4 ms·

March? The MoveIT vulnerability was a zero day with a coordinated attack on Memorial Day weekend. "On May 31, 2023, the State of Maine became aware of a softwa

March? The MoveIT vulnerability was a zero day with a coordinated attack on Memorial Day weekend. "On May 31, 2023, the State of Maine became aware of a software vulnerability in MOVEit... The software vulnerability was exploited by a group of cybercriminals and allowed them to access and download files belonging to certain agencies in the State of Maine between May 28, 2023, and May 29, 2023." "Why Am I Hearing About This Now? The State of Maine carried out an extensive evaluation to identify the individuals whose information may have been impacted."

cookiengineer 3y ago
Come on, man. It's not like cl0p was quiet about this. Pretty much any hacking related channel was making fun of the RCE and bypass when "thenoc" was hacked, their and all their customers' (mostly lawyers) stuff was leaked, and cl0p devs bragged about it everywhere on Telegram. Maybe you should change your cyber intelligence provider if it's just as good as the NVD/NIST databases. Zero days like this can be easily caught if you have the right sources and don't rely solely on your splunk and fortinet tech stack, you know.
- thedougd 3y ago
  Whose NOC was hacked? Or what does “thenoc” refer to? We’re talking about hundreds of organizations running MoveIt. Are they all culpable for not having threat intelligence better than disclosed vulnerabilities in COTS software? Or worse, in their vendors’ software? What should they subscribe to?
  - Terretta 3y ago
    The MOVEit vulnerability was covered everywhere all at once. So it didn't matter what you were subscribed to as long as that was more than zero things. The ongoing miss everywhere is less about detection or awareness than about response. Problem is there's lots of these across old back office I.T. stuff all the time, so much noise, and MOVEit is not a "top of mind" tech even though every legacy company uses it or a competitor to exchange files because they haven't heard of Box. So they didn't realize they use MOVEit and didn't think to dig in. That's the actual issue: not knowing what your firm runs on.
    - thedougd 3y ago
      Yes, it was covered everywhere all at once, after the event. The ex-filtration happened on May 27th through May 29th, and the vendor issued the alert on May 31st, after the wide-spread hacking. The Maine incident is not a new one, it too was from Memorial Day weekend hacks. https://www.rapid7.com/blog/post/2023/06/14/etr-cve-2023-34362-moveit-vulnerability-timeline-of-events/ https://www.rapid7.com/blog/post/2023/06/14/etr-cve-2023-343...

cookiengineer 3y ago

Come on, man. It's not like cl0p was quiet about this. Pretty much any hacking related channel was making fun of the RCE and bypass when "thenoc" was hacked, their and all their customers' (mostly lawyers) stuff was leaked, and cl0p devs bragged about it everywhere on Telegram. Maybe you should change your cyber intelligence provider if it's just as good as the NVD/NIST databases. Zero days like this can be easily caught if you have the right sources and don't rely solely on your splunk and fortinet tech stack, you know.

thedougd 3y ago
Whose NOC was hacked? Or what does “thenoc” refer to? We’re talking about hundreds of organizations running MoveIt. Are they all culpable for not having threat intelligence better than disclosed vulnerabilities in COTS software? Or worse, in their vendors’ software? What should they subscribe to?
- Terretta 3y ago
  The MOVEit vulnerability was covered everywhere all at once. So it didn't matter what you were subscribed to as long as that was more than zero things. The ongoing miss everywhere is less about detection or awareness than about response. Problem is there's lots of these across old back office I.T. stuff all the time, so much noise, and MOVEit is not a "top of mind" tech even though every legacy company uses it or a competitor to exchange files because they haven't heard of Box. So they didn't realize they use MOVEit and didn't think to dig in. That's the actual issue: not knowing what your firm runs on.
  - thedougd 3y ago
    Yes, it was covered everywhere all at once, after the event. The ex-filtration happened on May 27th through May 29th, and the vendor issued the alert on May 31st, after the wide-spread hacking. The Maine incident is not a new one, it too was from Memorial Day weekend hacks. https://www.rapid7.com/blog/post/2023/06/14/etr-cve-2023-34362-moveit-vulnerability-timeline-of-events/ https://www.rapid7.com/blog/post/2023/06/14/etr-cve-2023-343...