2021-40449 Win32k Elevation of Privilege Vulnerability
ASPY 235:Malformed-File exe.MP_210

CVE-2021-40450 Win32k Elevation of Privilege Vulnerability
ASPY 236:Malformed-File exe.MP_211

CVE-2021-40466 Windows Common Log File System Driver Elevation of Privilege Vulnerability
ASPY 237:Malformed-File exe.MP_212

CVE-2021-40467 Windows Common Log File System Driver Elevation of Privilege Vulnerability
ASPY 231:Malformed-File exe.MP_206

CVE-2021-40470 DirectX Graphics Kernel Elevation of Privilege Vulnerability
ASPY 232:Malformed-File exe.MP_207

CVE-2021-40487 Microsoft SharePoint Server Remote Code Execution Vulnerability
ASPY 233:Malformed-File exe.MP_208

CVE-2021-41357 Win32k Elevation of Privilege Vulnerability
ASPY 234:Malformed-File exe.MP_209

Adobe Coverage:
CVE-2021-40728 Use After free Vulnerability
ASPY 239:Malformed-File pdf.MP_510

The following vulnerabilities do not have exploits in the wild :
CVE-2020-1971 OpenSSL: CVE-2020-1971 EDIPARTYNAME NULL pointer de-reference
There are no known exploits in the wild.
CVE-2021-26427 Microsoft Exchange Server Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2021-26441 Storage Spaces Controller Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2021-26442 Windows HTTP.sys Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2021-34453 Microsoft Exchange Server Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2021-3449 OpenSSL: CVE-2021-3449 NULL pointer deref in signature_algorithms processing
There are no known exploits in the wild.
CVE-2021-3450 OpenSSL: CVE-2021-3450 CA certificate check bypass with X509_V_FLAG_X509_STRICT
There are no known exploits in the wild.
CVE-2021-36953 Windows TCP/IP Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2021-36970 Windows Print Spooler Spoofing Vulnerability
There are no known exploits in the wild.
CVE-2021-38662 Windows Fast FAT File System Driver Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2021-38663 Windows exFAT File System Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2021-38672 Windows Hyper-V Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2021-40454 Rich Text Edit Control Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2021-40455 Windows Installer Spoofing Vulnerability
There are no known exploits in the wild.
CVE-2021-40456 Windows AD FS Security Feature Bypass Vulnerability
There are no known exploits in the wild.
CVE-2021-40457 Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability
There are no known exploits in the wild.
CVE-2021-40460 Windows Remote Procedure Call Runtime Security Feature Bypass Vulnerability
There are no known exploits in the wild.
CVE-2021-40461 Windows Hyper-V Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2021-40462 Windows Media Foundation Dolby Digital Atmos Decoders Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2021-40463 Windows NAT Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2021-40464 Windows Nearby Sharing Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2021-40465 Windows Text Shaping Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2021-40468 Windows Bind Filter Driver Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2021-40469 Windows DNS Server Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2021-40471 Microsoft Excel Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2021-40472 Microsoft Excel Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2021-40473 Microsoft Excel Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2021-40474 Microsoft Excel Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2021-40475 Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2021-40476 Windows AppContainer Elevation Of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2021-40477 Windows Event Tracing Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2021-40478 Storage Spaces Controller Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2021-40479 Microsoft Excel Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2021-40480 Microsoft Office Visio Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2021-40481 Microsoft Office Visio Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2021-40482 Microsoft SharePoint Server Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2021-40483 Microsoft SharePoint Server Spoofing Vulnerability
There are no known exploits in the wild.
CVE-2021-40484 Microsoft SharePoint Server Spoofing Vulnerability
There are no known exploits in the wild.
CVE-2021-40485 Microsoft Excel Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2021-40486 Microsoft Word Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2021-40488 Storage Spaces Controller Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2021-40489 Storage Spaces Controller Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2021-41330 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2021-41331 Windows Media Audio Decoder Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2021-41332 Windows Print Spooler Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2021-41334 Windows Desktop Bridge Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2021-41335 Windows Kernel Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2021-41336 Windows Kernel Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2021-41337 Active Directory Security Feature Bypass Vulnerability
There are no known exploits in the wild.
CVE-2021-41338 Windows AppContainer Firewall Rules Security Feature Bypass Vulnerability
There are no known exploits in the wild.
CVE-2021-41339 Microsoft DWM Core Library Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2021-41340 Windows Graphics Component Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2021-41342 Windows MSHTML Platform Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2021-41343 Windows Fast FAT File System Driver Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2021-41344 Microsoft SharePoint Server Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2021-41345 Storage Spaces Controller Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2021-41346 Console Window Host Security Feature Bypass Vulnerability
There are no known exploits in the wild.
CVE-2021-41347 Windows AppX Deployment Service Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2021-41348 Microsoft Exchange Server Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2021-41350 Microsoft Exchange Server Spoofing Vulnerability
There are no known exploits in the wild.
CVE-2021-41352 SCOM Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2021-41353 Microsoft Dynamics 365 Sales Spoofing Vulnerability
There are no known exploits in the wild.
CVE-2021-41354 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
There are no known exploits in the wild.
CVE-2021-41355 .NET Core and Visual Studio Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2021-41361 Active Directory Federation Server Spoofing Vulnerability
There are no known exploits in the wild.
CVE-2021-41363 Intune Management Extension Security Feature Bypass Vulnerability
There are no known exploits in the wild.

