After observing attacks on customers , Cisco is telling users to i nstall Vulnerability-related.PatchVulnerability the fix for a recently disclosed denial-of-service flaw a ffecting Vulnerability-related.DiscoverVulnerability a number of its security appliances . The flaw , t racked as Vulnerability-related.DiscoverVulnerability CVE-2018-0296 , was detailed in an advisory on June 6 and a ffects Vulnerability-related.DiscoverVulnerability Cisco ASA Software and Cisco Firepower Threat Defense ( FTD ) Software . `` Cisco strongly recommends that customers u pgrade Vulnerability-related.PatchVulnerability to a fixed software release to r emediate Vulnerability-related.PatchVulnerability this issue , '' Omar Santos of Cisco 's Product Security Incident Response Team w arned Vulnerability-related.DiscoverVulnerability on June 22 . The attacks follow the publication of proof-of-concept exploits for the flaw . Santos n otes Vulnerability-related.DiscoverVulnerability that a unauthenticated , remote attacker could cause a device to reload unexpectedly and cause a denial-of-service ( DoS ) condition . Additionally , an exploit could cause a DoS or unauthenticated disclosure of information . However , Santos said : `` Only a denial-of-service condition ( device reload ) has been observed by Cisco . '' Cisco h as also updated Vulnerability-related.PatchVulnerability the advisory for CVE-2018-0296 with details about the attacks . The researcher who f ound Vulnerability-related.DiscoverVulnerability the flaw , Michał Bentkowski from Polish security firm Securitum , gave a brief description of the root cause in a tweet shortly after Cisco d isclosed Vulnerability-related.DiscoverVulnerability the bug . Bentkowsky r eported Vulnerability-related.DiscoverVulnerability the issue to Cisco as a way to use directory-traversal techniques to disclose information to an unauthenticated attacker . Cisco labeled its primary impact as a DoS condition , but said it is possible that on certain releases of ASA a device reload would not occur , yet still allow an attacker to use directory-traversal techniques to view sensitive system information . Bleeping Computer i dentified Vulnerability-related.DiscoverVulnerability two proof-of-concept exploits for CVE-2018-0296 on GitHub . One attempts to e xtract Attack.Databreach user names from Cisco ASA . The other states : `` If the web server is vulnerable , the script will dump in a text file both the content of the current directory , files in +CSCOE+ and active sessions . ''

Thousands of industrial control systems ( ICS ) could be at risk of hacking due to critical vulnerabilities a ffecting Vulnerability-related.DiscoverVulnerability a popular piece of software . SecurityWeek d etailed Vulnerability-related.DiscoverVulnerability how the flaws a ffect Vulnerability-related.DiscoverVulnerability an application from 3S-Smart Software Solutions . The potential problem for ICS security stems from CODESYS , a hardware-independent middleware layer for programming Industrial Internet of Things ( IIoT ) and ICS . SecurityWeek r eported Vulnerability-related.DiscoverVulnerability the issue h as now been resolved Vulnerability-related.PatchVulnerability by 3S-Smart Software Solutions . However , the need for a patch , which could take some time to r oll out Vulnerability-related.PatchVulnerability to all affected organizations , highlighted the need for IT managers to be aware of the risk to connected technologies , particularly when it comes to ICS security . The flaws w ere discovered Vulnerability-related.DiscoverVulnerability by security firm CyberX . Phil Neray , vice president of industrial cybersecurity and marketing at CyberX , d escribed Vulnerability-related.DiscoverVulnerability how the vulnerabilities a ffect Vulnerability-related.DiscoverVulnerability all devices incorporating CODESYS Web Server v2.3 and earlier versions of the software . CODESYS is used to program a range of devices , such as programmable logic controllers and human machine interfaces . CyberX detailed how these devices are used in almost all elements of critical industrial infrastructure , including power plants , oil and gas installations , and chemical and pharmaceutical factories . The first vulnerability , CVE-2017-6027 , allows an attacker to upload arbitrary files to the CODESYS Web Server and potentially create remote code execution . The second flaw , CVE-2017-6025 , is a stack-based buffer overflow that attackers could use to crash the application or execute arbitrary code . The fear is that attackers could use the flaws to create safety failure and environmental damage at critical industrial infrastructure . ICS-CERT p ublished Vulnerability-related.DiscoverVulnerability an advisory note and rated the potential risk score of the vulnerabilities as critical because attackers can potentially gain remote code execution capabilities . 3S-Smart Software h as released Vulnerability-related.PatchVulnerability a patch , but CyberX suggested that the rollout process could be complicated by a range of factors .

