Ivanti has patched two more flaws that hackers chained to break into Connect Secure devices, including ones already fully updated. Businesses that use it should act.
Ivanti has released fixes for two more security flaws in Connect Secure, a product many companies use to let staff connect to the office network from outside. Hackers were already using them. They chained these two flaws with a third one, patched in October, to take over devices, even ones that were fully up to date.
Attackers have been using the flaws since at least October 1. One of the new flaws lets an attacker raise their level of access on a device. Ivanti rates it high severity. The other lets someone who is already logged in upload files to an unpatched device.
The third flaw, patched in October, let attackers get past the login step. Ivanti said it was aware of limited attacks at that time. Security firm Volexity, which found the problem, said one group chained the flaws to run commands with full control of fully patched devices.
Volexity said the attackers installed no malware and no hidden back door. They simply broke in again for every command they ran. They also tampered with logs, the records a device keeps of what happened, to cover their tracks. That let them get around Ivanti's Integrity Checker Tool, which is meant to detect tampering.
Ivanti said it had a fix for the login flaw nearly ready when the attacks were found. It chose not to delay that fix, because it closed the main way in. The two newer flaws were dealt with after that.
Organizations running Ivanti Connect Secure are the ones at risk. Shadowserver, a group that tracks internet exposure, counts more than 5,000 of these devices reachable from the internet. It has no data on how many have been updated. The US cybersecurity agency CISA added the login flaw to its list of actively exploited flaws and told federal agencies to patch by Friday.
If your business does not use Connect Secure, these particular flaws do not apply to you. If you are not sure, your IT team or provider can tell you quickly.
The steps in the alert box above cover the essentials. The key point is that updating is not the whole job. Because attackers hid their activity and slipped past Ivanti's own checking tool, companies should also look for signs that someone got in before the update.
Attackers keep coming back to Ivanti because these devices are a quick way into company networks, where sensitive business and customer data can be stolen. Since November 2021, CISA has flagged 38 Ivanti flaws as actively exploited, and 12 of them were also used in ransomware attacks. It is not yet known how many devices were broken into during this campaign.
If your company uses Ivanti Connect Secure, install all the new updates now and have someone check for signs of a past break-in.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
