CCTR.17.April.24
Pwning PLCs and more open source software security
Last updated
Pwning PLCs and more open source software security
Last updated
It's a great win for the good folks! ⚖️ Law enforcement agencies from 19 countries across three continents collaborated to take down a cybercrime operation called LabHost. LabHost, a cloud based service, facilitated phishing scams for inexperienced criminals. Europol reported that users of LabHost could select from various scam site designs, featuring stolen logos and look-alike fake login pages mimicking those of legitimate businesses to deceive unsuspecting individuals into divulging their login credentials. These stolen credentials were then relayed to the scammers. Ref Following the XZ Utils discovery, scrutiny has extended to other open-source projects, revealing similar incidents. The OpenJS Foundation Cross Project Council reported receiving suspicious emails requesting updates for a popular JavaScript project to address unspecified critical vulnerabilities. Despite lacking specifics, the emails urged OpenJS to designate the senders as new project maintainers, resembling the tactics used by hackman "Jia Tan" in the XZ backdoor incident. Ref Datadog Security Labs discovered a vulnerability, CVE-2024-28056, within Amazon Web Services (AWS) Amplify, exposing IAM roles associated with Amplify projects. This weakness allowed unauthorised parties worldwide to assume control. Projects created using the Amplify CLI between July 2018 and August 2019 were especially at risk due to their vulnerable trust policies. AWS promptly remediated the vulnerability, rendering it no longer exploitable. Ref Cybersecurity and Infrastructure Security Agency issued an advisory highlighting unpatched vulnerability in Unitronics - PLC & Automation products industrial control systems devices. 🏭 Unitronics Vision Series PLCs used in the Water and Wastewater sector. CISA warns that the controller is susceptible to remote exploitation vulnerability CVE-2024-1480 (CVSS 8.7) due to storing passwords in a recoverable format. Successful exploitation of this vulnerability could allow an attacker to factory reset, stop or restart the device. The advisory recommends measures such as disconnecting the PLC controllers from the Internet 🙄, isolating them from business networks, using firewalls for protection, and employing secure methods like virtual private networks (VPNs) for remote access. Ref
