D-Link DIR-806 Devices Command Injection

/in /by

D-Link Corporation is a multinational networking equipment manufacturing corporation headquartered in Taipei, Taiwan. D-Link’s products are geared towards the networking and communications market. Its business products include switches, surveillance network cameras, firewalls, iSCSI SANs and business wireless, while consumer products cover consumer wireless devices, broadband devices, and the Digital Home devices. DIR-806 is a wireless AC750 dual band router and access point

An issue was discovered in D-Link DIR-806 devices. There is command injection in function hnap_main, which calls system() without checking the parameter that can be controlled by user, and finally allows remote attackers to execute arbitrary shell commands with a special HTTP header.
While this vulnerability is a couple years old, SonicWall Capture Labs threat research team recently spotted attacks exploiting this vulnerability in the wild.

Command Injection Vulnerability
The goal of command injection attack is the execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user-supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation

D-Link DIR-806 Devices Command Injection| CVE-2019-10891
A command injection vulnerability exists in D-Link routers.
Following are some exploits in the wild. The Home Network Administration Protocol(HNAP) allows querying and setting of configuration options on network devices . It is based on SOAP therefore an attacker can send HTTP POST messages with a special header Soapaction.

This header is used to download malicious payload(in this case it is wget.sh file) from an attacker controlled server. The attacker then executes the malicious script on the vulnerable device.

This vulnerability is patched.

SonicWall Capture Labs provides protection against this threat via following signatures:

    • IPS 15501:D-Link DIR-806 Devices Command Injection
    • IPS 13635:D-Link Devices HNAP SOAPAction-Header Command Injection

IoCs
dcf241331018349c57d5636cc4076676727364178bf75fd5fc4003969e866b2a
6182e41e66eac130893d600836e6957dd28ffeded793a2b71aebd6ec947ca358
47b396259c4b24091e7bedb876bbac6658768cd6b70826322388d1bb1de33f11
bba1631d1891c9d62bd1a48d5b064ba1b1e65563b237c7bff4afbd049f2c5fa1

Threat graph

How SonicWall’s Supply-Chain Strategies Are Slicing Wait Times

/0 Comments/in /by

Cybersecurity customers in 2022 occupy an increasingly uneasy middle ground. On one side are elected officials, news writers and security professionals all urgently warning that attack surfaces are widening, cybercrime is rising, and you really ought to have upgraded your security posture yesterday. And on the other side are equally urgent warnings from cybersecurity vendors that the components you need to do exactly that … won’t be in stock for several months.

With reports of wait times already stretching into 2023, how can you ensure your organization is prepared to face today’s cyberattacks?

“If you want a firewall next year, call them. If you want one next week, call us.”

The outlook for SonicWall customers, however, is quite different. Products are in stock when they’re needed, and time from order to receipt is a small fraction of what’s being estimated with other vendors.

Currently, SonicWall is fulfilling 95% of orders within 3 days.

Before the pandemic, this sort of lead time was admirable; today, it’s nearly unheard-of. Even more remarkable, SonicWall has achieved this track record during a period of record sales. The introduction of SonicWall’s Gen 7 product line, along with exceptional third-party testing results and industry accolades, has fueled a 33% increase in new customer growth and a 45% increase in new customer sales.

To understand why this is such an accomplishment, it helps to understand why today’s supply-chain environment has ensured such lead times are the exception rather than the rule.

The Ongoing Struggles of the Supply Chain

The COVID-19 pandemic is often discussed as having a “ripple effect,” like a rock being dropped in the water. But when it comes to the effects on manufacturing and shipping, it’s more like an earthquake, with unpredictable aftershocks unleashing chaos in greater magnitude than the original event.

Material shortages, cost increases and shipping challenges have been felt across the board, and roughly 94% of the Fortune 1000 have seen pandemic-related supply-chain disruptions

In a world where few things are manufactured in the same place they’re ultimately purchased, shipping is among the most crucial links in the supply chain. There is currently a 12-plus-week door-to-door ocean freight delivery extension — and those delays are continuing to grow as consumer spending increases and congestion worsens.

The Port of Los Angeles last year saw more containers than any year in its history, surpassing the previous high-water mark by 13%. While numbers aren’t yet in for March 2022, January and February 2022 have both set new records, suggesting that this year may be even busier.

This volume has created unprecedented strain: During the past few months, The New York Times reports that container ships have been stuck at ports for a week on average, up 4% compared with all of 2021 and an increase of 21% over the start of the pandemic.

The outlook isn’t much better once containers move inland: reports of trains backed up for dozens of miles aren’t uncommon, and trucking companies are facing a worker shortage nearly 80,000 strong.

And while all industries have been shaken up, security vendors and other tech companies have been especially vulnerable to the worldwide shortage of computer chips, with many companies simply unable to supply products to meet their customers’ security needs.

SonicWall’s Secret Weapon: Preparation

But if everyone is experiencing these problems, what are people doing about it? Not much, as it turns out. When consulting firm Alix Partners surveyed 3,000 CEOs in early 2022, fewer than half reported that they were taking longer-term action to ameliorate supply-chain challenges, while a majority said they were instead relying on short-term solutions.

SonicWall has been able to succeed in this climate because it bucked this trend — and it did so early on. The company’s current goal is that any product ordered be “on the shelf” and ready to ship. This has required SonicWall to change many of its internal processes, as well as how the company works with suppliers and ships goods — a process that began long ago.

