Weekly News Digest #8

800,000 SonicWall VPNs vulnerable to new remote code execution bug

Over 800,000 internet-accessible SonicWall VPN appliances are vulnerable to CVE-2020-5135, a critical bug with a rating of 9.4 out of 10. It is assumed to happen under active exploitation once proof-of-concept code is made publicly available.

Link here

Barnes & Noble Hack: A Reading List for Phishers and Crooks

Barnes & Noble is advising that it has been hacked, possibly exposing personal data for customers. The company did offer condolences in what’s become a response to data breaches. They also announced that the company possibly was hacked over not updated Pulse Secure VPN service. 

Link here

Google Warns of Zero-Click Bluetooth Flaws in Linux-based Devices

Google project zero research center notice of a new set of zero-click vulnerabilities in the Linux Bluetooth software stack that can allow a nearby unauthenticated, remote attacker to execute arbitrary code with kernel privileges on vulnerable devices. An attacker can send a malicious Bluetooth packet which gains access to the device to the victim.

Link here

Microsoft Releases Patches For Critical Windows TCP/IP and Other Bugs

On October 2020 Patch Tuesday, Microsoft published the patches for 87 newly discovered security vulnerabilities, including two critical remote code execution (RCE) flaws in Windows TCP/IP stack and Microsoft Outlook. The flaws, 11 of which are categorized as Critical, 75 are ranked Important, and one is classified Moderate in severity, affect Windows, Office and Office Services, and Web Apps, Visual Studio, Azure Functions, .NET Framework, Microsoft Dynamics, Open Source Software, Exchange Server, and the Windows Codecs Library.

Link here

FIN11 hackers jump into the ransomware money-making scheme

One of the most popular financially motivated cybercrime groups FIN11 jumps into the ransomware money-making scheme. A group of researchers published an overview of the FIN11 activity and its transition to the ransomware scene. The researchers treat the group as a separate threat actor, noting its significant overlap in tactics, techniques. Based on their investigation, the researchers have moderate confidence that FIN11 works from the Commonwealth of Independent States (CIS – former Soviet Union countries).

Link here