Security Alert
A high-priority security advisory was published by #ConnectWise for all on-premise partners using ScreenConnect (versions 23.9.7 and prior). Critical vulnerabilities were identified on February 13, 2024, and there are urgent remediation steps you need to take.
Summary of the Issue: Two critical vulnerabilities have been reported:
• CWE-288: An authentication bypass issue.
• CWE-22: A path traversal flaw.
Both pose severe risks, with the authentication bypass being rated at a maximum severity score of 10, and the path traversal at 8.4.
Affected Versions:
• ScreenConnect 23.9.7 and earlier.
Immediate Remediation Steps:
• For Cloud Users: No action needed. The hosted services on “screenconnect.com” and “hostedrmm.com” are already updated.
• For On-Premise Users: Update immediately to ScreenConnect version 23.9.8 to apply the necessary patch.
While updated versions for releases from 22.4 through 23.9.7 addressing this issue will be provided, it is strongly recommended to update to version 23.9.8 for the most complete solution.
Action Required:
Please follow the upgrade instructions detailed in the Upgrade an on-premise installation documentation. You can download the patch directly from the ConnectWise ScreenConnect Download page.
Why Is This Urgent?
These vulnerabilities could allow unauthorized remote code execution or access to confidential data. They are considered critical and have a high chance of being exploited.
Please prioritize this update to protect your systems and data.
Stay safe!
https://t.me/InformationTechnologySecurity
A high-priority security advisory was published by #ConnectWise for all on-premise partners using ScreenConnect (versions 23.9.7 and prior). Critical vulnerabilities were identified on February 13, 2024, and there are urgent remediation steps you need to take.
Summary of the Issue: Two critical vulnerabilities have been reported:
• CWE-288: An authentication bypass issue.
• CWE-22: A path traversal flaw.
Both pose severe risks, with the authentication bypass being rated at a maximum severity score of 10, and the path traversal at 8.4.
Affected Versions:
• ScreenConnect 23.9.7 and earlier.
Immediate Remediation Steps:
• For Cloud Users: No action needed. The hosted services on “screenconnect.com” and “hostedrmm.com” are already updated.
• For On-Premise Users: Update immediately to ScreenConnect version 23.9.8 to apply the necessary patch.
While updated versions for releases from 22.4 through 23.9.7 addressing this issue will be provided, it is strongly recommended to update to version 23.9.8 for the most complete solution.
Action Required:
Please follow the upgrade instructions detailed in the Upgrade an on-premise installation documentation. You can download the patch directly from the ConnectWise ScreenConnect Download page.
Why Is This Urgent?
These vulnerabilities could allow unauthorized remote code execution or access to confidential data. They are considered critical and have a high chance of being exploited.
Please prioritize this update to protect your systems and data.
Stay safe!
https://t.me/InformationTechnologySecurity
👍3
Information Technology Security
Security Alert A high-priority security advisory was published by #ConnectWise for all on-premise partners using ScreenConnect (versions 23.9.7 and prior). Critical vulnerabilities were identified on February 13, 2024, and there are urgent remediation steps…
ScreenConnect servers hacked in LockBit ransomware attacks
Attackers are exploiting a maximum severity authentication bypass vulnerability to breach unpatched #ScreenConnect servers and deploy #LockBit ransomware payloads on compromised networks.
The maximum severity CVE-2024-1709 auth bypass flaw has been under active exploitation since Tuesday, one day after ConnectWise released security updates and several cybersecurity companies published proof-of-concept exploits. ConnectWise also patched the CVE-2024-1708 high-severity path traversal vulnerability, which can only be abused by threat actors with high privileges. Both security bugs impact all ScreenConnect versions, prompting the company on Wednesday to remove all license restrictions so customers with expired licenses can upgrade to the latest software version and secure their servers from attacks. CISA added CVE-2024-1709 to its Known Exploited Vulnerabilities Catalog today, ordering U.S. federal agencies to secure their servers within one week by February 29. CVE-2024-1709 is now widely exploited in the wild, according to security threat monitoring platform Shadowserver, with 643 IPs currently targeting vulnerable servers.
Image: Shodan currently tracks over 8,659 ScreenConnect servers, with only 980 running the ScreenConnect 23.9.8 patched version.
