runZero’s Post

Hey everyone, A little while ago, I had noticed a new project released by the NSA, called Elitewolf. https://lnkd.in/gnXk-iKt To summarize, the ELITEWOLF set of rules can be used to detect mostly routine activity involving ICS controllers in your environment. These rules can be used as a part of an audit package to establish which hosts have been interacting with which controllers at what times, etc. I took a little bit of time and effort to optimize the rules as best I could, and have them added to the Emerging Threats Open ruleset, under the ET SCADA category. For the most part, the rules will detect things like FTP banners, Default SSL certificate data, Accessing specific web pages, Uploading/Downloading specific files via FTP, Specific telnet banners and responses, as well as the use of default credentials or failed login in attempts in some cases. While the rules may not be overly interesting, and/or overtly malicious, they can be analyzed in bulk and sorted by source/destination address to hunt for anomalous interactions with ICS controllers from unexpected sources or to unexpected destinations. I wrote a somewhat lengthy post on the integration of this ruleset into the ETOPEN ruleset, and included some options on how to reduce alert fatigue from these rules as necessary over on our community forum: https://lnkd.in/gz5DW3SK Thank you again for all of your support, and happy hunting.

Difenda is issuing a high-severity vulnerability (CVE-2024-28995) in SolarWinds Serv-U, which allows threat actors to access sensitive files. This flaw is actively being exploited, but you can take immediate action to safeguard your systems. Protect your assets with Difenda’s expert insights and actionable solutions. 👉 Discover the full advisory now ➡️ https://hubs.ly/Q02H9pk60

Want to learn more about the #ScreenConnect vulnerability but without the technical jargon? Check out our latest blog to get a breakdown of the #SlashAndGrab vulnerability. https://zurl.co/qmv3 Benchmark Network Solutions will protect your network: https://zurl.co/5LsK

Quarkslab finds serious, remotely exploitable vulnerabilities in EDK II, the de-facto open source reference implementation of the UEFI spec. The post Remotely Exploitable ‘PixieFail’ Flaws Found in Tianocore EDK II PXE Implementation appeared first on SecurityWeek.

PoC for critical Progress Flowmon vulnerability released (CVE-2024-2389): More details of and a proof-of-concept exploit for an unauthenticated OS command injection vulnerability (CVE-2024-2389) in Flowmon, Progress Software’s network monitoring/analysis and security solution, have been published. The critical vulnerability has been disclosed and patched by Progress earlier this month. “Currently, we have not received any reports that this vulnerability has been exploited, and we are not aware of any direct impacts on customers,” the company says in an advisory that was last updated on … More → The post PoC for critical Progress Flowmon vulnerability released (CVE-2024-2389) appeared first on Help Net Security.

Security: Even though a fix is available, threat actors remain actively targeting Linear eMerge E3-Series to exploit a 5-year-old critical vulnerability. #ICS #industrialcybersecurity #scadasecurity #OTsecurity https://bit.ly/43D9K8M

Security: Even though a fix is available, threat actors remain actively targeting Linear eMerge E3-Series to exploit a 5-year-old critical vulnerability. #ICS #industrialcybersecurity #scadasecurity #OTsecurity https://bit.ly/43D9K8M

Enhance your #NetworkSecurity by combining #Suricata with #ELKStack. This #integration provides in-depth visibility into network security events, empowering swift responses to potential #threats. #Cybersecurity #CyberThreats #ITSecurity

Enhance your #NetworkSecurity by combining #Suricata with #ELKStack. This #integration provides in-depth visibility into network security events, empowering swift responses to potential #threats. #Cybersecurity #CyberThreats #ITSecurity

Earlier this week an important #vulnerability was published. This vulnerability titled ‘OpenSSH: Possible Remote Code Execution Due To A Race Condition In Signal Handling’ has been assigned CVE-2024-6387. In our newest #post you learn what this vulnerability is, understand if your product might be affected, and possible resolutions ➡ https://lnkd.in/dnEXs5UP --- 'Prompt identification and resolution of vulnerabilities are key to keeping your product secure. With Security Pattern's SBOM & Vulnerability Management Solution, SUM Platform, you receive notifications if your product is affected by a new or existing vulnerability. All our customers have been notified about CVE-2024-6387 and advised of the resolution.' Learn more about SUM: https://lnkd.in/dZATWN2y