Check Before You Click and Fight the Phish!

/0 Comments/in /by

Phishing is one of the oldest cybersecurity scams. The first phishing attacks occurred during the mid-1990s when unsuspecting users of America Online (AOL) answered fraudulent emails and gave up passwords and credit card information. Fast forward twenty years, the scam has evolved, but the goal is still the same: get people to give up vital data.

And scammers have been very busy.

According to the FBI, phishing was the most common type of cybercrime in 2020. In addition, they found that phishing incidents nearly doubled in frequency, from 114,702 in 2019 to 241,324 incidents in 2020.

When you dig a bit and learn how people fall for phishing scams, you discover the patterns and the twists. We’ve narrowed the patterns down to three:

1.     The Approach

Phishing attacks often begin with email, text messages, even phone calls. The message will be simple, often in the form of an announcement, like a problem with a payment, a security breach, or suspension of benefits or services. If the target is a company or organization, the scammer may seem unassuming, even respectable. For example, some scammers will claim to be a new employee, IT technician, or researcher. They may even produce some credentials or other information to support their claim.

If the attack is broader, the message may appear to originate from a well-known brand, a trusted company or a nonprofit organization. For example, common phishing scams have themes like a credit card company or other financial institution, a charity or a political organization.

Scammers also take advantage of current events and certain times of the year, such as:

  • Natural disasters (e.g., North American Fires, Haiti Earthquake, etc.)
  • Epidemics and health scares (e.g., H1N1, COVID-19)
  • Economic concerns (e.g., IRS scams)
  • Major political elections
  • Holidays

2.     The Build-up

Simple phishing scams take a spray and pray approach, hitting thousands of potential victims all at the same time with identical spoof messages. Some of these campaigns also spoof websites where the primary trap is laid. These campaigns have gotten upgrades in appearance. Although they are easiest to detect among phishing campaigns, we fall to them when we’re rushing around and don’t pay close enough attention.

Some scammers go a step further by picking a target then attacking with a sophisticated social engineering script. The goal is to gain trust and approval from a chain of victims. For instance, the scammer may start with a spoofed email address of known colleagues or executives. If the scammer can’t get enough information from one source, they’ll move on to another within the same organization. Finally, they increase credibility by adding information gleaned from the previous victim as they probe for more data. Within 20-30 minutes, the scammer may have enough information to piece together what they need to infiltrate highly sensitive networks and computers.

3.     The Payoff

While the basic pattern is much the same as the first phishing campaigns, the scammers have added new twists with both the script and the payoff. At one point, rather than steal just passwords and credit card information, some scammers led their victims to all sorts of malware: Trojans, spyware, adware, rootkits, worms, keyloggers — all of them costly and destructive for the victim. Lately, ransomware has become vogue with scammers encrypting computers and whole networks — for a much bigger payoff at the end. In addition, with rising cryptocurrency values, scammers also want to enslave some of your computing power for cryptomining.