Attackers are exploiting a maximum severity authentication bypass vulnerability to breach unpatched #ScreenConnect servers and deploy #LockBit ransomware payloads on compromised networks.
The maximum severity CVE-2024-1709 auth bypass flaw has been under active exploitation since Tuesday, one day after ConnectWise released security updates and several cybersecurity companies published proof-of-concept exploits. ConnectWise also patched the CVE-2024-1708 high-severity path traversal vulnerability, which can only be abused by threat actors with high privileges. Both security bugs impact all ScreenConnect versions, prompting the company on Wednesday to remove all license restrictions so customers with expired licenses can upgrade to the latest software version and secure their servers from attacks. CISA added CVE-2024-1709 to its Known Exploited Vulnerabilities Catalog today, ordering U.S. federal agencies to secure their servers within one week by February 29. CVE-2024-1709 is now widely exploited in the wild, according to security threat monitoring platform Shadowserver, with 643 IPs currently targeting vulnerable servers.
Image: Shodan currently tracks over 8,659 ScreenConnect servers, with only 980 running the ScreenConnect 23.9.8 patched version.
Media is too big
VIEW IN TELEGRAM
White House urges developers to switch to memory-safe programming languages
👍3🤡1
Hijacked subdomains of major brands used in massive spam campaign
A massive ad fraud campaign named "SubdoMailing" is using over 8,000 legitimate internet domains and 13,000 subdomains to send up to five million emails per day to generate revenue through scams and malvertising.
The campaign is called "SubdoMailing, as the threat actors hijack abandoned subdomains and domains belonging to well-known companies to send their malicious emails.
As these domains belong to trusted companies, they gain the benefit of being able to bypass spam filters and, in some cases, take advantage of configured SPF and DKIM email policies that tell secure email gateways that the emails are legitimate and not spam.
Some notable brands that fell victim to this domain hijacking campaign include MSN, VMware, McAfee, The Economist, Cornell University, CBS, NYC.gov, PWC, Pearson, Better Business Bureau, Unicef, ACLU, Symantec, Java.net, Marvel, and eBay.
#SubdoMailing
A massive ad fraud campaign named "SubdoMailing" is using over 8,000 legitimate internet domains and 13,000 subdomains to send up to five million emails per day to generate revenue through scams and malvertising.
The campaign is called "SubdoMailing, as the threat actors hijack abandoned subdomains and domains belonging to well-known companies to send their malicious emails.
As these domains belong to trusted companies, they gain the benefit of being able to bypass spam filters and, in some cases, take advantage of configured SPF and DKIM email policies that tell secure email gateways that the emails are legitimate and not spam.
Some notable brands that fell victim to this domain hijacking campaign include MSN, VMware, McAfee, The Economist, Cornell University, CBS, NYC.gov, PWC, Pearson, Better Business Bureau, Unicef, ACLU, Symantec, Java.net, Marvel, and eBay.
#SubdoMailing
🤬3
FBI, CISA warn US hospitals of targeted BlackCat ransomware attacks
Today, the FBI, CISA, and the Department of Health and Human Services (HHS) warned U.S. healthcare organizations of targeted ALPHV/Blackcat ransomware attacks.
Link
Today, the FBI, CISA, and the Department of Health and Human Services (HHS) warned U.S. healthcare organizations of targeted ALPHV/Blackcat ransomware attacks.
Link
Blogspot
FBI, CISA warn US hospitals of targeted BlackCat ransomware attacks
By Sergiu Gatlan, Bleeping Computer Today, the FBI, CISA, and the Department of Health and Human Services (HHS) warned U.S. healthcare orga...
😱3🙈1
Pharmaceutical giant Cencora says data was stolen in a cyberattack
The Company had $262.2 billion in revenue for fiscal year 2023 and employs approximately 46,000 people. In a Form 8-K filing with the SEC, Cencora disclosed they suffered a cyberattack that led to data theft. "On February 21, 2024, Cencora, Inc. (the "Company"), learned that data from its information systems had been exfiltrated, some of which may contain personal information," reads the SEC filing.