More than 18 months ago, SonicWall’s operations department began noticing an increase in lead times. The shift was subtle at first, starting with a few decommits from suppliers that were missing their targets by a week or two. Suppliers weren’t yet officially announcing that lead times were going up, but these delays were enough to propel the company’s supply-chain management team into action.

At that time, the company planned roughly six to nine months out. To accommodate increasing delays, the outlook was increased to about 12 months, and since then it’s been extended up to 16 months for some products. These projections have helped ensure that if one part of the supply chain slows down or breaks, partners and customers are impacted as little as possible.

At the same time, SonicWall began working with its suppliers to identify at-risk components, and quickly set about redesigning products (without impacting performance or capabilities) to take advantage of readily available supplies. Using available components not only eases manufacturing, it also eliminates the possibility that a delay at the factory could create timing issues that could plague the process from start to finish.

SonicWall has also embraced flexibility when it comes to shipping. Because the time from when products are picked up from a supplier’s warehouse until the time they arrive at a SonicWall warehouse has increased from four weeks to eight to 12 weeks, supply-chain managers are constantly on the lookout for which ports are likely to be the least congested two to three months from now. And when it becomes difficult to find storage containers or book freight on time, products are also shipped by air when necessary.

While many of SonicWall’s competitors are struggling to fill orders, these steps have ensured that SonicWall has a strong inventory of products on hand and is able to provide customers with the solutions they need, when they need them. If your current security vendor can’t deliver, reach out to a SonicWall expert — you could be up and running by this time next week.

SonicWall SMA 1000 Series Earns Best-Of Enterprise VPNs Award from Expert Insights

/0 Comments/in /by

SonicWall is pleased to announce that it has been awarded an Expert Insights “Best-Of” award for its enterprise VPN solution: SMA 1000 Series.

SonicWall earned this coveted award thanks to its ability to empower remote workforces without sacrificing security or ease of use. The SonicWall SMA 1000 Series easily handles the influx of remote users on large, distributed networks by enabling organizations to scale up to a million remote VPN users.

“The SMA 1000 Series appliances enable organizations to deliver best-in-class secure access to any network or application, anytime, from anywhere and any device — all while minimizing attack surfaces,” said SonicWall Executive Director of Product Marketing Kayvon Sadeghi. “We are incredibly honored to see our enterprise VPN solution be recognized by Expert Insights.”

Expert Insights’ Best-Of Awards are designed to recognize cloud technology providers across multiple software categories including cloud software, security and storage, highlighting up to 11 vendors in each category.

Best-Of award winners are chosen by Expert Insights’ editors, based on extensive research into each solution’s merits as a solution provider, customer reviews and how they compare to their competitors.

All recipients of these awards were specifically selected for their impressive features, strong capabilities, and positive user experiences. Expert Insights also takes into consideration pricing, target markets and the deployment process when selecting the top vendors.

You can view the full list of Expert Insights award winners here.

Award image

Cybersecurity News & Trends – 04-01-22

/0 Comments/in /by

Not only did we pick up more news hits for the 2022 SonicWall Cyber Threat Report, SonicWall saw global reports on the fantastic record-breaking year for its channel partners. Industry news in cybersecurity and hacking didn’t take a pause last week. First, the health care equipment manufacturer Philips discovered a vulnerability in products that use an e-alert system. We’ll wait to see if that item gets more airplay next week. Second, Crypto hackers stole more than $600 million from Axie Infinity’s Ronin gaming network – and this is a new record haul. Finally, we found an excellent overview and summary of the “Strengthening American Cybersecurity Act” legislation this month. And in other news, Chinese hackers target VMware with Deep Panda, and hackers are abusing fake emergency subpoenas to force companies to give up important information.

SonicWall News

Apple Forced to Issue Emergency Fixes for Two Zero-Days

IT Wire: Apple issued emergency fixes for two zero-day vulnerabilities that were being exploited in the wild and affected iPhones, iPads, and Macs. In the same report, over the past 12 months, SonicWall threat researchers have diligently tracked the meteoric rise in cyberattacks and trends and activity across all threat vectors.

Cyber Security Risks and Companies’ Readiness

Financial Times: Research from cyber security company SonicWall supports a more positive outlook [that major business recognizes the risks]. “From mid-2020 to 2021, the number of CEOs who said cyber security risks were the biggest threat to short-term growth nearly doubled,” said SonicWall chief executive Bill Conner in its recent cyber threat report.

Cyber Heroes Prepare for Battle

RED/MSU Denver: The bad guys – cybercriminals, in this case – appear to be winning. Ransomware attacks have risen 62% worldwide since 2019 and by nearly 160% in North America, according to a 2021 SonicWall Cyber Threat Report. Last year’s attack on Colonial Pipeline was among those which crippled energy infrastructure that delivers about 45% of fuel for the East Coast. As for the good guys: There aren’t enough of them.

World Backup Day: Building a Tiered Backup Strategy for Ransomware Recovery

ToolBox: In 2021, SonicWall recorded an alarming 623.3 million ransomware attacks globally, averaging 2,170 attempts per customer. With each attack aimed at exploiting weaknesses in IT networks and endpoint devices to inject ransomware, organizations can’t afford to lower their guard for a moment.

Can The Financial Sector Manage Hybrid Working Security?

