Barracuda says attackers are already using two flaws in its Email Security Gateway to take full control of devices, just a week after fixes came out.
Barracuda Networks has warned that hackers are now attacking two flaws in its Email Security Gateway, a device many businesses use to filter their email. The company released fixes one week ago. It says a small number of organizations have already been hit.
An email security gateway sits between the internet and your mailboxes. It checks incoming mail for spam, scams and dangerous attachments. Barracuda fixed two flaws in the product. One is a weakness in how the device checks who is logging in, which can let an attacker change the device's main settings. The other lets an attacker with no login slip in commands that run with root access, meaning total control.
Barracuda says the two flaws can be combined to get around its permission checks and take over the device. On Monday evening, the company updated its warning to say attacks are happening, though only against a limited number of customers.
A device that handles all of a company's email is a rich target. Someone with full control of it is in a strong position to snoop on or tamper with messages. Barracuda has been here before. In 2023, a different flaw in the same product was used by attackers for at least seven months, starting in October 2022, to plant spyware-style malware and steal data. Mandiant, a security firm, found that almost a third of the systems breached in that campaign belonged to government agencies.
Anyone running a Barracuda Email Security Gateway is in scope. Barracuda has more than 200,000 customers worldwide, from small businesses to large companies and managed service providers, which are firms that run technology for other businesses. If your company uses another email filter, or Barracuda's product is not part of your setup, this alert is not about you.
There is one limit on the risk. Barracuda says an attacker needs access to the device's administrative page to succeed. That is why the company urges customers to keep that page reachable only from trusted internal networks.
If you manage one of these devices, or pay someone who does, ask them today whether the latest patch is installed. The steps in the alert box above cover patching and locking down the admin page. If you use an outside IT provider, send them the question in writing and ask for a clear yes or no.
Several things are still unknown. Barracuda has not said how many organizations were hit, who they are or who is behind the attacks. The material gives no sign yet of a link to the 2023 campaign. Barracuda's advisory lists every affected device and its matching patch, and it may be updated as the company learns more.
If your business uses a Barracuda Email Security Gateway, confirm the new patch is installed and keep its admin page off the open internet.
Two healthcare organizations confirmed breaches, one involving Social Security numbers. Here is who should watch their mail and what is still unknown.
Read more: Two healthcare data breaches expose patient records, including Social Security numbersGhana's cyber security agency says fake texts using the name TraffiTech-GH are going to drivers. One wrong tap could cost you money or personal details.
Read more: Fake TraffiTech-GH texts target drivers, Ghana cyber agency warnsQueens Public Library says a ransomware attack has disrupted its network at every location. Branches are open, but renewals are down and some programs may change.
Read more: Queens Public Library hit by ransomware, network down at all branches