According to SonicWall’s Mid-year update to the 2021 Cyber Threat Report, this past summer witnessed a record high of 78.4 million global ransomware attacks. Here in the US, the attacks rose by 185%; in the UK, 144%. Our report also shows that scammers have learned to target specific types of organizations. For example, ransomware attacks on government agencies and organizations rose 917%, 615% on education, 594% on healthcare, and 264% on retail.

Avoid being a victim. Here’s how:

The first and probably the most important rule is for us to be constantly vigilant. Raise your awareness when you get an unsolicited phone call or receive unexpected messages. Watch for unusual requests about employees or other internal information. Withhold all information and rely on better judgment before divulging ANY info.

Remember that the phish is all about squeezing information from you: refuse to give it to them. Instead, make a personal commitment to your cybersecurity. For instance:

  • Do not click links on email or text – even from trusted individuals.
  • Do not download ANYTHING that comes from an email or text message you did not expect; and
  • DO authenticate URLs, sender’s identity, and company identity. Often, a simple phone call from your own device will do the trick.

What do you do if you think you are a victim of the phish?

Everyone makes a mistake. The goal of this article (and the whole reason for Cybersecurity Awareness campaigns) is to help you avoid common traps. But even experts fall victim from time to time. If you think that you have tripped into a phishing scam, your response depends on your situation.

  • Contain the damage by contacting financial institutions for any accounts you may have exposed. Change your password. If you reuse the same password for multiple resources, change them all.
  • Isolate the damage by moving quickly. You should be well protected if you have a service like SonicWall’s Capture Advanced Threat Protection (ATP). If not, isolate the computer or device that you think is infected. Disconnect it from home or office network – wired and Wi-Fi). Treat any nearby devices as suspect and disconnect them as well
  • Verify the infection. Understand the threat you face. Several online services can help you identify the type of malware and give you some options for removal and repair.
  • Report the incident. If you believe you have revealed sensitive information about your organization, report it as soon as possible. Inform network administrators so that they can raise the alert for other suspicious activities. When you confirm a ransomware attack, report it to law enforcement so they can add to their investigations and search for the criminals.

SonicWall joined the Cybersecurity and Infrastructure Security Agency (CISA) this month to help raise awareness during Cybersecurity Awareness Month. Take on the challenge to do better to prevent cyberattacks like phishing.

Fight the Phish and #BeCyberSmart

VMware AsyncTelemetryController Arbitrary File Write Vulnerability

/in /by

Overview:

  VMware vCenter Server is a data centre management server application developed by VMware Inc. VMware vCenter Server is designed primarily for vSphere, VMware’s platform for building virtualized cloud infrastructures. As part of a broader VMware stack which may include both private and public cloud infrastructure, vCenter Server has an analytics service which provides health and telemetry data to VMware’s Cloud Analytics service (VAC) in order to help diagnose and prevent issues within the environment.

  An arbitrary file write vulnerability has been reported in VMware vCenter Server. The vulnerability is due to insufficient validation of collector IDs and collector instance IDs in requests handled by the AsyncTelemetryController class.

  A remote attacker could exploit this vulnerability by sending crafted requests to the target server. Successful exploitation of this vulnerability results in the writing of a .json file with arbitrary file contents to a location of the attacker’s choosing, potentially allowing the execution of arbitrary code.

CVE Reference:

  This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2021-22005

Common Vulnerability Scoring System (CVSS):

  The overall CVSS score is 9.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C).

  Base score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), based on the following metrics:
    • Attack vector is network.
    • Attack complexity is low.
    • Privileges required is none.
    • User interaction is none.
    • Scope is changed.
    • Impact of this vulnerability on data confidentiality is high.
    • Impact of this vulnerability on data integrity is high.
    • Impact of this vulnerability on data availability is high.
  Temporal score is 9.0 (E:P/RL:O/RC:C), based on the following metrics:
    • The exploit code maturity level of this vulnerability is proof of concept.
    • The remediation level of this vulnerability is official fix.
    • The report confidence level of this vulnerability is confirmed

Technical Overview:

  One of the primary components of the analytics service is the Telemetry Server which exposes an API at “/analytics/telemetry/”. The Telemetry Server consists of several services which determine where the telemetry data is to be sent such as a local log file, or VMware Analytics Cloud. The sending of telemetry data is initiated by a request to one of the following URIs:

The second URI is considered the “staging” telemetry server.

