Conversation

Notices

1. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Friday, 02-Feb-2024 02:17:28 JST Kevin Beaumont

   CISA re #ConnectAround "As soon as possible and no later than 11:59PM on Friday February 2, 2024, disconnect all instances of Ivanti Connect Secure and Ivanti Policy Secure solution products from agency networks."

   https://www.securityweek.com/cisa-sets-48-hour-deadline-for-removal-of-insecure-ivanti-products/

   #threatintel

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Friday, 02-Feb-2024 02:24:48 JST Kevin Beaumont

     in reply to

     • Will Dormann

     Here is the latest mitigation for #ConnectAround visualised by @wdormann, if you want to know how the US Government is getting comprehensively owned again.

     Spoiler: ../.. cyber mega threat. #threatintel

   • Embed this notice
     cR0w (cr0w@infosec.exchange)'s status on Friday, 02-Feb-2024 02:30:10 JST cR0w

     in reply to

     • K. Reid Wightman :verified: 🌻
     • Will Dormann

     @GossiTheDog @wdormann Pretty sure I've seen a recent thread from @reverseics about this whole ../.. thing.

   • Embed this notice
     chort ↙️↙️↙️ (chort@infosec.exchange)'s status on Friday, 02-Feb-2024 03:36:33 JST chort ↙️↙️↙️

     in reply to

     • K. Reid Wightman :verified: 🌻
     • cR0w
     • Will Dormann

     @reverseics @GossiTheDog @cR0w @wdormann why am I doing this instead of owning a goat farm? ../ was literally one of the first things one of my teenage wannabe hacker friends told me about over 25 years ago. How are we still here?

   • Embed this notice
     K. Reid Wightman :verified: 🌻 (reverseics@infosec.exchange)'s status on Friday, 02-Feb-2024 03:36:34 JST K. Reid Wightman :verified: 🌻

     • cR0w
     • Will Dormann

     @GossiTheDog @cR0w @wdormann

   • Embed this notice
     K. Reid Wightman :verified: 🌻 (reverseics@infosec.exchange)'s status on Friday, 02-Feb-2024 03:36:34 JST K. Reid Wightman :verified: 🌻

     in reply to

     • cR0w
     • Will Dormann

     @GossiTheDog @cR0w @wdormann i was definitely memestorming on the subject a few days ago. if you're a vuln hunter, just knowing a decent amount about directory traversal will net you a lot of cves. it's like the new sqli, except it's actually older. and easier to exploit.

   • Embed this notice
     Will Dormann (wdormann@infosec.exchange)'s status on Friday, 02-Feb-2024 05:48:25 JST Will Dormann

     • chort ↙️↙️↙️
     • K. Reid Wightman :verified: 🌻
     • cR0w

     @GossiTheDog @chort @reverseics @cR0w
     The thing was clearly made about 20 years ago without changing anything fundamental about how it works.
     The only reason for its existence is to collect licensing fees.

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Friday, 02-Feb-2024 07:01:39 JST Kevin Beaumont

     in reply to

     844 IPs exploiting #ConnectAround and their payloads https://gist.github.com/andrew-morris/7679a18ef815068897bf27bf631f2ede

     #threatintel

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Saturday, 03-Feb-2024 20:19:19 JST Kevin Beaumont

     in reply to

     The deadline has now passed for US federal government agencies to disconnect all Ivanti Pulse Secure systems from their networks. (Not all have, btw).

     https://www.cisa.gov/news-events/directives/supplemental-direction-v1-ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure

     More soon on why the USG have told people to kill the product. It’s bad.

     #ConnectAround #threatintel

     Dash 🇸🇬 repeated this.
   • Embed this notice
     VessOnSecurity (bontchev@infosec.exchange)'s status on Saturday, 03-Feb-2024 20:23:47 JST VessOnSecurity

     in reply to

     @GossiTheDog

   • Embed this notice
     Kevin Beaumont (gossithedog@cyberplace.social)'s status on Thursday, 04-Apr-2024 08:53:29 JST Kevin Beaumont

     in reply to

     3 months since #ConnectAround vulns in Ivanti Pulse Connect

     Ivanti have announced they plan to radically change how they work to reposition around customer security: https://www.ivanti.com/blog/our-commitment-to-security-an-open-letter-from-ivanti-ceo-jeff-abbott

     It’s a good move. I just went back and looked at my Ivanti Pulse Connect internet survey and re-ran it - it looks like about 10% of systems no longer run that product. It’s both the right thing by customers and a smart business move to try to stop the bleeding.