Finance Monthly: Ransomware is not the only threat, of course. Today, a wide range of attack methods need to be considered and resisted. For example, SonicWall’s Cyber Threat Report recently recorded 56.9 million IoT attacks, 5.6 billion malware attacks, and 4.8 trillion intrusion attempts.

Digital Rights Management Market is Growing at A Rate Of 17% With The Rise In Security Concerns

Globe Newswire (TBRC Business Research): according to the 2021 Cyber Threat Report by SonicWall, there has been a 62% increase in ransomware since 2019. This number is still rising as cybersecurity attacks become more complex and challenging to detect. Digital rights management is also used by healthcare organizations and financial services firms to ensure compliance with data privacy and protection standards such as HIPAA (Health Insurance Portability and Accountability) and the Gramm-Leach-Bliley Act (GLB Act or GLBA). Hence, the rise in security concerns is expected to create avenues for the digital rights management market growth.

Mitigating Security Risks Posed by Hybrid Working

TechRadar Pro: A wide range of attack methods need to be considered and resisted. SonicWall’s Cyber Threat Report recently recorded 56.9 million IoT attacks, 5.6 billion malware attacks, and 4.8 trillion intrusion attempts.

SonicWall Posts Record-Breaking Year as Channel Partners Thrive with Unparallel Product Demand

Yahoo Finance (Cision Press Release): Today, SonicWall announced that 2021 was its best year. Propelled by delivering high-demand products, including the evolution of its Generation 7 next-generation firewalls and a laser focus on its customers, SonicWall showed record levels of sales and profitability in 2021.

SonicWall Creció Un 20% En Iberia, Ayudado Por Sus Más De 900 Partners

IT User (Spain): La compañía cuenta a nivel global con más de 17.000 partners activos, que han aumentado su cuota de mercado en franjas de precios y segmentos de mercado clave. SonicWall ha aumentado un 33% su cartera de nuevos clientes y un 45% las ventas en nuevos clientes, y ha registrado un aumento del 10% en los ingresos recurrentes anuales de los partners.

El Canal Ayuda a SonicWall a Cosechar en 2021 El Mejor Resultado De Su Historia

Dealer World (Spain): De histórico se puede calificar el año 2021 para SonicWall, que se ha traducido en los mejores resultados en la historia de la compañía. Resultados que se han visto impulsados por la venta de productos de alta demanda, incluida la evolución de sus firewalls de próxima generación, Generation 7, y un enfoque 100% dirigido al cliente, SonicWall logró niveles récord de ventas y rentabilidad en 2021; y especialmente por el trabajo de su Canal.

SonicWall Hace Frente a Las Ciberamenazas e Incrementa Las Oportunidades De Los Canales

Reseller 15 Años (Mexico): Basado en el Informe de Ciberamenazas 2022 de SonicWall, el fabricante líder en Inteligencia de Amenazas de ransomware, compartió el trabajo que está realizando junto con sus socios para enfrentar el aumento de casi todas las amenazas monitoreadas, ciberataques y ataques digitales maliciosos, donde se incluye el ransomware, las amenazas cifradas, el malware IoT y cryptojacking.

SonicWall Live-Webinar: Meet the Cybersecurity Requirements of Hybrid Working Models

InfoPoint Security (Germany): Join the SonicWall MINDHUNTER series and learn from security expert Stephan Kaiser what business and security challenges this fast-growing and dynamic IT landscape poses for your IT managers.

SonicWall Reports Record Year for Products and Channel Engagement

Channel Life (Australia): SonicWall has reported its best year on record, attributing its new range of products, customer focus and successful channel engagement. Despite challenging economic conditions, the company posted strong financial results, strengthening its pipeline growth. They reported a 33% increase in new customer growth and a 45% increase in recent customer sales.

Industry News

Philips Issues Cybersecurity Warning Over e-Alert MRI Monitoring System

Fierce BioTech: Philips is currently facing a possible hacking risk following discovering a vulnerability in its eAlert MRI monitoring systems. This could be a significant event due to the high use of Philips medical instruments in the U.S. The e-Alert system has sensors that monitor MRI machines and issues alarms when specific parameters are exceeded. These include temperature and humidity in the technical and exam rooms and the status of the machine’s power supply. They also monitor the chiller, cryo-compressor, and helium levels. In addition, magnet placement is also observed.

Hackers Steal Over $600 Million From Video Game Axie Infinity’s Ronin network

CNN: A new crypto-hack has taken out a gaming-oriented blockchain network that supports Axie Infinity. In one of the most significant crypto hacks, hackers stole approximately $625 million in Ethereum and USDC, two currencies. According to a company blog post, attackers stole private keys used to verify transactions on the network. Malicious actors used these keys to create fake withdrawals. The malicious actors were able to forge fake withdrawals. According to the blog post, the network promised to “ensure that no users’ funds were lost.” The company stated that most of the stolen funds are still in the crypto wallet of the hacker.

Three Cybersecurity Fundamentals Businesses Get Wrong

Forbes: What do all businesses, regardless of industry and size, have in common? They are at risk from cybersecurity attacks like ransomware and customer data breaches. These attacks can cause financial ruin for businesses and force them to close. Hiscox, an insurance company, found that cyberattacks had affected one in six companies. At the same time, when businesses spend a lot of money to protect themselves from these types of attacks, they often do it without a plan. Written by a cybersecurity professional who claims to have worked with many financial institutions, this article is well worth reading. It has the perspective of a cybersecurity professional and offers essential insights that many businesses are dealing with today.