  An arbitrary file write vulnerability exists in VMware vCenter Server. The vulnerability is due to the fact the class responsible for handling telemetry “send” requests does not validate or sanitize one of the HTTP request query parameters before using its value as a file path and writing the contents of the request body to the file. Requests to the aforementioned telemetry send URIs are handled by the AsyncTelemetryController class. Requests to the production URL are handled by the overloaded handleSendRequest() method and requests to the staging URL are handled by the handleStageSendRequest() method. In both cases, the request accepts three query parameters: _v, a version number, _c, a collector ID, and _i, a collector instance ID. These parameters are provided as arguments to a different overloaded version of the handleSendRequest() method which first creates a TelemetryRequest object given the version, collector ID, and collector instance ID. The method then calls the processTelemetry() method of the TelemetryLevelBasedTelemetryServiceWrapper class which first inspects the current telemetry level configured on the system then calls the processTelemetry() method of the LogTelemetryService class if telemetry is not disabled.

  LogTelemetryService.processTelemetry() first puts a path and filename into the thread context. The filename is created by passing the collector ID and collector instance ID from the request to the LogTelemetryUtil.getLogFileNamePattern() method. The method uses a format string of “_c%1$s_i%2$s” along with the collector ID and collector instance ID to create the file name. Then processTelemetry() calls the info() method of the currently configured logger to write the body of the received request to the location determined by the path and filename put into the thread context, appending the .json extension to the file as configured by the logger in the initial service definition. Due to the fact that the collector ID and collector instance ID values are not validated or sanitized, an attacker may provide a collector instance ID which contains directory traversal characters in order to write a .json file with attacker controlled contents to an arbitrary location where it may be used to facilitate execution of arbitrary code such as /etc/cron.d/.

  An unauthenticated, remote attacker can exploit this vulnerability by sending a crafted telemetry send request. Successful exploitation results in the writing of a .json file to an arbitrary location which may lead to the execution of arbitrary code as root.

Triggering the Problem:

  The server must have the vulnerable product installed and running.
  • The attacker must have network connectivity to the target server.

Triggering Conditions:

  The attacker sends a crafted HTTP request to the telemetry send endpoint of the target server. The vulnerability is triggered when the server processes the request.

Attack Delivery:

  The following application protocols can be used to deliver an attack that exploits this vulnerability:
    • HTTPS, over port 443/TCP

SonicWall’s, (IPS) Intrusion Prevention System, provides protection against this threat:

  • IPS: 15690 VMware vCenter Server AsyncTelemetryController Arbitrary File Creation 1

  • IPS: 18064 VMware vCenter Server AsyncTelemetryController Arbitrary File Creation 2

Remediation Details:

  The risks posed by this vulnerability can be mitigated or eliminated by:
    • Filtering attack traffic using the signatures provided above.
    • Applying the vendor provided patch or workaround.
  The vendor has released the following advisory regarding this vulnerability:
  Vendor Advisory

Cybersecurity News & Trends – 10-08-21

/0 Comments/in /by

It been a big news week as conversations about the Mid-Year Update to the 2021 SonicWall Cyber Threat Report, the Boundless Cybersecurity Model, and the 30th Anniversary filled up pages. SonicWall got a big boost from a story about a new ransom disclosure bill when the co-sponsoring senators (Warren and Ross) mentioned data from the Threat Report in their press releases. In industry news, MIT designs a cybersecurity fire drill, “urgently needed rules” fail to impress and Facebook is crystal clear: outage was not a hack.

SonicWall in the News

New Bill Would Require Ransom Disclosure Within 48 Hours

U.S. Senators Warren and Ross have introduced legislation requiring ransomware victims to report payments within 48 hours of the transaction. Warren and Ross cited figures from SonicWall’s Mid-Year Update to the 2021 SonicWall Cyber Threat Report noting that ransomware attacks rose 62% worldwide between 2019 and 2020 and 158% in North America.

 

Warren Drafts’ Ransom Disclosure Act’ as Ransomware Attacks Increase

Be In Crypto (USA): The legislation proposes that victims of ransomware attacks in the U.S. file an incident report within 48 hours of payment. The bill’s co-sponsors used data from the Mid-Year Update to the SonicWall 2021 Cyber Threat Report.

