Week of November 7, 2022: Medibank's Ransom Refusal and a Zero-Day-Heavy Patch Tuesday

Security leaders watched Australian insurer Medibank publicly refuse to pay ransom for data stolen from 9.7 million customers, while Microsoft's November Patch Tuesday closed multiple flaws already being exploited in the wild and CISA added seven of them to its Known Exploited Vulnerabilities Catalog. CISA also rolled out new vulnerability-prioritization guidance and a wave of advisories from Cisco, Citrix, and industrial-control vendors, keeping patch queues full across November 7-13, 2022.

Medibank confirms it will not pay ransom over 9.7 million-customer breach

Australian health insurer Medibank confirmed it would not pay the ransom demanded by the threat actor behind the data theft affecting 9.7 million current and former customers, citing cybercrime expert advice that payment offered only a limited chance of preventing publication and could invite further extortion. The insurer said credit card and banking details were not compromised, and it began rolling out identity-protection and mental health support services for affected customers. (Help Net Security)

Microsoft's November security updates address multiple actively exploited flaws

Microsoft issued its November 2022 security updates, addressing multiple vulnerabilities across its software, some of which an attacker could exploit to take full control of an affected system. CISA urged users and administrators to review Microsoft's Security Update Guide and apply the necessary patches without delay, given the presence of flaws attackers were already exploiting in the wild. (CISA)

CISA publishes SSVC methodology to prioritize vulnerability remediation

CISA published guidance on Stakeholder-Specific Vulnerability Categorization, a methodology intended to help organizations prioritize vulnerability remediation based on exploitation status, safety impact, and how widely the affected product was deployed. The agency positioned the framework alongside its Known Exploited Vulnerabilities catalog and machine-readable advisory formats as tools meant to shrink the window attackers have to exploit unpatched systems. (CISA)

Cisco patches multiple products including ASA and Secure Firewall 3100

Cisco released security updates addressing vulnerabilities across multiple products, including Adaptive Security Appliance Software, Firepower Threat Defense Software, and the Secure Firewall 3100 Series, some of which a remote attacker could exploit to seize control of an affected system. CISA urged administrators to review the seven linked advisories, which covered denial-of-service flaws, a secure boot bypass, and a default SNMP credential issue, and to apply the necessary updates promptly. (CISA)

Citrix fixes ADC and Gateway flaw allowing full system takeover

Citrix released security updates for Citrix ADC and Citrix Gateway to address vulnerabilities that a remote attacker could exploit to take control of an affected system. CISA encouraged administrators to review Citrix's advisory CTX463706 and apply the necessary fixes, given the potential for full system compromise on products widely used for secure remote access and application delivery. (CISA)

CISA releases twenty ICS advisories covering Siemens, Omron, and others

CISA released twenty Industrial Control Systems advisories on November 10, 2022, covering products from Siemens, Omron, LS Elec, and Delta Electronic, spanning issues in network management software, PLCs, industrial controllers, and visualization tools. The agency encouraged operators to review each advisory for technical details and mitigations, reflecting the steady cadence of ICS-specific vulnerability disclosures affecting critical infrastructure environments during the period. (CISA)