Tens of Thousands of Cisco Devices Hacked via Zero-Day Vulnerability

Tens of thousands of Cisco devices have reportedly been hacked through the exploitation of the newly disclosed IOS XE zero-day vulnerability tracked as CVE-2023-20198.

Cisco warned customers on Monday that a critical IOS XE zero-day has been exploited by threat actors to gain elevated privileges on devices. The company is working on a patch and in the meantime it has urged customers to implement mitigations.

The vulnerability impacts the IOS XE web user interface, which is delivered with the default image, and it allows a remote, unauthenticated attacker to add level 15 access accounts that provide complete control over the targeted system.

https://www.securityweek.com/tens-of-thousands-of-cisco-devices-hacked-via-zero-day-vulnerability/

Spyware Caught Masquerading as Israeli Rocket Alert Applications

A threat actor targets Israelis with spyware masquerading as an Android application for receiving rocket alerts.

In the the wake of the Israel-Gaza conflict, threat actors have been observed targeting Israeli rocket alerting applications to spread fear and mobile spyware, Cloudflare reports.

With thousands of rockets launched since Hamas attacked Israel on October 7, individuals in Israel rely on several mobile applications to receive timely alerts about incoming airstrikes and seek safety.

Days after the latest escalations in the region, pro-Palestinian hacktivist groupAnonGhostclaimed to have targeted various such applications, succeeding in compromising at least one.

After exploiting a vulnerability in the ‘Red Alert: Israel’ application by Kobi Snir, the group was able to intercept requests and expose APIs and servers, and was seen sending fake alerts to users, including nuclear bomb messages.

On October 12, a threat actor created a website hosting a malicious version of the ‘RedAlert – Rocket Alerts’ open source mobile application developed by Elad Nava, in an attempt to infect users with spyware.

https://www.google.com/amp/s/www.securityweek.com/spyware-caught-masquerading-as-israeli-rocket-alerting-applications/amp/

DDoS attacks trending upwards: multiple EU websites under siege

Since their emergence in the late 1990s, Denial of Service (DDoS) attacks continue to be a mainstay for threat actors. As 2024 looms, these invisible onslaughts continue to threaten system stability across a wide range of government institutions, industries, and organizations, casting a shadow of uncertainty on the ability to maintain highly secure and connected environments.

Denial of service attacks, including their distributed counterparts, are some of the oldest cyberweapons around. They've been used as a primary attack of choice for cybercriminals since approximately 1996, with the first impact hitting internet service provider Panix1. Cisco predicts that nearly 15 million DDoS attacks will occur before 2023 concludes, making it one of the most widely experienced and utilized attacks seen year over year.

Questions arise, such as, “How are these attacks still successful in the days of sophisticated web applications and network traffic filtering services like Cloudflare or Imperva WAF?” Additional research conducted in Q2 2023 by Black Lotus – the threat intelligence arm of Lumen Technologies, provides a concerning perspective into why this antiquated attack remains highly successful nearly three decades after its emergence – the continued evolution of multi-vector DDoS Attacks. Showcasing several government and educational institution examples from Europe that occurred across September 2023, this article will delve into approaches used within Multi-Vector DDoS attacks, defensive considerations, and some of the threat actors behind these attacks.

https://cybernews.com/cyber-war/ddos-attacks-trending-upwards/

>>19756631

Morning Swordy.

Signal says there is no evidence rumored zero-day bug is real

Signal messenger has investigated rumors spreading online over the weekend of a zero-day security vulnerability related to the 'Generate Link Previews' feature, stating that there is no evidence this vulnerability is real.

This statement comes after numerous sources told BleepingComputer and reported on Twitter that a new zero-day vulnerability allowed for a full takeover of devices.

After contacting Signal about the zero-day last night, they released a statement on Twitter stating that they have investigated the rumors and have found no evidence that this flaw is real.

"PSA: we have seen the vague viral reports alleging a Signal 0-day vulnerability, reads a statement on Twitter.

"After responsible investigation we have no evidence that suggests this vulnerability is real nor has any additional info been shared via our official reporting channels."

https://www.google.com/amp/s/www.bleepingcomputer.com/news/security/signal-says-there-is-no-evidence-rumored-zero-day-bug-is-real/amp/