CISA Identifies Five New Vulnerabilities Currently Being Exploited - Source: www.schneier.com

Comments

Bob • March 5, 2025 5:40 PM

Don’t worry. We’ll gut CISA to the point of impotence, then we won’t have to worry about new vulns.

netjeff • March 5, 2025 11:31 PM

Just a reminder that CISA reports on currently-active attacks, including attacks using vulnerabilities that might have been first reported years ago.

Regarding the Windows vulnerability, it was first reported in 2018, and CISA sees current attacks using this 2018 vulnerability.

Clive Robinson • March 6, 2025 12:09 AM

@ ALL,

Two things to mull over,

1, Are “Currently Being Exploited”
2, MS “Windows vulnerability”

A look at the date of the original CVS is “2018” which is back in Win-7 days…

I’m ‘assuming’ the ‘Currently Being Exploited’ is via the Internet or other ‘externally exposed’ communications path…

I’m hoping that as the MS OS’s mentioned are nolonger effectively supported the available “mitigation strategies” should be fairly obvious (ie “pull the plug”).

But in the back of peoples minds should be the question as to why someone should be running an OS that is not security supported?

As I’ve indicated in the past I still run an Apple ][ that is so old (1970’s tech) it never had what most would call “security support”.

Likewise I still run Microsoft Win3.1, Win XP, Win 2000 amongst other creaky old pre-this-century OS’s…

The why is believe it or not “Development and Support”… That is I still support products I’ve developed in the past that use 8 and 16 bit computers (not microcontrollers).

The reason for this is the hardware or equivalent has not been replaced nor can it be for various reasons.

One such is “regulation”…

Medical, aviation, industrial, safety etc equipment is “certified” and is in effect,

“Frozen from that time on”

Because the cost of “re-certification” is “prohibitively expensive”.

Another reason is that some hardware needs a minimum of a “Quarter to half a Century” life expectancy to in effect “recover costs”. This applies to “Industrial, Medical and Scientific”(ISM) equipment and now increasingly Infrastructure and Measurement equipment.

It might be a scary thought, but there are “Office PABX” systems still in use, and still being supported as they are “Still on lease” that pre-date Win XP.

Unless you’ve upgraded to a “Smart Meter” –which is ill advised– the chances are good that if the house is a 1960’s or later build, the utility meters are the originals…

But consider the US Medical Insurance industry is “popping in pacemakers” and other “medical electronics implants” on an industrial scale. Do you want to have your chest opened up for an “update/patch” every year or even decade?. No of course not…

I sometimes mention the “security” aspects of all these sorts of system, but few, especially politicians and regulators actually really think about them.

Because they are,

“The technical debt no one wants to talk about…”

ResearcherZero • March 6, 2025 3:18 AM

@Clive Robinson, @ALL

Older operating systems run much faster with considerably less requirements. The interface is often better designed. The system settings are easier and simpler to access and the lack of unneeded features greatly reduces the attack surface. The UI remains static. Due to the great reduction in running system processes and attack vectors, diagnostics is far simpler.

Having to factory reset, then break the security on a modern hardware in order to install a less bloated and more secure operating system seems a little bizarre. Requiring a bunch of hacks and having to SSH into a device just to get control, with a minimum of unwanted junk installed, is a steep learning curve for the uninitiated who may want a lean system and UI.

That often leaves older hardware and systems as the only other alternative. The bonus is no unneeded attack vectors. With one in four GPs now popping your health data into ChatGPT for convenience, big tech has completely diverged from consumer need into irresponsibility.

Patching insecure products with Session Initiation Protocol and other in-the-clear product more than a decade after the horse bolted demonstrates this insecure product design. SMS, email and many other communication products have security tacked on later, or not at all.
Large companies knowingly built and left insecure configurations within exposed devices.

Before building devices for public networks, secure design should be the priority. But given it is a “free” market, why not give away all the most sensitive secrets for free?
The designs for the new Iron Dome Star Wars fantasy should be the first to go, followed by all the most important defense and intelligence secrets, nuclear subs, planes, warheads etc.

Planned ahead? Smart thinking! Pull up a crate and hotspot, or use my WIFI if you want.

‘https://edition.cnn.com/2025/03/04/politics/federal-employees-return-to-office-problems/index.html

Subscribe to comments on this entry