 

In The Face of More Lethal Attacks, A New Cyberdefense.

BYTE (Spain): The article notes that 2021 has already been a record year for cybercrime, and there is still a quarter to go. The article describes the cybercrime landscape by citing data from SonicWall’s Mid-Year Update to the 2021 SonicWall Cyber Threat Report.

 

Egnyte Expands Ransomware Protection and Adds Ransomware Recovery

ChannelProNetwork (Blog): Citing 304.7 million ransomware attacks in the first half of 2021 as reported by the Mid-Year Update to the 2021 SonicWall Cyber Threat Report. The author describes methods for recovery from ransomware attacks.

 

SonicWall Is Geared Up with the Boundless Cybersecurity Model to Address the New Business Normal

VARIndia (India): The article includes commentary from SonicWall’s Debasish Mukherjee, VP Regional Sales, APAC, about SonicWall’s role in helping companies and organizations transition. Debasish comments that the current era of the ‘anytime, anywhere business’ is forever changing the shape of the I.T. and business landscape.

 

5 Key Cybersecurity Trends to Know, for 2021

The Clinton Courier: The author describes significant trends for cybersecurity this year based on Mid-Year Update to the 2021 SonicWall Cyber Threat Report.

 

Celebrating 30 years, SONICWALL, the leader in CYBERSECURITY

TechFeedThai (Thailand): SonicWall Solution Provider Cybersecurity for SMBs and Large Enterprises Celebrates 30 years since its inception in August 1991. The story also announces an offer by a regional SonicWall product distributor to perform threat assessments for local businesses.

 

Why Email is Your Biggest Cybersecurity Threat

ACE IT (blog): According to SonicWall, email remains a primary way people share information, with over 320 emails sent per day. In addition, the blog notes that through the massive shift to work-from-home, email became “the most extensive channel for all forms of phishing and ransomware attacks.”

 

MSPs: Ransomware Is Your Wake-Up Call to Deliver Non-Negotiable and Comprehensive Security

MSP Insights: Noting that ransomware attacks are only becoming more prevalent, more dangerous, and more costly, the report cites ransomware attacks increased 158% in North America last year, from the Mid-Year Update to the 2021 SonicWall Cyber Threat Report.

 

Cybersecurity Report: Record 304.7 million Ransomware Attacks

vTechio Blog: Quoting SonicWall’s Mid-Year Update to the 2021 SonicWall Cyber Threat Report: the number of attacks eclipses 2020 global totals in just six months. With this data, the writers explain, it’s clear that cybercrime has reached a new and unsettling paradigm.

 

Cybersecurity – Attack and Defense Strategies

Packt: Promoting the Second Edition of a book, the publisher notes “32.7 million IoT attacks” from the Mid-Year Update to the 2021 SonicWall Cyber Threat Report as an example of the current threat landscape. They also note that malware leveraged during an IoT-related attack infects routers and can facilitate data theft.

Industry News

What Happened to Facebook, Instagram, & WhatsApp?

Krebbs on Security: Earlier this week, Facebook (with Instagram, WhatsApp) suffered a massive outage that lasted almost seven hours. While many news organizations speculated that attackers hacked Facebook, Krebbs Report suggested “something inside Facebook” triggered a company-wide revocation of vital digital records that point computers and other devices to Facebook’s assigned resources. Reportedly, during the early part of the outage, employees on-premises could not use passcodes and electronic I.D. badges. Krebbs also speculated that the company’s Border Gateway Protocol (BGP) was affected. The BGP is a chunk of code that Internet Service Providers worldwide share for routing traffic through the complex array of Internet Protocol addresses. On Wednesday, details about the outage appeared to confirm reporting from Krebbs. Also, in the face of rising concerns about cybersecurity, Facebook is crystal clear that the hours-long outage had nothing to do with hackers.

 

Cyberattack Fire Drills: Is Your Company Prepared?

Harvard Business Review: Preparing for the unexpected is much easier said than done. In the case of cyberattacks, many companies have vulnerabilities that they don’t know about. Many organizations can benefit from instituting fire drills and exercises that test a company’s response plan for a cybersecurity catastrophe. Drills can reveal gaps in security, response plans, and employees’ familiarity with their roles. Research for this article was supported by the Cybersecurity at MIT Sloan consortium and Boston Consulting Group.