An Overview of the Strengthening American Cybersecurity Act

J.D. Supra: President Joe Biden signed the Strengthening American Cybersecurity Act on March 15, 2022. This overview gives us a concise understanding of the act’s provisions and how they may affect business. For instance, the reviewer notes that the act focuses on the need for rapid disclosures and solid protections for private-sector workers in the cybersecurity field. This legislation establishes a cyber incident and ransomware response protocol for businesses that operate in many core sectors of the U.S. economic system. These industries include communications, financial services, chemical, communication, energy, food & agricultural, government facilities and healthcare, transportation and waste management. The law is not only targeted at organizations that are critical infrastructure but will also have wide-reaching consequences for all businesses.

Local Cybersecurity Gaining Traction

S.C. Media: StateScoop reports on local cybersecurity information sharing and resource sharing. Federal support via the $1 billion cybersecurity grant program has led to increased cyber collaboration among local governments, according to Michael Makstman, San Francisco Chief Information Security Officer, and Greg McCarthy, Boston CISO. As a result, they co-founded The Coalition of City CISOs.

Chinese Hackers Target VMware Horizon Servers with Log4Shell to Deploy Rootkit

Hacker News: Deep Panda, a persistent Chinese threat, has been observed exploiting Log4Shell vulnerability on VMware Horizon servers. This was to install a backdoor and a novel rootkit onto infected machines to steal sensitive data. Deep Panda is also known as Shell Crew, KungFu Kattens and Bronze Firestone. Recent attacks “targeting technology providers for command and control infrastructure building,” according to Secureworks.

Hackers Abusing Power of Subpoena Via Fake “Emergency Data Requests”

Krebs on Security: Criminal hackers have discovered a terrifying new “method” to steal sensitive customer data from Internet service providers and phone companies. This involves hacking into email accounts linked to government agencies and police departments, then sending unauthorized requests for subscriber information while claiming that the requested information cannot wait for a court order as it is an urgent matter of life or death. The Verge reported that Apple and Meta gave user data to hackers, who feigned emergency request orders usually sent by law enforcement. Both companies gave out user data to hackers in the middle of the massive surge in hacks SonicWall reported last year.

Suppose federal, state, or local law enforcement agencies want to know who owns a particular account at a social networking firm or which Internet addresses that account has used previously? In that case, they must submit a court-ordered warrant. This notification forges that entire legal process. Most of these bad actors who make these fake requests are teenagers. According to Bloomberg, cybersecurity researchers believe the teen mastermind behind Lapsus$ hacking organization may have inspired the group to take this type of action. Another group called the Recursion Team might be responsible for last year’s string of similar attacks. While the group has since disbanded, they have some members who joined Lapsus$ under different names. Bloomberg was informed by officials involved in the investigation that hackers had accessed accounts in several countries and targeted numerous companies over a few months beginning in January 2021.

In Case You Missed It

A Github repository exists for AndroSpy spyware for Android

/in /by

SonicWall Threats Research team identified a version of AndroSpy in the wild. Interestingly, there exists a Github repository for this version of the malware. This repository was created a few months back and appears to be fairly active.

Sample specifics

  • MD5: 1749d7830b1593fbe9eec1946002dee7
  • Application Name: Critical Device Settings
  • Package Name: com.kernel32.criticalprocess

 

This app requests a number of dangerous permissions, few of them are listed below:

  • WRITE_EXTERNAL_STORAGE
  • READ_EXTERNAL_STORAGE
  • READ_CALL_LOG
  • WRITE_CALL_LOG
  • CAMERA
  • READ_SMS
  • ACCESS_FINE_LOCATION
  • RECORD_AUDIO
  • READ_CONTACTS
  • WRITE_CONTACTS
  • SEND_SMS
  • BIND_DEVICE_ADMIN
  • RECEIVE_SMS
  • WRITE_SMS
  • PROCESS_OUTGOING_CALLS
  • DELETE_PACKAGES
  • SYSTEM_ALERT_WINDOW
  • ACCESSIBILITYSERVICE

 

This version of AndroSpy boasts a number of functionalities, some of them are listed below:

  • Access camera
  • Access files
  • Live microphone
  • Keylogger
  • SMS manager
  • Shell terminal
  • Access contacts
  • Call Logs
  • Check installed apps
  • Live screen
  • Disable Google Play Protect

 

Similar threats

Searching for this app on Virustotal showed a number of related apps, some with different names and icons:

 

This indicates that this threat is being used and propagated with malicious intent. As mentioned earlier, the attacker server ad other configurations can be viewed under resources>res>values>strings

Additional observation

The github repository shows a BTC wallet address for donations towards this project:

 

Overall this is a spyware that is available on Github as a framework. This spyware is being used as legitimate application in some cases.

 

Sonicwall Capture Labs provides protection against this threat using the signature listed below:

  • AndroidOS.Androspy.GT

 

Indicators of Compromise:

  • 1749d7830b1593fbe9eec1946002dee7
  • 603b7c441289ff7a15d3a458add66f2d
  • 0e9d6812f7ed7f912fab2f74e143ea76
  • 4f48d7d1258d52db555e0aae4b5136d6
  • 93c0c8c706a219d4194110035898f36d

JAVA Spring Framework Spring4Shell RCE Vulnerability

/in /by

Overview:

  A Spring MVC (Model-View-Controller) or Spring WebFlux (Parallel version of Spring MVC which supports non-blocking reactive streams) application running on JDK (Java Development Kit) 9+ may be vulnerable to Remote Code Execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat (Apache Tomcat as the Servlet container) as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

  .ear files: An enterprise archive (EAR) file is a compressed file that contains the libraries, enterprise beans, and JAR files that the application requires for deployment.

