GreyKeep Security Blog - Page 8 of 9

Cybersecurity Daily: August 9, 2023

greykeep · August 9, 2023 ·

Your daily dose of relevant cybersecurity advisories, industry news, and product updates for Wednesday, August 9, 2023.

Advisories

[Read more…]

Security Researchers Repurpose Amazon SSM Agent as a Remote Access Trojan

greykeep · August 4, 2023 ·

Security researchers at Mitiga have discovered a technique for using AWS Systems Manager (SSM) Agent as a remote access trojan (RAT). The technique allows for persistent command and control of a compromised host by an attacker from within another AWS account.

SSM Agent is software that allows administrators to configure, manage, and update AWS resources through the Systems Manager service. It can be installed on a various systems, including Amazon Elastic Compute Cloud (EC2) instances, edge devices, on-premises servers, and virtual machines.

[Read more…]

Cybersecurity Daily: August 3, 2023

greykeep · August 3, 2023 ·

Your dose of relevant cybersecurity advisories, industry news, and product updates for Thursday, August 3, 2023.

Advisories

[Read more…]

Over 640 Citrix Servers Compromised Using RCE Vulnerability

greykeep · August 2, 2023 ·

Attackers are actively exploiting a code injection vulnerability in Citrix Netscaler ADC and Gateway servers to gain remote access and exfiltrate data. The remote code execution (RCE) vulnerability is being tracked under CVE-2023-3519.

Security researchers from the non-profit Shadowserver Foundation estimate attackers have used the vulnerability to deploy web shells on at least 640 Citrix servers, with thousands of unpatched servers potentially impacted.

[Read more…]

GameOver(lay) Vulnerabilities in Ubuntu May Affect 40% of Cloud Users

greykeep · August 1, 2023 ·

Ubuntu Linux command line prompt — Photo by Gabriel Heinzer

Two privilege escalation vulnerabilities, collectively called GameOver(lay), may affect 40% of cloud workloads running on Ubuntu. The GameOver(lay) vulnerabilities were discovered by security firm Wiz and jointly reported by The Hacker News.

The vulnerabilities were reported under CVE-2023-32629 and CVE-2023-2640 and only affect Ubuntu kernels.

[Read more…]