Hackers chain Windows, VPN bugs to access government systems

By Steve Zurier for SC Media
Monday, October 12, 2020

• 3.2k
• 164
• 164
• 164
• 82
• More
• 164
• 164
• 164

CISA also found multiple cases where the Fortinet FortiOS Secure Socket Layer (SSL) VPN vulnerability CVE-2018-13379 has been exploited to gain access to networks. And to a lesser extent, CISA has also observed threat actors exploiting the MobileIron vulnerability CVE-2020-15505.

A growing number of state and federal agencies can be easily compromised even without hackers having any technical skills, said Ilia Kolochenko, founder and CEO of ImmuniWeb.

“Government agencies have a myriad of unprotected IT and cloud systems exposed to the Internet, with default or weak credentials, or even without passwords,” Kolochenko said. “Furthermore, it’s possible to easily find a great wealth of stolen credentials belonging to governmental employees on the dark web and, in view of a widespread and continuing trend of password reuse, can silently login to some state systems that process or store critical national data.” Read Full Article