1010.TEAM 🇺🇦

CYBERSECURITY / DEFENSE / INTELLIGENCE

  • Critical Apache HugeGraph Flaw Let Attackers Execute Remote Code

    ·

    Security researchers have identified a critical vulnerability in Apache HugeGraph, an open-source graph database tool.

    This flaw, if exploited, could allow attackers to execute arbitrary code remotely, posing a significant threat to systems using this software.

    The vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) identifier, highlighting its severity and the need for immediate attention by users of Apache HugeGraph.

    The specific details of the CVEs are given below.

    Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide

    CVE-2024-27348: Apache HugeGraph-Server: Command execution in gremlin

    This vulnerability, classified as a Remote Command Execution (RCE), poses a serious risk as it allows unauthorized remote execution of commands.

    The issue is prevalent in environments running Java 8 and Java 11, making various installations vulnerable to potential attacks.

    Recommended Actions:

    • Upgrade to Version 1.3.0: Users are urged to upgrade their Apache HugeGraph-Server installations to version 1.3.0.
    • This version addresses the RCE vulnerability and is optimized for Java 11, which offers improved performance and security features.
    • Enable Authentication System: Strengthening security configurations by enabling the authentication system is crucial.
    • This system helps verify and authenticate user access, providing an additional layer of security.
    • Implement Whitelist-IP/Port Function: To enhance the security of RESTful-API execution further, enabling the Whitelist-IP/port function is recommended.
    • This function restricts API access to only those IP addresses and ports that are explicitly allowed, significantly reducing the risk of malicious access.

    CVE-2024-27349: Apache HugeGraph-Server: Bypass whitelist in Auth mode

    This critical flaw affects all versions from the initial release 1.0.0 up to, but not including, the more secure 1.3.0 version.

    The vulnerability allows attackers to bypass authentication mechanisms by spoofing legitimate user credentials, potentially leading to unauthorized access and control over the HugeGraph-Server.

    Urgent Security Measures:

    • Immediate Upgrade Required: Users must promptly upgrade to Apache HugeGraph-Server version 1.3.0.
    • This version contains necessary fixes that address the authentication bypass vulnerability, closing the door on this particular method of system compromise.
    • Activate Whitelist-IP/Port: Enabling the Whitelist-IP/port function is strongly advised as an additional security precaution.
    • This security feature limits RESTful-API execution to trusted IP addresses and ports, providing a robust defense against unauthorized access.

    CVE-2024-27347: Apache HugeGraph-Hubble: SSRF in Hubble connection page

    This moderate severity issue allows attackers to send crafted requests from the server, potentially leading to unauthorized actions and information disclosure from internal systems that are otherwise inaccessible from the external network.

    Recommended Remedial Actions:

    • Upgrade to Version 1.3.0: Users of Apache HugeGraph-Hubble must upgrade their systems to version 1.3.0 as soon as possible.
    • This updated version includes patches that effectively resolve the SSRF vulnerability, enhancing the server’s security against such exploitation techniques.

    The discovery of this critical vulnerability in Apache HugeGraph underscores the importance of maintaining up-to-date software and implementing robust security measures. 

    Organizations using HugeGraph should act swiftly to apply the provided updates and secure their systems against potential threats. 

    Free Webinar: Mastering Web Application and API Protection/WAF ROI Analysis -  Book Your Spot

    The post Critical Apache HugeGraph Flaw Let Attackers Execute Remote Code appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    / /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hacker Offers Upto $300 To Mobile Networks Staff For Illegal SIM Swaps

    ·

    A SIM Swap Scam or SIM Cloning Scam exploits a vulnerability in a two-factor authentication (2FA) system that relies on SMS messages for verification codes, where attackers aim to gain control of the victim’s mobile phone number by convincing the victim’s mobile carrier to transfer the number to a new SIM card under the attacker’s control.

    The attacker typically initiates the scam by acquiring the victim’s personal information, including their phone number, which can be obtained through various means, such as data breaches, social engineering attacks (e.g., phishing emails or smishing attacks), or by purchasing the information on the dark web.

    Breakdown Of The Technical Aspects Of A SIM Swap Scam:

    Once the attacker has the victim’s phone number and potentially other personal details (e.g., Social Security Number, date of birth), they contact the victim’s mobile carrier while impersonating the victim. 

