Latest / Daily DefSec Brief / Ivanti VPN zero-days, exploited Windows flaw, Docker Hub token mix-up | Cyber Security News Oct 14
Transcript
- Jerry: When you move into a new house, you change the locks. For two years, Docker Hub didn't. This is the daily DefSec brief for Wednesday, october fourteenth, twenty twenty six. If you do only one thing today, push October's Windows updates. One, attackers are already taking over Ivanti Connect Secure VPNs without a login. Yes, again. The one Veloxity investigated was fully patched. Once in, they took the directory credentials stored on the box. Then they went looking for laps passwords and bitlocker keys. Ivanti's own integrity checker didn't notice. Ivanti shipped a fix yesterday. The step that gives full control still has no patch. Upgrade today and change the password on the account the VPN uses to read your directory. Number two, attackers are already using a Windows flaw that skips the warning on downloaded files. The fixes in October's updates. They cover more than 1400 flaws, a new record. October was also the last update Windows Server 2012 R2 will ever get. Push the updates starting with the machines where people open email. 3. No attacks yet, but two Fortinet flaws let someone without a password take over a Forti sandbox or a Forti SIEM Those are the tools your security team uses to watch everything else. It turns out the sandbox has a side door. Upgrade both. No attacks reported yet, but a Chrome update a week after Chrome 155 fixes seven critical bugs. Update it and force the restart. 5. No attacks yet, but Copilot in Visual Studio and SQL Server Management Studio could be made to run commands. A prompt hidden in something it reads was enough. Copilot wasn't allowed to edit its own configuration file. Put a dot on the end of the file name and it could. Windows treats both names as the same file. The check treated them as different. Update Visual Studio and Management Studio on your developer and database admin machines. Six. SAP's October notes fix four critical flaws And there are no attacks reported yet. The worst is in SAP's Python toolkit for cloud apps. It can send the app's own credentials to an attacker's server. another is in Visual Composer. Depending on how it's set up, a user with few rights could take over a system it connects to. Apply the October notes and have your developers update SAP's Python toolkit. 7. An attacker used stolen credentials to get into a European bank. The way in was a remote access gateway of vendor ran and it wasn't enforcing strict authentication. The attacker then spent months scanning thousands of machines and guessing admin passwords. It wasn't subtle and it ran for months. Require MFA on every way into your network, including the ones the vendor runs for you. Eight, whoever claims an abandoned GitHub repository could publish new versions of the NPM packages that trusted it. For trust settings that had never been used to publish, NPM checked the repository's name, not its permanent ID. Researchers counted more than 1,500 exposed packages and haven't seen it used. GitHub has tightened the check. If you publish NPM packages, review which repositories you've told npm to trust. Nine, no attacks yet, but a crafted PDF can run code through Ghostscript. A lot of Linux servers use it for previews and thumbnails. So far the exploit has only worked on a test server built for it. Update GhostScript and anything that processes uploaded files. ten. Docker had been a flaw for two years And as far as Docker can tell, no attacker used it. Converting an account into an organization handed its access tokens to the new owner. The token secrets didn't change, so an attacker could convert their own account, name you as the owner, and keep a token that worked as you. That token could push images under your name. Docker fixed it on September 30th. It has already shut off the transfer tokens and emailed anyone affected. Either way, revoke any Docker Hub tokens you don't recognize. Docker has since changed the locks. Once more, push October's Windows updates. Thanks for watching. Sources are in the show notes. Like, subscribe and share the show with a friend who uses it. I'm Jerry Bell and the daily Def Sec Brief will be back again tomorrow.