The IT Nerd

Security researchers at Trend Micro have observed an active exploitation of the Spring4Shell vulnerability where threat actors were able to weaponize and execute the Mirai botnet malware on vulnerable servers in the Singapore region. 

Trend Micro says most of the vulnerable setups were configured with the following features:

• Spring Framework versions before 5.2.20, 5.3.18, and Java Development Kit (JDK) version 9 or higher
• Apache Tomcat
• Spring-webmvc or spring-webflux dependency
• Using Spring parameter binding that is configured to use a non-basic parameter type, such as Plain Old Java Objects (POJOs)
• Deployable, packaged as a web application archive (WAR)
• Writable file system, such as web apps or ROOT

This of course is a major problem as if one group of threat actors taking advantage of this vulnerability, other threat actors are doing the same thing. Or will be doing the same thing soon enough.

I have sourced a pair of comments on this starting with Saryu Nayyar, CEO and Founder, Gurucul:

“This is another example of a known set of malware being leveraged to exploit a newly discovered set of vulnerabilities. Mirai is indeed a long standing and dangerous piece of malware that can deliver multiple destructive outcomes to organizations. Until vulnerabilities such as these can be patched, which can take weeks or months, organizations need to augment their threat detection, investigation and response programs to determine if they are already under attack and certainly find any signs of an attack early in the kill chain. This can allow them to perform emergency patching on systems if threatened. However, this requires a solution not only with advanced analytics and non-rule-based machine learning models to detect any variations employed when Mirai is executed, but also threat intelligence combined with risk analytics to prioritize and escalate to security teams once the attack is potentially found. These capabilities are critical for accelerating response and rallying security teams to identify and focus efforts on a serious active threat. Unfortunately, most current SIEM and XDR solutions lack this combination of features to be enough to stop this attack so organizations must look at more advanced solutions to better enable security teams. “

Chris Olson, CEO, The Media Trust is next:

 “In the face of Log4Shell, many organizations rolled out patches to protect their internal systems and consumer-facing services. But the emergence of Spring4Shell reminds us that patching is only a temporary fix: as long as organizations are depending on third-party assets for website, app and backend development, they must exercise continual vigilance and monitoring to protect their users.”

This is likely the start of larger campaigns using this exploit. This sysadmins and security professionals should take this time to make sure that they aren’t vulnerable to being pwned by this exploit.

By Hank Schless, Senior Manager of Security Solutions at Lookout. 

There is only one you – let’s keep it that way! Tomorrow, April 12th is Identity Management Day and Lookout cybersecurity would like to share tips on how consumers can better manage their identity online. 

A recent study from Lookout found that scammers are increasing their complexity, and hacks are looking more real to consumers. Only 8.7% of the 2,000 survey participants correctly identified the legitimate text message, login page, and video when compared to scammers.

Here are some tips to keep you protected: 

Conceal Personal Information
Limit the amount of personal information placed online. Information like location, pet name, last name, and birthday can be used to break into important accounts. 

• 60% of people share their birthday publicly on social media

Strong Passwords 

• Use Two-Factor Authentication: This makes it harder for hackers to access your account and will alert you to any potential hacking attempts.  
• Password Changes: Be sure to regularly change the password to your most important accounts. This will help prevent hackers from getting access. Make sure you use a combination of letters and numbers for the best protection. 
• AVOID using passwords like these:

Delete WiFi Connections
If you connect to an unknown WiFi network and it starts asking you for any sort of username and password, such as validating your identity with a login, disconnect from it immediately. 

Install Security Software On Your Devices
Security protection, like Lookout, will automatically monitor and identify scam URLs in email, text messages, and on the web and block you from threats that can do harm.

• Only 31% of Americans pay for identity theft monitoring on their devices, leaving 69% of Americans vulnerable to identity theft.