Link
The Company had $262.2 billion in revenue for fiscal year 2023 and employs approximately 46,000 people. In a Form 8-K filing with the SEC, Cencora disclosed they suffered a cyberattack that led to data theft. "On February 21, 2024, Cencora, Inc. (the "Company"), learned that data from its information systems had been exfiltrated, some of which may contain personal information," reads the SEC filing.
Link
Blogspot
Pharmaceutical giant Cencora says data was stolen in a cyberattack
By Lawrence Abrams, Bleeping Computer The Company had $262.2 billion in revenue for fiscal year 2023 and employs approximately 46,000 peopl...
Rhysida ransomware wants $3.6 million for children’s stolen data
The Rhysida ransomware gang has claimed the cyberattack on Lurie Children's Hospital in Chicago at the start of the month. Lurie is a leading pediatric acute care institution in the U.S. that provides care to over 200,000 children annually.
The cyberattack forced the healthcare provider to take its IT systems offline and postpone medical care in some cases. Email, phone, access to MyChart, and on-premises internet were all impacted. Ultrasound and CT scan results were rendered unavailable, patient service prioritization systems were taken down, and doctors were forced to switch to pen and paper for prescriptions.
Link
The Rhysida ransomware gang has claimed the cyberattack on Lurie Children's Hospital in Chicago at the start of the month. Lurie is a leading pediatric acute care institution in the U.S. that provides care to over 200,000 children annually.
The cyberattack forced the healthcare provider to take its IT systems offline and postpone medical care in some cases. Email, phone, access to MyChart, and on-premises internet were all impacted. Ultrasound and CT scan results were rendered unavailable, patient service prioritization systems were taken down, and doctors were forced to switch to pen and paper for prescriptions.
Link
Supply Chain Compromise Affecting XZ Utils Data Compression Library, CVE-2024-3094
We've obtained intelligence about an ongoing supply chain attack affecting XZ Utils versions 5.6.0 and 5.6.1. This activity has been assigned CVE-2024-3094. XZ Utils is a data compression software that may be included in Linux distributions. The malicious code could potentially allow unauthorized access to impacted systems.
We recommend downgrading XZ Utils to an uncompromised version, such as XZ Utils 5.4.6 Stable.
https://t.me/InformationTechnologySecurity
We've obtained intelligence about an ongoing supply chain attack affecting XZ Utils versions 5.6.0 and 5.6.1. This activity has been assigned CVE-2024-3094. XZ Utils is a data compression software that may be included in Linux distributions. The malicious code could potentially allow unauthorized access to impacted systems.
We recommend downgrading XZ Utils to an uncompromised version, such as XZ Utils 5.4.6 Stable.
https://t.me/InformationTechnologySecurity
Telegram
Information Technology Security
All sorts of technology headlines and rumors, as well as photos, videos and tricks.
Discussion Group: @DiscussTheNews
Directory: @Z9Network
Website: www.Z9Network.com
Discussion Group: @DiscussTheNews
Directory: @Z9Network
Website: www.Z9Network.com
❤1
Why remote desktop tools are facing an onslaught of cyber threats
Hackers are increasingly targeting remote desktop tools in their attacks, new research reveals, prompting warnings for enterprises globally
Link
Hackers are increasingly targeting remote desktop tools in their attacks, new research reveals, prompting warnings for enterprises globally
Link
Blogspot
Why remote desktop tools are facing an onslaught of cyber threats
By Solomon Klappholz, IT Pro Hackers are increasingly targeting remote desktop tools in their attacks, new research reveals, prompting warni...
👍4❤3
Meta deepens AI push with 'Superintelligence' lab, source says
CEO #MarkZuckerberg has reorganized the company's artificial intelligence efforts under a new division called Meta Superintelligence Labs, according to a source on Monday.
The division will be headed by Alexandr Wang, former CEO of data labeling startup #ScaleAI. He will be the chief AI officer of the new initiative at the social media giant, the source said.
The high-stakes push follows senior staff departures and a poor reception for Meta's latest open-source Llama 4 model, challenges that have allowed rivals including #Google, #OpenAI and China's #DeepSeek to seize momentum in the #AI race.
Zuckerberg hopes the new lab will fast-track work on artificial general intelligence - machines that can outthink humans - and help create new cash flows from the #MetaAI app, image-to-video ad tools and smart glasses.
