300+ Organizations Breached by Multiple DrayTek Vulnerabilities

Ivanti Connect Secure Zero-Day Under Active Exploitation

January 10, 2025January 10, 2025

Ivanti Warns of Security Vulnerabilities in Connect Secure Products

Ivanti has recently issued a critical warning regarding ongoing security intrusions targeting older versions of its Ivanti Connect Secure software. This issue stems from a severe vulnerability, known as CVE-2025-0282, which is classified as a stack-based buffer overflow. The flaw poses a significant risk as it could allow malicious actors to execute arbitrary code on affected systems. Organizations using Ivanti Connect Secure versions earlier than 22.7R2.5 should take immediate action to secure their networks.

In addition to CVE-2025-0282, Ivanti has identified another high-severity vulnerability, CVE-2025-0283, which could enable privilege escalation. Affected versions of Ivanti Policy Secure (older than 22.7R1.2) and Ivanti Neurons for ZTA Gateways (older than 22.7R2.3) are also at risk, although no attacks have yet been reported against those devices.

Understanding the Vulnerabilities

Key Vulnerabilities Impacting Ivanti Products

CVE-2025-0282: Stack-based buffer overflow vulnerability allowing arbitrary code execution.
CVE-2025-0283: High-severity vulnerability enabling privilege escalation.

Recommended Actions for Organizations

Organizations utilizing Ivanti Connect Secure should act swiftly to mitigate potential risks. Here are some recommended steps:

Monitor for Exploitation: Utilize the Integrity Checker Tool provided by Ivanti to keep an eye on any potential exploitation attempts.
Conduct Factory Resets: Before updating to the latest version of Ivanti Connect Secure, perform factory resets to ensure a clean environment.
Update Software: Ensure that all Ivanti products are updated to the latest versions to minimize vulnerabilities.

Ivanti has reassured users that the chances of exploitation for the vulnerable Ivanti Policy Secure are considerably lower. A patch for this product is expected to be released on January 21, which should further enhance security measures.

Conclusion

As cybersecurity threats continue to evolve, organizations must remain vigilant and proactive in applying security updates and monitoring their systems. For more information on Ivanti’s security advisories, you can visit the Ivanti Security Center or check out detailed insights from SecurityWeek.

If you found this article helpful, please share your thoughts in the comments below or explore related articles on cybersecurity best practices to stay informed about protecting your organization’s assets.

New LLM Jailbreak Exploits Models’ Own Evaluation Skills

January 4, 2025January 4, 2025

A new multi-step jailbreak method for large language models (LLMs), called the “Bad Likert Judge,” has raised significant security concerns. Developed by Palo Alto Networks’ Unit 42, this technique exploits LLMs’ ability to assess harmful content, enabling the generation of malware and illegal materials. Utilizing a Likert scale for evaluating content harmfulness, the method achieved a remarkable 71.6% average success rate in tests, peaking at 87.6% with one model. To counteract such vulnerabilities, LLM developers must implement robust content filters, which have shown to reduce jailbreak success by 89.2%. Enhanced security measures are crucial as AI systems become increasingly prevalent.

US Treasury Breached by State-Sponsored Chinese Hackers

China Hack Targets Treasury Sanctions Office, Reports Say

January 3, 2025January 3, 2025

The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) has been targeted in a cyberespionage operation attributed to Chinese state-sponsored actors, raising concerns over the security of sensitive information regarding U.S. sanctions. The breach also affected the Office of Financial Research, stemming from vulnerabilities in the BeyondTrust remote support software. The Treasury quickly responded by purging the attackers from its systems and conducting an ongoing investigation. This incident highlights the rising threat of Chinese cyberattacks on U.S. infrastructure, emphasizing the need for improved cybersecurity measures to protect national interests.

Haroon Meer: The Hacker Hero Behind PSW Vault

December 25, 2024December 25, 2024

Haroon Meer is a prominent figure in cybersecurity, recognized for his innovative strategies to combat cyber threats. As the founder of a successful cybersecurity firm, he emphasizes proactive measures to protect organizations. Meer’s expertise in threat detection, development of innovative solutions, and education on online safety highlight the critical role of cybersecurity professionals. He advocates for a culture of cybersecurity within organizations and shares insights at industry events. With the rise in cyberattacks, Meer’s contributions are increasingly vital to safeguarding digital infrastructure. His work exemplifies the importance of cybersecurity heroes in today’s evolving digital landscape.

US Launches Cyber Trust Mark for IoT Devices

January 8, 2025January 8, 2025

The Biden administration has launched the U.S. Cyber Trust Mark labeling program to enhance the security of Internet of Things (IoT) devices. Following FCC approval, this initiative aims to protect consumers as smart devices proliferate. Initially focused on consumer products, the program will expand to include small office routers and enterprise systems. Nearly a dozen companies have been designated as Cybersecurity Label Administrators, with UL Solutions leading. An upcoming executive order will require government agencies to use labeled devices by 2027. The Cyber Trust Mark will help consumers identify secure products, encourage manufacturer compliance, and improve overall cybersecurity.

Tech Update: Robot Dogs, Ivanti, SonicWall & More – SWN #441

January 11, 2025January 11, 2025

Recent technological innovations feature robot dogs and advancements in cybersecurity. Robot dogs, capable of autonomous navigation and real-time data collection, are becoming integral for tasks like surveillance and search and rescue, driven by companies such as Motorola. In cybersecurity, Ivanti and SonicWall are leading the charge, providing crucial tools for endpoint security management and advanced firewall solutions. Additionally, platforms like Telegram are gaining popularity for secure messaging, addressing privacy concerns. New players like Banshee and experts like Aaran Leyland are also shaping the conversation around technology and security. Staying informed about these trends is vital for a safer digital future.

SWN #439: Dysentery, TP-Link, TikTok, and Scams Uncovered

December 21, 2024December 21, 2024

In SWN #439, key topics addressed include a rising global dysentery outbreak, ongoing digital piracy concerns, and security vulnerabilities involving companies like TP-Link and Tencent. Health officials warn of increased dysentery cases, urging preventive measures such as hand washing, safe food handling, and drinking clean water. Meanwhile, digital piracy is impacting content creators, leading to revenue loss and legal challenges for platforms like TikTok. TP-Link faces scrutiny for security flaws in smart home devices, highlighting the need for firmware updates and strong passwords. The edition emphasizes the importance of staying informed about these interconnected health and technology issues.