Change Healthcare Notices Start, OS Command Injection Warning, Veeam Ransomware Exploit

CyberHub Podcast

1×

0:00

-14:43

Change Healthcare Notices Start, OS Command Injection Warning, Veeam Ransomware Exploit

Today’s top cybersecurity news and the latest threats from Practicing CISO James Azar, tune in to hear how practitioner’s breakdown the latest to bolster their cybersecurity programs

James Azar

Jul 11, 2024

Transcript

CyberHub Podcast Summary: July 11th, 2024

Good morning, security enthusiasts!

Welcome to another packed episode of the CyberHub Podcast. Today's highlights include a major data breach at Change Healthcare and critical vulnerability patches from several tech giants.

Change Healthcare Data Breach Notification

Change Healthcare has started notifying affected individuals of a data breach from a February 2024 cyber attack. This breach impacts approximately 110 million people, exposing sensitive information like health insurance details, medical records, and personal identification numbers.

Health insurance details, medical records, billing information, financial data, and personal identifiers. Change Healthcare is offering two years of identity theft protection and credit monitoring services. Affected individuals can sign up at [ChangeCyberSupport.com] or call 888-846-4705.

Action Items:

1. Sign Up for Protection: If affected, immediately sign up for the offered identity theft protection and credit monitoring.

2. Monitor Financial Statements: Regularly check bank and credit card statements for any unusual activity.

Palo Alto Networks Vulnerability Patches

Palo Alto Networks has released patches for several vulnerabilities, including a critical bug in its Expedition Migration Tool (CVE-2024-59010), which could allow attackers to take over admin accounts. CVE-2024-59010 with a CVSS score of 9.3. Fixes for high and medium severity issues in Panorama software, Cortex XDR agent, and PAN-OS software.

Action Items:

1. Apply Patches: Ensure all Palo Alto Networks systems are updated to the latest versions to mitigate these vulnerabilities.

2. Review Security Settings: Regularly review and update security configurations to prevent unauthorized access.

VMware High-Risk SQL Injection Vulnerability

VMware has patched a high-risk SQL injection vulnerability (CVE-2024-22280) in its Aria Automation product, which could allow authenticated users to manipulate databases with a CVSS score of 8.5. Impacted versions are Aria Automation version 8.x and VMware Cloud Foundation versions 5.x and 4.x.

Action Items:

1. Update Software: Immediately update to the latest versions of Aria Automation and VMware Cloud Foundation.

2. Monitor Database Activity: Implement additional monitoring to detect any unusual database activities.

GitLab Critical Vulnerability

GitLab has addressed a critical vulnerability (CVE-2024-6385) that allows attackers to run pipeline jobs as any other user, impacting versions 15.8 to 17.1.2. CVSS score of 9.6, patches released for Community and Enterprise Editions.

Action Items:

1. Upgrade GitLab: Administrators should upgrade to the patched versions immediately.

2. Audit Pipelines: Regularly audit pipeline activities for any suspicious actions.

Exploitation of PHP Vulnerability

Multiple threat actors are exploiting a security flaw in PHP (CVE-2024-4577) CVSS score of 9.8 to deliver remote access trojans, cryptocurrency miners, and botnets. Allows remote execution of malicious commands on Windows systems.

Action Items:

1. Patch PHP Installations: Ensure all PHP environments are updated to the latest secure versions.

2. Enhance Security Monitoring: Increase monitoring to detect and respond to potential exploits quickly.

Citrix Security Vulnerabilities

Citrix has issued patches for critical and high severity vulnerabilities in its Netscaler product line, including an improper authorization bug (CVE-2024-6235). Buffer overflow issue (CVE-2024-6236).

Action Items:

1. Update Citrix Systems: Apply the latest updates to all Citrix Netscaler environments.

FBI and CISA Alert on Network Edge Device Vulnerabilities

The FBI and CISA have issued an alert about the exploitation of OS command injection vulnerabilities in network edge devices, including Cisco's NX-OS. CVE-2024-20399 (Cisco) and others affecting Palo Alto and Avanti products. Eliminate OS command injection vulnerabilities by validating and sanitizing user input.

Action Items:

1. Patch Devices: Ensure all network edge devices are updated with the latest security patches.

2. Review Security Protocols: Strengthen security protocols and input validation practices.

Nonsense Ransomware Exploiting Veeam Vulnerability

The Nonsense ransomware operation is exploiting a vulnerability in Veeam backup and replication software (CVE-2023-27532) to compromise backups with a CVSS score of 7.5. Exploitation through Fortinet firewall SSL VPN and subsequent backdoor installation.

Action Items:

1. Patch Veeam Software: Update Veeam backup and replication software to the latest secure versions.

2. Secure VPN Access: Strengthen VPN security and monitor for suspicious activities.

North Korean APT Group Targeting Japan

Japan's CERT has warned that North Korean APT group Kimiski is targeting Japanese organizations through phishing attacks. Phishing emails with malicious attachments, leading to malware infection.

Conclusion

Stay tuned for an insightful conversation with Steve Warren, Federal CTO for Intel, discussing AI and cybersecurity, airing tomorrow at 11 a.m. Eastern. Don't forget to subscribe and stay cyber safe!

Discussion about this podcast

CyberHub Podcast

Today’s top cybersecurity news and the latest from Practicing CISO James Azar, tune in to hear how practitioners read, view and work after hearing the latest headlines and how these stories help keep practitioners sharp and ready.

Listen on