Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Server Exploit. Show all posts
TeamCity
Authentication Bypass Cyber Security JetBrains Server Exploit Supply Chain Attack TeamCity

TeamCity Software Vulnerability Exploited Globally

 


Over the past few days a security breach has transpired, hackers are taking advantage of a significant flaw in TeamCity On-Premises software, allowing them to create unauthorised admin accounts. This flaw, known as CVE-2024-27198, has prompted urgent action from software developer JetBrains, who released an update on March 4 to address the issue.

The gravity of this situation is evident as hackers exploit the vulnerability on an extensive scale, creating hundreds of unauthorised users on instances of TeamCity that have not yet received the essential update. According to LeakIX, a platform specialising in identifying exposed device vulnerabilities, over 1,700 TeamCity servers remain unprotected. Most notably, vulnerable hosts are predominantly found in Germany, the United States, and Russia, with an alarming 1,440 instances already compromised.

On March 5, GreyNoise, a company analysing internet scanning traffic, detected a notable surge in attempts to exploit CVE-2024-27198. The majority of these attempts originated from systems in the United States, particularly those utilising the DigitalOcean hosting infrastructure.

These compromised TeamCity servers are not mere inconveniences; they serve as vital production machines used for building and deploying software. This presents a significant risk of supply-chain attacks, as the compromised servers may contain sensitive information, including crucial credentials for environments where code is deployed, published, or stored.

Rapid7, a prominent cybersecurity company, brought attention to the severity of the situation. The vulnerability, with a critical severity score of 9.8 out of 10, affects all releases up to TeamCity version 2023.11.4. Its nature allows remote, unauthenticated attackers to gain control of a vulnerable server with administrative privileges.

JetBrains responded swiftly to the report by releasing TeamCity version 2023.11.4 on March 4, featuring a fix for CVE-2024-27198. They are urging all TeamCity users to update their instances to the latest version immediately to mitigate the risks associated with this critical vulnerability.

Considering the observed widespread exploitation, administrators of on-premise TeamCity instances are strongly advised to take immediate action in installing the newest release. Failing to do so could leave systems vulnerable to unauthorised access and potential supply-chain attacks, amplifying the urgency of this situation.

The recent discovery of a critical flaw in TeamCity software has far-reaching implications for the global security landscape. Users are urged to act promptly by updating their TeamCity instances to ensure protection against unauthorised access and the looming threat of potential supply-chain attacks. The urgency of this matter cannot be overstated, accentuating the imperative need for immediate action.



Read more »
Shell
Atlassian Backdoor Cyber Security Ransomware Attacks. Server Exploit servers Shell

Effluence Backdoor: A Lingering Menace in Atlassian Confluence Servers

According to current cybersecurity developments, despite intensive efforts to patch vulnerabilities in Atlassian Confluence servers, the infamous Effluence backdoor remains a persistent danger. Because of this online shell's invisibility and the possible threats it poses to companies, security experts and researchers have expressed alarm.

Effluence, a covert backdoor identified in Atlassian Confluence servers, has been a focal point in the cybersecurity community due to its ability to evade detection and persist even after patching. Reports from prominent sources like The Hacker News and OPP Today reveal that despite efforts to secure Confluence servers, the Effluence backdoor remains active, allowing unauthorized access and potential exploitation.

TS2 Space, a cybersecurity platform, sheds light on the clandestine nature of the Effluence backdoor, emphasizing its stealthy capabilities. The backdoor's ability to operate without authentication makes it a formidable threat, enabling hackers to infiltrate systems undetected. This characteristic poses a significant challenge for organizations relying on Atlassian Confluence for collaborative work, as the backdoor can potentially compromise sensitive data and lead to severe security breaches.

Aon Cyber Labs has been at the forefront of efforts to detect and mitigate the Effluence backdoor. Their insights into unauthenticated Confluence web shell attacks provide valuable information for organizations looking to fortify their cybersecurity defenses. The challenge lies not only in patching known vulnerabilities but also in actively identifying and eliminating instances of the Effluence backdoor that may have already infiltrated systems.