Over the past month, Zuckerberg personally led an aggressive talent raid, floating offers for startups including OpenAI co-founder Ilya Sutskever's Safe Superintelligence (SSI) and courting prospects directly on #WhatsApp with million-dollar pay packages.
Earlier this month, the #Facebook and #Instagram parent invested $14.3 billion in Scale AI.
Apart from Wang and some Scale AI staff, the new division will reportedly include SSI's co-founder and CEO, Daniel Gross.
CEO #MarkZuckerberg has reorganized the company's artificial intelligence efforts under a new division called Meta Superintelligence Labs, according to a source on Monday.
The division will be headed by Alexandr Wang, former CEO of data labeling startup #ScaleAI. He will be the chief AI officer of the new initiative at the social media giant, the source said.
The high-stakes push follows senior staff departures and a poor reception for Meta's latest open-source Llama 4 model, challenges that have allowed rivals including #Google, #OpenAI and China's #DeepSeek to seize momentum in the #AI race.
Zuckerberg hopes the new lab will fast-track work on artificial general intelligence - machines that can outthink humans - and help create new cash flows from the #MetaAI app, image-to-video ad tools and smart glasses.
Over the past month, Zuckerberg personally led an aggressive talent raid, floating offers for startups including OpenAI co-founder Ilya Sutskever's Safe Superintelligence (SSI) and courting prospects directly on #WhatsApp with million-dollar pay packages.
Earlier this month, the #Facebook and #Instagram parent invested $14.3 billion in Scale AI.
Apart from Wang and some Scale AI staff, the new division will reportedly include SSI's co-founder and CEO, Daniel Gross.
👍2
This media is not supported in your browser
VIEW IN TELEGRAM
Now Google’s Gemini AI is ready to fill in those empty cells in your spreadsheet
#Google is launching a new #AI function in #GoogleSheets to help you generate text to fill out parts of your spreadsheet. The feature, powered by #Gemini, can reference specific cells to create text, summarize information, or categorize your data.
In the example shared by Google, you can use the new AI function to generate and tailor copy for an advertisement based on the different target audiences listed in your spreadsheet. To do this, you would highlight the cells where you want the AI copy to appear and then use this function (but make sure to change the target range to match your spreadsheet):
Another example includes using the AI function to summarize the feedback of customers listed in a group of cells, which you could perform by typing this:
You can also categorize a customer inquiry as a compliment, exchange request, or return request, or even use it to classify restaurants by location. You can check out a range of different examples for the AI function on Google’s support page.
________
https://t.me/InformationTechnologySecurity
#Google is launching a new #AI function in #GoogleSheets to help you generate text to fill out parts of your spreadsheet. The feature, powered by #Gemini, can reference specific cells to create text, summarize information, or categorize your data.
In the example shared by Google, you can use the new AI function to generate and tailor copy for an advertisement based on the different target audiences listed in your spreadsheet. To do this, you would highlight the cells where you want the AI copy to appear and then use this function (but make sure to change the target range to match your spreadsheet):
=AI(“Write a formal ad copy for the product. Cater copy to the objective and target audience.”, A2:C2).
Another example includes using the AI function to summarize the feedback of customers listed in a group of cells, which you could perform by typing this:
=AI(“For the customer, write a one sentence summary of their feedback.”, A2:D2)
You can also categorize a customer inquiry as a compliment, exchange request, or return request, or even use it to classify restaurants by location. You can check out a range of different examples for the AI function on Google’s support page.
________
https://t.me/InformationTechnologySecurity
👍3❤1
Ingram Micro outage caused by SafePay ransomware attack
An ongoing outage at IT giant #IngramMicro is caused by a #SafePay ransomware attack that led to the shutdown of internal systems.
Ingram Micro is one of the world's largest business-to-business technology distributors and service providers, offering a range of solutions including hardware, software, cloud services, logistics, and training to resellers and managed service providers worldwide.
Since Thursday, Ingram Micro's website and online ordering systems have been down, with the company not disclosing the cause of the issues.
https://t.me/InformationTechnologySecurity
An ongoing outage at IT giant #IngramMicro is caused by a #SafePay ransomware attack that led to the shutdown of internal systems.
Ingram Micro is one of the world's largest business-to-business technology distributors and service providers, offering a range of solutions including hardware, software, cloud services, logistics, and training to resellers and managed service providers worldwide.