  .jar files: The .jar files contain libraries, resources and accessories files like property files.

  .war files: The war file contains the web application that can be deployed on any servlet/jsp container. The .war file contains jsp, html, javascript and other files necessary for the development of web applications.


  Vendor Homepage

CVE Reference:

  This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2022-22965.

  CVE Listing

Common Vulnerability Scoring System (CVSS):

  The overall CVSS score is 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

  Base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), based on the following metrics:
    • Attack vector is network.
    • Attack complexity is low.
    • Privileges required is none.
    • User interaction is none.
    • Scope is unchanged.
    • Impact of this vulnerability on data confidentiality is high.
    • Impact of this vulnerability on data integrity is high.
    • Impact of this vulnerability on data availability is high.
  Temporal score is 9.8 (E:X/RL:X/RC:X), based on the following metrics:
    • The exploit code maturity level of this vulnerability is not defined.
    • The remediation level of this vulnerability is not defined.
    • The report confidence level of this vulnerability is not defined.

  CVSS Calculator Metrics

Technical Overview:

  The vulnerability is caused by the getCachedIntrospectionResults method of the Spring framework wrongly exposing the class object when binding the member properties:

  Using the HTTP POST method below; you will access the member object properties, the binding process (bindRequestParameters) in the Spring framework implementation will call the getCachedIntrospectionResults method to get and set the object property in the cache. This class object can be remotely controlled by simply submitting a payload as shown:

  Modifying the Tomcat log configuration and remotely upload a JSP web shell (The Payload, with Headers):


  Sending Payload, Placing File called (tomcatwar.jsp) into the (webapps/ROOT) directory with Curl:

  Accessing the newly placed file called (tomcatwar.jsp) on the server (Reverse Shell):

Triggering the Problem:

  • JDK 9 or higher.
  • Apache Tomcat as the Servlet container.
  • Spring Framework versions 5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions.
  • Packaged as WAR container.

Triggering Conditions:

  The attacker sends a maliciously crafted request to the vulnerable server. The vulnerability is triggered when the Tomcat log configuration (class.module.classLoader.resources.context.parent.pipeline.first) members (pattern, suffix, directory, prefix, and fileDateFormat) are manipulated and changed with the payload above.

Attack Delivery:

  The following application protocols can be used to deliver an attack that exploits this vulnerability:
    • HTTP
    • HTTPS

SonicWall’s, (IPS) Intrusion Prevention System, provides protection against this threat:

  • IPS: 2609 JAVA Spring Framework Command Injection (Spring4Shell)
  • IPS: 13431 JAVA Spring Framework Remote Code Execution (Spring4Shell) 2
  • IPS: 13432 JAVA Spring Framework Remote Code Execution (Spring4Shell) G-1
  • IPS: 13443 JAVA Spring Framework Remote Code Execution (Spring4Shell) G-2
  • IPS: 13444 JAVA Spring Framework Remote Code Execution (Spring4Shell) IOC

  Please note that if your web service/server is accessible over HTTPS, then enabling of Server DPI-SSL is necessary for the above signature to detect exploits targeting this vulnerability.

Remediation Details:

  The risks posed by this vulnerability can be mitigated or eliminated by:
    • Applying the vendor supplied patch.
    • Detecting and blocking malicious traffic using the signatures above.
  The vendor has released the following advisory regarding this vulnerability:
  Vendor Advisory

World Backup Day: Because Real Life Can Have Save Points Too

/0 Comments/in , /by

You’ve been playing for hours. You’ve faced two tough enemies in a row, and all signs indicate you’re about to take your remaining 12 hit points straight into a boss fight.

Up ahead a glowing stone beckons like a glimmering oasis.

“Would you like to save your progress?” a popup asks as you approach.

Um. YES!

But as obvious a choice as that seems, when the same opportunity presents itself in real life, a shocking number of people don’t take advantage of it.

What Do You Have to Lose?

The digital revolution has brought about unprecedented efficiency and convenience, ridding us of the need for bulky filing cabinets, media storage, photo albums, rolodexes and more. But every time we outsource the storage of our data to the cloud, we become a little more reliant on digital devices that are anything but infallible.

According to WorldBackupDay.com, more than 60 million computers worldwide will fail this year, and more than 200,000 smartphones—113 every minute—will be lost or stolen. But while the devices themselves are replaceable, their contents often aren’t. Imagine what could be at stake: All the photos you’ve taken of your children over the past two years. Every message you ever sent your spouse, all the way back to the very beginning. The last voicemail you ever got from your grandmother. All could disappear in an instant, even when associated with cloud accounts, as experienced below.

But the loss isn’t always just sentimental. Sometimes it’s professional too, as journalist Matt Honan found out in 2012. Honan used an iCloud account for his data, but had no backups — and when hackers gained access to the account, they remotely wiped his phone, tablet and computer. They also took over and deleted his Google account. “In the space of one hour,” Honan told Wired, “my entire digital life was destroyed.”

Good Backups Are Good Business

Businesses have fallen victim to devastating data loss, as well. In 1998, Pixar lost 90% of its film “Toy Story 2,” then in progress, due to the combination of a faulty command and insufficient backups.

