Week of November 11, 2024: PRC Telecom Espionage Disclosed, KPMG Names New CISO

Security leaders tracking the week of November 11, 2024 saw CISA and the FBI disclose a broad PRC-linked espionage campaign against commercial telecommunications carriers, while KPMG named Steve Frank as its new Chief Information Security Officer. The same stretch brought a cluster of vendor and government advisories, including CISA's addition of seven actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog, a joint US-UK-Australia-Canada-New Zealand advisory on 2023's most exploited flaws, and fresh guidance on exposed Palo Alto Networks and Fortinet products.

KPMG Names Steve Frank as Chief Information Security Officer

KPMG and KPMG Americas named Steve Frank as Chief Information Security Officer, according to SecurityWeek's industry moves coverage published November 11, 2024. Frank arrived with cybersecurity leadership experience from Kaiser Permanente and more than 15 years at the Central Intelligence Agency. The appointment added a CISO with both private-sector healthcare and intelligence-community backgrounds to KPMG's executive bench as the firm managed its own information security program alongside client-facing risk advisory work. (SecurityWeek)

FBI and CISA Detail PRC Hacking of Telecom Carriers

On November 13, 2024, the FBI and CISA issued a joint statement describing a broad cyber espionage campaign in which PRC-affiliated actors compromised networks at multiple telecommunications companies. The agencies said the activity enabled theft of customer call records, compromised the private communications of a limited number of individuals involved in government or political activity, and copied information previously subject to U.S. law enforcement court orders. FBI and CISA said their understanding of the compromises was expected to grow as the investigation continued and urged potential victims to contact local FBI field offices or CISA. (CISA)

Five-Nation Advisory Details 2023's Top Exploited Vulnerabilities

CISA, the FBI, NSA, and cybersecurity agencies from Australia, Canada, New Zealand, and the United Kingdom published a joint advisory on November 12, 2024 detailing the top vulnerabilities routinely exploited by malicious cyber actors in 2023. The advisory found that the majority of the most frequently exploited vulnerabilities were first exploited as zero-days, an increase from 2022 when fewer than half were. The agencies urged vendors to adopt secure-by-design practices and end-user organizations to apply timely patches and centralized patch management to reduce exposure. (CISA)

CISA Adds Two Palo Alto Expedition Flaws to KEV Catalog

CISA added two Palo Alto Networks Expedition vulnerabilities, an OS command injection flaw tracked as CVE-2024-9463 and a SQL injection flaw tracked as CVE-2024-9465, to its Known Exploited Vulnerabilities Catalog on November 14, 2024 based on evidence of active exploitation. The catalog listing required Federal Civilian Executive Branch agencies to remediate the vulnerabilities by a set due date under Binding Operational Directive 22-01. CISA also urged all organizations, not only federal agencies, to prioritize timely remediation of catalog entries as part of routine vulnerability management practice. (CISA)

Palo Alto Networks Warns on Exposed Firewall Management Interfaces

CISA updated its advisory on Palo Alto Networks firewall management interfaces on November 15, 2024 after the vendor revised an informational bulletin. Palo Alto Networks said it had observed threat activity exploiting an unauthenticated remote command execution vulnerability against a limited number of internet-exposed firewall management interfaces. CISA urged administrators to follow Palo Alto Networks' hardening guidance, review instructions for accessing internet-facing management interface scan results, and take immediate action where required to reduce exposure of management interfaces to the internet. (CISA)

CISA Adds Five More Vulnerabilities to KEV Catalog

CISA added five more vulnerabilities to its Known Exploited Vulnerabilities Catalog on November 12, 2024, citing evidence of active exploitation. The additions included an Atlassian Jira Server and Data Center path traversal flaw, a Cisco Adaptive Security Appliance cross-site scripting flaw, a Metabase GeoJSON API local file inclusion flaw, and two Microsoft Windows vulnerabilities covering NTLMv2 hash disclosure spoofing and Task Scheduler privilege escalation. CISA again required Federal Civilian Executive Branch agencies to remediate the vulnerabilities by set deadlines under Binding Operational Directive 22-01. (CISA)

Fortinet Patches Multiple FortiOS and Product Vulnerabilities

Fortinet released security updates on November 12, 2024 addressing vulnerabilities across multiple products including FortiOS. CISA said a cyber threat actor could exploit some of the flaws to take control of an affected system and pointed administrators to four Fortinet advisories covering issues such as SSL-VPN session hijacking via SAML authentication, privilege escalation through a Lua auto-patch function, and improper access control involving named pipes. CISA encouraged users and administrators to review the advisories and apply the necessary updates promptly. (CISA)