How do threat actors discover and exploit vulnerabilities in the wild?

#News(Security) [ via IoTGroup ]

Headings…
How do threat actors discover and exploit vulnerabilities in the wild?
Popular Target Vulnerabilities and their Exploitation
Citrix ADC, Citrix Gateway RCE, Directory Traversal
Jira Sensitive Data Exposure
Webmin RCE via backdoored functionality
Why do threat actors exploit vulnerabilities?
How do adversaries exploit vulnerabilities?
Steps involved in vulnerability exploitation

Auto extracted Text……

Popular Target Vulnerabilities and their Exploitation
Avinash Jain, from Grofers, tested the vulnerability on multiple targets, and discovered a large number of vulnerable Jira instances , revealing sensitive data belonging to various companies, such as NASA, Google and Yahoo, and its employees.
Why do threat actors exploit vulnerabilities?
How do adversaries exploit vulnerabilities?
On disclosure of such vulnerabilities, adversaries probe the internet for technical details and exploit codes, to launch attacks.
Rand corporation’s research and analysis on zero-day vulnerabilities states that, after a vulnerability disclosure, it takes 6 to 37 days and a median of 22 days to develop a fully functional exploit.
But when an exploit disclosure comes with a patch, developers and administrators immediately patch the vulnerable software.
Once a bad actor decides to exploit a vulnerability they have to:
Obtain a working exploit or develop an exploit (in case of a zero-day vulnerability)
Identify as many hosts as possible that are vulnerable to the exploit
Adversaries identify a vulnerable host through their signatures/ behaviour, to generate a list of exploitable hosts.
Many commonly used software has a specific default installation port(s).
Using port scans to discover targets to exploit the Webmin RCE vulnerabilities
This will lead to a discovery of all possible Webmin installations that could be vulnerable to the exploit.
At the same time, if Shodan does not index the target port, attackers leverage tools like MassScan, Zenmap and run an internet-wide scan.
Similarly, an attacker in search of an easy way to find a list of systems affected by Ghostcat, will port scan all the target IPs and narrow down on machines with port 8009 open.
Using distinct paths to discover targets to exploit Spring Boot Data Leakage
Since the default Spring Boot applications start on port 8080 , it would help to have a list of hosts that have this port open

Read More..
AutoTextExtraction by Working BoT using SmartNews 1.02976805238 Build 26 Aug 2019