SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)
SANS ISC Stormcast, Jan 9, 2025: Critical Vulnerabilities in Ivanti, Aviatrix, and Hijacked Backdoors in Compromised Systems
Podcast summary created with Snipd AI
Quick takeaways
- Recent research reveals that hijacked abandoned domains still expose systems to risks from previously installed cyber backdoors.
- Urgent security advisories highlight critical vulnerabilities in Ivanti's secure gateway products due to active exploitation in the wild.
Deep dives
Domain Hijacking to Uncover Compromised Systems
Registering expired domains can be a tactic to access abandoned infrastructure, but recent research by Watchtower highlights a novel approach where they targeted abandoned domains previously used by attackers. By re-registering these domains, Watchtower was able to set up their own servers and gain access to thousands of compromised systems that were still trying to connect to them. The research revealed that many backdoors installed by attackers were still operational and calling back to these re-registered domains, allowing Watchtower to identify various affected companies and government agencies worldwide. This demonstrates how previously abandoned cyber resources can still pose significant security risks due to lingering connections from compromised systems.
Remember Everything You Learn from Podcasts
