The perimeter is under attack.
Over the past eight months, easily exploitable vulnerabilities have plagued perimeter-facing infrastructure, from in-the-wild exploits against a critical flaw in F5's BIG-IP application-delivery software to ransomware attackers sneaking in using a vulnerability in Pulse Secure's virtual private network (VPN) appliances.
The attacks often turn hardware and software meant to secure the perimeter into an attacker's beachhead into the network. Two days after F5 posted an initial advisory on July 1 about the vulnerability in its BIG-IP application-delivery appliance (CVE-2020-5902), attackers had already started widespread scanning for the issue, looking for systems that exposed the vulnerable Traffic Management User Interface (TMUI).
Because the critical vulnerability was trivial to exploit, F5 updated its advisory within days with frank advice: If you haven't patched by now, consider your company hacked.
"If your BIG-IP system has TMUI exposed to the Internet, and it does not have a fixed version of software installed, there is a high probability that it has been compromised and you should follow your internal incident response procedures," the company stated.
There is no single reason for the increased discovery and reporting of vulnerabilities in perimeter devices, but several trends have made it more likely that vulnerabilities will be found and attacked, says Johannes Ullrich, dean of research at the SANS Technology Institute. Since containerized versions of the appliances are often available, security researchers can more easily set up environments to automate the search for vulnerabilities.
In addition, companies often do not keep the appliances up to date, giving attackers a greater window of vul ..
Support the originator by clicking the read the rest link below.
