The all in one place for non-profit security aid.
Guest Sean Gallagher, Principal Researcher with Sophos Xops team, joins us to discuss “‘FleeceGPT’ mobile apps target AI-curious to rake in cash. Joe shares some listener feedback from Jon about “No Stupid Questions” podcast. Dave’s story is from Reddit about a free piano scam. Joe’s got a story on a woman pleading with her bank to stop a fake wire transfer, but they were too busy. Our Catch of the Day comes from Rob about a fake student loan help ticket. Read More
The CyberWire
FIN7 Hacker Group Leverages Malicious Google Ads to Deliver NetSupport RAT
The financially motivated threat actor known as FIN7 has been observed leveraging malicious Google ads spoofing legitimate brands as a means to deliver MSIX installers that culminate in the deployment of NetSupport RAT.
“The threat actors used malicious websites to impersonate well-known brands, including AnyDesk, WinSCP, BlackRock, Asana, Concur, The Wall Read More
N2K and Unit 42 by Palo Alto Networks expand Threat Vector into a standalone podcast on N2K media network
N2K and Palo Alto Networks® Unit 42® announced today the launch of their standalone podcast, Threat Vector, on the N2K media network, building on the success of their bi-weekly segment on the CyberWire Daily podcast. Read More
The CyberWire
Patch now! BIG-IP Configuration utility is vulnerable for an authentication bypass
Tech company F5 has warned customers about a critical authentication bypass vulnerability impacting its BIG-IP product line that could result in unauthenticated remote code execution.
F5 provides services focused on security, reliability, and performance. BIG-IP is a collection of hardware platforms and software solutions that provides a wide range of services, including load balancing, web application firewall, access control, and DDoS protection.
Two security researchers found a critical vulnerability in the configuration utility of several versions of BIG-IP:
17.1.0 (Fixed in 17.1.0.3 + Hotfix-BIGIP-17.1.0.3.0.75.4-ENG)
16.1.0 – 16.1.4 (Fixed in 16.1.4.1 + Hotfix-BIGIP-16.1.4.1.0.50.5-ENG)
15.1.0 – 15.1.10 (Fixed in 15.1.10.2 + Hotfix-BIGIP-15.1.10.2.0.44.2-ENG)
14.1.0 – 14.1.5 (Fixed in 14.1.5.6 + Hotfix-BIGIP-14.1.5.6.0.10.6-ENG)
13.1.0 – 13.1.5 (Fixed in 13.1.5.1 + Hotfix-BIGIP-13.1.5.1.0.20.2-ENG)
In a post, F5 said:
“This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.”
F5 also said customers can also use iHealth to check if they are vulnerable.
The Common Vulnerabilities and Exposures (CVE) database lists publicly disclosed computer security flaws. This CVEs is listed as:
CVE-2023-46747 (CVSS score 9.8 out of 10): Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
BIG-IP defines a self IP address as an IP address on the BIG-IP system that you associate with a virtual local area network (VLAN), to access hosts in that VLAN. A customer normally assigns self IP addresses to a VLAN when they initially run the Setup utility on a BIG-IP system.
An authentication bypass happens when someone claims to have a given identity, but the software does not prove or insufficiently proves that the claim is correct.
Remote code execution (RCE) is when an attacker accesses a target computing device and makes changes remotely, no matter where the device is located.
In general you can say that if the BIG-IP Traffic Management User Interface is exposed to the internet, then the system in question is impacted. It’s estimated that there are over 6,000 external-facing instances of the application.
The researchers say exploitation of the vulnerability could lead to a total compromise of the F5 system by executing arbitrary commands as root on the target system.
“A seemingly low impact request smuggling bug can become a serious issue when two different services offload authentication responsibilities onto each other.”
If you are running a vulnerable version, F5 has a list of updates here.
If you can’t install a fixed version for any reason, then F5 advises you can block Configuration utility access through self IP addresses or block Configuration utility access through the management interface.
We don’t just report on vulnerabilities—we identify them, and prioritize action.
Cybersecurity risks should never spread beyond a headline. Keep vulnerabilities in tow by using Malwarebytes Vulnerability and Patch Management.
Malwarebytes