Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Attackers Target Sophos Firewalls with Zero-Day
Newest First  |  Oldest First  |  Threaded View
blueboxschematic
blueboxschematic,
User Rank: Apprentice
4/28/2020 | 12:41:28 PM
The Sophos Breakdown of Asnarok
Sophos breaks the attack down with great detail: news.sophos.com/en-us/2020/04/26/asnarok/

The good news is you can reference the list of URLs used in the attack and immediately guard against access to these sites, at least. While updated versions of the trojan may point to other domains, it's a start. Additionally they provide a comprehensive file list that can be used for system scans of malicious files.

Because this SQL injection attack will have been patched against already in a hotfix, the biggest issue currently is the Sophos user base that does not have automatic updates enabled. Opening themselves up to the Asnarok attackers will not only provide access to data for as long as their Sophos installs remain unpatched, they offer a testbed for modifications to the code that could allow bypassing any changes made in the hotfix.

 

 

 


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Promise and Reality of Cloud Security
Cloud security has been part of the cybersecurity conversation for years but has been on the sidelines for most enterprises. The shift to remote work during the COVID-19 pandemic and digital transformation projects have moved cloud infrastructure front-and-center as enterprises address the associated security risks. This report - a compilation of cutting-edge Black Hat research, in-depth Omdia analysis, and comprehensive Dark Reading reporting - explores how cloud security is rapidly evolving.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-23077
PUBLISHED: 2023-02-01
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment.
CVE-2023-23078
PUBLISHED: 2023-02-01
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the Assets.
CVE-2023-22287
PUBLISHED: 2023-02-01
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
CVE-2023-23073
PUBLISHED: 2023-02-01
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component.
CVE-2023-23074
PUBLISHED: 2023-02-01
Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component.