Pregunta en Español
Question in English
CISSP – preguntas para practicar – Pregunta101
1
Author Archives: seolito2014
Exchange Server attacks: Run this Microsoft malware scanner now, CISA tells government agencies
The Microsoft scanner can use up a lot of a server’s processing capacity, so CISA recommends running the scan during off-peak hours.
"By 12:00 pm Eastern Daylight Time on Monday, April 5, 2021, download and run the current version of Microsoft Safety Scanner (MSERT) in Full Scan mode and report results to CISA using the provided reporting template," it notes.
Critical F5 BIG-IP Bug Under Active Attacks After PoC Exploit Posted Online
The flaws affect BIG-IP versions 11.6 or 12.x and newer, with a critical remote code execution (CVE-2021-22986) also impacting BIG-IQ versions 6.x and 7.x. CVE-2021-22986 (CVSS score: 9.8) is notable for the fact that it’s an unauthenticated, remote command execution vulnerability affecting the iControl REST interface, allowing an attacker to execute arbitrary system commands, create or delete files, and disable services without the need for any authentication.
https://thehackernews.com/2021/03/latest-f5-big-ip-bug-under-active.html
Burnt by SolarWinds attack? US releases tool for post-compromise detection
CISA says CHIRP currently looks for:
- The presence of malware identified by security researchers as TEARDROP and RAINDROP;
- Credential dumping certificate pulls;
- Certain persistence mechanisms identified as associated with this campaign;
- System, network, and M365 enumeration; and
- Known observable indicators of lateral movement.
CHIRP is available on GitHub as a compiled executable or as a Python script.
FireEye in January also released a free tool on GitHub called Azure AD Investigator.
Burnt by SolarWinds attack? US releases tool for post-compromise detection | ZDNet
At Least 30,000 U.S. Organizations Newly Hacked Via Holes in Microsoft’s Email Software
At least 30,000 organizations across the United States — including a significant number of small businesses, towns, cities and local governments — have over the past few days been hacked by an unusually aggressive Chinese cyber espionage unit that’s focused on stealing email from victim organizations, multiple sources tell KrebsOnSecurity. The espionage group is exploiting four newly-discovered flaws in Microsoft Exchange Server email software, and has seeded hundreds of thousands of victim organizations worldwide with tools that give the attackers total, remote control over affected systems.
Airlines warn passengers of data breach after aviation tech supplier is hit by cyberattack
Global aviation industry IT supplier SITA has confirmed it has fallen victim to a cyberattack, with hackers gaining access to personal information of airline passengers.
The information technology and communications company, which claims to serve around 90% of the world’s airlines, said that a cyberattack on February 24, 2021 led to "data security incident" involving passenger data that was stored on SITA Passenger Service System Inc. servers located at Atlanta, Georgia in the United States.
A Basic Timeline of the Exchange Mass-Hack
Sometimes when a complex story takes us by surprise or knocks us back on our heels, it pays to revisit the events in a somewhat linear fashion. Here’s a brief timeline of what we know leading up to last week’s mass-hack, when hundreds of thousands of Microsoft Exchange Server systems got compromised and seeded with a powerful backdoor Trojan horse program.
When did Microsoft find out about attacks on previously unknown vulnerabilities in Exchange?
Pressed for a date when it first became aware of the problem, Microsoft told KrebsOnSecurity it was initially notified “in early January.” So far the earliest known report came on Jan. 5, from a principal security researcher for security testing firm DEVCOR who goes by the handle “Orange Tsai.” DEVCOR is credited with reporting two of the four Exchange flaws that Microsoft patched on Mar. 2.
https://krebsonsecurity.com/2021/03/a-basic-timeline-of-the-exchange-mass-hack/
Everything you need to know about the Microsoft Exchange Server hack
HOW CAN I CHECK MY SERVERS AND THEIR VULNERABILITY STATUS? WHAT DO I DO NOW?
Microsoft has urged IT administrators and customers to apply the security fixes immediately. However, just because fixes are applied now, this does not mean that servers have not already been backdoored or otherwise compromised.
Interim mitigation option guides are also available if patching immediately is not possible.
The Redmond giant has also published a script on GitHub available to IT administrators to run that includes indicators of compromise (IOCs) linked to the four vulnerabilities. IoCs are listed separately here.
CISA issued an emergency directive on March 3 that demanded federal agencies immediately analyze any servers running Microsoft Exchange and to apply the firm’s supplied fixes.
CybersecurityHoy 