Tag: KEV

  • Was It Really GPAC? (No!) Getting a CVE Removed from CISA KEV

    Was It Really GPAC? (No!) Getting a CVE Removed from CISA KEV

    On October 3, 2024, Aquasec published a report about newly discovered malware named “perfctl”, targeting Linux servers. In it they cite the malware taking advantage of misconfigurations, as well as attempting to “exploit the Polkit vulnerability (CVE-2021-4043) to escalate privileges.”  Only problem is that CVE-2021-4043 isn’t “the Polkit vulnerability”, which in itself is problematic since…

  • Known Exploited Vulnerabilities (KEV) Thoughts – Part Two

    Known Exploited Vulnerabilities (KEV) Thoughts – Part Two

    This is part two of my thoughts on Known Exploited Vulnerabilities (KEV), and where it gets a lot more interesting! Please see the first blog before starting here. Automation / Eagerness To Add Reading vulnerability disclosures can be a grueling mission full of frustrations. Poorly written advisories, missing technical details, and errors make the life…

  • Known Exploited Vulnerabilities (KEV) Thoughts – Part One

    Known Exploited Vulnerabilities (KEV) Thoughts – Part One

    This is the first of two blogs with my thoughts on Known Exploited Vulnerabilities (KEV) tracking and the challenges that come with tracking them. Introduction On November 03, 2021, Cybersecurity and Infrastructure Security Agency (CISA) announced a Binding Operational Directives (BOD) titled “BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities“. This BOD established…

  • A Glimpse Into the CISA KEV

    A Glimpse Into the CISA KEV

    On March 27, Elizabeth Cardona and Tod Beardsley gave a presentation at VulnCon 2024 about CISA’s KEV, or ‘Known Exploited Vulnerabilities’ list. This initiative was created as a result of BOD 22-01, which is a ‘Binding Operational Directive’ aimed at reducing the risk due to vulnerabilities that are known to be exploited in the wild,…

  • Commentary on Radware’s Top Web Exploits of 2020

    Commentary on Radware’s Top Web Exploits of 2020

    At the close of each year we see at least one article covering the top vulnerabilities / exploits from the prior year. This is usually written on the back of having large detection networks across the Internet that get a comprehensive view of exploitation. It’s a great way to get real intelligence for criminal hacking…

  • The Blurred or Not So Blurred Lines Of Vulnerability Research

    The Blurred or Not So Blurred Lines Of Vulnerability Research

    [This was originally published on RiskBasedSecurity.com.] On April 18, 2018, vpnMentor disclosed a ‘critical’ vulnerability in LG NAS devices, which also received a bit of media attention. The blog leads with “Here at vpnMentor, we are concerned about your security and privacy.” However, that didn’t seem to apply to a specific system in South Korea. In their…

  • Response to Kenna Security’s Explanation of the DBIR Vulnerability Mess

    Response to Kenna Security’s Explanation of the DBIR Vulnerability Mess

    [This was originally published on the OSVDB blog.] Earlier this week, Michael Roytman of Kenna Security wrote a blog with more details about the vulnerability section of the Verizon DBIR report, partially in response to my last blog here questioning how some of the data was generated and the conclusions put forth. The one real…

  • A Note on the Verizon DBIR 2016 Vulnerabilities Claims

    A Note on the Verizon DBIR 2016 Vulnerabilities Claims

    [This was originally published on the OSVDB blog.] [Updated 4/28/2016] Verizon released their yearly Data Breach Investigations Report (DBIR) and it wasn’t too long before I started getting asked about their “Vulnerabilities” section (page 13). After bringing up some highly questionable points about last year’s report regarding vulnerabilities, several people felt that the report did…