Hackers are exploiting a Pulse Secure 0-day to breach orgs around the world

[Pickles von Brine]

Quote

Hackers backed by nation-states are exploiting critical vulnerabilities in the Pulse Secure VPN to bypass two-factor authentication protections and gain stealthy access to networks belonging to a raft of organizations in the US Defense industry and elsewhere, researchers said.

At least one of the security flaws is a zero-day, meaning it was unknown to Pulse Secure developers and most of the research world when hackers began actively exploiting it, security firm Mandiant said in a blog post published Tuesday. Besides CVE-2021-22893, as the zero-day is tracked, multiple hacking groups—at least one of which likely works on behalf of the Chinese government—are also exploiting several Pulse Secure vulnerabilities fixed in 2019 and 2020...

...Used alone or in concert, the security flaws allow the hackers to bypass both single-factor and multifactor authentication protecting the VPN devices. From there, the hackers can install malware that persists across software upgrades and maintain access through webshells, which are browser-based interfaces that allow hackers to remotely control infected devices.

Source

This is pretty bad. Almost feels as bad as SolarWinds. The fact this bug allows bypassing of 2FA and be stealthy is scary stuff. So many business rely on VPNs to work. Hope a resolution is found quickly. 

[Levent]

I cringe every time I hear Pulse "secure" VPN exploits. Its particularly bad for marketing when your product name is literally "secure" yet these new 0days are found every year and most of them are critical.

[TempestCatto]

5 minutes ago, Levent said:

I cringe every time I hear Pulse "secure" VPN exploits. Its particularly bad for marketing when your product name is literally "secure" yet these new 0days are found every year and most of them are critical.

Clearly no one at Pulse has a pulse. 

[MultiGamerClub]

I would think VPN services would be safe enough.. But sure enough.. Either its private information or exploits

[Fasterthannothing]

Figured something was up when our network engineers were sending out notifications to our technology department about an emergency patch they had to do on the VPN yesterday.

[rcmaehl]

ZScaler is obviously the superior Enterprise VPN.