Weekly Cyber News Roundup

The German Federal Office for Information Security (BIS) has announced that there are over 17,000 Microsoft Exchange servers that are vulnerable to at least one vulnerability exposed to the Internet in Germany out of 45,000 in total.

Considering many of the Microsoft Exchange vulnerabilities were disclosed many months ago, it is surprising to see such a huge percentage still vulnerable. The move from on-premises to cloud is slowly taking place, but Integrity360 have found that most organisations that get breached due to a vulnerable Exchange server is because they are in the process of migrating. Whilst migrating, we have found that they take their “foot off the pedal” when it comes to keeping their servers patched because in their mind they are getting rid of them soon anyway.

Some Apple CPU’s have been found to have an “un-patchable” vulnerability whereby they’re leaking encryption keys.

The side-channel vulnerability (where indirect effects of the system or hardware is monitored and then targeted) was discovered in Apple’s M-series processors and the researchers claim that they can use it to steal encryption keys from Mac devices. Similar to the historical and infamous Spectre/Meltdown vulnerability that affected a huge amount of different CPU models, this vulnerability relies on the preloading of data (called branch prediction) in order to work. In order to patch this would require the redesign of the CPU which is unlikely.

A critical vulnerability in Jenkins (open-source DevOps software) was disclosed recently as CVE-2024-23897.

It allows unauthenticated attackers with no permissions to read the first few lines of any file they wish on the underlying operating system. This means that potentially sensitive data could be read. The vulnerability arises from an un-sanitised argument being interpreted by the Jenkins service. Jenkins is a major piece of DevOps infrastructure around the world and is used by many organisations meaning that a large number might get breached.

The Big Issue is having a big issue!

The parent company of the street newspaper company has reportedly suffered a ransomware attack from the Qilin ransomware gang. They claim to have stolen 550GB of company data. In the initial data leak by Qilin, sensitive data such as the CEO’s driving licence and salary information have been released. It is an unforatunate event for any company to be ransomware’d, but especially so for one that typically employs homeless/vulnerable people to give them a chance to earn money and reintegrate into society.