And when social media/bookmarking site Ma.gnolia.com experienced a database failure resulting in the loss of all user data, it ultimately shuttered the company. “I made a huge mistake in how I set up my [backup] system,” founder Larry Halff said of the incident. 

The Cultural Cost of Insufficient Backups

While World Backup Day’s primary goal is to encourage people to create and check their backups, it also aims to spark discussion of an enormous task: how to preserve our increasingly digital heritage and cultural works for future generations.

Due to insufficient archiving and backup practices, many cultural properties have already disappeared. For example, an entire season of the children’s TV show “Zodiac Island” was lost forever when a former employee at the show’s internet service provider deleted over 300GB of video files, resulting in a lawsuit over the ISP’s lack of backups.

And decades before, a similar fate befell the now-iconic sci-fi series “Dr. Who.” The Film Library of Britain and BBC Enterprises each believed the other party was responsible for archiving the material. As a result, the BBC destroyed its own copies at will, resulting in the master videotapes of the series’ first 253 episodes being recorded over or destroyed. Despite the existence of secondary recordings and showrunners obtaining copies from as far away as Nigeria, 97 episodes are still unaccounted for and presumed lost for good.

How to Ensure Your Digital Future Today

With so much at stake, you’d think almost everyone would back up their data at least occasionally. This isn’t the case, however. According to WorldBackupDay.com, only about 1 in 4 people are backing up their data regularly, and an astounding 21% have never made a backup.

This phenomenon is also seen at the corporate level. While 45% of companies have reported downtime from hardware failure and 28% reported a data loss event in the past 12 months, FEMA reports that 1 in 5 companies don’t have a disaster recovery/business continuity plan (and thus don’t typically have current backups.) With 20% of SMBs facing catastrophic data loss every five years, being left unprepared is much less an “if” than a “when.”

The difference in outcome for these businesses is stark. Ninety-three of businesses that experienced data loss and more than ten days of downtime filed for bankruptcy within a year. But 96% of businesses that had a disaster recovery plan fully recovered operations.

While a good backup plan will require ongoing attention, today is a great day to start — and even one backup is a tremendous improvement over no backups at all. The World Backup Day website is full of information on online backup services, external hard drive backup, computer backup, smartphone backup, creating a NAS backup, and other methods of preserving your data.

If you’re like many IT professionals and already understand the importance of backups, today’s a perfect day to test your backups out and make sure they’re still fully operational. It’s also a good opportunity to share the importance of backups with bosses, colleagues and friends.

After all, if you’re an individual, you won’t get an “extra life” to go back and relive all the memories you might lose if your device fails. And if you’re a small- or medium-sized business owner and lose all your data, having backups might be the difference between “Continue” and “Game Over.” On World Backup Day and every day, the choice is up to you.

To learn more about backups, visit WorldBackupDay.com.

CRN Honors SonicWall With 5-Star Rating in 2022 Partner Program Guide

/0 Comments/in /by

We’re thrilled to announce that SonicWall is being celebrated by CRN, a brand of The Channel Company, with a prestigious 5-star rating in its 2022 Partner Program Guide.

CRN’s annual Partner Program Guide provides a definitive list of the most notable partner programs from industry-leading technology vendors that provide innovative products and flexible services through the IT channel. The 5-star rating is achieved only by select vendors that deliver the best of the best, going above and beyond in their partner programs to help push growth and positive change.

“SonicWall has been dedicated to enabling its partners to succeed now and into the future,” said HoJin Kim, SonicWall SVP, Worldwide Channel, North American Sales. “We always try to anticipate our partners’ needs to help them exceed their annual sales goals and objectives. We appreciate the recognition from CRN as a world-class partner.”

The Partner Program Guide provides the channel community with a deep dive into the partner programs offered by IT vendors, service providers and distributors. Companies are scored based on their investments in program offerings, partner profitability, partner training, education and support, marketing programs and resources, sales support, and communication. A 5-star rating helps narrow the field to find the best fit, identifying the most rewarding partner programs and providing crucial insight into their strengths.

“CRN’s Partner Program Guide delves into the strengths of each organization’s partner program in order to honor those that consistently support and promote good change within the IT channel,” said Blaine Raddon, CEO of The Channel Company. “As innovation fuels the speed and complexity of technology today, solution providers want partners that can keep up with and assist their growing business.”

The 2022 Partner Program Guide will be featured in the April 2022 issue of CRN and online at www.CRN.co˚m/PPG.

Cyberattacks on Government Skyrocketed in 2021

/0 Comments/in , /by

Over the past several years, cybersecurity researchers (including those at SonicWall) have noted a growing shift away from the “spray-and-pray” tactics that dominated much of the past decade, to a more targeted “big-game hunting” approach.

We’ve seen the effects of this strategic transition for a little while, as attackers have increasingly looked for targets that would cause the most disruption, that would have the most valuable information, and so on. And accordingly, in 2021 cybercriminals focused a lot of their attention on local, state and federal governments.

The year’s headlines offered snapshots of this trend, as threat actors launched attacks on a diverse set of targets including the governments of Indonesia and Israel, India’s prime minister, Belgium’s ministry of defense, Australia’s government-owned telecommunications systems, and multiple U.S. defense firms.

But a look at the exclusive threat data from the 2022 SonicWall Cyber Threat Report tells a larger picture about when, how and how much government customers are being targeted as compared with those in other industries.