Since Thursday, Ingram Micro's website and online ordering systems have been down, with the company not disclosing the cause of the issues.
https://t.me/InformationTechnologySecurity
😱2
OpenAI to release web browser in challenge to Google Chrome
#OpenAI is close to releasing an #AI-powered web #Browser that will challenge #Alphabet's opens new tab market-dominating #Google #Chrome, three people familiar with the matter told Reuters.
The browser is slated to launch in the coming weeks, three of the people said, and aims to use artificial intelligence to fundamentally change how consumers browse the web. It will give OpenAI more direct access to a cornerstone of Google's success: user data.
https://t.me/InformationTechnologySecurity
#OpenAI is close to releasing an #AI-powered web #Browser that will challenge #Alphabet's opens new tab market-dominating #Google #Chrome, three people familiar with the matter told Reuters.
The browser is slated to launch in the coming weeks, three of the people said, and aims to use artificial intelligence to fundamentally change how consumers browse the web. It will give OpenAI more direct access to a cornerstone of Google's success: user data.
https://t.me/InformationTechnologySecurity
👍2
Outlook takes another sick day
Millions of users disrupted, mailbox infrastructure blamed
#Microsoft's #Outlook was down for the count in a major outage affecting millions of users worldwide for the more than 11 hours.
The troubles, according to Microsoft's service status page, began at 2220 UTC on July 9 when it confirmed "users may be unable to access their mailbox using any connection methods."
This included Outlook.com, Outlook Mobile, and the Outlook desktop client.
"We've determined that a portion of mailbox infrastructure isn't performing as efficiently as expected, resulting in impact. We're investigating this further to better understand the issue and help inform our next troubleshooting steps," Microsoft stated.
https://t.me/InformationTechnologySecurity
#Office365
Millions of users disrupted, mailbox infrastructure blamed
#Microsoft's #Outlook was down for the count in a major outage affecting millions of users worldwide for the more than 11 hours.
The troubles, according to Microsoft's service status page, began at 2220 UTC on July 9 when it confirmed "users may be unable to access their mailbox using any connection methods."
This included Outlook.com, Outlook Mobile, and the Outlook desktop client.
"We've determined that a portion of mailbox infrastructure isn't performing as efficiently as expected, resulting in impact. We're investigating this further to better understand the issue and help inform our next troubleshooting steps," Microsoft stated.
https://t.me/InformationTechnologySecurity
#Office365
👎2
This media is not supported in your browser
VIEW IN TELEGRAM
Gmail’s new tab is made for unsubscribing from emails
#Google is introducing a new #Gmail feature for those feeling overwhelmed by an onslaught of subscription emails in their inboxes. The Manage subscriptions view shows a list of emails delivered through active subscriptions, automatically sorted with the most frequent senders at the top, next to individual one-click links that will unsubscribe you from their mailing lists.
You can find the new feature by clicking the navigation bar in the top left corner of your Gmail inbox and selecting Manage subscriptions from the menu that appears. If you don’t see it yet, it’s being introduced on the web version of Gmail starting today, the #Android mobile app starting on July 14th, and the #iOS app starting on July 21st, but it could take a couple of weeks for it to show up for all users. It will be available for all personal Google accounts, #GoogleWorkspace customers, and Workspace Individual Subscribers in “select countries.”
https://t.me/InformationTechnologySecurity
#Google is introducing a new #Gmail feature for those feeling overwhelmed by an onslaught of subscription emails in their inboxes. The Manage subscriptions view shows a list of emails delivered through active subscriptions, automatically sorted with the most frequent senders at the top, next to individual one-click links that will unsubscribe you from their mailing lists.
You can find the new feature by clicking the navigation bar in the top left corner of your Gmail inbox and selecting Manage subscriptions from the menu that appears. If you don’t see it yet, it’s being introduced on the web version of Gmail starting today, the #Android mobile app starting on July 14th, and the #iOS app starting on July 21st, but it could take a couple of weeks for it to show up for all users. It will be available for all personal Google accounts, #GoogleWorkspace customers, and Workspace Individual Subscribers in “select countries.”
https://t.me/InformationTechnologySecurity
👍3🔥1
Google and Microsoft Trusted Them. 2.3 Million Users Installed Them. They Were Malware!
