Today’s Cybersecurity Threats and Trends - 08/06/2024

Perilous patching and old exploits exposed.

Author

J.W. Croley
August 06, 2024

1. Apache’s Alarming Zero-Day

Primary Threat: A new zero-day vulnerability in Apache OFBiz ERP, tracked as CVE-2024-38856, has been discovered. This flaw allows attackers to execute remote code on affected systems, potentially leading to full control over vulnerable servers. With Apache OFBiz being a widely used open-source ERP system, this zero-day poses a significant risk to organizations that rely on it for business operations.

  • ​MITRE Tactics: Initial Access, Execution

  • Risk: High – Potential for widespread server compromise and data exfiltration.

2. Ivanti’s Infiltration Incident

Primary Threat: A critical authentication bypass vulnerability in Ivanti's Endpoint Manager Mobile (EPMM), tracked as CVE-2023-35082, is now under active exploitation. This flaw allows attackers to gain unauthorized access to sensitive information and backdoor compromised servers.

  • MITRE Tactics: Initial Access, Privilege Escalation, Defense Evasion.

  • Risk: High – Unauthorized access and persistent threats within enterprise environments.

3. Specula Tool’s Sinister Strategy

Primary Threat: The newly released Specula tool is exploiting an old Microsoft Outlook vulnerability (CVE-2017-11774) for remote code execution. This tool allows attackers to set malicious home pages in Outlook, enabling them to execute arbitrary code on Windows systems. Despite the vulnerability being patched years ago, the threat actors are leveraging it to target unpatched systems.

  • MITRE Tactics: Execution, Persistence, Defense Evasion

  • Risk: Medium – Targeted attacks on unpatched systems leading to potential data breaches.

4. North Korean Network Nightmare

Primary Threat: North Korean state-sponsored hackers are exploiting a VPN update flaw to deploy malware across compromised networks. Current proactive defensive measures include: strict software distribution approval policies and administrator authentication for the final installation stage.

  • MITRE Tactics: Initial Access, Execution, Persistence.

  • Risk: High – Network infiltration and long-term espionage capabilities.

5. Google’s Glaring Zero Day

Primary Threat: Google has patched a critical zero-day vulnerability in the Android kernel, tracked as CVE-2024-36971. This flaw was being actively exploited in the wild, allowing attackers to execute arbitrary code on unpatched devices, putting millions of Android users at risk.

  • MITRE Tactics: Privilege Escalation, Execution

  • Risk: High – Potential for widespread device compromise and unauthorized access.

IN SUMMARY:

This week’s cyber news is packed with peril!

A new Apache zero-day is threatening ERP systems, while Ivanti and Google scramble to patch critical flaws.

North Korean hackers are back with VPN exploits, and even an old Outlook vulnerability is being revived by crafty attackers.

Remember: It’s better to be paranoid than pwned! So patch early, patch often, and keep those systems secure!

J.W.