GSMA - Security and Fraud’s Post

Good insights here from our CIO & CISO, covering increasing Gov/public sector adoption of ethical hacking approaches, and key learnings from Bugcrowd’s new Vulnerability Trends Report... 👀

With #QRcodes becoming a ubiquitous part of our daily lives, bad actors will continue to take advantage of vulnerabilities to launch attacks, predicts Zimperium's Kern Smith. Having a #MobileFirstSecurity strategy will be necessary for a QR-code friendly business. #MobileSecurity #WeSecureMobile #2024predictions

With #QRcodes becoming a ubiquitous part of our daily lives, bad actors will continue to take advantage of vulnerabilities to launch attacks, predicts Zimperium's Kern Smith. Having a #MobileFirstSecurity strategy will be necessary for a QR-code friendly business. https://bit.ly/3RQrWru #MobileSecurity #WeSecureMobile #2024predictions Byron Acohido

"The threat actor exploited two Ivanti Connect Secure zero-day vulnerabilities to target Mitre's Virtual Private Networks, then dug deep into the organization's VMware infrastructure using a compromised administrator account." "The hackers used session hijacking to bypass multi-factor authentication requirements, then "employed a combination of sophisticated backdoors and webshells to maintain persistence and harvest credentials." "At the time we believed we took all the necessary actions to mitigate the vulnerability," the post read, "but these actions were clearly insufficient." Any organization can become victim of a cyber-attack. Having a mature risk management and incident response program can only reduce the risk - there is certainly a lot of value in that! #DOD #CMMC #RiskManagement #Mitre #BoardofDirectors #CSuite https://lnkd.in/gSqprzeu

🔒 Ivanti Avalanche: Strengthening Endpoint Security #️⃣ Security Update Highlights 📅 Published by SC Staff 🔧 Ivanti addresses 27 vulnerabilities in its Avalanche mobile device management solution, including critical heap overflow bugs in WLInfoRailService and WLAvalancheService components. 🚨 Critical Issues: 💥 CVE-2024-24996 and CVE-2024-29204 could lead to arbitrary command execution without user interaction. 🔍 Other Risks: 🔓 High- and medium-severity flaws could enable arbitrary command execution, data access, remote code execution, and denial-of-service attacks. 🔒 Immediate Action Required: 🔧 Upgrade to Avalanche 6.4.3 to mitigate risks, even though no active exploitation has been detected. #️⃣ #IvantiAvalanche #EndpointSecurity #PatchManagement #DeviceSecurity #VulnerabilityManagement

🚨🚨All supported versions of the Ivanti Connect Secure—often abbreviated as ICS and formerly known as Pulse Secure—are still affected🚨🚨 Background: On Jan. 10, 2024, Ivanti disclosed two new vulnerabilities in their Ivanti Connect Secure (ICS) and Ivanti Policy Secure gateways: CVE-2023-46805 and CVE-2024-21887. The first CVE is a High severity authentication bypass vulnerability, and the second CVE is a Critical severity command injection vulnerability. These vulnerabilities impact all supported versions of the gateways. Details: These vulnerabilities, when exploited conjointly, facilitate remote code execution on servers, impacting all supported versions of Ivanti Connect Secure (formerly known as Pulse Secure). Notably, threat actors leverage a sophisticated evasion technique known as "living off the land," employing legitimate software and tools to obfuscate their activities. Remediation as of Jan 24th: 🚨‼️Given the gravity of these vulnerabilities and the potential repercussions of exploitation, users are strongly advised to prioritize the mitigation of these vulnerabilities, even if it necessitates a temporary suspension of VPN usage. #Cybersecurity #vulnerabilitymanagement #avanti

This is kind of scary, but not at all surprising, and one of many reasons why i love working with Operational Technologies and critical infrastructure. The OT systems are often forgotten, dusty and overlooked. Management tend to focus on securing the IT environment after they read about the latest ransomware scare. #otsecurity #criticalinfrastructure #cybersecurity https://lnkd.in/deCMrajM

Do not hardcode passwords or tokens in code (Secrets Management) 👩💻 In an era where data breaches are all too common, securing your secrets has never been more critical. As developers, we hold the keys to the kingdom - but are we doing enough to protect them?  This carousel dives into the essential dos and don'ts of secrets management, offering actionable insights for anyone looking to bolster their security posture.  Let's navigate through these best practices together and fortify our defenses against potential threats. ✅ Sarat Lingamallu Satheesh Challa #FlyingDuck #DotnetSecurity #SupplyChainSecurity #SBOM #SoftwareDevelopment #InnovationInTech

Do not hardcode passwords or tokens in code (Secrets Management) 👩💻 In an era where data breaches are all too common, securing your secrets has never been more critical. As developers, we hold the keys to the kingdom - but are we doing enough to protect them?  This carousel dives into the essential dos and don'ts of secrets management, offering actionable insights for anyone looking to bolster their security posture.  Let's navigate through these best practices together and fortify our defenses against potential threats. ✅ #FlyingDuck #DotnetSecurity #SupplyChainSecurity #SBOM #SoftwareDevelopment #InnovationInTech

Palo Alto Networks has released remediation guidance for a critical security flaw impacting PAN-OS that has come under active exploitation. The vulnerability, tracked as CVE-2024-3400 (CVSS score: 10.0), could be weaponized to obtain unauthenticated remote shell command execution on susceptible devices. The flaw has been addressed in multiple versions of PAN-OS 10.2.x, 11.0.x, and 11.1.x. According to reports, the issue has been exploited as a zero-day since at least March 26, 2024, by a threat cluster tracked as UTA0218. The activity, codenamed Operation MidnightEclipse, entails the use of the flaw to drop a Python-based backdoor called UPSTYLE that's capable of executing commands transmitted via specially crafted requests. For more information, check out Palo Alto Networks' remediation guidance. #PaloAltoNetworks #cybersecurity #remediation #networksecurity https://lnkd.in/eDgm5w2T