How do threat actors discover and exploit vulnerabilities in the wild?

Forums Security News (Security) How do threat actors discover and exploit vulnerabilities in the wild?

  • This topic is empty.
Viewing 0 reply threads
  • Author
    Posts
    • #41456
      Telegram SmartBoT
      Moderator
      • Topic 5959
      • Replies 0
      • posts 5959
        @tgsmartbot

        #News(Security) [ via IoTGroup ]


        Headings…
        How do threat actors discover and exploit vulnerabilities in the wild?
        Popular Target Vulnerabilities and their Exploitation
        Citrix ADC, Citrix Gateway RCE, Directory Traversal
        Jira Sensitive Data Exposure
        Webmin RCE via backdoored functionality
        Why do threat actors exploit vulnerabilities?
        How do adversaries exploit vulnerabilities?
        Steps involved in vulnerability exploitation

        Auto extracted Text……

        Popular Target Vulnerabilities and their Exploitation
        Avinash Jain, from Grofers, tested the vulnerability on multiple targets, and discovered a large number of vulnerable Jira instances , revealing sensitive data belonging to various companies, such as NASA, Google and Yahoo, and its employees.
        Why do threat actors exploit vulnerabilities?
        How do adversaries exploit vulnerabilities?
        On disclosure of such vulnerabilities, adversaries probe the internet for technical details and exploit codes, to launch attacks.
        Rand corporation’s research and analysis on zero-day vulnerabilities states that, after a vulnerability disclosure, it takes 6 to 37 days and a median of 22 days to develop a fully functional exploit.
        But when an exploit disclosure comes with a patch, developers and administrators immediately patch the vulnerable software.
        Once a bad actor decides to exploit a vulnerability they have to:
        Obtain a working exploit or develop an exploit (in case of a zero-day vulnerability)
        Identify as many hosts as possible that are vulnerable to the exploit
        Adversaries identify a vulnerable host through their signatures/ behaviour, to generate a list of exploitable hosts.
        Many commonly used software has a specific default installation port(s).
        Using port scans to discover targets to exploit the Webmin RCE vulnerabilities
        This will lead to a discovery of all possible Webmin installations that could be vulnerable to the exploit.
        At the same time, if Shodan does not index the target port, attackers leverage tools like MassScan, Zenmap and run an internet-wide scan.
        Similarly, an attacker in search of an easy way to find a list of systems affected by Ghostcat, will port scan all the target IPs and narrow down on machines with port 8009 open.
        Using distinct paths to discover targets to exploit Spring Boot Data Leakage
        Since the default Spring Boot applications start on port 8080 , it would help to have a list of hosts that have this port open


        Read More..
        AutoTextExtraction by Working BoT using SmartNews 1.02976805238 Build 26 Aug 2019

    Viewing 0 reply threads
    • You must be logged in to reply to this topic.