Oct 8, 2019, 03:22am

U.S. And U.K. Governments Issue Update Now Warning For Windows, macOS And Linux Users

Davey WinderSenior Contributor
Cybersecurity
I report and analyse breaking cybersecurity and privacy stories

Both U.S. and U.K. government agencies have taken the unusual step of issuing a rare update now warning to Windows, macOS and Linux users concerning a critical cybersecurity threat from advanced persistent threat (APT) attackers. Here's everything you need to know.

The nature of the cybersecurity threat

It isn't the first time that the National Security Agency (NSA) has released a critical security vulnerability warning but these government agency update now advisories are few and far between. Once again, though, the NSA is making such a warning; this time regarding an ongoing attack from advanced persistent threat (APT) actors. The NSA warns that attackers could remotely take control of affected Windows, macOS and Linux systems. The United States Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) has also issued an advisory and is recommending that users upgrade now. Furthermore, the National Cyber Security Centre (NCSC) in the U.K. isn't being left out of the attack threat alert party either. So what is the threat behind this string of critical warnings?

The NSA advisory concerns the exploit of multiple vulnerabilities in Virtual Private Network (VPN) applications. As is often the case, these official government warnings come when vulnerabilities that have been known about for some time have, despite fixes being available, ongoing exploits causing concern. Indeed, according to the NCSC alert, the vulnerabilities are well documented in open source, and the exploit activity is continuing with international targets across academic, business, government, healthcare and military sectors.

A brief history of affected VPN warnings

The vulnerabilities are to be found within several enterprise VPN products and can enable a remote attacker to retrieve files including those with authentication credentials. Armed with these credentials the slow and stealthy APT attackers can then change the configuration of the VPN or dig deeper into internal network infrastructures. Intelligence gathering, data exfiltration and system control are all on the exploit table here.

-snip-