Cloud Hosting

A security researcher has found several vulnerabilities in a number of Ruckus wireless routers, which the networking giant has since patched.

Gal Zror told TechCrunch that the vulnerabilities he found lie inside in the web user interface software that runs on the companys Unleashed line of routers.

The flaws can be exploited without needing a routers password, and can be used to take complete control of affected routers from over the internet.

Routers act as a gateway between a home or office network and the wider internet. Routers are also a major line of defense against unauthorized access to that network. But routers can be a single point of failure. If attackers find and take advantage of vulnerabilities in the routers software, they can control the device and gain access to the wider internal network, exposing computers and other devices to hacks and data theft.

Zror said his three vulnerabilities can be used to to gain root privileges on the router the highest level of access allowing the attacker unfettered access to the device and the network.

Although the three vulnerabilities vary by difficulty to exploit, the easiest of the vulnerabilities uses just a single line of code, Zror said.

With complete control of a router, an attacker can see all of the networks unencrypted internet traffic. An attacker also can silently re-route traffic from users on the network to malicious pages that are designed to steal usernames and passwords.

Zror said that because many of the routers are accessible from the internet, they make very good candidates for botnets. Thats when an attacker forcibly enlists a vulnerable router or any other internet-connected device into its own distributed network, controlled by a malicious actor, which can be collectively told to pummel websites and other networks with massive amounts of junk traffic, knocking them offline.

There are thousands of vulnerable Ruckus routers on the internet, said Zror. He revealed his findings at the annual Chaos Communication Congress conference in Germany.

Ruckus told TechCrunch it fixed the vulnerabilities in the 200.7.10.202.92 software update, but said that customers have to update their vulnerable devices themselves.

By design our devices do not fetch and install software automatically to ensure our customers can manage their networks appropriately, said Ruckus spokesperson Aharon Etengoff. We are strongly advising our customers and partners to deploy the latest firmware releases as soon as possible to mitigate these vulnerabilities, he said.

Ruckus confirmed its SmartZone-enabled devices and Ruckus Cloud access points are not vulnerable.

Its very important for the customers to know that if theyre running an old version [of the software], they might be super vulnerable to this very simple attack, said Zror.

Originally posted here:
A ton of Ruckus wireless routers are vulnerable to hackers - TechCrunch

As ransomware attacks proliferate across state and local governments, agencies can turn to a key federally funded ally the Multi-State Information Sharing and Analysis Center.

The MS-ISAC and the Elections Infrastructure Information Sharing and Analysis Center are staffed and operated by the Center for Internet Security through a cooperative agreement with the U.S. Department of Homeland Security at the CIS Security Operations Center24 hours a day, 365 days a year.

DHS designated the MS-ISAC as the key cyberthreat resource for the prevention, protection, response, and recovery for the state, local, tribal and territorial (SLTT) community. Throughout the past year, for example, the MS-ISAC helped SLTT agencies fight ransomware such as RobbinHood and LockerGoga.

Leveraging the experience of the MS-ISAC, CIS established the EI-ISAC following the 2016 elections. The EI-ISAC is fully operational in all 50 states, with over 2,000 local election offices as members. Membership is free to all SLTT agencies. EI-ISACs 24/7 operations share and correlate information on cyberthreats affecting members, including threats against internet-connected voting systems.

MORE FROM STATETECH: Discover how vulnerability scans can help secure election systems.

Sounds impressive, but what does the MS-ISAC really provide for its members? As a membership organization working exclusively with the SLTT community, the MS-ISAC has unparalleled insight into the cybersecurity threats and challenges faced by state and local government entities. Whether an agency is a large state IT department or a one- person operation handling a local school district, the MS-ISAC can help defend an organization from cyberthreats.

The CIS SOC is the MS-ISACs front line in the battle against cyberthreat actors. Trained SOC analysts and intelligence professionals work tirelessly reviewing logs and threat vectors, responding to calls and helping members navigate the complex world of cybersecurity. In conjunction with the SOC, the MS-ISAC offers members access to a premier computer emergency response team. This team provides forensic services, malware and vector identification.

The SOC team reviews thousands of logs more precisely, 37 petabytes of data per month looking for indicators of compromise. The data about cybercrimes affecting SLTT governments comes from open sources and nonpublic threat information received from the federal government.

In addition, the MS-ISACs intrusion detection system, called Albert, has been deployed across the United States and its territories. This passive monitoring device resides just outside members networks, where internet traffic meets members systems. The signature-based device is not a firewall; rather, it monitors network traffic to find suspicious activity. If a signature fires, the SOC is notified. Analysts review the event and determine what the signal is.

If warranted, the SOC then notifies an entity of a possible issue. The CIS ensures a very low false positive result thanks to a user review.

MORE FROM STATETECH:Keep an eye on these4 IT trends in state and local government in 2020.

The MS-ISAC ties this information together to provide its membership with timely alerts about attacking addresses and domains to help keep firewalls current. Combined with the ISACs IP- and domain-monitoring services and port profiler, the CIS offers a diverse toolkit to bolster cyberdefenses for MS-ISAC and EI-ISAC members.