 

Cybersecurity Budgets for Industrial Control Systems and Operational Tech Increasing

ZDNet: Nozomi Networks and the SANS Institute released a survey that revealed companies had invested more in cybersecurity to protect industrial control systems (ICS). Of 480 responses, 47% reported that their cybersecurity budgets increased over the past two years, 32% said there had been no change, and 15% said they had at least one cybersecurity event in the last 12 months. 

 

Senators Introduce Bill to Strengthen Federal Cybersecurity After Attacks

The Hill: A bipartisan bill was introduced in the U.S. Senate last Monday stipulating overhaul and improvement for federal cybersecurity policy. The legislation aims at the Federal Information Security Modernization Act, signed into law in 2014, and clarifies reporting requirements for federal agencies if hackers successfully target them.

 

New’ Urgently Needed’ Cybersecurity Rules for Pipelines Draw Mixed Reviews

Last July, the U.S. Transportation Security Administration issued “urgently needed” emergency rules to strengthen the cybersecurity of the nation’s most essential energy pipelines. The effort followed the Colonial Pipeline shut down earlier this year sparked massive fuel shortages and gasoline panic-buying. The regulations recognize that voluntary compliance is not working. However, according to industry officials and some analysts, TSA administrators wrote the new rules in such a way that implementing them could hamper pipeline reliability.

 

Why Today’s Cybersecurity Threats Are More Dangerous

With greater complexity and interdependence among networked digital systems, attackers have even more opportunities to conduct widespread damage. The report identifies unsecured Internet of Things (IoT) devices as the “big hairy monster under the bed” while noting that, in many cases, the barriers to cybercrime are low.

In Case You Missed It

 

The State of Cybersecurity Funding for State and Local Government

/0 Comments/in /by

Congress recognizes a national cybersecurity crisis. SonicWall has a plan to help state and local governments with proposals and procurement.

With dozens of high-profile cybersecurity attacks still fresh in everyone’s mind, U.S. Senate negotiators are hard at work to show taxpayers they can deliver a solution. The recent $1.2 trillion infrastructure proposal passed by the U.S. House of Representatives authorizes $2 billion in new cybersecurity programs, including a $1 billion grant program for cybersecurity initiatives especially set aside for state and local government.

The initiative is entirely understandable given the range and scope of threats facing Americans today. The ransomware attack last May on Colonial Pipeline offered a chilling view of one possible future. Policy-makers are anxious to avoid repeating an episode that triggered regional gasoline shortages and panic-buying that lasted several days.

However, the cyberattacks on business threw the covers off greater dangers that nearly all levels of government now face. In the widely cited and quoted Mid-Year Update to the 2021 SonicWall Cyber Threat Report, government agencies and departments experienced three times more attacks in the first half of 2021 than in all of 2020. By June of this year, federal, state and local governments saw 10 times more ransomware activity than business.

Congress Jumps into Cybersecurity

Given the magnitude of enormous threats from hacker gangs and state-sponsored teams, the move certainly made a lot of sense. But politics being politics, the proposal still must get through the House, where it faces a long road to approval.

Speaker of the House Nancy Pelosi and many members of the House have declared that they will vote on the measure after the Senate passes an even more ambitious $3.5 trillion social policy bill this fall. The process will likely place the infrastructure bill and the cybersecurity initiative on hold for months.

Before the infrastructure bill’s passing, the White House budget proposal for 2022 outlined $58.4 billion for IT funding, including $9.8 billion specified for cybersecurity initiatives for civilian agencies.

While the National Defense Authorization Act (NDAA) Conference Committee has not finalized defense-related budgeting for 2022, it does pick up from last year’s budget, which established the office of the National Cyber Director. In addition, it allows up to $6 billion in discretionary funding, which, according to some capitol observers, could find its way into state and local government IT projects, especially if the infrastructure bill stalls in Congress.

The American Rescue Plan

While the discussion about infrastructure captures all the attention, state and local governments have already started tapping into other funding sources to help shore up their cybersecurity. In March 2021, the American Rescue Plan Act (ARPA) was signed into law. Designed as a means to bridge funding gaps for state, local and tribal governments hammered by the COVID pandemic, the law provides $350 billion in total funding.

