Transcript
Jim Love (0:01)
OpenSSH vulnerabilities expose systems to man in the middle and DDoS attacks. A hacker group, Black Stash releases 4 million stolen credit cards for free, and Palo Alto's firewalls are under active attack. This is cybersecurity today. I'm your Host Jim Love Two significant vulnerabilities have been identified in OpenSSH, which is widely used for secure network communications. They potentially expose systems to man in the middle and denial of service attacks discovered by Qualsys threat research unit TRU. These flaws are tracked as CVE2025 26465 and CVE2025 26466. The vulnerability affects OpenSSH client version 6.8 P1 through 9.9P1. When verify host key DNS option is enabled, an attacker capable of intercepting network traffic could impersonate a legitimate server, potentially hijacking or altering SSH sessions. While Verify Host Key DNS is disabled by default, it was enabled by default on FreeBSD systems from September 2013 until March 2023, increasing exposure during that period. Notably, exploitation requires the attacker to exhaust the client's memory resources, adding complexity to the attack and for CVE2025 26466 impacting both open SSH clients and servers from versions 9.5p1 to 9.9p1. This vulnerability allows an unauthenticated attacker to to cause excessive memory and CPU consumption, leading to a denial of service condition. Repeated exploitation could disrupt server operations, preventing legitimate users from accessing services. The OpenSSH development team has addressed these vulnerabilities in version 9.9P2, which was just released. Users and administrators are strongly advised to update to this latest version promptly. Additionally, reviewing and adjusting the Verify Host Key DNS setting is also recommended to prevent potential man in the middle attacks. Given OpenSSH's critical role in securing network communications, timely application of these patches is essential to maintaining system security. In a strategic move to attract new clientele, the Dark Web marketplace Blackstash has announced the release of 4 million stolen credit credit card details for free. The dump was supposed to take place on February 19th. Blackstash aims to showcase the quality and volume of their illicit offerings by providing free access to vast amounts of stolen data. This tactic is designed to entice potential buyers to engage in future transactions on their platform. Similar strategies have been employed by other illicit marketplaces. For instance, Biden cash leaked 2 million stolen cards in 2024 to celebrate its anniversary. The stolen card information has been obtained through sophisticated phishing campaigns that exploit fake captcha verifications embedded within PDF documents. The cybercriminals distribute these malicious PDFs via legitimate platforms such as Webflow that uses Cloudflare's content delivery network to enhance their credibility. Unsuspecting users encounter these PDFs during routine searches and upon opening them, are prompted to complete a captcha verification. Now, interacting with this fake captcha redirects users to a phishing page that hosts a real cloudflare turnstile captcha, lending an air of legitimacy. After completing this genuine captcha users are presented with a download button, which when clicked, triggers a popup requesting personal information, including credit card details. Once the information is submitted, it's harvested by the attackers and used for fraudulent activities. It's just another reason to be wary of unsolicited PDF documents, especially those prompting action, particularly immediate action or requesting personal information. PDFs are increasingly being used by attacks by a number of groups. Palo Alto Networks has issued an urgent warning regarding active exploitation of a recently patched vulnerability in its Pan OS software. Attackers are chaining multiple flaws to escalate privileges and gain root access on affected systems. There's three CVEs on this 2024 9474. This allows administrators with web interface access to execute actions with root privileges. There's CVE2025 0108, an authentication bypass vulnerability was patched on February 12, 2025, and it enables attackers to bypass authentication and execute PHP scripts if they have network access to the management web interface. And there's CVE2025 0111, a file read vulnerability also patched on February 12th. It lets authenticated attackers read files accessible to the nobody user. But Palo Alto Networks is also urging administrators to ensure that firewall management interfaces are never exposed to the open Attackers are actively scanning for these vulnerable devices and organizations relying on security by obscurity such as using non standard ports or limiting access via ip, restrictions remain at high risk. Security researchers have repeatedly emphasized that any system exposed to the Internet will eventually be found and targeted firewalls should always be managed through a secure vpn, a dedicated internal network, or a bastion host, rather than being directly accessible online. And that's our show for today. You could reach me with comments, suggestions, or even corrections and critique by email@EditorialEchnewsDay CA or on LinkedIn or for the growing audience on YouTube. Just put a comment under the video. We have a Saturday show this week on the Dark side of AI, a discussion of what to think about in terms of cybersecurity and AI. I hope you can join us. And I'll be back in the news chair on Monday morning. I'm your host, Jim Love. Thanks for listening.