TL;DR No, it’s not a new Dr. Seuss story – it’s a recently discovered zero-day exploit (CVE-2021-36934, known as HiveNightmare or SeriousSam) that allows an attacker to read the contents of a Security Account Manager (SAM) file on Windows 10 and 11 systems with non-administrator user privileges. In the Assura’s Take section, we provide two… Continue reading I do not like HiveNightmare, SeriousSam. I do not like it here or there. I do not like it anywhere!
Tag: Cyber Heads Up
Windows Print Spooler “PrintNightmare” Vulnerability, Exploits
TL;DR There is a Windows vulnerability that uses Print Spooler to gain remote code execution on devices. In the Assura’s Take section, we offer three mitigation options: 1. Disable the print spooler service, 2. Apply an ACL to restrict print driver installation/upgrades. 3. Disable remote connections to the Print Spooler. Overview Recently, the security research… Continue reading Windows Print Spooler “PrintNightmare” Vulnerability, Exploits
Kaseya’s VSA Supply Chain Ransomware
TL;DR A supply chain exploit of Kaseya’s VSA Remote Management service puts customers of managed service providers (MSPs) using this tool at risk of REvil ransomware. Assura recommends anyone using Kaseya VSA to follow Kaseya guidance on server hardening when available, and also download and run the indicator of compromise (IOC) scanning tool linked below… Continue reading Kaseya’s VSA Supply Chain Ransomware
Verkada Cameras Hacked and New Microsoft DNS Server Vulnerability
It’s been quite a few months in the cyber security world, and last week was no exception with two major vulnerabilities concerning Verkada cameras and Windows DNS servers. Both vulnerabilities are unpacked in the below CHU alerts! Alert 1: Verkada Cameras Hacked, Leads to Network Compromise of Cloudflare, Tesla, and more Overview On March 9,… Continue reading Verkada Cameras Hacked and New Microsoft DNS Server Vulnerability
Update to HAFNIUM/Microsoft Exchange Server zero-day vulnerabilities
Overview On March 4, 2021 we posted a Cyber Heads-Up article titled, “Chinese State-Sponsored Group HAFNIUM Exploiting Exchange Zero-Day Vulnerabilities – PATCH NOW”. Today, we are revisiting this attack campaign with updates about what Assura and other security firms are seeing during response efforts. If you are just hearing about the HAFNIUM campaign, please refer… Continue reading Update to HAFNIUM/Microsoft Exchange Server zero-day vulnerabilities
Chinese State Sponsored Group HAFNIUM Exploiting Exchange Zero-Day Vulnerabilities – PATCH NOW
Overview Microsoft recently released out-of-band security updates to address four new vulnerabilities in Exchange Server (on-premises). The series of exploits is actively being used by malicious actors to steal emails and compromise internal networks. What Do We Know About This Attack? The Microsoft announcement contains four new vulnerabilities, which when chained, together have glaringly evil results. Let’s… Continue reading Chinese State Sponsored Group HAFNIUM Exploiting Exchange Zero-Day Vulnerabilities – PATCH NOW
Oversharing in the Age of COVID-19
To say that selfies have been popular for the last two decades would be an understatement. Everyone from celebrities to grandparents have been posting pictures online. In the Age of Covid, the posting of your Covid-19 vaccine record is just the latest selfie phenomenon. However, this trend is not without its dangers. You may be… Continue reading Oversharing in the Age of COVID-19
CISA Announces Active Exploitation of SolarWinds Orion Platform – What You Should Know
Overview The Cybersecurity and Infrastructure Security Agency (CISA) released an alert regarding the active exploitation of the SolarWinds Orion platform. It was found by FireEye that SolarWinds Orion versions 2019.4 through 2020.2.1, released between March 2020 and June 2020, were compromised in a supply chain attack. What Do We Know About This Attack? On Sunday, December… Continue reading CISA Announces Active Exploitation of SolarWinds Orion Platform – What You Should Know
Cyber Security Firm FireEye Reports Major Breach, Assura’s response and monitoring plan
Overview Major news shocked the cyber security world yesterday (Tuesday, December 8) when FireEye, the parent company of Mandiant, announced they had been breached and their Red Team tools were stolen. Everyone can be breached, and we mean everyone. FireEye’s Mandiant division is the company everyone runs to when they experience a major breach! FireEye has handled… Continue reading Cyber Security Firm FireEye Reports Major Breach, Assura’s response and monitoring plan
A Busy Week in Cyber Threats
Key Takeaways It’s been a busy several days in cybersecurity. Below is an overview of the key events, followed by Assura’s take on these matters. Google announced the discovery of a zero-day privilege escalation flaw in Microsoft Windows, possibly dating back to Windows 7. The U.S. Department of Homeland Security, U.S. Cyber Command, and FBI… Continue reading A Busy Week in Cyber Threats