Concerns have been raised by cybersecurity specialists regarding a possible link between ransomware attacks and Effluence. Effluence poses increased threats, since hackers may use it as a doorway to spread ransomware and extort businesses for money. This rise in risks emphasizes how urgent it is for businesses to take comprehensive and quick action against the Effluence backdoor.

The Effluence backdoor's continued existence is a sobering reminder of the difficulties businesses confront in protecting their digital infrastructure as the cybersecurity scene changes. Proactive patching, ongoing monitoring, and strong detection methods are just a few of the many strategies needed to combat this danger. Preventing possible breaches is crucial for preserving the security and integrity of organizational data in an era where cyber threats are growing more complex.


Read more »
Server Exploit
Cyber Security Japanese hackers Malicious actor phone scams Scammers Sensitive Data Leak Server Exploit

Cambodia Deports 19 Japanese Cybercrime Scam Suspects

Cambodia has deported 19 Japanese nationals for allegedly running online scams. According to reports, these individuals were involved in a cybercrime operation that used telephone calls to deceive people and steal their money. This incident highlights the need for improved cybersecurity measures to protect individuals and businesses from such scams.

The suspects were arrested in Cambodia after Japanese authorities requested their extradition. They were accused of running a call center from Cambodia to target people in Japan. The scam involved posing as officials from banks, tax offices, or other organizations, and asking victims to transfer money or reveal their personal information.

The arrests were part of a joint operation between Japanese and Cambodian law enforcement agencies. The suspects were charged with violating Japan's organized crime laws, as well as Cambodia's immigration laws. The Japanese authorities have commended the Cambodian government for their cooperation in this matter.

The incident highlights the vulnerabilities of online systems and the need for individuals and businesses to be vigilant. Cybercriminals often use social engineering tactics to trick people into revealing their personal information, such as passwords or bank account details. They may also use malware to gain access to computer systems and steal sensitive data.

To protect against such threats, it is important to implement robust cybersecurity measures. This may include using strong passwords, encrypting data, and regularly updating software and security systems. Additionally, individuals should be wary of unsolicited calls or emails, and should never disclose personal information unless they are certain of the identity and legitimacy of the caller.

In conclusion, the deportation of 19 Japanese nationals for their involvement in cybercrime highlights the need for improved cybersecurity measures. Online scams and fraud are a growing threat, and it is essential that individuals and businesses take steps to protect themselves against such threats. By remaining vigilant and implementing robust cybersecurity measures, we can help to safeguard our personal and financial information from cybercriminals.
Read more »
Server Exploit
Cloud Computing Cloud Server Honeypot Honeypot Mumbai Ohio Server Exploit

Over Rs 6 lakh attempted attacks on Mumbai cloud server honeypot

At least 678,013 login attempts were made on Mumbai cloud server honeypot making it the second biggest attack spread over a month, after Ohio, US, honeypot that recorded more than 950,000 login attempts during the same time period, among a total of 10 honeypots placed globally, global cyber security major Sophos said on Wednesday. This demonstrates how cybercriminals are automatically scanning for weak open cloud buckets.

A honeypot is a system intended to mimic likely targets of cyberattackers for security researchers to monitor cybercriminal behaviour. The first login attempt on the Mumbai honeypot was made within 55 minutes and 11 seconds of going live.

On average, the cloud servers were hit by 13 attempted attacks per minute, per honeypot. The honeypots were set-up in 10 of the most popular Amazon Web Services (AWS) data centres in the world, including California, Frankfurt, Ireland, London, Mumbai, Ohio, Paris, Sao Paulo, Singapore, and Sydney over a 30-day period.

Sophos announced the findings of its report, Exposed: Cyberattacks on Cloud Honeypots.

With businesses across the globe increasingly adopting Cloud technology, the report revealed the extent to which businesses migrating to hybrid and all-Cloud platforms are at risk. It has thus become vital for businesses to ensure compliance and to know what to protect.

“The aggressive speed and scale of attacks on devices demonstrates the use of botnets to target an organisation’s cloud platform. In some instances, it may be a human attacker. However, regardless of this, companies need to set a security strategy to protect what they are putting into the cloud,” said Sunil Sharma, managing director, sales at Sophos (India & SAARC).

However, multiple development teams within an organization and an ever-changing, auto-scaling environment make this difficult for IT security.