    Free Webinar | Mastering WAAP/WAF ROI Analysis | Book Your Spot

    To appear legitimate, attackers may use social engineering tactics to convince carrier representatives that they have lost their phone or SIM card and request a replacement. 

    Weaknesses in the carrier’s verification process, such as relying solely on security questions with predictable answers or a lack of multi-factor authentication for customer service representatives, can increase the scam’s success rate.

    As reported by Reddit, if the social engineering is successful, the attacker convinces the carrier to issue a new SIM card and activate it on their device, effectively porting the victim’s phone number to the attacker’s controlled SIM card.

    With the phone number under their control, the attacker can intercept any SMS messages sent to the victim’s number, including 2FA codes for various online accounts (e.g., bank accounts and social media accounts).

    Attackers can bypass 2FA security measures and potentially take over the victim’s accounts by gaining access to these codes.

    Once attackers have access to the victim’s accounts, they can wreak havoc by stealing money by transferring funds from bank accounts, making unauthorized purchases using linked credit cards, or even committing identity theft by using the victim’s personal information for fraud.

    Mitigate The Risk Of SIM Swap Scams:

    Carriers can stop relying solely on knowledge-based authentication (e.g., security questions) and implement multi-factor authentication for customer service interactions.

    This involves sending a one-time verification code to a trusted email address or registered device before processing any SIM swap requests.

    Biometric verification using fingerprints or facial recognition can be a more robust way to confirm a customer’s identity during SIM swap requests.

    Carriers can educate their customer service representatives on the tactics used in SIM Swap Scams and train them to be more vigilant in identifying and preventing such attempts.

    Looking to Safeguard Your Company from Advanced Cyber Threats? Deploy TrustNet to Your Radar ASAP.

    The post Hacker Offers Upto $300 To Mobile Networks Staff For Illegal SIM Swaps appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    / / / / /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Critical Flaw with Popular API Portal Let Attackers Launch SSRF Attacks

    ·

    A significant vulnerability in the Perforce Akana Community Manager Developer Portal has been found, allowing attackers to conduct server-side request forgery (SSRF) attacks.

    Community Manager is an advanced solution designed to assist businesses in creating an API portal that will draw in, manage, and assist developers who create applications using their APIs.

    Organizations frequently use this software to create and maintain developer portals for their APIs. 

    Typically, an SSRF attack involves the attacker forcing the server to connect to internal services only found in the infrastructure of the company. 

    Free Webinar | Mastering WAAP/WAF ROI Analysis | Book Your Spot

    In different circumstances, they might be able to force the server to establish a connection with any random external systems.

    Sensitive information, such as authorization credentials, can leak as a result.

    SSRF in Akana Community Manager Developer Portal

    This critical severity vulnerability tracked as CVE-2024-2796, has a CVSS base score of 9.3. The vulnerability was disclosed by Jakob Antonsson.

    The Akana Community Manager Developer Portal, versions 2022.1.3 and earlier, has a server-side request forgery (SSRF) vulnerability. 

    When an SSRF attack is successful, the hacker can control the target web server to carry out harmful operations or disclose private data. 

    This approach can cause significant damage to an organization, including sensitive data exposure, cross-site port attacks (XSPA), denial of service (DoS), and remote code execution.

    Affected Software Versions

    It has been confirmed that the following Perforce Akana Community Manager Developer Portal versions are impacted:

    • 2022.1.1 
    • 2022.1.2 
    • 2022.1.3

    Patches Released

    • 2022.1.1 (CVE-2024-2796 Patch) 
    • 2022.1.2 (CVE-2024-2796 Patch) 
    • 2022.1.3 (CVE-2024-2796 Patch)

    It is highly recommended that organizations utilizing the Akana Community Manager Developer Portal update to one of the patched versions right away.

    Looking to Safeguard Your Company from Advanced Cyber Threats? Deploy TrustNet to Your Radar ASAP

    The post Critical Flaw with Popular API Portal Let Attackers Launch SSRF Attacks appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    / /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Europol calls for Tech Giants to Get Lawful Access To end-to-end Encryption

    ·

    The ongoing tension between privacy rights and public safety, Europol, along with European Police Chiefs, has issued a call for tech giants to provide lawful access to encrypted communications.