For almost six years , Google knew about the exact technique that someone used to t rick Attack.Phishing around one million people into giving away access to their Google accounts to hackers on Wednesday . Even more worrisome : other hackers might have known about this technique as well . On October 4 , 2011 , a researcher speculated in a mailing list that hackers could t rick Attack.Phishing users into giving them access to their accounts by simply p osing as Attack.Phishing a trustworthy app . This attack , the researcher argued in the message , hinges on c reating Attack.Phishing a malicious application and registering it on the OAuth service under a name like `` Google , '' exploiting the trust that users have in the OAuth authorization process . OAuth is a standard that allows users to grant websites or applications access to their online email and social networking accounts , or parts of their accounts , without giving up their passwords . It is commonly used throughout the web , and typically shows up as a menu that lets you select which of your personal accounts ( such as your Google or Facebook account ) you want to use to sign into or connect to another service . If that sounds really familiar , is because that 's pretty much exactly how someone t ricked Attack.Phishing around one million people into giving up full access to their Google accounts to a malicious app named `` Google Doc . '' The viral , `` d ynamite phishing" Attack.Phishing scheme ripped through the internet on Wednesday for around an hour before Google shut down the malicious app and its infrastructure . ( We 're calling it `` d ynamite phishing" Attack.Phishing because it 's basically the digital equivalent of the real thing—a way to catch a bunch of users with a single blast . ) As it turns out , DeMarre c laims Vulnerability-related.DiscoverVulnerability he w arned Vulnerability-related.DiscoverVulnerability Google directly about this vulnerability in 2012 , and s uggested Vulnerability-related.DiscoverVulnerability that Google a ddress Vulnerability-related.PatchVulnerability it by checking to see ensure the name of any given app matched the URL of the company behind it . In a Hacker News post , DeMarre s aid Vulnerability-related.DiscoverVulnerability he r eported Vulnerability-related.DiscoverVulnerability this attack vector back then , and got a `` modest bounty '' for it . `` I 'm a little surprised it has taken so long for a worm like this one to get attention , '' DeMarre told Motherboard . A few months after he r eported Vulnerability-related.DiscoverVulnerability the issue , DeMarre s aid Vulnerability-related.DiscoverVulnerability Google told him the following : `` We 're deploying some abuse detection and reactive measures to deal with impostors that might try to abuse this sort of attack . Given this , we do not intend to perform validation that the URL matches the branding information . '' DeMarre criticized Google 's decision not to perform the URL validation , which was one of his suggestions to mitigate the risks . The researcher also theorized this could be easily turned into a worm , foreshadowing this week 's attack . `` [ If the ] service is a social platform , the client app might distribute links using resource owners ' accounts with the access tokens it has acquired , becoming a sort of worm , '' DeMarre wrote . Fast forward five years , and someone m imicked Attack.Phishing DeMarre 's technique , c reating Attack.Phishing a malicious Google Doc app that t ricked Attack.Phishing millions . A similar technique has also been previously used by the Russian hacking group known as APT28 or Fancy Bear . It 's possible someone else used the same technique in the last five years , without getting caught . The reason Wednesday 's d ynamite phishing campaign Attack.Phishing was caught and disabled quickly was because it spread so quickly and affected major media companies , which rapidly reported on the news . It effect , it was so extremely virulent that its success contributed to its downfall .

For almost six years , Google knew about the exact technique that someone used to t rick Attack.Phishing around one million people into giving away access to their Google accounts to hackers on Wednesday . Even more worrisome : other hackers might have known about this technique as well . On October 4 , 2011 , a researcher speculated in a mailing list that hackers could t rick Attack.Phishing users into giving them access to their accounts by simply p osing as Attack.Phishing a trustworthy app . This attack , the researcher argued in the message , hinges on c reating Attack.Phishing a malicious application and registering it on the OAuth service under a name like `` Google , '' exploiting the trust that users have in the OAuth authorization process . OAuth is a standard that allows users to grant websites or applications access to their online email and social networking accounts , or parts of their accounts , without giving up their passwords . It is commonly used throughout the web , and typically shows up as a menu that lets you select which of your personal accounts ( such as your Google or Facebook account ) you want to use to sign into or connect to another service . If that sounds really familiar , is because that 's pretty much exactly how someone t ricked Attack.Phishing around one million people into giving up full access to their Google accounts to a malicious app named `` Google Doc . '' The viral , `` d ynamite phishing" Attack.Phishing scheme ripped through the internet on Wednesday for around an hour before Google shut down the malicious app and its infrastructure . ( We 're calling it `` d ynamite phishing" Attack.Phishing because it 's basically the digital equivalent of the real thing—a way to catch a bunch of users with a single blast . ) As it turns out , DeMarre c laims Vulnerability-related.DiscoverVulnerability he w arned Vulnerability-related.DiscoverVulnerability Google directly about this vulnerability in 2012 , and s uggested Vulnerability-related.DiscoverVulnerability that Google a ddress Vulnerability-related.PatchVulnerability it by checking to see ensure the name of any given app matched the URL of the company behind it . In a Hacker News post , DeMarre s aid Vulnerability-related.DiscoverVulnerability he r eported Vulnerability-related.DiscoverVulnerability this attack vector back then , and got a `` modest bounty '' for it . `` I 'm a little surprised it has taken so long for a worm like this one to get attention , '' DeMarre told Motherboard . A few months after he r eported Vulnerability-related.DiscoverVulnerability the issue , DeMarre s aid Vulnerability-related.DiscoverVulnerability Google told him the following : `` We 're deploying some abuse detection and reactive measures to deal with impostors that might try to abuse this sort of attack . Given this , we do not intend to perform validation that the URL matches the branding information . '' DeMarre criticized Google 's decision not to perform the URL validation , which was one of his suggestions to mitigate the risks . The researcher also theorized this could be easily turned into a worm , foreshadowing this week 's attack . `` [ If the ] service is a social platform , the client app might distribute links using resource owners ' accounts with the access tokens it has acquired , becoming a sort of worm , '' DeMarre wrote . Fast forward five years , and someone m imicked Attack.Phishing DeMarre 's technique , c reating Attack.Phishing a malicious Google Doc app that t ricked Attack.Phishing millions . A similar technique has also been previously used by the Russian hacking group known as APT28 or Fancy Bear . It 's possible someone else used the same technique in the last five years , without getting caught . The reason Wednesday 's d ynamite phishing campaign Attack.Phishing was caught and disabled quickly was because it spread so quickly and affected major media companies , which rapidly reported on the news . It effect , it was so extremely virulent that its success contributed to its downfall .