Key features in Sophos Cloud Optix include:

Smart Visibility - Automatic discovery of organization’s assets across AWS, Microsoft Azure and Google Cloud Platform (GCP) environments, via a single console, allowing security teams complete visibility into everything they have in the cloud and to respond and remediate security risks in minutes.

Continuous Cloud Compliance – Keeps up with continually changing compliance regulations and best practices policies by automatically detecting changes to cloud environments in near-time.

AI-Based Monitoring and Analytics - Shrinks incident response and resolution times from days or weeks to just minutes. The powerful artificial intelligence detects risky resource configurations and suspicious network behaviour with smart alerts and optional automatic risk remediation
Read more »
Social Media
Breach of Security and Privacy Data Breach Facebook Password Crackers Server Exploit Social Media

Facebook leaves passwords unencrypted



Facebook said there is no evidence its employees abused access to this data. The company said the passwords were stored on internal company servers, where no outsiders could access them. However, privacy experts suggested that users change their passwords.

The security slip left the passwords readable by the social networking giant's employees.

The issue was first reported by security researcher Brian Krebs, who published a blog post-Thursday detailing that Facebook employees built applications that captured the passwords of users and stored them as plain text, meaning a password would be readable just the same as it is entered to log in.

The blunder was uncovered during a routine security review early this year, according to Canahuati.

"To be clear, these passwords were never visible to anyone outside of Facebook and we have found no evidence to date that anyone internally abused or improperly accessed them," vice president of engineering, security, and privacy Pedro Canahuati said.

"As part of a routine security review in January, we found that some user passwords were being stored in a readable format within our internal data storage systems," Pedro Canahuati, vice president of engineering for security and privacy at Facebook, wrote in a blog post. "This caught our attention because our login systems are designed to mask passwords using techniques that make them unreadable."

Most companies encrypt passwords to prevent them from being stolen in the event of a data breach or used for nefarious purposes by company employees.

The incident reveals yet another huge and basic oversight at a company that insists it is a responsible guardian for the personal data of its 2.3 billion users worldwide.

By storing passwords in readable plain text, Facebook violated fundamental computer-security practices. Those call for organizations and websites to save passwords in a scrambled form that makes it almost impossible to recover the original text. The blunder was uncovered during a routine security review early this year, according to Canahuati. 
Read more »
Virus Attack
BlackHole Exploit Malware Attack Malware Report Server Exploit Virus Attack

MySQL.com is hacked and infected by Malware ~ Exploits Visitor's Broswer



MySQL.com is hacked and infected by Malware ,detected by HackAlert 24x7 Website malware monitoring platform. If you visit the website , your system will be infected by malware without your knowledge and crash your flash player,java.



 
Infection Process:
if you visit , you will run the malicious javascript code.

This code generates this Iframe
http://falosfax.in/info/in.cgi?5&ab_iframe=1&ab_badtraffic=1&antibot_hash=1255098964&ur=1&HTTP_REFERER=http://mysql.com/

and Throws out a 302 redirect to

http://truruhfhqnviaosdpruejeslsuy.cx.cc/main.php



This domain hosts the BlackHole exploit pack. It exploits the visitor's browsing platform (the browser, the browser plugins like Adobe Flash, Adobe PDF, etc, Java, ...), and upon successful exploitation, permanently installs a piece of malware into the visitor's machine, without the visitor's knowledge. The visitor doesn't need to click or agree to anything; simply visiting mysql.com with a vulnerable browsing platform will result in an infection.

Currently, 4 out of 44 vendors on VirusTotal can detect this piece of malware.

Trend Micros said:
"We recently found an interesting post in a Russian underground forum in the course of our research. People exchange information about their illegal activities in these kinds of forums. We found a user in the forum with the handle ‘sourcec0de‘ and ICQ number ’291149′ who is currently offering root access to some of the cluster servers of mysql.com and its subdomains.

The price for each access starts at $3,000 USD, with the exchange of money/access being provided by the well known garant/escrow system, whereby a trusted third party verifies both sides of the transaction."


The mysql.com website is as of now, still serving this exploit and malware.

armorize.com trying to contact mysql.com


Read more »
Subscribe to: Posts (Atom)