Week of March 25, 2024: XZ Utils Backdoor Surfaces as CISA Pushes New Cyber Rules

The week of March 25, 2024 was dominated by the disclosure of a deliberately planted backdoor in the XZ Utils compression library tracked as CVE-2024-3094, a joint CISA/FBI Secure by Design alert on SQL injection, and the posting of CISA's long-awaited CIRCIA incident-reporting rulemaking for public comment. SouthState Corporation also updated an SEC filing on a prior cybersecurity incident, Cisco pushed out a bundled set of patches, and Code42 and Inversion6 both named new chief information security officers.

XZ Utils backdoor prompts emergency CISA alert

CISA disclosed on March 29, 2024 that malicious code had been embedded in versions 5.6.0 and 5.6.1 of the widely used XZ Utils data compression library, tracked as CVE-2024-3094. The backdoor could allow unauthorized access to systems where the compromised library was installed, raising concern across the open-source ecosystem given how deeply XZ Utils is embedded in Linux distributions. CISA urged developers and users to downgrade to an uncompromised version such as XZ Utils 5.4.6 Stable and to hunt for signs of exploitation. (CISA)

CISA and FBI press software makers on SQL injection

On March 25, 2024, CISA and the FBI issued a joint Secure by Design Alert urging software manufacturers to eliminate SQL injection vulnerabilities from their products. The alert referenced a well-publicized exploitation of SQLi defects in a managed file transfer application that had affected thousands of organizations, and called on senior executives at technology manufacturers to formally review their code for susceptibility to SQLi compromises and implement mitigations across current and future products. (CISA)

CISA adds Fortinet, Ivanti, and Nice Linear flaws to KEV catalog

On March 25, 2024, CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: a SQL injection flaw in Fortinet FortiClient EMS (CVE-2023-48788), a code injection vulnerability in Ivanti Endpoint Manager Cloud Service Appliance (CVE-2021-44529), and an OS command injection flaw in Nice Linear eMerge E3-Series devices (CVE-2019-7256). Under Binding Operational Directive 22-01, federal civilian agencies were required to remediate these vulnerabilities by set deadlines, and CISA urged all organizations to prioritize the same fixes. (CISA)

CISA posts CIRCIA incident-reporting rule for public comment

On March 27, 2024, the Federal Register posted for public inspection CISA's Notice of Proposed Rulemaking for the Cyber Incident Reporting for Critical Infrastructure Act of 2022, the regulation CISA was required to develop under CIRCIA. The proposal set out requirements for covered entities to report cyber incidents and ransomware payments to CISA, with a 60-day public comment period to follow formal publication. CISA Director Jen Easterly said the rule would help the agency spot adversary campaigns earlier and coordinate response with public and private partners. (CISA)

SouthState updates SEC filing on bank cybersecurity incident

SouthState Corporation filed an amended Form 8-K on March 29, 2024, providing supplemental detail on a cybersecurity incident its bank subsidiary had detected on February 6, 2024. The amendment stated that SouthState had contained the impact of the incident and would mail notification letters to individuals whose personal information may have been involved. SouthState said the incident was not reasonably likely to have a material impact on its financial condition or results of operations, even though it had significantly affected certain business processes. (U.S. Securities and Exchange Commission (EDGAR))

Code42 and Inversion6 name new CISOs

SecurityWeek's Industry Moves column for the week of March 25, 2024 reported two new CISO appointments. Data loss and insider threat protection firm Code42 named Dennis Dayman as CISO, putting him in charge of global risk and compliance, security operations, and incident response; he previously held security leadership roles at Proofpoint, Maropost, Return Path, and Eloqua. Cyber risk management provider Inversion6 appointed Tom Siu as CISO, a role in which he works directly with clients on their cybersecurity programs after prior CISO postings at Michigan State and Case Western Reserve universities. (SecurityWeek)

Cisco bundles IOS and IOS XE security patches

On March 28, 2024, CISA highlighted security updates Cisco released for IOS, IOS XE, and access point software as part of its semiannual bundled publication. The advisories covered multiple vulnerabilities, including a secure boot bypass and a denial-of-service flaw in Cisco Access Point software, which a threat actor could exploit to disrupt network availability. CISA encouraged administrators to review the bundled advisories and apply the necessary patches to Cisco's networking infrastructure software promptly. (CISA)