January 25, 2025 - Red Dot Security

(Select here for a video version of my opening commentary)

Hello all,

After Microsoft’s record-breaking number of defect and flaw patches last week, I figured that this week we’d be safe from onslaught. Was I ever wrong! Oracle decided to grace us with their quarterly update consisting of over three hundred items that need fixing, some of which are critical. And SonicWall and Zyxel have both added some spice to the mix with their own alerts.

As usual, my commentary is followed by a plethora of links to other items that are worth skimming to see if they interest you or pertain to your particular environment or of those you support.

Headline NEWS:

Cisco Fixes Critical Privilege Escalation Flaw in Meeting Management – This defect is thankfully not internet facing, but all it takes is for a threat actor to have persistence in a network for you to have a really bad day. If you use Cisco Meeting Management, patch soon.
Microsoft will automatically keep you signed in to your account starting in February – In a move that has most security professionals scratching their heads wondering how it could possibly be seen as a good idea, Microsoft has announced that in February accounts will no longer be logged out when you close your browser. I’m not sure if this is quite consistent with Microsoft’s promised new “Secure Future Initiative”. The only silver lining so far in this announcement is that it doesn’t appear to be for business or enterprise accounts – yet.
Oracle Patches 200 Vulnerabilities With January 2025 Critical Patch Update – this massive flaw, defect, and vulnerability patch release addresses 220 CVEs in 27 different product families. At least 30 of these defects are rated critical, so prioritize accordingly. If you use anything by Oracle, make sure that you quickly check if your product has updates that it needs to have applied.
SonicWall Urges Immediate Patch for Critical CVE-2025-23006 Flaw Amid Likely Exploitation – their SMA1000 VPN device has a critical Remote Code Execution flaw that is already under active exploitation. There have been a lot of vulnerability reveals for VPNs lately which threat actors have been quick to exploit. So don’t waste any time patching this defect.
Zyxel warns of bad signature update causing firewall boot loops – If you have one of the affected devices, you’re having a bad day. The fix requires plugging in the RS232 console cable into the USG FLEX or ATP Series firewalls to be able to load a stable firmware version.

In Ransomware, Malware, and Vulnerabilities News:

Hacker infects 18,000 “script kiddies” with fake malware builder – in a poetic turn, wanna-be hackers aka script-kiddies who thought they were getting free malware tools to attack others, were themselves infected via a trojanized version of the XWorm Remote Access Trojan builder. However, instead of being a tool to bundle and use the XWorm RAT, this weaponized version infected the victim machine with the rodent. Apparently you can’t trust a free tool made available by criminals, who knew?
Conduent confirms cybersecurity incident behind recent outage – in a story that is still unfolding, the massive government contractor and business services company revealed that they had indeed experienced a “cyber security incident”. Conduent services half of the Fortune 100; companies such as automakers, banks, and medical related fields, along with more than 600 government entities in 46 US states. Speculation is that it is another ransomware incident like they had in 2020, but we have no confirmation of that yet.

In Other News Events of Note and Interest:

First-ever data center on the Moon set to launch next month – via a SpaceX Falcon 9 rocket. Lonestar Data Holdings plans to land the “Freedom Data Center” to take advantage of unique benefits of the moon’s environment, such as unmatched physical security, and natural cooling. Utilizing solar power, it will of necessity be entirely self-contained with multiple levels of redundancy since a service call might be a bit difficult to make.

Musings:

The story of the Trojan Horse, clever deception by Greeks to sneak their soldiers past the defenses and into the city of Troy, may or may not be true. But it is from this legend that we get our modern term “trojan” as it references something malicious that was allowed in under the pretense of being something good. I’m seeing increasing stories of modern Trojan Horses in the form of malicious browser plugins, weaponized free hacking tools and cracked legitimate software that attack those using them, fake Reddit websites, and helpful pop-ups on your screen. You would be wise to heed the words of Troy’s priest, Laocoon, “Beware of geeks bearing gifts”. Or words something to that effect.

Headline NEWS

Ransomware, Malware, and Vulnerabilities News

Other News Events of Note and Interest

Like this: