Tenable Archives - Media Bulletins Today News Bulletin in English

Business

Tenable Completes Acquisition of Bit Discovery and Announces Tenable.asm for External Attack Surface Management

Jun 8, 2022 by Agency 0 Comments #Tenable, #Tenable.asm

Tenable Holdings, Inc. (“Tenable”), the Cyber Exposure company, today announced it has closed its acquisition of Bit Discovery, Inc. (“Bit Discovery”), a leader in external attack surface management (EASM). Tenable will launch Tenable.asm, a new solution that will provide the full capabilities of Bit Discovery’s technology and enable customers to gain a more complete 360-degree view of their full attack surface so they can better understand how attackers could gain access via the internet and help prioritize remediation steps.

Gaining Visibility Into Unseen Risk

An organization’s digital footprint extends far beyond its walls as various services, applications and APIs are internet facing or reside on the internet. To avoid new points of security vulnerability and to ensure good organizational risk management, it is critical for organizations to have visibility into and to understand both known and previously unknown internet-facing assets.

Modern organizations require continuous monitoring of their complete attack surface and context-aware intelligence on where to prioritize remediation efforts. Tenable.asm will continuously map the entire internet and discover connections to an organization’s internet-facing assets, whether internal or external to their networks, to assess the security posture of their entire external attack surface. When used with the rest of Tenable’s solutions, customers will be able to get the context of potential attack paths from external systems to critical assets throughout their organization providing a comprehensive measure of their overall exposure. Tenable.asm is scheduled to be available for purchase early in the third quarter of 2022.

Because the security of internet-facing assets is a top CISO priority and pain point, Tenable is also integrating foundational quarterly attack surface discovery into its existing market-leading cyber exposure solutions at no additional cost to Tenable customers. New capabilities are scheduled to be included in Tenable.io®, Tenable.sc™and Tenable.ep™ early in the third quarter of 2022. A new version of Nessus will also include asset discovery.

“Very few, if any, organizations truly understand their full digital footprint. One of the most common but dangerous security lapses is to misconfigure something in the cloud and make it internet-facing. Organizations increasingly have less of a grasp on which of their assets are exposed,” said Glen Pendley, chief technology officer, Tenable. “Every business or government entity should have advanced capabilities like those found in Tenable.asm, but given the critical security importance of having ASM everywhere, Tenable is making sure that its customers have at least foundational discovery functionality within the solutions they’re already using. This will enable them to spot points of vulnerability that have been completely invisible until now, with the goal of preventing attacks rather than simply managing them.”

Bit Discovery provides Tenable customers with:

Discovery of previously unknown internet-connected assets
Rich context and attribution for domains, sub-domains and other exposed technologies
Continuous monitoring of the constantly changing external attack surface

Fortinet zero-day Comment from Claire Tills, Senior Research Engineer, Tenable

Business

Comment on Follina Zero Day Vulnerability from Claire Tills, Senior Research Engineer, Tenable

Jun 1, 2022 by Agency 0 Comments #Claire Tills, #Follina Zero Day Vulnerability, #Tenable

A zero day exploit was discovered in Microsoft Office over the weekend that MSFT had previously been alerted to in April by a researcher. This vulnerability, dubbed “Follina”, can be exploited by an attacker sending a URL to a vulnerable machine. Successful exploitation allows an attacker to install programs, view or change data, or create new accounts in line with the victim’s user permissions.

And a comment from Claire Tills, senior research engineer, Tenable:

“Over the weekend, researchers began discussing a zero-day remote code execution vulnerability that can be exploited via Microsoft Office documents, a favored vector for threat actors. On Monday, Microsoft released some official details for CVE-2022-30190, noting that the RCE impacted its Microsoft Windows Diagnostic Tools, but did not release any patches. Microsoft has provided a mitigation recommendation.

“The RCE appears to have been exploited as far back as April, and recently came to broad public attention after a researcher began investigating a malicious sample on VirusTotal. Over the weekend, multiple researchers reproduced the issue and determined that it is a “zero click” exploit, meaning that no user interaction is required. Given the similarities between CVE-2022-30190 and CVE-2021-40444, and that researchers speculate other protocol handlers may also be vulnerable, we expect to see further developments and exploitation attempts of this issue.

“Because this is a zero click exploit, there isn’t as much individual users can do, however, a healthy dose of skepticism goes a long way. Users should always be suspicious of attachments from untrusted sources.”