Ransomware

In 2021, global ransomware volume skyrocketed, rising 105% year over year. But while “The Year of Ransomware” spared no country, region or industry, the stats were particularly grim for those in government. Ransomware attempts among government customers rose a staggering 1,885% — more than double the increase seen in healthcare (+755%), education (152%) and retail (21%) combined.

Malware

For 2020 to 2021, global malware — affecting all customers across all regions and industries — fell 4%. But among government customers, malware actually increased 94%. The percentage of SonicWall customers targeted further highlights this rise: Each month, an average of 19.6% of government customers saw a malware attempt.

Government devices were increasingly attacked last year, as well. In 2021, IoT malware increased 6% globally — but among government customers, these attacks spiked 46%. Government customers were second only to those in education in terms of how likely they were to see an attempted attack, with an average of roughly 9% of customers targeted by IoT malware each month.

Cryptojacking

Unfortunately, IoT malware attacks aren’t the only way that cybercriminals leverage government customers’ devices against them. Cryptojacking, a type of attack in which cybercriminals use a victim’s device to mine cryptocurrency without their knowledge or consent, also spiked last year, buoyed by record-high cryptocurrency prices.

Global cryptojacking volume in 2021 jumped 19% year-over-year, reaching the highest point ever recorded by SonicWall Capture Labs threat researchers. But this jump disproportionately affected those involved in government: Cryptojacking attempts on government customers rose 709% in 2021.

Governments Fight Back

But as cyberattacks on government continued to increase in 2021, efforts at the state, federal and local level increasingly turned to strengthening defenses . At least 45 U.S. states considered their own cybersecurity bills in 2021, up 18% from 2020. And many of their cybersecurity efforts were bolstered by the passage of a historic U.S. infrastructure bill in November 2021, which included $1 billion for state, local, tribal and territorial cybersecurity.

Advances were made at the federal level, as well. U.S. President Joe Biden signed an executive order in May 2021 aimed at modernizing the government’s response to cyberattacks, joining Japan, Australia, Germany and countless other countries in passing measures to improve national security in 2021.

Biden reiterated his commitment to cybersecurity, particularly concerning the nation’s infrastructure, in a statement last week:

“From day one, my administration has worked to strengthen our national cyberdefenses, mandating extensive cybersecurity measures for the federal government and those critical infrastructure setors where we have authority to do so, and creating innovative public-private partnerships and initiatives to enhance cybersecurity across all our critical infrastructure.

“My administration will continue to use every tool to deter, disrupt and, if necessary, respond to cyberattacks against critical infrastructure,” Biden said.

As part of the United States’ increased focus on cybersecurity, the Department of Justice in June announced the formation of its Ransomware and Digital Extortion Task Force, increasing the resources and personnel available for pursuing cybercriminals. As a result of the efforts made by this task force and other enforcement agencies, members of the REvil ransomware gang, the Trickbot group, the DarkSide ransomware group and more were brought to justice in 2021.

Cybersecurity News & Trends – 03-25-22

/0 Comments/in /by

This week, we continue to pick up new mentions for the 2022 SonicWall Cyber Threat Report, including an excellent product review for Capture Client by BizTech Magazine. Our own Debasish Mukherjee, Vice President of Regional Sales APAC, was interviewed by regional industry trade journal, Express Computer. Industry news remains largely focused on national reactions to the ongoing Ukrainian crisis, with President Biden issuing an ominous-sounding warning to businesses that evolving Russian cyber threats are “coming.” Some observers added to our collective fear that undersea cables used by nearly every country around the globe are vulnerable. Meanwhile, health data of almost 50 million Americans were compromised last year, HubSpot was breached, members of the gang that hacked Okta and Microsoft were arrested in the UK, and Nestlé denies Anonymous claims that it was hacked.

SonicWall News

Securing Information in A Boundless World Is Virtually Impossible

Express Computer: An exclusive interview with Debasish Mukherjee, Vice President, Regional Sales APAC, SonicWall Inc, shares the significance of new threats to cybersecurity and the impact on Indian companies while heavily citing the SonicWall Cyber Threat Report 2022.

Review: SonicWall Capture Client Makes Security Seamless

BizTech Magazine: A recent test of SonicWall’s advanced endpoint protection solution left us impressed with its ability to provide continuous behavioral monitoring, easy threat hunting, and a multilayered heuristic approach to determining potential network anomalies. It all combines to produce highly accurate determinations of active threats with very little noise or false positives.

Irish Charity Rehab Group Targeted by Cyberattack

Silicon Republic: SonicWall’s latest cyberthreat report highlighted the variety of cybersecurity threats that increased to unprecedented levels in 2021, with ransomware attacks up 105pc and encrypted threats increasing 167pc.

Ransomware Attacks Rose 105% In 2021

Staffing Industry Analysts: There were 623 million ransomware attacks globally in 2021, an increase of 105% from the previous year, according to a report released last month by SonicWall, a San Jose, California-based cybersecurity firm. Separately, staffing firms can take steps to reduce the chance of becoming victims of such attacks.

Investing In Thematics: Big Data

Benzinga: In 2020, ransomware attacks increased by 62% globally and 158% in North America compared to 2019, citing data from the 2021 SonicWall Cyber Threat Report. The story uses the data to conclude that malicious attacks have real consequences for business, infrastructure, and end-users beyond lost data and operational disruptions.

