In response to new research that the DarkIRC bot exploits recent Oracle WebLogic vulnerability to drop attacks such as a browser stealer, a keylogger, a Bitcoin Clipper, a worm and other threats, cybersecurity experts offer perspective below.
In response to new research that the DarkIRC bot exploits recent Oracle WebLogic vulnerability to drop attacks such as a browser stealer, a keylogger, a Bitcoin Clipper, a worm and other threats, cybersecurity experts offer perspective below.
Information Security Buzz (aka ISBuzz News) is an independent resource that provides the experts comments, analysis and opinion on the latest Information Security news and topics
The fix for this vulnerability was issued two months ago and updated last month. We don’t know if the persons who started advertising this in Aug 2020 used it at some point, but it’s certainly possible.
This is why updating and patching is so important, and why reliance on vulnerability scanners alone is a poor strategy. It’s important that security team members have input into patch prioritization, and that organizations look seriously at exactly how their patch priorities are set. Are they the head of IT or security? By team decision?
The real question here is: why doesn\’t something get patched right away? What are the reasons for an outstanding vulnerability to linger?
It’s discouraging that recently CISA needed to issue a warning asking companies to implement patches that in some cases had been available for over a year.
Also, it’s good to see that more researchers are careful to use the term “attacker” for those who launch or enable attacks, recognizing the difference between those threat actors and the hacker community, which discovers and generally attempts to disclose vulnerabilities before an attacker can exploit them. Kudos there!
Attackers are constantly evolving their methods, often incorporating exploits shortly after they\’re revealed. The exploit DarkIRC bot is now leveraging ( CVE-2020-14882 ) against Oracle WebLogic was corrected in October 2020 after being revealed 4 months earlier in June. While the patch has been out for a month, that is not actually that long given normal maintenance and patch cycles. However, it points to an ongoing issue in our ability to keep our systems up to date and get vital security patches in place quickly. Security analytics tools can help us identify where patches need to go in and recognize attacks when they take place, but we still need to improve our maintenance processes to reduce our risk from known vulnerabilities.