• Skip to primary navigation
  • Skip to main content
nGuard

nGuard

Call us p. 704.583.4088
  • Solutions
    • Security Assessments
    • Compliance
    • Cyber Security Incidence Response
    • Penetration Testing
    • Managed Event Collection
    • Vulnerability Management
    • Red Teaming
    • Mobile Security
    • Cloud Security
  • Industries
    • Healthcare
    • Energy
    • Information Technology
    • Manufacturing
    • Defense
    • Banking
    • Insurance
    • Government
    • Transportation
    • Entertainment
    • Food & Beverage
  • About Us
    • Our Company
    • Careers
    • Blog
  • Contact
Client PortalSpeak to An Expert

FortiOS

TWiC | U.S. House Data Leak, ICS Attacks, FortiOS Vulnerability, Cyber Insurance

FBI Investigating Data Breach Affecting U.S. House of Representatives Members and Staff

The Federal Bureau of Investigation (FBI) is investigating a data breach affecting members and staff of the U.S. House of Representatives. The breach saw account and sensitive personal information belonging to them and their families stolen from the servers of DC Health Link, which administers their health care plans.

While US House Chief Administrative Officer Catherine L. Szpindor has said, “it was unclear how many people had been affected by the breach.” A sample of the data reportedly posted on a hacking forum showed details of around 170,000 people. The information included names, dates of birth, addresses, email addresses, phone numbers, and Social Security numbers. At least one threat actor has reportedly put the data up for sale.

nGuard’s MECC (Managed Event Collection and Correlation) can help protect against malicious attacks by collecting and analyzing log data from various sources. MECC can then alert security teams to potential threats and provide them with the information they need to investigate and respond to an ongoing or potential attack. Should your organization fall victim to an attack like this, call nGuard to help with our Cyber Security Incident Response services.

New FortiOS and FortiProxy Critical Vulnerabilities

Fortinet has released patches to address 15 security flaws, including one critical vulnerability in FortiOS and FortiProxy that could allow an attacker to take control of affected systems. The buffer underwrite flaw (CVE-2023-25610) is rated 9.3 out of 10 for severity and was discovered by Fortinet’s internal security teams. The vulnerability could enable a remote, unauthenticated attacker to execute arbitrary code on the device or cause a denial-of-service attack. Fortinet has not yet seen any malicious exploitation attempts against the flaw, but users are urged to apply the patches quickly, as prior flaws in software have been actively abused in the wild. Workarounds include disabling the HTTP/HTTPS administrative interface or limiting IP addresses that can reach it. Just last week, nGuard wrote about another Fortinet critical vulnerability that was actively being exploited. As this continues to develop, nGuard has a number of solutions that can help your organization stay ahead of the curve, including internal penetration testing and vulnerability management.

Over 40% of Industrial Control Systems (ICS) Were Attacked in 2022

Over 40% of industrial control systems (ICS) computers globally experienced malicious attacks in 2022, according to Kaspersky research into telemetry statistics. The report highlighted growth in Russia, which saw a 9% increase in malicious activity in 2022, but Ethiopia was the top target overall with 59% of its ICS footprint seeing malicious activity.

Kaspersky noted that blocked malicious scripts and phishing pages targeting ICS were particularly common threats, seeing an 11% rise from 2021. The percentage of ICS computers experiencing malicious activity varied from 40.1% in Africa and Central Asia to 14.2% and 14.3% respectively in Western and Northern Europe. nGuard has been helping protect Industrial control systems, SCADA networks, and critical infrastructure for over 20 years with security assessments, penetration testing, incident response, and managed SIEM services.

Low-coverage Cyber Insurance Plans Help Meet Compliance and Contractual Requirements

As the cyber insurance market experiences a surge in claims for ransomware attacks, insurance carriers and brokers have started imposing tighter rules on the companies that can qualify for coverage, raising prices and reducing the amount of coverage offered per policy. nGuard recently wrote about requirements needed to obtain cyber insurance. Policy coverages have significantly dropped in recent times, with some as low as $5m, and some companies cannot purchase as much insurance as they would like. However, some contracts and compliance regulations require that a company have a cyber insurance policy, which can pose a problem for those that lose coverage. Basic policies are now available for more organizations to obtain affordable coverage, allowing them to avoid a breach of compliance and fulfill contractual obligations.

Filed Under: Advisory, Breach, Compliance, Events, Financial, General, Products & Services, Vulnerabilities & Exploits Tagged With: CVE-2023-25610, cyber insurance, data breach, fbi, FortiOS, FortiProxy, ICS, Incident Response, insurance, internal penetration testing, Kaspersky, malware, mecc, Penetration Testing, SIEM, U.S. House of Representatives, vulnerability management, Vulnerability Scans

Don’t Let Zero-Day Vulnerabilities Spoil Your Holidays

In this article, we will be discussing several recent developments in cybersecurity. First, we will cover the FortiOS SSLVPN Buffer Overflow, a vulnerability that allows attackers to execute arbitrary code on affected devices. Next, we will discuss new Atlassian security flaws, which have been discovered in several of the company’s popular software tools. We will also examine the issue of JSON requests bypassing Web Application Firewalls and how this can leave systems vulnerable to attacks. Finally, we will discuss Apple’s efforts to patch iPhone and iPad Zero-Days, which are vulnerabilities that have not yet been publicly disclosed. These topics highlight the ongoing importance of staying vigilant and taking steps to protect against emerging threats in the digital landscape.