These are just a few of the services offered to the SLTT community absolutely free of charge by the MS-ISAC. There are many others, including CIS SecureSuite membership, awareness campaigns, newsletters for both the security professional and the layperson, web-based malicious code analysis platforms, threat stream assessments and more.

To join the MS-ISAC or EI-ISAC and begin taking advantage of its many benefits, visit the Center for Internet Security at cisecurity.org.

More here:
The MS-ISAC Helps State and Local Governments Boost Their Cybersecurity - StateTech Magazine

Russia clamps down on the internet; ToTok used for state spying; and a critical vulnerability impacts Citrix applications worldwide

Vladimir Putins latest attempts to isolate Russia from the global internet caused the computer systems at several airports in the country to crash this week, according to an independent Russian TV station.

On December 24 The BBC reported that Russia had taken a major step towards emulating Iran and China in internet control after road-testing a gigantic intranet, in the words of computer scientist Professor Alan Woodward.

The sovereign Runet would effectively turn Russias online realm into a government-controlled walled garden by blocking, or regulating, the undersea nodes through which data is transmitted between national communication networks.

But while the Ministry of Communications claimed the test of the system was a success, Dozhd, or TV Rain, reported that check-in, baggage handling, and other systems at five airports had promptly crashed as a result of the operation.

Russia, which stands accused of weaponizing the global internet to destabilize liberal Western democracies, is also creating its own Wikipedia to combat fake news.

The United Arab Emirates (UAE) government is undermining digital rights beyond its own borders via a free messaging app with millions of users, US officials believe.

Apple and Google removed ToTok, a popular Emirati chat app, from their app stores following a report in The New York Times (December 22) that claimed UAE intelligence agencies were using the platform to track users conversations, locations, and photos, among other data.

ToTok, which blamed the removal on a technical issue, has alerted would-be users to its continuing availability through its own website, or their phone manufacturer's app store.

Only a few months old, the app already has users in Europe, Asia, Africa, and North America, as well as the Middle East.

A 22-year-old man who dodged jail after blackmailing Apple has claimed his elaborate extortion bluff started out as a legitimate business idea.

According to the UKs National Crime Agency (NCA), whose investigation led to his arrest, Kerem Albayrak threatened in 2017 to hack 250 million iCloud accounts, reset iCloud passwords, and factory-reset users' devices if the tech giant didnt pay a $100,000 ransom.

But Albayrak told Forbes that his ostensible hacking group, Turkish Crime Family, was actually a marketing vehicle and that he originally sought to whip up a storm of press coverage before launching a database search engine that would enable people to secure their accounts.

However, operating in a community frequented by cybercriminals had fuelled his decision to do something stupid in a bid to make a bigger PR splash.

Despite purporting to show otherwise in a now-deleted YouTube video, Albaryak only had access to login details leaked through other data breaches, according to Apple.

Albayrak was sentenced to a two-year suspended jail term, 300 hours of unpaid work, and a six-month electronic curfew at a London court on December 21.

And nothing screams the holidays better than a critical vulnerability impacting 80,000 companies worldwide.

On Monday (December 23) Positive Technologies disclosed a bug in two prominent Citrix applications that, if exploited, could allow an attacker to perform arbitrary code execution and obtain access to a companys local network via the internet.

Citrix products are typically used so that employees can connect to their companys internal applications remotely.

All versions of Citrix Application Delivery Controller (ACD) and Citrix Gateway are vulnerable to the flaw, which has been assigned as CVE-2019-19781 and is said to be easy to exploit since no authentication is required. A PoC has not been publicly released.

Considering the high risk brought by the discovered vulnerability, and how widespread Citrix software is in the business community, we recommend information security professionals take immediate steps to mitigate the threat, said Dmitry Serebryannikov, director of the security audit department at Positive Technologies in its blog post.

Companies operating in the US, the UK, Germany, the Netherlands, and Australia are among those affected. Citrix has advised these mitigation steps in its initial security bulletin from December 17. A patch is expected to be published in the near future.

And finally; Britains foreign intelligence service, MI6, has had a somewhat stressful festive season after sources in The Sunreport that building plans for the agencys iconic Vauxhall Cross headquarters had gone missing in the midst of refurbishment work.

More than 100 documents, which were sensitive but not classified, were implicated in the security breach, which is believed to have been an accident that occurred two weeks ago.

The source told the newspaper: The whole building went into lockdown and all the construction workers were kept in isolation.

To lose such sensitive documents was grossly irresponsible.

They showed the layout of the building and specifically where alarms and other security measures were. The documents would be gold dust to any enemy agents or terrorists.

Most of the documents were later found. Balfour Beatty, the construction company in charge of the renovation, was subsequently sacked.

Designed by Sir Terry Farrell, the MI6 HQ building, one that has become synonymous with the James Bond film franchise, was completed in 1994 for 135 ($177) million.

On reviewing the new addition to the Thames Embankment, British writer and design critic Deyan Sudjic is reported to have said: It's a design which combines high seriousness in its classical composition with a possible unwitting sense of humour.

The building could be interpreted equally plausibly as a Mayan temple or a piece of clanking art deco machinery.

Additional reporting by Catherine Chapman.

See the rest here:
#SocialSec Hot takes on this week's biggest cybersecurity news (Dec 27) - The Daily Swig