Scott Caveza, Research Engineering Manager, Tenable

Technology

Comment from Tenable: Pulse Connect Secure Vulnerability Used to Target Water Agency, Verizon

Jun 17, 2021 by Neel Achary 0 Comments #Research Engineering Manager, #Scott Caveza, #Tenable

The trend of attacks against critical infrastructure continues as news broke overnight that Verizon and one of the largest water agencies in the US were reportedly among the group targeted in the hack of Pulse Connect Secure devices. An out-of-band advisory warning that foreign threat actors were targeting previously known vulnerabilities in Pulse Secure was issued on April 20 but the scale of the hack is now starting to become clear. Please find below a comment from Scott Caveza, research engineering manager, Tenable.

“On April 20, Pulse Secure released an out-of-band advisory warning that foreign threat actors were targeting three previously known vulnerabilities (CVE-2019-11510, CVE-2020-8243 and CVE-2020-8260) along with a newly discovered critical authentication bypass zero-day vulnerability (CVE-2021-22893). In the months since, we are now learning about new victims in these attacks as we continue to see attackers leveraging well-known vulnerabilities in their attack chains. CVE-2019-11510, which has been exploited in the wild since details became public in August 2019, was one of the Top 5 vulnerabilities in Tenable’s 2020 Threat Landscape Retrospective report because of its ease of exploitation and widespread exploitation.

“Bad actors are targeting core infrastructure and organisations very aggressively. Patching and securing critical devices must remain a top priority for defenders who should be implementing compensating controls wherever this is not practical. Attackers have had continued success exploiting known vulnerabilities, many with easily identified public proof-of-concept code and patches readily available. Among other things, attackers are targeting networks through VPNs to gain entry into private networks.” — Scott Caveza, research engineering manager, Tenable

Satnam-Narang_Staff-Research-Engineer_Tenable

Technology

Microsoft’s June 2021 Patch Wednesday Addresses 49 CVEs

Jun 9, 2021 by Neel Achary 0 Comments #Satnam Narang, #Staff Research Engineer, #Tenable

Microsoft’s June Patch Wednesday, addressed 49 CVEs. Of those, six have been observed as being exploited in the wild, and five are rated as critical. Remote Code Execution vulnerabilities account for 34% of the flaws, with elevation of privilege accounting for 26%. Below is a comment by Satnam Narang, Staff Research Engineer, Tenable and further analysis can be found here.

“This month’s Patch Wednesday release addressed 49 CVEs, five of which are rated critical. This is the third time in 2021 that Microsoft has patched less than 60 CVEs and this month’s release contains the lowest number of patches in a month so far this year.

“Microsoft patched six zero-day vulnerabilities that have been exploited in the wild, including four elevation of privilege vulnerabilities, one information disclosure vulnerability and one remote code execution vulnerability.

“CVE-2021-33742 is a remote code execution vulnerability in the Microsoft Windows MSHTML Platform. While this vulnerability does not require special privileges, the attack complexity for exploiting this vulnerability is high, which means an attacker would need to perform additional legwork to successfully exploit this flaw. It appears that was the case, though details of in-the-wild exploitation are not yet known.

“CVE-2021-31955 is an information disclosure vulnerability in the Windows Kernel, while CVE-2021-31956 is an elevation of privilege vulnerability in Windows NTFS. Details about the in-the-wild exploitation of these vulnerabilities are not yet known. While both vulnerabilities require the attacker to be authenticated to the target system, it is likely that they have been leveraged either post-compromise by the attackers directly or through the use of a malicious file opened by a local user.

“CVE-2021-33739 is an elevation of privilege zero-day vulnerability in the Microsoft Desktop Window Manager (DWM) Core Library. For context, Microsoft patched two elevation of privilege vulnerabilities in February (CVE-2021-1732) and April (CVE-2021-28310) which appear to be linked to a threat actor known as BITTER APT. In the case of CVE-2021-28310, researchers linked the flaw to the dwmcore.dll file. Given that CVE-2021-33739 is credited to the same researchers who found CVE-2021-1732 in February, and was discovered in the same core library as CVE-2021-28310, it is feasible this is another zero-day being leveraged by the same BITTER APT group.

