A critical vulnerability in Ivanti’s Cloud Service Appliance (CSA) has been actively exploited by attackers. The flaw, tracked as CVE-2024-8190, allows attackers to gain unauthorized access to sensitive data and execute arbitrary commands on vulnerable systems. The vulnerability exists in the CSA’s authentication mechanism and can be exploited by attackers who can send specially crafted requests to the CSA. This attack vector allows attackers to bypass the CSA’s security measures and gain access to the underlying operating system. The vulnerability has been exploited in the wild by a suspected nation-state adversary. There are strong indications that China is behind the attacks. Organizations using Ivanti CSA should prioritize patching the vulnerability immediately to reduce their risk of being compromised.
Ransomware gangs are increasingly using the notoriety of established variants, such as LockBit, to intimidate victims. They leverage the fear associated with LockBit’s capabilities to pressure victims into paying ransoms. These gangs often embed hard-coded AWS credentials in their ransomware, allowing them to exfiltrate data using Amazon S3’s Transfer Acceleration feature. This tactic highlights the importance of implementing robust data protection measures, such as strong access controls and secure credential management, to prevent data exfiltration and mitigate ransomware threats.
Microsoft Threat Intelligence has discovered a new macOS vulnerability, dubbed “HM Surf”, that allows attackers to bypass the operating system’s Transparency, Consent, and Control (TCC) technology and gain unauthorized access to protected user data. The vulnerability involves removing TCC protection for the Safari browser directory and modifying a configuration file to access user data, including browsing history, camera, microphone, and location, without user consent. Microsoft has reported the vulnerability to Apple, which has released a fix as part of a macOS security update. Users are urged to install the update as soon as possible to mitigate the risk. This vulnerability highlights the importance of keeping operating systems and applications updated to protect against emerging threats and the persistent challenges of maintaining robust security in complex software environments.
A new macOS vulnerability dubbed ‘HM Surf’ allows Adload malware to bypass Safari’s protections, potentially granting unauthorized access to user data. The vulnerability impacts MDM-managed devices and could enable attackers to access browsing history, camera, microphone, and location data. This vulnerability highlights the importance of keeping software up to date and being wary of suspicious activities, especially on managed devices.