Seems it’s exploiting vulnerabilities in some software called “Ivanti Connect Secure VPN”, so unless you’re running that, you’re safe I guess. Says in the past they used vulnerabilities in “Qlik Sense” and Adobe “Magento”. Never heard of any of those, but I guess maybe some businesses use them?
These vpns seem to be quite a good target since at least the one my university uses is run as a setuid executable, so if there is a vulnerability in there, you can execute code as root that wasn’t intended to be executed as root.
Did I miss the bit where they said how it was delivered?
Seems it’s exploiting vulnerabilities in some software called “Ivanti Connect Secure VPN”, so unless you’re running that, you’re safe I guess. Says in the past they used vulnerabilities in “Qlik Sense” and Adobe “Magento”. Never heard of any of those, but I guess maybe some businesses use them?
My university has us use Ivanti to connect to our network from offsite…
These vpns seem to be quite a good target since at least the one my university uses is run as a setuid executable, so if there is a vulnerability in there, you can execute code as root that wasn’t intended to be executed as root.
Hmmm… Nice, nice, that’s nice,
Which university??
Magento is the e-commerce platform. Adobe acquired it in 2018. Quite a few businesses use it.
ITT people who don’t understand the difference between “privacy” VPNs pitched by influencers and corporate remote access VPN.
This is the latter. Ivanti bought Pulse a few years back. Pulse, iirc, spun out of Juniper and Netscreen.
Ivanti is a huge name in enterprise management. They make LANdesk which has been one of the most widely deployed enterprise endpoint management tools.
Juniper is one of the biggest names in enterprise and service-provider networks.