“While these vulnerabilities have already been exploited in the wild as zero-days, it is still vital that organisations apply these patches as soon as possible. Unpatched flaws remain a problem for many organisations months after patches have been released.”– Satnam Narang, Staff Research Engineer, Tenable

Technology

Comment from Tenable- FBI Issues Second Alert on Attackers Leveraging Three Legacy Fortinet Vulnerabilities

May 31, 2021 by Neel Achary 0 Comments #Satnam Narang, #Staff Research Engineer, #Tenable

“The Federal Bureau of Investigation (FBI) issued their second alert regarding multiple flaws in Fortinet’s FortiGate SSL VPN being exploited in the wild, the first was published over a month ago. However, multiple U.S. Government agencies, including the FBI, NSA and CISA have published several alerts over the last few years highlighting the use of CVE-2018-13379, a critical flaw in the SSL VPN, by advanced persistent threat (APT) groups that was patched two years ago.

“The fact that we continue to see these legacy vulnerabilities being exploited in spite of these alerts is a cautionary tale that unpatched flaws remain a valuable tool for APT groups and cybercriminals in general. The risk is further heightened by the broad shift of the workforce over the past year. Unpatched vulnerabilities, not zero-days, are the biggest threat to most organizations today because it gets attackers to their end goal in the fastest and cheapest way. It is imperative that both public sector and private organizations that use the FortiGate SSL VPN apply these patches immediately to prevent future compromise.” — Satnam Narang, Staff Research Engineer, Tenable

Technology

Comment from Tenable on Vulnerabilities in VMware vCenter

May 26, 2021 by Neel Achary 0 Comments #Claire Tills, #Senior Research Engineer, #Tenable

Two vulnerabilities were found in VMware’s vCenter Server. CVE-2021-21985 is a remote code execution vulnerability in the vSphere Client via the Virtual SAN (vSAN) Health Check plugin, which is enabled by default. CVE-2021-21986 is an authentication mechanism issue in several vCenter Server Plug-in. In a rare move, VMware published a blog post calling out ransomware groups as being adept at leveraging flaws like this post-compromise, after having gained access to a network via other means such as spearphishing. Claire Tills, Senior Research Engineer, Tenable; express view on the same.

“VMware has disclosed a pair of vulnerabilities impacting vCenter Server, a centralized management software for VMware vSphere systems. The most severe flaw, CVE-2021-21985, is a remote code execution vulnerability in vSphere Client, assigned a CVSSv3 score of 9.8

“To exploit this vulnerability, an attacker would need to be able to access vCenter Server over port 443 in the firewall. Even if an organization has not exposed vCenter Server externally, attackers can still exploit this flaw once inside a network.

“In a rare move, VMware published a blog post calling out ransomware groups as being adept at leveraging flaws like this post-compromise, after having gained access to a network via other means such as spearphishing. With ransomware dominating the news, this context is important and reinforces VMware’s assertion that patching these flaws should be a top priority. Successful exploitation would allow an attacker to execute arbitrary commands on the underlying vCenter host.

“VMware also patched CVE-2021-21986, which is an authentication mechanism issue found in several vCenter Server Plug-ins and was assigned a CVSSv3 score of 6.5, making it moderately severe.

“VMware has provided patches for both flaws and organizations using vCenter Servers are advised to act immediately.” — Claire Tills, Senior Research Engineer, Tenable

Technology

Microsoft’s Security Patches for May 2021 Addresses 55 CVEs

May 12, 2021 by Neel Achary 0 Comments #Microsoft patched CVE-2021-31166, #Satnam Narang, #Staff Research Engineer, #Tenable

This month’s Patch Wednesday release addressed 55 CVEs, 4 of which are rated critical. This is the second time in 2021 that Microsoft has patched less than 60 CVEs.

“Microsoft patched CVE-2021-31166, a remote code execution vulnerability in the HTTP Protocol Stack (http.sys). This vulnerability was discovered internally by Microsoft and is rated as Exploitation More Likely on Microsoft’s Exploitability Index.

“To exploit the flaw, an attacker would need to target a vulnerable server using the HTTP Protocol Stack with a packet containing the exploit code. Additionally concerning is that this vulnerability is wormable, meaning it can self-replicate on its own without human intervention. The most devastating wormable attack in the last several years was the WannaCry attacks. Organisations that utilise the HTTP Protocol Stack in their server architecture should apply these updates immediately.

