Stories
Slash Boxes
Comments

SoylentNews is people

posted by martyb on Monday August 10 2020, @12:19AM   Printer-friendly
from the "Virtually-Private"-Networks dept.

Hacker Leaks Passwords For 900+ Enterprise Vpn Servers | Zdnet:

EXCLUSIVE: The list has been shared on a Russian-speaking hacker forum frequented by multiple ransomware gangs.

A hacker has published [on August 4] a list of plaintext usernames and passwords, along with IP addresses for more than 900 Pulse Secure VPN enterprise servers.

ZDNet, which obtained a copy of this list with the help of threat intelligence firm KELA, verified its authenticity with multiple sources in the cyber-security community.

According to a review, the list includes:

  • IP addresses of Pulse Secure VPN servers
  • Pulse Secure VPN server firmware version
  • SSH keys for each server
  • A list of all local users and their password hashes
  • Admin account details
  • Last VPN logins (including usernames and cleartext passwords)
  • VPN session cookies

The security researcher noted that all the Pulse Secure VPN servers included in the list were running a firmware version vulnerable to the CVE-2019-11510 vulnerability.

[...] The publication of this list as a free download is a literal DEFCON 1 danger level for any company that has failed to patch its Pulse Secure VPN over the past year, as some of the ransomware gangs active on this forum are very likely to use the list for future attacks.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 0) by Anonymous Coward on Monday August 10 2020, @04:33PM

    by Anonymous Coward on Monday August 10 2020, @04:33PM (#1034381)

    After being volunteered as safety inspector for our district and finding out a manager was altering my inspection results to make himself look glorious, somebody got hurt from a safety violation that was documented many times. I gave up that unpaid position after stating... "It's not my job."
    It's bullshit games like this from management no matter what industry it is.