Critical Zero-Day Vulnerability in Atlassian Confluence

Critical Zero-Day Vulnerability in Atlassian Confluence | Security Sunday w40/2023#### Welcome to Security Sunday, your weekly digest of cybersecurity news. Week 40 has been eventful with a zero-day vulnerability discovered in Atlassian Confluence, an exploit for vulnerability CVE-2023–4911 threatening numerous Linux systems, and a rundown of the 10 most common misconfigurations endangering security.

MGM Resorts Ransomware Attack Costs Surpass $110 Million

MGM Resorts recently faced a devastating ransomware assault, which we covered in a previous Security Sunday edition. The company reported losses exceeding $110 million, including one-time consultancy fees, tech advisory services, legal costs, and other third-party advisory expenses. While MGM confirmed operational disruptions, it assured no bank account or credit card data of customers was compromised. However, hackers did steal personal information like names, contact details, gender, birth dates, and driver’s license numbers. A limited number of customers also had their social security and passport numbers exposed.

A zero-day vulnerability in the popular software tool Atlassian Confluence was discovered this week. The vulnerability, labeled CVE-2023–22515, exposes a critical access control flaw impacting Confluence Data Center and Server versions. Atlassian noted the vulnerability was exploited to create unauthorized admin accounts, granting hackers access to Confluence instances. Affected versions range from 8.0.0 to 8.5.1, and Atlassian recommends upgrading to patched versions. An immediate system check for potential compromises is also advised.

‘Looney Tunables’ Exploit Threatens Numerous Linux Systems

An exploit for the vulnerability CVE-2023–4911, dubbed ‘Looney Tunables’, was recently released. Identified in the GNU C library, it allows for local privilege escalation, potentially giving attackers root privileges. System administrators need to act swiftly, as this vulnerability poses a significant threat to widely-used Linux platforms like Fedora, Ubuntu, and Debian.

Sony Confirms Significant Data Breach Affecting Thousands persons

Sony Interactive Entertainment confirmed a severe data breach affecting thousands, predominantly in the United States. Resulting from a zero-day vulnerability in the MOVEit Transfer platform, sensitive information concerning approximately 6,800 individuals was compromised. The breach was detected on June 2, 2023, shortly after the attack on May 28, 2023.

Cloudflare vs. Cloudflare: The Irony in DDoS Protection

A security issue was discovered concerning Cloudflare’s DDoS protection capabilities. Stefan Proksch, an Austrian security engineer, revealed a method to bypass Cloudflare’s DDoS protection using Cloudflare’s tools due to logical flaws in Cloudflare’s inter-client security management.

NSA and CISA Unveil Top 10 Security Misconfigurations

The National Security Agency (NSA) and the Cybersecurity Infrastructure Security Agency (CISA) have revealed the top ten cybersecurity misconfigurations their Red and Blue teams have uncovered in large organizations’ networks.

The top ten network configurations uncovered in the Red and Blue assessment by the NSA and CISA Hunt and Incident Response team include:

Default configurations of software and applications- Improper separation of user/administrator privilege- Insufficient internal network monitoring- Lack of network segmentation- Poor patch management- Bypass of system access controls- Weak or misconfigured multifactor authentication (MFA) methods- Insufficient access control lists (ACLs) on network shares and services- Poor credential hygiene- Unrestricted code execution

Data Breaches:- Blackbaud Agrees to a $49.5 Million Settlement Over Ransomware Data Breach- European Institute for Telecommunication Standards Reveals Data Security Breach- Motel One Announces Data Breach Following Ransomware Attack

Cyber Attacks:- Madagascar’s Governmental Services Reportedly Purchased and Used Predator Spyware for Political Domestic Surveillance Ahead of November Presidential Elections- [Chinese Hackers Target Semiconductor Manufacturers in East Asia Using Cobalt Strike](http://Čínští hackeři se pomocí Cobalt Strike zaměřili na firmy vyrábějící polovodiče ve východní Asii)- Ransomware Attackers Exploit Critical Vulnerability in TeamCity- Nearly 100,000 Industrial Control Systems Exposed Online- Royal Family Websites Knocked Offline by DDoS Attack- Turnkey Rootkit Facilitates Supply Chain Attacks- Microsoft Warns of Cyber Attacks Targeting the Cloud via SQL Server Instances- EvilProxy Uses indeed.com’s Open Redirection for Microsoft 365 Phishing

Vulnerabilities:- Exploit Available for Critical WS_FTP Flaw- Apple Releases Patches for Additional Zero-Day Vulnerabilities- Four Zero-Day Vulnerabilities in Qualcomm Chips Threaten Billions of Users- Vulnerable Arm Graphics Processor Drivers Actively Exploited, Patches May Not Be Available- Microsoft Edge and Teams Receive Fixes for Zero-Day Vulnerabilities in Open Source Libraries### Interested in cyber security? Check out the next episodes of Security Sunday.

https://medium.com/@zakpatrikcz/list/security-sunday-en-c438ddf5f168