@IRJ Yeah I've tried openVAS in the past, it wasn't bad, but it also wasn't great.

I've ended up making some changes to my firewall and using Wazuh to report on my endpoints that are remote to our datacenter.

Which works well enough for our needs

@scottalanmiller said in New secret-spilling hole in Intel CPUs sends company patching (again):

If you build in a back door, people will use it.

So tired of Intel's messes.

@dustinb3403

Oh, yeah that changes things... advanced ip scanner as others have suggested might be the safest thing.

We've pushed the config to "Disable the “Allow Print Spooler to accept client connections:” policy to block remote attacks."

Option 2 at the link below:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527

@dbeato said in Substantial OnPremise Exchange Vulnerabilities announced yesterday Patch Immediately:

@DustinB3403 Yeah, Exchange 2013 and over. You have to also be on the last 2 Cumulative Updates from Exchange 2013, 2016 or 2019. For 2019 You only can get the updates through Microsoft Volume Licensing.

Yeah, a customer attempted an update from 2016 CU15.1 to CU19, it errored out on the last step, they restored (bad move) and had some mail flow issues for a bit.

But they are back online now

@Obsolesce said in ADV200005 | Server Message Block 3.1.1 (SMBv3) Vulnerability & Workaround:

ADV200005 | Microsoft Guidance for Disabling SMBv3 Compression

Microsoft is aware of a remote code execution vulnerability in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target SMB Server or SMB Client.

To exploit the vulnerability against an SMB Server, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv3 Server. To exploit the vulnerability against an SMB Client, an unauthenticated attacker would need to configure a malicious SMBv3 Server and convince a user to connect to it.

Workarounds

The following workaround may be helpful in your situation. In all cases, Microsoft strongly recommends that you install the updates for this vulnerability as soon as they become available even if you plan to leave this workaround in place:

Disable SMBv3 compression

You can disable compression to block unauthenticated attackers from exploiting the vulnerability against an SMBv3 Server with the PowerShell command below.

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force

Notes:

No reboot is needed after making the change. This workaround does not prevent exploitation of SMB clients.

You can disable the workaround with the PowerShell command below.

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 0 -Force

Keep in mind that the vulnerability is only listed for Windows 10 1903 and up and Windows Server Semi-Annual Channel 1903 and up.

Folks should have inbound file/print turned off at user endpoints via Group Policy anyway so that eliminates that vector.

We don't deploy containers so no Server SAC anywhere in our stable.

Only so serious, it's in D-Link gear. Bwahaha

@dashrender said in Intel finds critical holes in secret Management Engine hidden in tons of desktop, server chipsets:

Here is a program Intel put together to tell you if you are vulnerable to this and several other security flaws they have found.

https://downloadcenter.intel.com/download/27150

But be warned, it's written by a company known to not understand security or be concerned about its customers. So...

@jmoore said in Linux vulnerability found - effecting Debian and RedHat:

@stacksofplates Oh that is interesting, I didn't know that.

Ya it forces it to use the legacy mmap layout which isn't vulnerable. Once you are able to reboot then you should be able to remove it.

@jaredbusch said in Apache Struts - Critical Security Flaw:

Was the Eqifax breech because of the march strus flaw or a more recent one?

Just making sure the actual facts are known.

The one from March.

@stacksofplates said in Ubiquiti vulnerability:

@JaredBusch said in Ubiquiti vulnerability:

@stacksofplates said in Ubiquiti vulnerability:

@JaredBusch said in Ubiquiti vulnerability:

None of that is the EdgeMax series.

That is all the original wireless stuff before even the Unifi line.

Yes it is all still currently available, but not nearly as horrible as that article is trying to insinuate.

All that gear should be behind a router normally.

Ya I was looking through it and noticed that. The tough switch was in there, but that's the only non bridge type device I saw.

The tough switch has been a dead product for years.

Ah didn't realize that. I've seen it for sale a few places, but never noticed they weren't produced any more.

It might still be produced, but it has not been developed against at all.

Thanks for sharing this, Scott. Threats are always evolving!

On the Ubuntu Linux family, for instance, you can fix it with the following steps:

Open /etc/sysctl.conf, with an editor, such as vim. Enter the line: net.ipv4.tcp_challenge_ack_limit = 999999999 Save the file. Use the shell command "sysctl -p" to update the configuration.

I used to live on campus at CM with @AndyW

So I guess I should have specified in the other thread. I use KeePassx and it's updated through yum. And the Android version of Keepass2Android (the one I use) isn't maintained by the same people.