It is important to keep in mind that these funds do not come with specific guidelines. State and local government applicants may use this kind of funding for just about anything they want. For example, funds can be invested in water, sewer or their IT security infrastructure.

According to an assessment on ARPA funding by the Brookings Institute, “funding for state and local governments appears to be incredibly flexible, and therefore even more supportive of innovative recovery solutions.”

These funds will be disbursed over the next three years, with many state, municipal and county agencies applying the funds to bridge budget gaps caused by revenue shortfalls during COVID-19. Meanwhile, the anecdotes are filtering in, emphasizing the nightmare scenarios of a security breach because of outdated firewalls and software.

Some funding will go to IT security. But, of course, the question will be how much is enough for the interim until bigger and deeper funding resources are made available.

SonicWall Has a Plan

SonicWall has a long history of working with federal, state, local governments and agencies. SonicWall understands the complexities of the network and how each user in a department may require specific user access. The SonicWall Boundless Cybersecurity model provides the performance and security that allows each agency the elasticity needed in today’s new normal.

SonicWall also bring solutions for hyper-distributed networks, where everyone is remote, mobile, and potentially unsecure, along with the traditional campus cybersecurity network needs.

In addition, the Boundless Cybersecurity model offers seamless protection against the most evasive and crippling cyberattacks like ransomware, IoT, encrypted threats and malware.

SonicWall works closely with all parties to help decipher the often-complicated procurement rules and sort out funding guidelines. We’re out there, in the field, assisting city, county and state agencies; we can share best practices when it comes to assessing the procurement process, right down to grant-writing.

In addition, SonicWall works closely with government procurement, and IT teams to determine their risk profile and build out a security solution for their current and future needs.

We’ve learned a lot throughout the years; below are some best practices and unique considerations:

  1. Recognize and address your increased cybersecurity risks from all aspects of your network. SonicWall can help you uncover hidden dangers with high-level analytics and reporting.
  2. Create and maintain robust data policies and procedures. Network management and policy management tools are built into SonicWall Network Security Manager. NSM gives IT teams the power to govern centrally, meet compliance rules and regulations, and manage risks as they emerge.
  3. Seek automated real-time breach detection and prevention. SonicWall offers automated TLS inspection, patented Real-Time Deep Memory Inspection (RTDMI), Reassembly-Free Deep Packet Inspection (RFDPI) and Capture ATP cloud-based multi-engine sandboxing. Alternatively, we also provide Capture Security Appliance (CSA) on-premises advanced threat detection and Cloud App Security for Office 365 and G Suite applications.
  4. Plan a layered approach to cybersecurity. For example, SonicWall solutions offer ‘end-to-end’ layers of protection, detection and inspection. Our portfolio provides firewalls, switches, secure mobile access, Wi-Fi, email security, cloud application security, endpoint security and control — all orchestrated within a consolidated Network Security Manager through a single pane of glass.
  5. Get everyone on board. The best cybersecurity implementation starts with total buy-in from everyone in the organization. Your network security is strengthened when everyone complies with security measures and recognizes that their security depends on their actions and behavior.
  6. Demand the correct certifications from your vendors. SonicWall meets S. federal governmental certification and interoperability requirements, e.g., NIST, FIPS 140-2, CSfC, Common Criteria, DoDIN APL, USGv6 and NSA CNSA Suite B.

Our goal is to help governments dive into the work of protecting public assets and communities with Boundless Cybersecurity. For more information, visit www.sonicwall.com.

OpenLDAP slapd Integer Underflow Vulnerability

/in /by

Overview:

  OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP) service. On a default installation, the OpenLDAP server uses TCP port 389 for communication. The OpenLDAP server has a modular architecture where the OpenLDAP server daemon, slapd, can be configured as a frontend, a backend or as an overlay. A frontend server typically listens on a TCP port and manages connections. Backend servers can either store the Directory data using one of various available engines (e.g. back-bdb for using BerkeleyDB, backldif for using LDIF text files), or act as a proxy server for other data storage systems (e.g. back-ldap for proxying to other LDAP servers, back-sql for talking to arbitrary SQL databases, back-passwd to use Unix system passwd and group data), or as a dynamic backend that generates data on the fly.

