Vulnerability Life Cycle and Vulnerability Disclosures

Vulnerability Life Cycle diagram shows possible states of the #vulnerability. In a previous post I suggested to treat vulnerabilities as bugs. Every known #vulnerability, as same as every #bug, was implemented by some software developer at some moment of time and was fixed at some moment of time later. What happens between this two events?

Right after the #vulnerability was implemented in the code by some developer ( creation ) nobody knows about it. Well, of course, if it was done unintentionally. By the way, making backdoors look like an ordinary vulnerabilities it’s a smart way to do such things. 😉 But let’s say it #WAS done unintentionally.

Time passed and some researcher found ( discovery ) this #vulnerability and described it somehow. What’s next? It depends on who was that researcher.

#vulnerability #Stuxnet #PoC #malware #exploit #EternalBlue #bughunter #backdoor #0day #VulnerabilityManagement #VulnerabilityDatabase #Concept

Read more: https://avleonov.com/2019/01/30/vulnerability-life-cycle-and-vulnerability-disclosures/

Коллеги,
Анализ сети ШПД Ростелеком показал, что более 42% публично доступных RDP-сервисов уязвимы к BlueKeep/CVE-2019-0708.
Эксплойт публично доступен. Сканер данной уязвимости для Metasploit так же доступен. Предполагаем начало массовых атак в ближайшее время.
RT CERT призывает Вас своевременно обновлять свое ПО и отказываться от идеи размещения публично доступных RDP-сервисов.

Все мы помним Wanna Cry, Petya, Bad Rabbit и т.п.

#rdp #metasploit #CVE-2019-0708 #windows #BlueKeep #exploit

Кто ещё не смотрел моё выступление на Tenable Security Day, залил его себе на канал. https://www.youtube.com/watch?v=V5T3ftcFwdY