China calls for internet security barrier. Advice for companies to keep pace with federal privacy requirements.

Over 130,000 Solar Panel Installations Exposed Online

Based on recent reports from Cyble, there has been a large attack vector for threat actors in the Solar industry’s PV (Photo-Voltaic) diagnostic and monitoring systems.

These systems are used to measure efficiency, detect faults, and optimize overall operations.

The research also mentioned that these systems are exposed over the internet, making them a prime target for threat actors.

These Distributed Energy Resources (DERs) are used to monitor and provide access to energy grids, remotely troubleshoot these systems, and many others.

Internet-Facing PV Monitoring and Diagnostic Systems

As these systems play a major role in the energy sector, securing these systems requires a high priority.

If threat actors target vulnerable PV monitoring systems, it can affect multiple energy-based entities and organizations.

Internet Exposed PV Systems

Reports indicate that there are over 130,000 PV monitoring and diagnostic systems exposed over the internet, which is a wide attacking surface for threat actors.

In addition to spear-phishing, Denial of Service (DoS), and physical damage to the assets, threat actors can also target PV inverter controls that can inflict great damage.

Types of Vulnerabilities in the Systems

The Vulnerabilities in the PV industry include 

Outdated firmware

Public exposure of sensitive information

Poor access control

Improper Network segmentation

Unsecured Communication

Default passwords

These kinds of security misconfigurations and lack of security in these systems are actively being exploited in other sectors like Financial, Education, etc.

Furthermore, bypassing the authorization protocol of these systems is becoming easy for threat actors.

Impact on Energy Sector

The energy sector is one of the most crucial sectors in a country which is connected with several other sectors, including the Military and Intelligence. Targeting this sector will impact beyond the sector.

The largest impacts it can lead to include reduced energy production, energy supply and demand imbalance, EV vehicles disruption, charging infrastructure and mobility services disruption and can also lead to economic impacts with downtime in businesses resulting in financial losses.

As the energy crisis is on the rise, it is recommended for organizations in the energy sector to stay secure from threat actors and patch and upgrade all the systems. Cyble has published a complete report on how PVs are targeted.

“AI-based email security measures Protect your business From Email Threats!” – Request a Free Demo.

The post Over 130,000 Solar Panel Installations Exposed Online appeared first on Cyber Security News.

   Read More 

Cyber Security News 

Hackers Exploit Pre-Authentication RCE Vulnerabilities in Adobe ColdFusion

Adobe ColdFusion is a Java-based, commercial web app development platform using CFML for server-side programming.

ColdFusion is primarily known for its tag-based approach, which is unique. Besides this, it is also popular among developers for its adaptability across various industries.

The cybersecurity researchers at Fortinet recently uncoverd that Windows and macOS users face risk from Adobe ColdFusion vulnerabilities, targeted by remote attackers for pre-authentication RCE exploits.

Technical Analysis

Hackers target the URI ‘/CFIDE/adminapi/accessmanager.cfc,’ injecting payloads via a POST request into the ‘argumentCollection’ parameter.

By using the interactsh tool, researchers spotted probing activities in July. While this tool generates domain names for testing exploits and monitoring vulnerabilities.

Attacker’s webpage at different times on 8/24

Threat actors can misuse it to validate the vulnerabilities by monitoring the domains, and here are the related domains collected by security experts:-

mooo-ng[.]com

redteam[.]tf

h4ck4fun[.]xyz

Probing activities involving other domains (Source – Fortinet)

Attackers employ reverse shells for exploiting system vulnerabilities, like in Adobe ColdFusion, using Base64-encoded payloads.

It’s been identified that from several IP addresses, all these attacks originated, and here below we have mentioned them:-

81[.]68[.]214[.]122

81[.]68[.]197[.]3

82[.]156[.]147[.]183

The malware was distributed from a publicly accessible HTTP file server:-

103[.]255[.]177[.]55[:]6895

Malware Variants

Here below, we have mentioned all the malware variants that the security analyst discovered:

XMRig Miner: It’s a software program that uses CPU cycles for Monero mining for both legitimate and malicious purposes.

DDoS/Lucifer: It’s a hybrid bot with cryptojacking, DDoS, C2, vulnerability exploitation, and DDoS capabilities, which was reported in 2020.

RudeMiner: It’s also a hybrid version of a malware bot that targets the crypto wallet and carries out DDoS attacks.

BillGates/Setag: This backdoor version is mainly known for hijacking, C2 server communication, and attacks. However, in this scenario, through the checking procedure with the file “bill.lock,” this malware could be detected.

Researchers have been monitoring this flaw for weeks and have seen many attacks against Adobe ColdFusion. They continue to be exploited in the wild despite introducing fixes to address these flaws. Users should upgrade affected systems to prevent threat probing.

IoCs

Attacker’s IP Address:

81[.]68[.]214[.]122

81[.]68[.]197[.]3

82[.]156[.]147[.]183

Malware Server’s IP Address:

103[.]255[.]177[.]55:6895

Files:

7c6f0bae1e588821bd5d66cd98f52b7005e054279748c2c851647097fa2ae2df

590d3088ed566cb3d85d48f4914cc657ee49b7d33e85c72167e7c72d81d4cb6c

808f0f85aee6be3d3f3dd4bb827f556401c4d69a642ba4b1cb3645368954622e

4f22fea4d0fadd2e01139021f98f04d3cae678e6526feb61fa8a6eceda13296a

The post Hackers Exploit Pre-Authentication RCE Vulnerabilities in Adobe ColdFusion appeared first on Cyber Security News.

   Read More 

Cyber Security News