Showing items from cyber threat

3 Ransomware Precursors Laid Bare in a Cyber Truth or Dare

Lari Huttunen
Date : February 14, 2023
Categories : Public exposure ,Cyber threat ,External attack surface

Recently, with my vulnerability researcher hat on, I was thrilled to get confirmation that three serious security vulnerabilities had been used as initial access vectors in ransomware attacks. Of course I was not gleeful or happy that this had happened to the victims, far from it, but what excited me was that I happened to know an antidote for these particular attacks and many like them. Neither was my elation due to the fact that each of the vulnerabilities is on the CISA Known Exploited Vulnerabilities Catalog (KEV), which Jussi Eronen brought up in his earlier post on exposure assessment. What pushed my buttons, was that post mortem analyses of three ransomware attacks had revealed the root cause for each incident to be the exploitation of a publicly exposed known vulnerability. In other words, the incident responders had discovered the smoking guns, plural. To put it bluntly, each incident could have been avoided had the service not been directly exposed to the Internet in the first place.

WordPress Version? Make Sure You're Running the Latest Supported

Lari Huttunen
Date : October 11, 2022
Categories : Public exposure ,Vulnerability research ,Cyber threat ,External attack surface

It all started with Miles Davis in 2004, when WordPress 1.0 was released that is. Since then, the popular open source content management system’s releases have been named after a prominent Jazz musician. Researching this topic from a security perspective makes it quite clear why Jazz musicians are apt denominators for releases, since securing WordPress and keeping it secure over time must indeed feel like a jamming session at your local Jazz club. What does this mean in practice? Quoting WordPress Codex: The only current officially supported version is WordPress 6.1.1. Previous major releases before this may or may not get security updates as serious exploits are discovered. Which means that if you’re a WordPress admin, you should bookmark the WordPress Codex supported versions page to check which actual release contains the latest and greatest fixes. This is important, as from the project’s standpoint only the latest named release and its subsequent minor releases are guaranteed to get the appropriate security fixes.

Software Dependency Failures: jQuery, a Canary in the Coal Mine

Lari Huttunen
Date : September 13, 2022
Categories : Cyber threat ,Public exposure ,External attack surface ,Vulnerability research

Keeping dependencies up-to-date is challenging for any software development project and even more so from a systems administration point of view. Too often you see packaged web projects, which have been put together and then forgotten. They contain dependencies to third party libraries, which never get updated even if the application itself is maintained – at least to some extent. In my daily work I research the impact of vulnerabilities on the scale of the Internet. Most of the time, vulnerabilities in protocols, services and platforms keep me and other security professionals busy, whereas the upper layers and especially the web layer is often something of an afterthought. To find out whether there is a pink elephant in the room, I wanted to analyze a web application library which is ubiquitous and has had issues with vulnerabilities which are more or less persistent – which lead me to jQuery. My hypothesis was that software dependencies cause hidden vulnerabilities in applications considered secure, even if they are otherwise developed or maintained as they should.