Week of October 31, 2022: OpenSSL Patches Critical Flaws, Dropbox Discloses GitHub Breach

The week of October 31, 2022 brought a dense patch cycle and a notable breach disclosure for security leaders, as CISA pushed guidance on phishing-resistant multifactor authentication, OpenSSL shipped fixes for two high-severity CVEs, ConnectWise patched a critical remote-code-execution flaw in its backup software, and Dropbox confirmed that a phishing attack impersonating CircleCI had exposed 130 private GitHub repositories. Cisco and Apple also issued security updates flagged by CISA, while a BlackFog survey highlighted mounting retention pressure among CISOs.

CISA Urges Adoption of Phishing-Resistant MFA

On October 31, 2022, CISA released two fact sheets addressing multifactor authentication weaknesses, urging organizations to adopt phishing-resistant MFA to guard against account takeover and other known threats. For organizations still relying on mobile push-notification MFA, the agency recommended enabling number matching as an interim mitigation against MFA fatigue attacks, while noting it remains less robust than phishing-resistant methods. CISA pointed security teams to its fact sheets, Implementing Phishing-Resistant MFA and Implementing Number Matching in MFA Applications, along with an infographic ranking MFA options by strength, to help prioritize authentication upgrades across their environments. (CISA)

ConnectWise Patches Critical RCE in Backup Products

ConnectWise disclosed and patched a critical remote-code-execution flaw affecting ConnectWise Recover and R1Soft Server Backup Manager, warning customers the bug was either being targeted or at higher risk of exploitation in the wild. The authentication-bypass vulnerability affected Recover versions 2.9.7 and earlier and R1Soft SBM versions 6.16.3 and earlier; ConnectWise automatically updated Recover installs to 2.9.9 while urging R1Soft customers to upgrade to 6.16.4. Security researchers at Huntress said their scans found upwards of 5,000 exposed Server Backup Manager instances via Shodan that could have been reachable by attackers before the patch. (Help Net Security)

OpenSSL Fixes Two High-Severity CVEs

OpenSSL shipped version 3.0.7 to fix CVE-2022-3602 and CVE-2022-3786, two high-severity buffer overflow flaws in the punycode decoder affecting OpenSSL versions 3.0.0 through 3.0.6. CISA said a threat actor could exploit the bugs by crafting a malicious email address in a certificate, potentially causing a crash or remote code execution during X.509 certificate verification. The agency, working with the Netherlands' NCSC-NL on an affected-software tracking list, encouraged users and administrators to upgrade to OpenSSL 3.0.7 without delay, noting the flaws did not affect OpenSSL 1.1.1s or earlier branch versions. (CISA)

Dropbox Discloses GitHub Code Repository Breach

Dropbox disclosed that attackers used a phishing campaign impersonating CircleCI to steal an employee's GitHub credentials and one-time password, gaining access to 130 of the company's private code repositories. The stolen repositories held copies of third-party libraries, internal prototypes, security team tools and configuration files, along with API keys and a few thousand names and email addresses of employees, customers and vendors. Dropbox said no customer passwords or payment information was exposed, rotated all exposed developer credentials, hired outside forensic experts, and reported the incident to regulators and law enforcement while accelerating its move to WebAuthn. (Help Net Security)

CISA Flags Cisco Security Updates for Multiple Products

CISA notified organizations on November 3, 2022 that Cisco had released security updates addressing vulnerabilities across multiple products, warning that a remote attacker could exploit some of the flaws to take control of an affected system. The agency directed administrators to Cisco's security advisories page for lower-severity issues and urged users to apply the vendor's patches promptly. The alert added to a week of vendor patching activity that also touched Apple, OpenSSL and ConnectWise products, giving security teams a heavier patch queue than usual. (CISA)

CISA Publishes Three ICS Advisories

CISA released three Industrial Control Systems advisories on November 3, 2022, covering ETIC RAS, the Nokia ASIK 5G AirScale System Module, and Delta Industrial Automation's DIALink software, each detailing vulnerabilities, exploits and mitigations relevant to operators of affected equipment. The advisories arrived alongside a separate CISA alert on Mitsubishi Electric factory automation products issued November 1, 2022, keeping ICS-focused security teams busy reviewing technical details across multiple vendors during the first week of November. (CISA)

Survey: Nearly a Third of CISOs Considering Quitting

BlackFog research published November 2, 2022 found that 32% of CISOs or IT security decision makers in the UK and US were considering leaving their current organization, with a third of those planning to do so within six months. The survey also found that 41% of respondents who had previously held a CISO or security leadership role said they left, or were let go, following an attack or data breach, while 30% cited poor work-life balance as their biggest frustration in the role. (Help Net Security)

Apple Patches Xcode Vulnerabilities

CISA alerted users on November 3, 2022 that Apple had released a security update for Xcode, warning that a remote attacker could exploit the underlying vulnerabilities to take control of an affected system. The agency pointed developers to Apple's security page for Xcode 14.1 and urged them to apply the update promptly, rounding out a week in which CISA also flagged security releases from Cisco and OpenSSL for enterprise patching queues. (CISA)