Hello, welcome to the Monday, April 4th, 2020 edition of the Sandsenet Storm Center's Stormcast. My name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

Well, let's start with patches today, and GitLab did release a critical security release, 14.9.2, 14.8.5 and 14.7. are the versions that you should be

running now. There are a total of 17 vulnerabilities that are being addressed in these updates.

The first one is a critical one, and it's a static password that inadvertently is set during Omni-Aid-based registration. And then we have two high stored cross-site scripting vulnerabilities. So this critical Omni-Oath issue that affects you if you're using, for example, Oath, LDAB,

or SAML, in order to authenticate.

In this case, a static password was set for the user that an attacker could then use

to take over accounts.

Probably not hard what that static password is,

and this also affected GitLab.com passwords

and respective passwords have been reset by GitLab.

You probably should do the same for your users after you apply the patch.

The cross-sad scripting issues sound more like something that would be exploited by an authenticated

user.

You have to leave notes or you have to add milestone references in order to exploit this.

Still, this could of course then be used to elevate privileges if, for example, administrator would be exposed to that

cross-side scripting code. So patch, and as usual, if you don't need to, then don't expose GitLab

to the internet. And then we have more details from Viassad regarding the attack against their KASAT network

that took down thousands of modems connected to the network in Europe. Now, it affected just

part of their network subsidiary called SkyLogic was really what was affected here and the modems

were using the two-way service brand. Now, what apparently happened here was sort of two things.

First of all, the initial intrusion happened through unprotected VPN connection.

As often, if you're not doing strong two-factor authentication on your VPN, and by strong, I'm meaning not just an SMS or something like this, you're probably doing it wrong.

...