January 18, 2025 - Red Dot Security

Hello all,

Last week I wrote about the unbelievable onslaught of CVEs that we must deal with. This week Microsoft hit us with the largest list of defect updates since 2017! Other vendors that are on the same patch cadence didn’t disappoint either, with both Adobe and SAP proffering fixes for defects. Additionally, there were some significant updates and warnings from Fortinet, Juniper, and Google.

The elephant in the room of teenagers and Zoomers is the TikTok US ban-hammer which hit as this was being published. Attempts to use VPNs to get around the blocks are mostly failing, indicating that ByteDance knows which usernames are from the United States. It makes you wonder how much more data they have behind the scenes as it relates to user profiles.

In a late breaking news addition, ByteDance has restored access to US based consumers, less than 24 hours after stopping it, after being assured by the incoming Trump administration that an executive order will be forthcoming to allow TikTok to spy again.

As usual, my commentary is followed by a plethora of links to other items that are worth skimming to see if they interest you or pertain to your particular environment or of those you support.

Headline NEWS:

Adobe patched a large percentage of their product offerings this week. Several are rated as critical. Thankfully, none are known to be in active exploitation, yet.
Fortinet has released updates for several flaws, one of which is a zero-day that has been actively exploited since at least November 2024. If you have FortiOS and FortiProxy in use, patch immediately and follow the vendor’s guidance.
Juniper Networks hadn’t made the news in a few months, so they decided to join this week’s list with dozens of vulnerabilities and several high-severity defects being plugged in their Juno OS.
Microsoft broke records this week with 161 defects and flaws receiving patches and updates. Depending on which researcher you follow, there are either three or eight zero-days in this mix. I don’t need to say it, but I will anyway, vet these and patch quickly!
Rsync is an open-source file transfer and sync tool that is rather ubiquitous. Google and independent security researchers discovered six different defects that when chained can enable complete takeover. Shodan results revealed that there are over 600,000 servers on the internet that could be susceptible to being owned. If your system or software uses Rsync, check for patch updates, and implement mitigations in the mean while.
SAP has patched several critical vulnerabilities in their NetWeaver and BusinessObjects Business Intelligence software. SAP strongly recommends that customers apply the latest updates.

In Ransomware, Malware, and Vulnerabilities News:

Hackers are turning Amazon S3 bucket encryption against customers. This is an incredibly evil genius exploit in its simplicity and effectiveness. A threat actor gains privileged access to someone’s Amazon Simple Storage Service and changes the encryption keys to something that only the attacker possesses. Immediately, the legitimate owner of the data loses access to it since they don’t have the correct key. No time-consuming reconnaissance, no software encrypting for hours and hours. Change the key, and wham, done. To further pressure the victim company into paying, the dirt-bags start an automatic 7-day delete/purge of data. And if not paid, that data then goes poof. If you’re not backing your data up somewhere other than that same S3 bucket, it is game-over.

In Other News Events of Note and Interest:

TikTok was briefly banned in the US this weekend. However, the incoming Trump administration has indicated that they may intervene to permit it to continue, so as of Sunday, ByteDance has restored access. Meanwhile, refugees from TikTok have been flocking like zombies to other Chinese apps such as RedNote (aka Xiaohongshu) and Lemon8, the latter also being owned by ByteDance and subject to being banned. For their part, the Chinese are considering “walling off” non-Chinese from RedNote to keep their citizens from being exposed to western ideas.

Musings:

The TikTok ByteDance situation is a stark reminder that security professionals have a sisyphean job as it relates to personal security of the general populous. Marketers have long known that if you offer trinkets, people will give up treasure in exchange. In this day and age, data is king, and kingdoms are not built on gold treasure anymore, but on how much you know and can use to your advantage as a result. When it comes to trading trinkets for treasure, marketplaces such as Alibaba, Amazon, Baidu, ByteDance, Oriental Trading Company, and Temu, have cheap Chinese trinkets aplenty.

Headline NEWS

Ransomware, Malware, and Vulnerabilities News

Other News Events of Note and Interest

Like this: