Comment on Never-before-seen Linux malware gets installed using 1-day exploits

octopus_ink@lemmy.ml ⁨8⁩ ⁨months⁩ ago

• UnityDevice@startrek.website ⁨8⁩ ⁨months⁩ ago

  Seems it’s exploiting vulnerabilities in some software called “Ivanti Connect Secure VPN”, so unless you’re running that, you’re safe I guess. Says in the past they used vulnerabilities in “Qlik Sense” and Adobe “Magento”. Never heard of any of those, but I guess maybe some businesses use them?

  source

  • Macros@feddit.de ⁨8⁩ ⁨months⁩ ago

    Ivanti Connect Secure VPN

    So its spreading via a closed source VPN software. Why should you even use that when there is great VPN software available on Linux which work reliable for decades?

    Well of course you miss zero trust connections, multi-cloud readiness, award‑winning security and proven secure corporate access …

    source

    • rolling_resistance@lemmy.world ⁨8⁩ ⁨months⁩ ago

      Because someone built an easy-to-use solution for organisations to charge money for. The same thing with Cisco VPN that every other software company seems to use.

      source
  • TonyTonyChopper@mander.xyz ⁨8⁩ ⁨months⁩ ago

    My university has us use Ivanti to connect to our network from offsite…

    source

    • Faresh@lemmy.ml ⁨8⁩ ⁨months⁩ ago

      These vpns seem to be quite a good target since at least the one my university uses is run as a setuid executable, so if there is a vulnerability in there, you can execute code as root that wasn’t intended to be executed as root.

      source
    • ComradeKhoumrag@infosec.pub ⁨8⁩ ⁨months⁩ ago

      Hmmm… Nice, nice, that’s nice,

      Which university??

      source
  • LodeMike@lemmy.today ⁨8⁩ ⁨months⁩ ago

    “Linux isn’t more secure than Windows! It has vulnerabilities”

    The Linux vulnerability: ^

    source
  • Zozano@lemy.lol ⁨8⁩ ⁨months⁩ ago

    I pay for ProtonVPN, and I still run my traffic through OpenVPN.

    Hate to victim blame, but unless you’re going to audit every line of code yourself, don’t use obscure software.

    source

    • Faresh@lemmy.ml ⁨8⁩ ⁨months⁩ ago

      As TonyTonyChopper this thread said, sometimes that obscure software is what you are required to use in your institution, or they don’t offer support for anything else.

      source

      • Zozano@lemy.lol ⁨8⁩ ⁨months⁩ ago

        Yeah it sucks. Of course there are outlying situations where people are obliged to use shit software.

        But for those with a choice, just don’t use shit software.

        source
      • Socsa@sh.itjust.works ⁨8⁩ ⁨months⁩ ago

        Are these tools implementing proprietary protocols or something? So far I have not found a VPN I couldn’t make work with openvpn or wireguard.

        source
    • LordKitsuna@lemmy.world ⁨8⁩ ⁨months⁩ ago

      To be fair you should be using wire guard then. Because multiple of the largest and most well-known security auditing firms in the world have said that openvpn is impossible to truly audit. It’s too large, you can audit individual parts of it, and you can audit individual interactions between parts. But it’s not possible to fully audit.

      Meanwhile wireguard is quite small so it can be fairly easily audited by a small team and has been multiple times

      source

      • humbletightband@lemmy.dbzer0.com ⁨8⁩ ⁨months⁩ ago

        But it could be banned by DPI. Russia does it, China also obviously

        source

        • -> View More Comments
  • kingorgg@feddit.uk ⁨8⁩ ⁨months⁩ ago

    Magento is the e-commerce platform. Adobe acquired it in 2018. Quite a few businesses use it.

    source
  • JasonDJ@lemmy.zip ⁨8⁩ ⁨months⁩ ago

    ITT people who don’t understand the difference between “privacy” VPNs pitched by influencers and corporate remote access VPN.

    This is the latter. Ivanti bought Pulse a few years back. Pulse, iirc, spun out of Juniper and Netscreen.

    Ivanti is a huge name in enterprise management. They make LANdesk which has been one of the most widely deployed enterprise endpoint management tools.

    Juniper is one of the biggest names in enterprise and service-provider networks.

    source