InfoSecBulletin Cybersecurity for mankind
SonicWALL SSL-VPN provides secure remote access to an organization’s internal network and resources through an encrypted SSL connection. This kind of VPN is great for giving employees and partners secure access to internal applications and data from remote locations.
A hacker is selling a $1000 exploit that targets SonicWALL SSL-VPN systems. This exploit supposedly lets attackers get around two-factor authentication (2FA) and access records from the RADIUS base, which can lead to unauthorized access to sensitive information.
Eight New ICS Advisories released by CISA
Authority Denies
Hacker claim ransomware attack on Indonesia’s state bank BRI
London-based company “Builder.ai” reportedly exposed 1.2 TB data
(CVE-2024-12727, CVE-2024-12728, CVE-2024-12729)
Sophos resolved 3 critical vulnerabilities in Firewall
“Workshop on Cybersecurity Awareness and Needs Analysis” held at BBTA
CVE-2023-48788
Kaspersky reveals active exploitation of Fortinet Vulnerability
U.S. Weighs Ban on Chinese-Made Router TP-Link: WSJ reports
Daily Security Update Dated: 18.12.2024
CISA released best practices to secure Microsoft 365 Cloud environments
Data breach! Ireland fines Meta $264 million, Australia $50m
Exposed Information Includes:
User cookies
Login credentials
Passwords
Domain information
Active Directory Rules details
Previous SonicWALL Exploits
BSCI said, according to Shodan search, there found 199 IP using SonicWall SSL-VPN on various organization in Bangladesh but may have more, they may be the target point of the bad actors if cant take stern action to secure.
According to Bangladesh cyber security intelligence (BSCI), The exploit is capable to bypasses 2FA, compromising a key security measure, Accesses RADIUS base records to retrieve sensitive data.
In 2021, hackers breached SonicWall’s SMA 100 series VPN appliances through zero-day vulnerabilities and a critical vulnerability was found in SonicWall’s SMA and SRA products, enabling attackers to gain control over affected systems by executing arbitrary code in 2029.
It’s important to quickly deal with security issues and keep all network security products updated with the latest patches.
Over a million users have been affected by the info stealer. Their data has been sold on the dark web, including sensitive information from corporations, financial institutions, and government organizations.
Hackers can use stolen credentials and an exploit called SonicWALL SSL-VPN to access classified information and cause data breaches. They can also launch ransomware attacks on organizations.
BCSI recommends staying alert and constantly checking their security systems for any strange activity, around the clock.
