Week of November 18, 2024: PAN-OS zero-days compromise 2,000 firewalls, and ransomware halts Blue Yonder

What mattered to security leaders in the week of November 18, 2024? Palo Alto Networks confirmed on Monday that two PAN-OS zero-days were being exploited, and by Thursday Shadowserver counted around 2,000 compromised firewalls, mostly in the US and India. A ransomware attack on supply chain software provider Blue Yonder on November 21 disrupted retailers including UK grocers, and Microsoft announced plans to move security products out of the Windows kernel after the CrowdStrike outage.

Two exploited PAN-OS zero-days lead to about 2,000 compromised firewalls

On November 18 Palo Alto Networks released fixes for CVE-2024-0012, a missing authentication flaw that gives unauthenticated attackers with access to the management web interface administrator privileges, and CVE-2024-9474, a command injection bug that escalates an administrator to root. Both had been exploited as zero-days. By November 21 Shadowserver's scanning showed about 2,000 devices compromised, and Unit 42 assessed that a working exploit chain was public. Exposed management interfaces on edge devices were again the entry point. (Help Net Security, Help Net Security)

Ransomware disrupts Blue Yonder's managed services and its retail customers

Blue Yonder, a Panasonic-owned supply chain software provider whose roughly 3,000 customers include Morrisons, Tesco, Starbucks and Sainsbury, said a ransomware incident on November 21 disrupted its managed services hosted environment. It reported no suspicious activity in its public cloud environment and said it was working with outside firms on recovery. Morrisons confirmed it had fallen back to a slower backup process. The incident showed how a single SaaS supplier can ripple into store operations for many brands at once. (BleepingComputer)

Microsoft's Windows Resiliency Initiative targets kernel-mode security tools

Four months after the CrowdStrike outage, Microsoft announced the Windows Resiliency Initiative on November 19. It is building Quick Machine Recovery, which will let administrators push targeted fixes through Windows Update to PCs that cannot boot, with a preview for Windows Insiders in early 2025. Microsoft will require endpoint security vendors with the deepest Windows integration to test components with each update and roll out updates gradually, and it is developing capabilities that let security products run outside kernel mode. Security teams should expect their EDR architecture to change as vendors adapt. (Help Net Security)

Maxar Space Systems confirms theft of employee data

Satellite maker Maxar Space Systems disclosed a breach in which an attacker using a Hong Kong-based IP address accessed a system holding files with employee personal data. Maxar discovered it on October 11, 2024, and said the attacker likely had access for about a week before it acted. Exposed data included names, home addresses, Social Security numbers and employment details, but not bank information or dates of birth. HR data at defense and space contractors carries intelligence value beyond fraud. (Help Net Security)

Apple patches two exploited WebKit zero-days hitting Intel Macs

Apple released emergency macOS Sequoia updates for CVE-2024-44309, a WebKit cross-site scripting flaw, and CVE-2024-44308, a JavaScriptCore bug that can lead to arbitrary code execution, both triggered by malicious web content. Apple said they may have been actively exploited on Intel-based Mac systems. Clément Lecigne and Benoît Sevens of Google's Threat Analysis Group reported them, which points to targeted attacks rather than mass exploitation. (Help Net Security)

CISA red team finds over-reliance on EDR at a critical infrastructure operator

CISA published advisory AA24-326A on November 21 describing a red team assessment requested by a critical infrastructure organization. The team got in through a web shell left behind by a third party's earlier security assessment, moved through the DMZ and fully compromised the domain and several sensitive business systems. The organization spotted early activity but did not act promptly. CISA's main lesson was that it relied too heavily on host-based EDR and lacked network-layer protections, a finding many mature programs could check against their own architecture. (CISA)