The IT Nerd

Armorblox has a deep dive into their latest analysis on an attack targeting end users across a large, national institution within the Education Industry with an email almost identical to an invoice reminder notification from a trusted vendor. 

Upon opening the attachment, unsuspecting victims were met with a message that seemed to be from Microsoft informing the recipient that he or she was being taken to the organization’s sign-in page. No matter if the end user immediately closed the attachment or waited to be navigated through, just opening the attachment initiated the installation of malware onto the user’s machine. 

Further details of this attack can be found in the blog, including:

• What techniques were used to get past traditional email security filters and pass the eye tests of unsuspecting users?
• How this attack  bypassed Microsoft Office 365 email security, potentially compromising more than 100,000 mailboxes.
• Guidance and recommendations that can be used to prevent similar attacks.

You can read the deep dive here.

Pentera has releaseda new research report on how Uriel Gabay, Security Researcher at Pentera was able to bypass an air-gapped network to execute an attack. In order to protect an organization’s critical assets from Internet access, IT teams often create isolated or ‘air-gapped’ networks. 

These networks are largely considered inherently untouchable, but Pentera Labs Research was able to bridge the air-gap and access them with only a few lines of code. Air-gapped networks may not have direct access to the Internet, but they still often require DNS services in order to resolve a company’s internal DNS records. 

Uriel was able to exploit this reality to execute an attack over the DNS and showcase how hackers could relatively easily access offline information that organizations assumed was safe.

You can read the research here.

Today Rezilion announced updates to MI-X, its highly-rated open-source tool developed by Rezilion’s vulnerability research team. The tool will be featured this week at Black Hat Arsenal during Black Hat Europe and features several new updates to give teams vital information about the exploitability of known critical CVEs in their environment.

Available as a download from the Github repository, MI-X already has more than 100 stars on GitHub since its debut in August 2022. The CLI tool is a free, open-source companion to Rezilion’s enterprise solution for software supply chain security and helps researchers and developers identify if containers and hosts are impacted by a specific vulnerability, thus allowing organizations to target remediation plans more effectively.

The recent updates to MI-X include:

• Mitigation and remediation recommendations for each supported vulnerability
• The ability to produce machine-readable output, either in JSON or CSV format
• Windows support for two pervasive vulnerabilities, Heartbleed and SpookySSL

MI-X adds context to vulnerabilities where other tools fall short

Using MI-X, organizations can identify and establish the exploitability of 20+ high-profile CVEs, including hosts and containers. The tool can easily be updated to include coverage for new critical and zero-day vulnerabilities. 

Through MI-X, users can:

• Find vulnerabilities: identify and establish the exploitability of a known critical CVE.
• Know why it’s exploitable: get a detailed view of the criteria that need to be met for the vulnerability to be exploitable. This allows organizations to adopt the correct remediation strategy.

MI-X will be featured Wednesday, December 7, 2022 from 10:15 a.m.-11:45 a.m. PT in the Business Hall, Station 5, in the Black Hat Arsenal.

For more information on getting started with MI-X, visit https://www.rezilion.com/rezilion-tools/am-i-exploitable/ .