  A denial-of-service vulnerabilities has been reported in the slapd of OpenLDAP. The vulnerability is due to improper input validation in controls in LDAP search requests.

  A remote attacker can exploit the vulnerability by sending a crafted query to the target OpenLDAP server. Successful exploitation could cause integer underflow which leads to denial of service condition.

CVE Reference:

  This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2020-36221, dated 2021-01-25.

Common Vulnerability Scoring System (CVSS):

  The overall CVSS score is 4.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C).

  Base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), based on the following metrics:
    • Attack vector is network.
    • Attack complexity is low.
    • Privileges required is none.
    • User interaction is none.
    • Scope is unchanged.
    • Impact of this vulnerability on data confidentiality is none.
    • Impact of this vulnerability on data integrity is none.
    • Impact of this vulnerability on data availability is low.
  Temporal score is 4.8 (E:P/RL:O/RC:C), based on the following metrics:
    • The exploit code maturity level of this vulnerability is proof of concept.
    • The remediation level of this vulnerability is official fix.
    • The report confidence level of this vulnerability is confirmed.

Technical Overview:

  An integer underflow vulnerability exists in the OpenLDAP daemon, slapd. When slapd receives an incoming SearchRequest message including a valuesReturnFilter control with attributeCertificateExactMatch assertion, it calls a function serialNumberAndIssuerSerialPretty() to normalize the string value in matchValue. Before the normalization, it will call a function serialNumberAndIssuerSerialCheck() to validate the syntax of the string. According to the implementation, a valid syntax of the string should be like follows:

  The order of the serialNumber and issuer does not matter for the validation. The validations include checking minimum length of the assertionValue or matchValue, the first and last characters are “{” and “}”, the existence of key words such as “issuer” and “serialNumber” etc. However, the validation of “{” and “}” logic is mistakenly implemented as follows:

  Therefore, if the assertionValue or matchValue only starts with “{” or ends with “}” will bypass the validation. Also, the vulnerable function has an internal variable of type “unsigned long” to record the remaining length of the assertionValue or matchValue for validation. During the process of the validation, the variable will be decreased until 0. Since the vulnerable function does not validate that the last character is “}”, it failed to decrement the variable correctly. When the last character of the assertionValue or matchValue is ‘”‘, there is a chance that the length variable will be decremented beyond zero which effectively translates to a large positive value for an unsigned long integer (integer underflow). Then, the variable will be used in a loop as the upper bound for the loop counter, leading to an out-of-bound read violation.

  Note that the filter part of a LDAP SearchRequest message can be used to reproduce this vulnerability too, since it also has an extensibleMatch field with the type of MatchingRuleAssertion. If the MatchingRuleId is set with OID “2.5.13.45”, the time string in the matchValue field will be parsed by the vulnerable function serialNumberAndIssuerSerialCheck() too.

  A remote attacker can exploit this vulnerability by sending a crafted SearchRequest message with a Filter that contains an crafted matchValue. Successful exploitation will result in the slapd process terminating abnormally.

Triggering the Problem:

  The server must have the vulnerable product installed and running.

  • The attacker must be able to send an LDAP SearchRequest to the target.

Triggering Conditions:

  The attacker sends a crafted SearchRequest. The server will processes this request, the vulnerability is triggered.

Attack Delivery:

  The following application protocols can be used to deliver an attack that exploits this vulnerability:
    • LDAP, over port 389/TCP
    • LDAPS, over port 636/TCP

SonicWall’s, (IPS) Intrusion Prevention System, provides protection against this threat:

  • IPS: 2084 OpenLDAP slapd serialNumberAndIssuerCheck Integer Underflow 1

  • IPS: 2093 OpenLDAP slapd serialNumberAndIssuerCheck Integer Underflow 2

Remediation Details:

  The risks posed by this vulnerability can be mitigated or eliminated by:
    • Filtering attack traffic using the signatures above.
    • Allowing only trusted authenticated users to Bind to the server.
    • Applying the vendor provided patch.
  The vendor has released the following advisory regarding this vulnerability:
  Vendor Advisory