Week of October 14, 2024: Iranian Brute-Force Advisory and CISO Moves at OpenAI, Keeper

Security leaders tracked a joint US-Canada-Australia advisory warning that Iranian actors had used brute-force and MFA push-bombing techniques to compromise critical infrastructure accounts, while CISA added an actively exploited Veeam Backup and Replication flaw to its Known Exploited Vulnerabilities Catalog. The week also brought a cluster of CISO changes, including Dane Stuckey's move from Palantir to OpenAI, alongside new CISA/FBI guidance on product security bad practices and Oracle's October Critical Patch Update.

OpenAI, Keeper Security, Cequence Security Name New CISOs

SecurityWeek's Industry Moves roundup for the week recorded several CISO changes. Dane Stuckey left his CISO post at Palantir Technologies to become CISO of ChatGPT maker OpenAI. Keeper Security named James Scobey, previously CISO at the SEC, as its new CISO. Cequence Security appointed Randolph Barr, who had held CISO roles at Zoom, Qualys, and WebEx, to the same title. Netwrix named Grady Summers, formerly of SailPoint and FireEye/Mandiant, as CEO, succeeding Steve Dickson. (SecurityWeek)

CISA Adds Actively Exploited Veeam Backup Flaw to KEV Catalog

CISA added CVE-2024-40711, a deserialization vulnerability in Veeam Backup and Replication, to its Known Exploited Vulnerabilities Catalog on October 17, 2024, citing evidence of active exploitation. Federal civilian agencies covered by Binding Operational Directive 22-01 were required to remediate the flaw by the stated due date. CISA urged all organizations, not only federal agencies, to prioritize patching catalog vulnerabilities as part of routine vulnerability management given how frequently this category of flaw is targeted. (CISA)

CISA Flags Windows, Firefox, and SolarWinds Flaws as Actively Exploited

On October 15, 2024, CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: a Microsoft Windows Kernel time-of-check time-of-use race condition, a Mozilla Firefox use-after-free flaw, and a SolarWinds Web Help Desk hardcoded credential vulnerability. CISA said these vulnerability types are frequent attack vectors posing significant risk to the federal enterprise, and it again urged all organizations to prioritize remediation of catalog entries as part of ongoing vulnerability management practices. (CISA)

US, Canada, Australia Warn of Iranian Brute-Force Campaign Against Critical Infrastructure

On October 16, 2024, CISA joined the FBI, NSA, and agencies from Canada and Australia in a joint advisory on Iranian actors using brute force and credential-access techniques against critical infrastructure organizations. The advisory said the actors had used password spraying and MFA push-bombing since October 2023 to compromise accounts across healthcare, government, IT, engineering, and energy sector organizations, and had modified MFA registrations to maintain persistent access. The agencies recommended organizations enforce strong passwords and register a second authentication factor. (CISA)

CISA and FBI Open Comment Period on Product Security Bad Practices Catalog

On October 16, 2024, CISA and the FBI released a Product Security Bad Practices catalog for public comment as part of CISA's Secure by Design initiative. The guidance groups risky practices into product properties, security features, and organizational processes, aimed primarily at manufacturers whose software supports critical infrastructure. CISA Director Jen Easterly said "basic, preventable software defects continue to enable crippling attacks" against hospitals, schools, and other critical infrastructure. The comment period runs through December 16, 2024, via the Federal Register. (CISA)

Oracle Ships October Critical Patch Update Addressing Multiple Products

On October 17, 2024, CISA highlighted Oracle's quarterly Critical Patch Update Advisory for October 2024, which addressed vulnerabilities across multiple Oracle products. CISA noted that a cyber threat actor could exploit some of the flaws to take control of an affected system, and it encouraged users and administrators to review the advisory and apply the necessary updates promptly to reduce exposure ahead of Oracle's next quarterly release cycle. (CISA)

CISA Publishes Seven ICS Advisories Covering Multiple OT Vendors

On October 17, 2024, CISA released seven Industrial Control Systems advisories covering products from Elvaco, LCDS, Mitsubishi Electric, HMS Networks, and Kieback&Peter, plus updated advisories for the goTenna Pro X and Pro X2 and the goTenna Pro ATAK Plugin. The bulletins described current security issues, vulnerabilities, and exploits affecting operational technology equipment used across critical infrastructure sectors. CISA encouraged asset owners and administrators to review the technical details and apply the recommended mitigations for each affected product line. (CISA)