“Microsoft also patched four vulnerabilities in Microsoft Exchange Server. The flaws, which include CVE-2021-31198, CVE-2021-31207, CVE-2021-31209 and CVE-2021-31195, are all rated Important or Moderate. CVE-2021-31195 is attributed to Orange Tsai of the DEVCORE research team, who was responsible for disclosing the ProxyLogon Exchange Server vulnerability that was patched in an out-of-band release back in March. While none of these flaws are deemed critical in nature, it is a reminder that researchers and attackers are still looking closely at Exchange Server for additional vulnerabilities, so organisations that have yet to update their systems should do so as soon as possible.” – Satnam Narang, Staff Research Engineer, Tenable

Technology

Critical vulnerability in Cisco SD-WAN vManage Software

May 7, 2021 by Neel Achary 0 Comments #Satnam Narang, #Staff Research Engineer, #Tenable

Cisco addressed multiple vulnerabilities in its SD-WAN vManage Software. One of which allows an attacker to perform actions not granted to average users, such as creating accounts with administrative level access. Please find below a comment from Satnam Narang, Staff Research Engineer, Tenable.

“Cisco patched multiple vulnerabilities on Wednesday, including several flaws in its SD-WAN vManage software. The most severe flaw is CVE-2021-1468, an unauthorised message processing vulnerability.

“The flaw exists because the vManage software fails to perform an authentication check on input supplied by the user to the application’s messaging service. This vulnerability could be exploited pre-authentication, meaning the attacker does not need to possess valid credentials and authenticate to the vulnerable application. Successful exploitation would give an attacker the ability to perform actions not granted to average users, such as creating accounts with administrative level access.

“It should be noted that this particular vulnerability as well as several others patched on Wednesday can only be exploited if the vManage software is running in Cluster Mode.

If your organisation uses vManage, we strongly encourage you to apply these patches as soon as possible.” — Satnam Narang, Staff Research Engineer, Tenable

Technology

Comment on World Password Day from Kartik Shahani, Country Manager, Tenable

May 6, 2021 by Neel Achary 0 Comments #Country Manager, #Kartik Shahani, #Tenable

Cyber attacks are on the rise in India with the number of incidents increasing threefold in the last one year. Be it a major breach like SolarWinds or phishing and ransomware attacks, cybercriminals always take the easiest route to obtain privileged credentials. In many instances, phishing and ransomware scams hinge on procuring passwords and personally identifiable information. Maintaining basic cyber hygiene by adopting strong passwords and multi-factor authentication go a long way in thwarting cyber attacks.

“In today’s digital-everything world, so much of our lives are available online and accessible across multiple devices. We have grown accustomed to sharing our personal information online, sometimes without giving thought to the potential consequences.

“Personally identifiable information has become an attractive target for cybercriminals and unfortunately a password with your pet’s name isn’t going to protect you. Weak or predictable passwords are akin having a door with no hinges, a thief can get through. Far too many scams focused on tricking individuals to disclose their passwords have occurred in India and the negative consequences as a result cannot be understated.

“Rather than relying on passwords alone, add additional layers of security. Implement authentication methods [multi-factor authentication (MFA)], such as the use of biometrics or one time passcodes [OTPs]. This is simple and prevents identity theft and other cybercrimes.” – Kartik Shahani, Country Manager, Tenable

Marty Edwards, VP of OT security, Tenable

Technology

Comment from Tenable on BadAlloc flaws

Apr 30, 2021 by Neel Achary 0 Comments #Marty Edwards, #Tenable, #VP of OT security

Microsoft disclosed more than 25 critical memory allocation vulnerabilities in OT and IoT devices that could enable an attacker to bypass security controls and execute malicious code or cause a system to crash in industrial, medical, and enterprise networks.

“Vulnerabilities such as the BadAlloc flaws underscore the need for critical infrastructure and manufacturing organisations to have continuous visibility into the devices used in their production environments. It is no longer sufficient to evaluate your risk ‘with a clipboard’ on a periodic basis. When the CISO comes to ask if your organisation is exposed to these latest vulnerabilities, you should have the answer immediately. Not being able to answer that question gives attackers the upper hand.

Since these vulnerabilities are in the Real Time Operating Systems that are the foundation of many OT and IoT devices, the end user may not actually know that they rely on these products. Hopefully, the OT OEM vendor community will evaluate these vulnerabilities and determine if they are a risk in their products. We always advise owners of OT to work with their vendors on how to appropriately mitigate vulnerabilities in critical devices. This case is no different.” — Marty Edwards, VP of OT security, Tenable

Tag: Tenable