Updated Mirai Botnet Targets Vulnerable Devices in Ongoing Attacks

Intrusions Endanger Thousands of Four-Faith Routers

December 31, 2024December 31, 2024

Major Security Flaw Discovered in Four-Faith Routers: Over 15,000 Devices at Risk

More than 15,000 internet-exposed Four-Faith F3x24 and F3x36 routers are under threat due to a critical security vulnerability identified as CVE-2024-12856. This operating system command injection flaw poses significant risks, allowing potential attackers to exploit these devices and gain unauthorized access. As cybersecurity concerns rise, understanding the implications of this vulnerability is crucial for both individual users and organizations relying on Four-Faith routers.

Understanding the CVE-2024-12856 Vulnerability

Recent reports from The Hacker News highlight the ongoing intrusions targeting these vulnerable routers. The attacks are being traced back to the same IP address that previously exploited a different vulnerability, CVE-2019-12168, which allowed for remote code execution. This new exploit is being used to deploy a reverse shell, ensuring persistent access and enabling unauthenticated OS command execution on affected devices.

How the Attack Works

The vulnerability can be exploited through the following method:

HTTP Access: The attack can be conducted over HTTP using the /apply.cgi endpoint.
Target Parameter: Specifically, the adj_time_year parameter is vulnerable when adjusting the device’s system time via submit_type=adjust_sys_time.

VulnCheck researcher Jacob Baines emphasizes the severity of this issue, stating, “The attack can be conducted against, at least, the Four-Faith F3x24 and F3x36.”

Lack of Immediate Fixes from Four-Faith

Despite the discovery of this significant vulnerability, Four-Faith has yet to release a patch or fix. This delay raises concerns for users who depend on these routers for secure internet connectivity.

For more detailed information about the vulnerability, you can visit VulnCheck’s report or check out this article on The Hacker News for ongoing updates.

Protecting Your Network

If you own a Four-Faith F3x24 or F3x36 router, consider taking the following steps to protect your network:

Limit Internet Exposure: Ensure that your router is not exposed to the internet unnecessarily.
Monitor Network Traffic: Keep an eye on unusual activity that might indicate a breach.
Stay Updated: Regularly check for firmware updates and security patches from Four-Faith.

Conclusion

The discovery of CVE-2024-12856 highlights the importance of cybersecurity in today’s digital landscape. With over 15,000 routers potentially at risk, it is vital for users to remain vigilant and informed about security vulnerabilities.

We invite you to share your thoughts on this issue or read related articles on maintaining cybersecurity in home and business networks. Stay safe online!

North Korean Hackers Use OtterCookie Malware in Job Scam

December 27, 2024December 27, 2024

North Korean hackers have launched a new JavaScript malware called OtterCookie as part of their Contagious Interview campaign, which targets job seekers. The campaign uses social engineering tactics, posing as recruiters to trick individuals into downloading malware disguised as legitimate videoconferencing applications or npm packages. Palo Alto Networks Unit 42 identified the group behind these attacks, known as CL-STA-0240. Recent findings indicate that OtterCookie can execute shell commands and steal sensitive data, including cryptocurrency wallet keys. This campaign highlights ongoing cyber threats from North Korea, prompting sanctions from South Korea and indictments from the U.S. Department of Justice.

New Termite Ransomware Group Linked to Blue Yonder Hack

Electrica Group Faces Ongoing Ransomware Attack

December 11, 2024December 11, 2024

Electrica Group, a major electricity distributor in Romania, is investigating a cyberattack that has disrupted its customer service operations, highlighting the increasing threat of cybercrime to critical infrastructure. While customer interactions were affected, the company assured stakeholders that essential systems remain secure. The attack, linked to a ransomware intrusion, reportedly has connections to Russian threat operations. This incident reflects a broader trend of cyber threats facing Romania, including recent vulnerabilities in its election infrastructure. As cybercriminals target essential services, robust cybersecurity measures are vital for protecting critical systems across all sectors.

CISA Vulnerabilities Catalog Sees Minor Decline in Flaws

December 31, 2024December 31, 2024

The Cybersecurity and Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) catalog, revealing 185 actively abused security issues in 2023, a slight decrease from 2022’s 187. Since its launch, CISA has added 1,238 vulnerabilities, with many being long-standing issues. The most common vulnerabilities this year include OS Command Injection, Deserialization of Untrusted Data, Use-After-Free, Path Traversal, and Improper Authentication. Microsoft leads in the number of newly added flaws, followed by Ivanti, Google Chrome, Adobe, and Apple. Staying informed about these vulnerabilities is crucial for organizations to enhance their cybersecurity measures.

US Warns TikTok’s Data Collection Poses Security Risks

January 13, 2025January 13, 2025

TikTok and its parent company, ByteDance, are facing serious allegations during a Supreme Court hearing regarding the excessive collection of data from 170 million American users, raising concerns about potential espionage and extortion. U.S. Solicitor General Elizabeth Prelogar highlighted that ByteDance has previously misused data at the request of the Chinese government, including spying on journalists and monitoring dissidents. TikTok’s attorney sought a delay in divestiture enforcement, but this was denied. As scrutiny increases, users are urged to review privacy settings, stay informed about legal developments, and consider alternative platforms to safeguard their data privacy.

2025: The Industry Must Avoid Complacency

December 24, 2024December 24, 2024

As we approach 2025, the cybersecurity landscape remains critical, highlighted by significant incidents in 2024 that revealed vulnerabilities across sectors. A flawed software update caused global IT outages, while a Chinese hacking group breached U.S. telecoms. The healthcare sector faced ransomware attacks, and cybercriminals increasingly employed AI for more sophisticated attacks. Data breaches surged, emphasizing the need for robust data protection. Organizations must adopt proactive risk management, enhance incident response strategies, and invest in cybersecurity technologies to navigate future threats. These lessons underscore that cybersecurity is essential for business survival and maintaining trust.

Trump Seeks Delay on TikTok Ban

December 31, 2024December 31, 2024

President-elect Donald Trump has asked the U.S. Supreme Court to delay a TikTok ban set for January 20, citing concerns over national security and free speech. His “friend-of-the-court” brief argues that the ban could set a dangerous precedent by shutting down a social media platform based on specific speech concerns. The Biden administration supports the ban, raising alarms about TikTok’s Chinese ownership potentially threatening U.S. interests through disinformation and data manipulation. This case reflects ongoing tensions regarding technology, privacy, and foreign relations, with the Supreme Court’s decision likely to influence future social media regulations in the U.S.