Mobile Traffic Dominates with Spike In Digital Fraud

IT Wire: The past year has seen a meteoric rise in ransomware incidents worldwide. Over the past 12 months, SonicWall threat researchers have diligently tracked the meteoric rise in cyberattacks and trends and activity across all threat vectors.

What Are the Biggest Ransomware Trends Facing US Businesses?

Insurance Business Magazine: SonicWall’s 2022 Cyber Threat Report described 2021 as “one of the worst years for ransomware ever recorded” as attack volume rose to a staggering 623.3 million. The number is equivalent to 2,170 ransomware attempts per customer and almost 20 attempts every second.

Big Data Cloud Computing and Cybersecurity

Seeking Alpha: In 2020, ransomware attacks increased by 62% globally and 158% in North America compared to 2019, according to the SonicWall Cyber Threat Report.

Microsoft And Okta Investigate Data Breach Claims

Silicon Republic: SonicWall’s latest cyberthreat report highlights the variety of threats that increased to unprecedented levels in 2021, with ransomware attacks up 105pc and encrypted threats increasing 167pc.

Industry News

“It’s coming”: President Biden warns of “evolving” Russian cyber threat to US

CBS News: Monday’s warning by President Biden culminated with “evolving intelligence” that suggests Russia has explored options for cyberattacks against US critical infrastructure. Biden addressed the Business Roundtable, a group of some of America’s largest corporations. He also said that “the magnitude of Russia’s cyber capability is quite consequential… and it’s coming.” Although there is no evidence of a specific threat to cybersecurity, Anne Neuberger, Biden’s deputy national security advisor for cyber and emerging technologies, explained to reporters Monday that US officials had observed “preparatory works” linking to nation-state actors. This activity could indicate an increase in US companies scanning websites and searching for vulnerabilities.

Threat Looms of Russian Attack On Undersea Cables To Shut Down West’s Internet

France 24: The twin global crises of cyber warfare and war in Ukraine have revived fears of a digital catastrophe scenario in which Russia would take over the internet, destroying its undersea cables. Since the outbreak of the Ukrainian crisis, this possibility has been raised many times, even by military leaders. For example, according to Guardian newspaper, Admiral Tony Radakin of the British Armed Forces stated, in January 2022, that Moscow could “put at danger and potentially exploit the real world’s information system, which are undersea cables that run all around the globe.” The influential American think tank Atlantic Council shared Radakin’s theory and published an article about the possibility of the Kremlin cutting global internet cables.
Anyone looking to disrupt cybersecurity and global connectivity will find that there are more than 430 undersea Internet cables. These cables are often seen as the weakest link in the worldwide network. They “look like large garden hoses lying at sea,” according to Tobias Liebetrau, an expert in international relations at the Danish Institute for International Studies. Except for integrated surveillance systems, which can only send alerts if there’s danger nearby, the cables don’t have any special protection.

Russian Spies Indicted in Worldwide Hacks of Energy Industry, Including Kansas Nuclear Plant

Politico: The US Department of Justice claims that three Russian spies spent five years targeting 135 countries’ energy infrastructures to allow the Russian government remote control of power stations. Wired Magazine reported that the attacks spanned 2012 to 2014. According to an indictment in Kansas’s district court, the three FSB officers — Pavel Aleksandrovich Akulov, Mikhail Mikhailovich Gavrilov, and Marat Valeryevich Tyukov — conspired to conceal malware in software updates used to control power plant equipment. This tactic, along with others, allowed the accused agents to install malware on more than 17,000 devices worldwide. These attacks were disclosed previously in 2018.

HubSpot Data Breach Ripples Through Cryptocurrency Industry

Threat Post: A HubSpot rogue employee was fired for leaking information about cryptocurrency customers. More than 135,000 customers use HubSpot. Analysts suspect the breach could affect approximately 30 crypto-companies, including BlockFi, NYDIG, Swan Bitcoin, Circle, and Pantera Capital. The breach reminds us of the amount of data CRM systems can gobble up.

Health Data Breaches Swell In 2021 Amid Hacking Surge

Politico: According to analysis, nearly 50 million Americans saw their sensitive healthcare data compromised in 2021. This is a threefold increase over the previous three years. These cybersecurity incidents were reported by health care providers, insurers and state officials last year. According to the analysis, more than half of all states and Washington, DC had more than one in 10 residents affected by unauthorized access to their health data. Hacking was responsible for almost 75% of these breaches, up from 35% in 2016.

Alleged Microsoft, Okta Hackers Arrested In UK

The Hill: British authorities arrested seven individuals on Thursday suspected of hacking major tech companies, including Okta and Microsoft, also reported by Reuters. The individuals arrested are between the ages of 16 and 21 and are likely members of the hacking group. The Verge also reported that this group had taken responsibility for some major security breaches at tech companies, including Nvidia, Samsung, and Ubisoft. On Wednesday, reports surfaced indicating an Oxford-based teenager is the mastermind of the group. City of London Police did not say if this teenager was among those arrested

Nestlé Denies Anonymous Hacked It

Fortune Magazine: Nestlé has denied claims that hacker collective Anonymous published sensitive information it stole from the Swiss food giant as punishment for doing business in Russia. Responding to increasing consumer pressure, Nestlé said it is reducing its offering of consumer brands in Russia, including Kit Kat and Nesquik, as quickly as possible in response to Vladimir Putin’s unprovoked war of aggression against Ukraine.

In Case You Missed It