Bear Security – FBI/CISA/DHS Warning, Microsoft Reports 25 Vuln's in IoT/OT (Week of May 1, 2021)

A trio of US agencies give warning about Russian attacks, Microsoft disclosed 25 critical flaws in IoT / OT devices and more on this episode of Bear Security.

Warning from FBI / CISA / DHS About Russian Attacks
https://us-cert.cisa.gov/ncas/alerts/aa21-116a

Microsoft Disclosed 25 Critical Memory Allocation flaws that impact IoT and OT devices

“BadAlloc” – Memory allocation vulnerabilities could affect wide range of IoT and OT devices in industrial, medical, and enterprise networks

https://us-cert.cisa.gov/ics/advisories/icsa-21-119-04

Major Apple Bug Allowed Bypass Most Security Mechanisms
https://www.vice.com/en/article/wx5855/massive-mac-apple-security-bug-malware-hack
https://objective-see.com/blog/blog_0x64.html

Python 3.8+ Vulnerability – Improper Input Validation

CVE-2021-29921 – python stdlib “ipaddress” – Improper Input Validation of octal literals in python 3.8.0 thru v3.10 results in indeterminate SSRF & RFI vulnerabilities. — “ipaddress leading zeros in IPv4 address”

F5 Networks has another vulnerability – KDC
https://thehackernews.com/2021/04/f5-big-ip-found-vulnerable-to-kerberos.html

Researchers Uncover Stealthy Linux Malware
https://thehackernews.com/2021/04/researchers-uncover-stealthy-linux.html
https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/

Europol dismantles Emotet Botnet

Following similar move in US, Europol prepares coup de grace for Emotet’s remains

Ransomware Extortion Demands Getting Higher in 2021

Ransomware demands up by 43% so far in 2021, Coveware says

Updates —

HashiCorp’s Private code-signing key Exposed as part of Codecov Breach
https://www.theregister.com/2021/04/26/hashicorp_reveals_exposure_of_private/

U of M Tries to Apologize, Gets Rejected
https://arstechnica.com/gadgets/2021/04/linux-kernel-team-rejects-university-of-minnesota-researchers-apology/
April 27th Letter – https://drive.google.com/file/d/1z3Nm2bfR4tH1nOGBpuOmLyoJVEiO9cUq/view

—-

Follow us on Twitter https://www.twitter.com/syntaxbearror
Follow Chris on Twitter https://www.twitter.com/chrisclai
Join the Patreon: https://www.patreon.com/syntaxbearror
Visit our website: https://www.syntaxbearror.io/

source

by Syntax Bearror

linux foundation