A flaw in Zyxel GS1900 network switches let hackers into 996 devices, and an earlier update did not stop it. A newer fix is out.
Hackers broke into 996 Zyxel network switches in 48 countries before a working fix existed. The catch for businesses is that many owners may think they are safe. Zyxel released an update in June, but it did not stop this attack. A newer update from October 22 does.
A network switch is the box that connects computers, printers and phones in an office. Zyxel's GS1900 series has a flaw in its web management page, the screen used to control the device. Someone with network access can send specially crafted requests and run commands on the switch without a password.
Starting around August 17, security firm GreyNoise saw a suspected Chinese-speaking group called Kapibala using this to take over switches. The attackers ran a script that collected the device's settings, scrambled (hashed) administrator passwords and network details.
On June 16, Zyxel patched an older flaw in the same switches. When GreyNoise reported the attacks on September 21, it blamed that older flaw. Researchers at Binarly then found the attackers' tool and saw it was aimed at a different, unknown weakness.
Binarly confirmed on September 28 that the tool still worked against all ten firmware versions from the June fix. It told Zyxel on September 29. Zyxel confirmed the new flaw on October 11, released new firmware on October 22, and published its advisory on November 3.
The warning covers ten GS1900 switch models. That mostly means businesses and the IT staff or providers who run their networks. Anyone who does not use one of these switches is not covered by this alert. Owners who installed the June update should not assume they are protected, because the attackers' tool was built to work against those versions.
The alert box above lists the steps. In short, find out whether a GS1900 switch is on your network, get the October 22 firmware installed, and ask your IT provider to confirm it. If a switch may have been reached by attackers, the stolen settings and passwords are a reason to have them reviewed and changed.
Binarly's findings leave one question open. It is unclear whether the attackers deliberately built their tool to get around the June update, or whether they used a related flaw that the earlier patch simply missed. Either way, the practical result is the same for switch owners.
The gap in time also matters. The fix came out on October 22, but the public advisory followed on November 3. Some owners may not have heard about it yet.
If your business uses a Zyxel GS1900 switch, install the October 22 update even if the June one is already on it.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
