Dell iDRAC Vulnerability CVE-2020-5366

Researchers released new information of a vulnerability in the Integrated Dell Remote Access Controller. iDRAC is designed to allow IT administrators to remotely deploy, update, monitor and maintain Dell servers without installing new software. Path Traversal vulnerability CVE-2020-5366 has a 7.1 score which reflects a high degree of danger. Although the vulnerability was fixed earlier in July, by exploiting the flaw, remote attackers could take over control of server operations.

Source: Info Security

How do you protect yourself?

To monitor threats against company servers, it’s crucial to have a managed security program in place. With services like Secure IT – SIEM you can rely on a team of security experts who perform remediation, root cause analysis and provide security recommendations to help you defend against malicious threats.

Cisco Network Security Vulnerability CVE-2020-3452

A high-severity vulnerability in Cisco’s network security software could comprimise sensitive data. The flaw exists in the web services interface of Cisco’s Firepower Threat Defense (FTD) software, and its Adaptive Security Appliance (ASA) software. The vulnerability (CVE-2020-3452) allows attackers to conduct directory traversal attacks, which is an HTTP attack enabling bad actors to access restricted directories and execute commands outside of the web server’s root directory.

Source: Threat Post

How do you protect yourself?

The vulnerability affects products if they are running a vulnerable release of Cisco ASA Software or Cisco FTD Software, with a vulnerable AnyConnect or WebVPN configuration. To eliminate the vulnerability, Cisco users are urged to update Cisco ASA to the most recent version.

VHD Ransomware

North Korean-backed hackers tracked as the Lazarus Group have developed and are actively using VHD ransomware against enterprise targets. VHD ransomware samples were found between March and May 2020 during two investigations, being deployed over the network with the help of an SMB brute-forcing spreading tool and the MATA malware framework (also known as Dacls). The ransomware tool creeps through the drives connected to a victim’s computer, encrypts files, and deletes all System Volume Information folders.

Source: Bleeping Computer

How do you protect yourself?

Organizations must have 24/7 monitoring and remediation solutions in place to defend against VHD Ransomware and similar threats. Secure IT – Endpoint Protection and SIEM help to avoid, or at least isolate these attacks from spreading.