Hackers start scanning for security flaws 15 minutes after disclosure
The enemy never sleeps, so patch fast
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
The latest findings from cybersecurity researchers at Unit 42 are the prime example of the old adage “the enemy never sleeps”.
Palo Alto Networks’ securityarmrecently published its newestIncident Response Report, in which it says that threat actors start scanning the web for vulnerableendpointsroughly 15 minutes after the CVE gets publicly disclosed.
In other words, hackers are keeping close tabs on software vendor bulletin boards, and as soon one of them publicly announces finding a vulnerability, they rush to see where an exploit is possible.
Attacks within hours
Scanning in itself isn’t a threat, and knowing a vulnerability exists is one thing, while actually exploiting it is another. However, crooks still conduct these reconnaissance tasks as they can, if all else fails, sell theintelon the black market, the researchers said.
Some of them move fast, too - Unit 42 says that “within hours”, the first active exploitation attempts can usually be seen.
According to Unit 42’s report, the most abused flaws in the first half of the year are the “ProxyShell” vulnerabilities, taking up 55% of all the reported incidents for the period. ProxyShell is a term that refers to abusing CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207, in a chain.
Open source Log4j scanners are here to save the day>Hackers started scanning for vulnerable Exchange servers minutes after patches were released>Here’s our take for the best free web security scanners right now
Log4Shell, the nightmare log4j vulnerability that experts expect will linger around for a decade, was second-placed with 14% of reports, followed by SonicWall CVEs with 7%.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
One of the takeaways of the report is that most of the time, cybercriminals abuse relatively old flaws, which just goes to show how important it is to patch systems, and programs, as soon as possible. Unit 42 has also said that in a third of network breaches, software vulnerabilities were used as the initial point of entry. Another third was taken up by phishing (37%) while brute-forcing, making up for 15%, rounds off the top three.
Via:BleepingComputer
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
Phishing attacks surge in 2024 as cybercriminals adopt AI tools and multi-channel tactics