    This development comes as major social media platforms, including those owned by Meta, begin to implement end-to-end encryption. This technology prevents anyone except the communicating users from accessing the messages.

    The Challenge of End-to-End Encryption

    End-to-end encryption ensures that digital conversations are private and secure from any third-party interception, including by the platforms themselves.

    Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide

    However, this level of privacy raises significant concerns for law enforcement agencies:

    • Prevention of Crime: Encrypted platforms can become safe havens for illegal activities, including child exploitation, human trafficking, and terrorism.
    • Investigation and Prosecution: The inability to access message content can hinder the investigation and prosecution of crimes.
    • Evidence Gathering: Critical evidence necessary for legal processes may become inaccessible, potentially allowing criminals to evade justice.

    Europol’s Call to Action

    During an informal meeting of the Europol hosted by the UK’s National Crime Agency on April 18, a joint declaration was made, emphasizing the urgent need for a balanced approach to encryption that considers both privacy rights and public safety.

    The meeting, which saw participation from police chiefs of all EU Member States and Schengen Associated Countries, highlighted several key points:

    • Public Safety: The primary concern is the potential increase in platforms used for harmful activities without the possibility of oversight or intervention.
    • Legal Access: This is the call for creating means through which law enforcement can legally access data, under strict conditions and oversight, to prevent or investigate serious crimes.
    • Cooperation with Tech Giants: There is a strong emphasis on collaboration between governments, law enforcement agencies, and technology companies to find solutions that balance privacy with security.

    The Role of Europol and International Cooperation

    Given its role in facilitating cross-border law enforcement cooperation within the EU and beyond, Europol’s involvement in this initiative is crucial.

    The agency’s Executive Director, Catherine De Bolle, recently met with Graeme Biggar, Director of the UK National Crime Agency, to discuss ongoing cooperation post-Brexit.

    These strategic exchanges are vital for maintaining and enhancing security across Europe.

    This call for lawful access to encrypted communications will likely spark a heated debate about balancing individual privacy rights and collective security needs.

    Tech companies, privacy advocates, and governments must engage in a nuanced dialogue to address these complex issues effectively.

    As this situation develops, the global community will be watching closely to see how privacy and security can coexist in the digital age and what compromises, if any, are necessary to protect citizens while respecting their rights to private communication.

    Free Webinar: Mastering Web Application and API Protection/WAF ROI Analysis -  Book Your Spot

    The post Europol calls for Tech Giants to Get Lawful Access To end-to-end Encryption appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • U.S. Imposes Visa Restrictions on 13 Linked to Commercial Spyware Misuse

    ·

    The U.S. Department of State on Monday said it’s taking steps to impose visa restrictions on 13 individuals who are allegedly involved in the development and sale of commercial spyware or who are immediately family members of those involved in such businesses. “These individuals have facilitated or derived financial benefit from the misuse of this technology, which

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Russia’s APT28 Exploited Windows Print Spooler Flaw to Deploy ‘GooseEgg’ Malware

    ·

    The Russia-linked nation-state threat actor tracked as APT28 weaponized a security flaw in the Microsoft Windows Print Spooler component to deliver a previously unknown custom malware called GooseEgg. The post-compromise tool, which is said to have been used since at least June 2020 and possibly as early as April 2019, leveraged a now-patched flaw that allowed for

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Human rights violations rising in several countries, State Department says

    ·

    Russian-occupied Ukraine was home to some of the worst abuses, according to new report.

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Controversial surveillance program gets 2-year extension

    ·

    Biden signed a law that extends Section 702 authorities into 2026—and lacks proposed limits on intelligence agencies’ right to gather and search Americans’ communications.

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Doctors prefer Pentagon’s old health-records system to its new one

    ·

    User satisfaction “increased minimally” last year for MHS Genesis, the electronic-records system installed under a 2015 contract, a GAO survey found.

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • China’s new stealth bomber ‘nowhere near as good’ as US’s, intel official says

    ·

    U.S. could win a war with China today, but would suffer heavy losses, the official told reporters.

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