FortiOS SSL-VPN Heap-Based Buffer Overflow Discovered

FortiGuard Labs has published a critical advisory warning of a heap-based buffer overflow vulnerability in FortiOS SSL-VPN. This may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests. The vulnerability is assigned the number FG-IR-22-398, has a CVSSv3 9.3 rating and has been confirmed to be exploited in the wild. FortiGuard Labs has included the indicators of compromise (IOCs) for FortiOS administrators to review the integrity of their systems. It is recommended that organizations upgrade to an unaffected version of FortiOS and follow FortiGuard’s advice to review existing systems for signs of compromise. To stay on top of new vulnerabilities like this, nGuard recommends having, at a minimum, quarterly vulnerability scans conducted on your internal and external environments. In addition, to get a full view of what an attacker could do if they gain access to your network, annual internal and external penetration testing is recommended.

Security Flaws Discovered in Atlassian Products

CloudSEK researchers have identified a flaw in Atlassian products Jira, Confluence, and BitBucket that could be exploited by threat actors to take over corporate Jira accounts. The researchers found that even if a password is changed with 2FA enabled, cookies are not invalidated and only expire when a user logs out or after 30 days. As a result, threat actors can restore Jira, Confluence, Trello, or BitBucket sessions using stolen cookies, even if they do not have access to the multi-factor authentication or one-time PIN required for 2FA. With over 10 million users across 180,000 companies, including 83% of Fortune 500 firms, Atlassian products are widely used, and threat actors are actively exploiting the flaw to compromise enterprise Jira accounts. CloudSEK is releasing a free tool that allows companies to check if their compromised computers and Jira accounts are being advertised on dark web marketplaces. Additionally, conducting a web application penetration test can help discover vulnerabilities with session cookies and other areas, using the OWASP Top 10 as the foundation of the assessment.

Web Application Firewalls Bypassed by JSON Requests

Researchers at Claroty have discovered that web application firewalls (WAFs) from Amazon Web Services, Cloudflare, F5, Imperva and Palo Alto are vulnerable to malicious requests that use the JavaScript Object Notation (JSON) format to obfuscate database commands and escape detection. This technique allows attackers to access and potentially change data as well as compromise the application. The researchers found that WAFs do not understand commands written in JSON, while major SQL databases do. This allows attackers to forward malicious requests to the back-end database without detection. WAFs are widely used to protect against application attacks, but they are not foolproof. A 2020 survey found that 40% of security professionals claimed at least half of application attacks had bypassed the WAF. This research shows that even if you have security devices in place, they can be bypassed. nGuard can find the vulnerabilities within your web applications before an attacker can by performing a web application penetration test.

Apple Send Updates to Patch New Zero-Day

Apple has released security updates for iOS, iPadOS, macOS, tvOS, and Safari to address a zero-day vulnerability that could result in the execution of malicious code. The issue, which has been given the code name of CVE-2022-42856, has been described as a type of confusion issue in the WebKit browser engine that could be triggered when processing specially crafted content. This could lead to arbitrary code execution, with Apple saying it is aware of a report that the issue may have been actively exploited against versions of iOS released before iOS 15.1. It is thought that the issue involved social engineering or a watering hole attack, with the devices being infected when visiting a rogue or legitimate-but-compromised domain via the browser. The company has addressed the issue with improved state handling.

Filed Under: Advisory, Breach, Compliance, Events, Financial, General, Products & Services, Vulnerabilities & Exploits Tagged With: Apple, Atlassian, BitBucket, Confluence, FortiGuard, FortiOS, information security, iPad, iPhone, Jira, JSON, Vulnerability Scans, WAF, zero-days

nGuard

nGuard

3540 Toringdon Way
Suite 200
Charlotte, NC 28277-4650

info@nGuard.com

Client Portal

Solutions

  • Security Assessments
  • Compliance
  • Cyber Security Incident Response
  • Penetration Testing
  • Managed Event Collection
  • nGuard Vulnerability Management
  • Red Team Testing
  • Mobile Security
  • Cloud Security

Industries

  • Healthcare
  • Energy
  • Information Technology
  • Manufacturing
  • Defense
  • Banking
  • Insurance
  • Government
  • Transportation
  • Entertainment
  • Food & Beverage

About Us

  • Our Company
  • Careers
  • Blog

© 2023 nGuard. All rights reserved.

  • Privacy Policy