ARCHIVE FOR THE ‘news’ CATEGORY

F-Secure discovers security flaw with the potential to turn hundreds of thousands of load balancers into beachheads for cyber attacks.

Cyber security provider F-Secure is advising organizations using F5 Networks’ BIG-IP load balancer, which is popular amongst governments, banks, and other large corporations, to address security issues in some common configurations of the product. Adversaries can exploit these insecurely configured load balancers to penetrate networks and perform a wide variety of attacks against organizations, or individuals using web services managed by a compromised device.

The security issue is present in the Tcl programming language that BIG-IP’s iRules (the feature that BIG-IP uses to direct incoming web traffic) are written in. Certain coding practices allow attackers to inject arbitrary Tcl commands which could be executed in the security context of the target Tcl script.

Adversaries that successfully exploit such insecurely configured iRules can use the compromised BIG-IP device as a beachhead to launch further attacks, resulting in a potentially severe breach for an organization. They could also intercept and manipulate web traffic, leading to the exposure of sensitive information, including authentication credentials and application secrets, as well as allowing the users of an organization’s web services to be targeted and attacked.

In some cases, exploiting a vulnerable system can be as simple as submitting a command or piece of code as part of a web request, that the technology will execute for the attacker. To make matters worse, there are cases where the compromised device will not record the adversaries’ actions, meaning there would be no evidence that an attack took place. In other cases, an attacker could delete logs that contain evidence of their post-exploit activities – severely hindering any incident investigations.

“This configuration issue is really quite severe because it’s stealthy enough for an attacker to get in, achieve a wide variety of objectives, and then cover their tracks. Plus, many organizations aren’t prepared to find or fix issues that are buried deep in software supply chains, which adds up to a potentially big security problem,” explains F-Secure Senior Security Consultant Christoffer Jerkeby. “Unless you know what to look for, it’s tough to foresee this problem occurring, and even harder to deal with in an actual attack.”   

Jerkeby discovered over 300,000 active BIG-IP implementations on the internet during the course of his research, but due to methodological limitations, suspects the real number could be higher. Approximately 60 percent of the BIG-IP instances he found were in the United States.  

The coding flaw and class of vulnerability is not novel and has been known, along with other command injection vulnerabilities in other popular languages, for some time. Not everyone using BIG-IP will be affected, but the load balancer’s popularity amongst banks, governments, and other entities that provide online services to large numbers of people, combined with the relative obscurity of the underlying security issues with Tcl, means any organization using BIG-IP needs to investigate and assess their exposure.

“Unless an organization has done an in-depth investigation of this technology, there’s a strong chance they’ve got this problem,” continues Jerkeby. “Even someone incredibly knowledgeable about security that works at a well-resourced company can make this mistake. So, spreading awareness about the issue is really important if we want to help organizations better protect themselves from a potential breach scenario.”

IBASE, a provider of embedded products for IoT has released its AGS100T/AGS102T IoT gateways.
Powered by Intel’s Apollo Lake Atom™ x7/x5 series, Pentium® N4200, and Celeron® N3350 SoCs, the systems enable seamless and secure data flow to the cloud in IoT-focused applications with enterprise-grade security, and easy manageability.

The AGS100T/AGS102T compact fanless platforms offer maximum reliability and longevity support, featuring wide-range operating temperature of up to -40°C ~ 70°C and dimensions of 160 x 110 x 44mm. Both models are suitable for space-constrained applications in harsh environments that require devices equipped with Trusted Platform Module (TPM) technology.

“Our AGS100T/AGS102T gateways come with an extra advanced security TPM 2.0 chip to provide a high level of hardware-based security,” said Wilson Lin, Director of IBASE Product Planning Department. “By using TPM together with Windows 10, these devices carry out cryptographic operations for access control and authentication. TPM enables integrity measurements during system boot and makes TPM-based key unavailable outside the TPM to prevent phishing attacks and authorization value guesses.”

The rugged AGS100T features 4GB DDR3L-1866 DO-DIMM, a 64GB MLC industrial-grade mSATA SSD, dual display ports (DVI-I and DisplayPort), 4x USB 3.0, 2x GbE, 2x COM, a DC-in terminal block for 9V~36V input and over/under/reverse voltage protection. Expansion is available with a full-size Mini PCI-E, a 2230 M.2 E-Key socket for WLAN & BT, a 3042 M.2 B-Key socket for WWAN & SSD, an mSATA socket (Mini PCI-E), and a 2242 M.2 B-Key socket for mSATA SSD. The AGS102T has two extra serial ports for COM3/COM4 and GPIO 4-in & 4-out multi-purpose interface.

British Safety Council welcomes regulator's guidance on working in hot weather and looks forward to its advice for outdoor employees working in polluted urban air.

Furthermore, King’s College London, which draws on and analyses the data from the London Air Quality Network (LAQN), has recently reported that in hot weather the ozone levels in London are rising rapidly which has further adverse health implications.

Telematics and transport technology solutions provider Microlise, has launched Focus, a telematics solution, specifically designed for smaller fleets.

New enterprise-class capabilities enable organizations to more easily design and improve digital workflows for deskless industrial workers, firm says.

SFG^SM's Bill Pollock gives an analyst response to Salesforce's $1/35bn purchase of Click Software.

From a general market standpoint, the acquisition bodes well for both companies, as each has built a strong market, product and management reputation over the years in its own domain; and each is, arguably, the leader in its respective marketspace.
This acquisition should firmly entrench Salesforce as one of the acknowledged/perceived leaders in FSM, based on an extrapolation from SFG℠’s 2014/2015 FSM Tracking Survey, as follows:
In 2014/15, prior to the acquisition, Salesforce had already been recognized as a potential FSM solution provider by a majority of the field services marketplace (i.e., 56% FSM application familiarity among the respondents in SFG℠’s 2014/2015 Field Service Management Benchmark Tracking Survey*) – despite the fact that it did not actually offer an FSM solution at that time. ClickSoftware was cited third (i.e., behind SAP at 50%) at 35% FSM application familiarity. The combination of the two companies should place its familiarity quotient to the top of the pack.We all knew it was coming – several years ago – but, we all thought it would be by SAP!

"Will the Salesforce acquisition prompt (or tempt) the big Internet/IoT guns to acquire their own Field Service Management (FSM) capabilities?"...