TL;DR - An investigation of a single “verified” color picker exposed a coordinated campaign of 18 malicious extensions that infected a massive 2.3 million users across Chrome and Edge...
If you think a Chrome extension with #Google’s verified badge, 100,000+ installs, 800+ reviews, and featured placement on the store is trustworthy? Think again... Meet “Color Picker, Eyedropper — Geco colorpick”, an extension that perfectly demonstrates how sophisticated threat actors are exploiting the trust signals we rely on. This isn’t some obvious scam extension thrown together in a weekend. This is a carefully crafted trojan horse that delivers exactly what it promises (a functional color picker) while simultaneously hijacking your browser, tracking every website you visit, and maintaining a persistent command and control backdoor. Not only that, but it remained legitimate for years before becoming malicious through a version update.
If that is not enough, meet the RedDirection campaign. Our investigation into the Color Picker extension revealed it was just the tip of the iceberg. By analyzing the command and control infrastructure and tracking similar code patterns, we uncovered what we’re calling the RedDirection campaign, a sophisticated cross-platform network of eighteen malicious extensions spanning both #Chrome and #Edge stores, all sharing the same hijacking functionality. Combined, these eighteen extensions have infected over 2.3 million users across both browsers, creating one of the largest browser hijacking operations we’ve documented.
These extensions masquerade as popular productivity and entertainment tools across diverse categories: emoji keyboards, weather forecasts, video speed controllers, #VPN proxies for #Discord and #TikTok, dark themes, volume boosters, and #YouTube unblockers. Each provides legitimate functionality while secretly implementing the same browser surveillance and hijacking capabilities we discovered in the color picker.
Several of these extensions have achieved verified status or featured placement across both the Chrome Web Store and Microsoft Edge Add-ons store, demonstrating that security failures extend across both major browser marketplaces. Each extension operates with its own command and control subdomain (like admitclick.net, click.videocontrolls.com, c.undiscord.com), giving the appearance of separate operators while actually being part of the same centralized attack infrastructure spanning both platforms.
▶️ Read On
https://t.me/InformationTechnologySecurity
TL;DR - An investigation of a single “verified” color picker exposed a coordinated campaign of 18 malicious extensions that infected a massive 2.3 million users across Chrome and Edge...
If you think a Chrome extension with #Google’s verified badge, 100,000+ installs, 800+ reviews, and featured placement on the store is trustworthy? Think again... Meet “Color Picker, Eyedropper — Geco colorpick”, an extension that perfectly demonstrates how sophisticated threat actors are exploiting the trust signals we rely on. This isn’t some obvious scam extension thrown together in a weekend. This is a carefully crafted trojan horse that delivers exactly what it promises (a functional color picker) while simultaneously hijacking your browser, tracking every website you visit, and maintaining a persistent command and control backdoor. Not only that, but it remained legitimate for years before becoming malicious through a version update.
If that is not enough, meet the RedDirection campaign. Our investigation into the Color Picker extension revealed it was just the tip of the iceberg. By analyzing the command and control infrastructure and tracking similar code patterns, we uncovered what we’re calling the RedDirection campaign, a sophisticated cross-platform network of eighteen malicious extensions spanning both #Chrome and #Edge stores, all sharing the same hijacking functionality. Combined, these eighteen extensions have infected over 2.3 million users across both browsers, creating one of the largest browser hijacking operations we’ve documented.
These extensions masquerade as popular productivity and entertainment tools across diverse categories: emoji keyboards, weather forecasts, video speed controllers, #VPN proxies for #Discord and #TikTok, dark themes, volume boosters, and #YouTube unblockers. Each provides legitimate functionality while secretly implementing the same browser surveillance and hijacking capabilities we discovered in the color picker.
Several of these extensions have achieved verified status or featured placement across both the Chrome Web Store and Microsoft Edge Add-ons store, demonstrating that security failures extend across both major browser marketplaces. Each extension operates with its own command and control subdomain (like admitclick.net, click.videocontrolls.com, c.undiscord.com), giving the appearance of separate operators while actually being part of the same centralized attack infrastructure spanning both platforms.
▶️ Read On
https://t.me/InformationTechnologySecurity
😱3🤬1