Accessibility links

Facebook   Twitter   LinkedIn   Email

Multiple Bad Actors Actively Attempting To Exploit MobileIron Vulnerability

January 30, 2021

In June 2020, MobileIron, a provider of mobile device management (MDM) systems, released security updates to address several vulnerabilities in their products. This included CVE-2020-15505, a remote code execution vulnerability, rated critical. It’s this particular issue that is catching attention of cybersecurity agencies and government institutions right now.

MDM systems allow system administrators to manage an organization’s mobile devices from a central server. While certainly convenient, it also makes them a valuable target for threat actors.

The U.S. Cybersecurity and Infrastructure Agency (CISA) is keenly aware that Advanced Persistent Threat (APT) nation-state groups and cyber criminals are now actively attempting to exploit this MDM vulnerability with intent to compromise the networks of organizations worldwide. The CISA has also noted that APTs are exploiting this vulnerability in combination with the Netlogon/Zerologon vulnerability CVE-2020-1472 from earlier this year using a single intrusion. It also noted that threat actors are exploiting both new and legacy vulnerabilities with this technique.

But good news! There is a patch for this vulnerability. Any organization that uses MDM should have applied it already. After all, it’s been out for a while now. If not, it’s a great time to get right on it. As with all patches, get them applied as soon as they are made available.

Available Patches:

  • MobileIron Core & Enterprise Connector
    Apply one of the following patches (v10.3.0.4, v10.4.0.4, v10.5.1.1, v10.5.2.1, v10.6.0.1) or update to a later version.
     
  • MobileIron Sentry
    Apply one of the following patches (v9.7.3, v9.8.1) or update to a later version.
     
  • MobileIron Monitor and Reporting Database (RDB)
    Apply the following patch (v2.0.0.2) or update to a later version.
     
  • MobileIron Cloud
    Status: Has been updated.

This critical vulnerability affects MobileIron Core and Connector products and could allow a remote attacker to execute arbitrary code on a system. The following versions are affected:

  • 10.3.0.3 and earlier
  • 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0
  • Sentry versions 9.7.2 and earlier
  • 9.8.0
  • Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier

A proof of concept exploit became available back September. Since then, both hostile state actors and cybercriminals have attempted to exploit this vulnerability. These actors typically scan victim networks to identify vulnerabilities, including this one. In some cases, when the latest updates are not installed, they have been able to successfully compromise systems.

The healthcare, local government, logistics, and legal sectors have all been targeted but others could also be, and likely are, affected. Don’t delay in getting this one patched.

It is also important for organizations using any of the affected versions to ensure they are following other best-practice cyber security advice, such as scanning their own networks and undertaking continual audits. This will help identify suspicious activity in the event that this vulnerability has already been exploited.



Agent Tesla Spyware Targets Oil And Gas Companies

Corporate Security

Agent Tesla Spyware Targets Oil And Gas Companies

Energy companies have long been the subject of malware attacks, with most consumers unaware of the cybersecurity challenges these companies face every day. And the thought of using spyware like Agent Tesla to hack the oil and gas industries should be a concern to us all. So far, damage from this includes stealing system data and killing antivirus efforts. Some security experts are concerned that Agent Tesla spyware may be stealing gas and oil data for more nefarious purposes. READ FULL STORY
Top Cybersecurity Threat Predictions For 2020

Your Security

Top Cybersecurity Threat Predictions For 2020

Without the help of a crystal ball, some security experts take stock of the past twelve months and make predictions about cybersecurity challenges for the year ahead. WatchGuard Threat Lab looked at the cyber-puzzle pieces of 2019 and put together a picture of what we’ll expect to see in 2020. Last year’s threat landscape provides insight into what we can expect this year and gives individuals and organizations a “heads up” about their own cybersecurity. READ FULL STORY
Windows Zero Day Runs Wild Amidst Barrage Of Virus News

Your Security

Windows Zero Day Runs Wild Amidst Barrage Of Virus News

It’s easy to become inundated with all the news about the novel coronavirus these days. It’s also becoming very easy to miss all of the other news that may still be important to know, even as we are all sheltering-in-place and avoiding social contact. In particular, Microsoft issued an advisory about a new zero-day vulnerability affecting all supported versions of the Windows operating system including Windows Server operating systems. READ FULL STORY
Chinese Backed Hacking Group Targets Big Pharma

Corporate Security

Chinese Backed Hacking Group Targets Big Pharma

Yet another major pharmaceutical company fell victim to a hacking group believed to be sponsored by the Chinese government. Roche, a Swiss drug maker and diagnostics company, added its name to a long list of international companies targeted by the state-sponsored cybercriminals. Others caught in the group’s cross-hairs include Bayer, Marriott, Siemens, BASF, and Henkel. This attack is just one of many believed to be part of the Wicked Panda hacking group. READ FULL STORY
Microsoft Warns Of Zero Day Vulnerability Actively Being Exploited On IE

Your Security

Microsoft Warns Of Zero Day Vulnerability Actively Being Exploited On IE

Knocking on the door of the recent Firefox vulnerability, Microsoft chimes in with a warning of its own. This time, it’s the old dinosaur Internet Explorer that Microsoft says is actively being exploited in the wild and for which there is no current fix. So, if you are one of those that still insists on using Internet Explorer, which is certainly not advised, this news is for you. This is a remote code execution vulnerability, which means someone could take over the device and use whatever permissions the user has. READ FULL STORY




We use cookies to give you a more relevant browsing experience and improve our website. Using this site means that you agree with our use of cookies policy.    

0----