> In a statement, Barracuda said it will be providing the replacement product to impacted customers at no cost
Obviously the time and effort to replace a device isn't free, but at least they're doing the right thing by acknowledging the issue and doing what they can to fix it definitively.
But correct - its the right thing to do regardless of the true, ultimate motivations...
But what I'd like to know is the impact of this? Like - how much corporate opportunity loss may have been created through information breaches which were unknown... That will never be known, unless we can assuredly say 'none' which is doubtful...
-
>Barracuda said the vulnerability existed in the Barracuda software component responsible for screening attachments for malware
Heh -- uhm... Isn't that like _THE_CORE_ component of the devices job?
Aside from ensuring filters on attachement egress blah blah...
--
>No other Barracuda product, including our SaaS email solutions, were impacted by this vulnerability
I'd like to hear them directly say that this specific ESG device line was NOT used in their Email SaaS offerings?
And to know exactly what ESG kit they are using?
Seems like a reasonable request if you're a large (or any) customer of theirs...
Unfortunately, add on that no customer makes a profit off their IT security org. Which disincentivizes excellence and incentivizes feature check-boxing at the lowest price point.
Which ultimately produces a highly privileged piece of software developed on budget salaries.
One reason MS security was a game changer (once the company got off its butt and admitted security was an existential threat to their OS sales) -- they could afford to burn great magnitudes of money to deliver.
(No offense intended to any of the amazingly brilliant non-MS Windows AV folks out there)
In my social circle, the kids Gaming PCs getting infected is very common.
Recently one of my boxes got hacked via a QBitTorrent exploit, and I didnt have Malware detection running, other than the built in W11 system.
I installed Malwarebytes and it detected and correctly removed the malware crypto miner.
FYI they exploited QBT via the web interface, which had default settings, but wasn't exposed via port forwarding to the web. It might have been via UPNP, which was enabled. No idea - but it's a common exploit used to DL a torrent then run a post DL script .bat file to DL and run a crypto miner.
I'd literally had QBT running on Windows for a couple of weeks, having switched from a dockerized setup on a Mac Mini. How Windows allows the running of a .bat file to DL an .exe that can run a crypto miner is just a bonkers lack of security!
Naturally I had to nuke the box from space anyway :-)
Is it any different from Linux allowing the running of a .sh file to DL an ELF executable that can run a crypto miner?
It's either that or iOS-type walled garden, which one you prefer?
By the way, Windows even has the lock-down switch, it's just off by (a sane) default.
Also, blaming OS for not protecting from random app exploits isn't fair.
Who or what triggers the execution of that script? If it is QBT, it almost sounds like malicious intent from the side of its developers.
> In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as demonstrated by remote command execution via a crafted name within an RSS feed.
(you speak with a fluidity I did in my gaming heyday - but I am over the global heap at this point.)
Chances are it's so core that some buggy LZMA or something implementation was offloaded to ASIC.