[German]In my blog post AnyDesk confirmed, they have been hacked in January 2024, Production systems affected – Part 1 I compiled the information officially published by AnyDesk and a brief history. However, I've been working on this topic for a few days now and in the meantime I've received a few tidbits of information that have led to further insights, questions and speculation. Below is a compilation of these points.
[German]My fears have been confirmed. The days-long "maintenance" of the AnyDesk websites is the result of a cyber attack. AnyDesk's production systems have been hacked. All AnyDesk software must be considered compromised. After the German CERT (BSI) sent out a confidential warning to users of critical infrastructures, I have received finally the incident report from AnyDesk. Below I have put together all the information I now have in one article.
[German]Are the developers of Windows 11 working on an implementation of the sudo command familiar from Linux? At least there is an option to enable sudo in the developer settings of the new Windows 11 Insider Preview builds. Whether the sudo implementation known from Linux and macOS will make it to users, however, remains to be seen.
[German]US company Cloudflare, which provides a CDN, security services and DNS services, was hacked in November 2023. The attackers were able to access an Atlassian server using an authentication token and gain access to the Confluence wiki, the Jira bug database and the Bitbucket source code management system. It is assumed that it is state hackers who are responsible for the attack.
[German]Security issues in Ivanti products are ongoing. In January 2024, the provider had to disclose two new security vulnerabilities in Ivanti Connect Secure. These are CVE-2024-21888 (privilege escalation to admin) and CVE-2024-21893 (SSRF to access "restricted resources"). So far, there have only been mitigation measures – but Ivanti released security updates a few hours ago.
[Sponsored Post]In the rapidly evolving IT world, choosing the right remote desktop software is critical for organizations that value security, ease of use and reliability. One provider of secure remote access that has been on the market since 2001 is ISL Online, which presents some considerations for choosing such software below. More ...
[German]A short warning to IT supporters who use the AnyDesk remote maintenance software for remote support. A few days ago, I reported some issues with this product (see my German blog post Störung bei AnyDesk, jemand betroffen?). AnyDesk web site has been on maintenance since January 30, 2024. Now vague information is trickling in, that there has been a cyber incident – although there is an information lock, so I can't get any details. Addendum: The hack is confirmed.
[German]Microsoft has released another security update for the Edge (Chromium) browser with version 121.0.2277.98 in the stable channel on February 1, 2024. It is a security update that is intended to close vulnerabilities.
[German]On January 23, 2024, a vulnerability became known that could cause event logging under Windows to crash. The vulnerability, known as EventLogCrasher, can also be exploited remotely in Windows clients and Windows servers and there is still no patch from Microsoft. However, the founder of ACROS-Security contacted me last night because he has provided a micro-patch for his 0patch agent for all affected Windows versions. The solution is free for all Windows users. Here is some information.
[German]The US government has just announced that the Volt Typhoon spy and botnet network has been shut down by remote commands. This network, attributed to China, infiltrates routers and aims to be able to shut down critical infrastructure in the event of an incident. FBI and other authorities received a warrant to remove the malware from infected devices.
[German]Google has been blocking third-party cookies in Google Chrome since the beginning of 2024 – and Edge is also likely to be affected. However, this will lead to collisions with Microsoft 365 services such as Teams, which will then no longer function correctly. Administrators must take appropriate countermeasures so that users can continue to make full use of these Microsoft services.
MVP:
2013 – 2016
WIMVP:
2017 – 2020
