VeeamON 2024 - Use Code "COMMUNITY10" for 10% Off!
If you haven’t already done so, you can enable ‘External’ tagging in Outlook for your Microsoft Office 365 tenant. This allows any external emails to be tagged which can be helpful if someone tries to impersonate emails or for attempted Phishing emails. Resource: Set-ExternalInOutlook (ExchangePowerShell) | Microsoft LearnQuite simple to enable:Connect to Exchange Online using Powershell Connect-ExchangeOnline -UserPrincipleName user@domain.com Check status Get-ExternalInOutlook If set to false, to enable Set-ExternalInOutlook -Enabled $true To exclude a domain from being tagged: Set-ExternalInOutlook -AllowList “example.com” To exclude an email from being tagged Set-ExternalInOutlook -AllowList “admin@example.com”
Microsoft released KB5034441 as part of Patch Tuesday. However, on Windows 10 the update is causing issues:More here:https://support.microsoft.com/en-gb/topic/kb5034441-windows-recovery-environment-update-for-windows-10-version-21h2-and-22h2-january-9-2024-62c04204-aaa5-4fee-a02a-2fdea17075a8 SummaryThis update addresses a security vulnerability that could allow attackers to bypass BitLocker encryption by using Windows Recovery Environment (WinRE). For more information, see CVE-2024-20666. IMPORTANT Some computers might not have a recovery partition that is large enough to complete this update. Because of this, the update for WinRE might fail. In this case, you will receive the following error message: Windows Recovery Environment servicing failed.(CBS_E_INSUFFICIENT_DISK_SPACE) To help you recover from this failure, please follow Instructions to manually resize your partition to install the WinRE update. Known issue Because of an issue in the error code handling rout
Hey everyone! Happy Friday 😃I had a quick question regarding Per-VM Backup chains. If I remember rightly, I think I read somewhere that in V12 it would be enabled by default. Are Per-VM backup chains now best practice? Anything to be aware of when transitioning to them on already existing backup jobs that do not utilise Per-VM backup jobs currently?Thank you!
VMware have released version 12.1.5 of VMware Tools patching the following:This is a maintenance release of VMware Tools to provide fixes for critical product issues and security issues. Updated OpenSSL to 3.0.7 Updated zlib to 1.2.12 with additional fixes Updated GLib to 2.56.3 with additional fixes Updated libxml2 to 2.10.2 This release resolves CVE-2022-31693. For more information on this vulnerability and its impact on VMware products, see https://www.vmware.com/security/advisories/VMSA-2022-0029.html. More: https://docs.vmware.com/en/VMware-Tools/12.1/rn/vmware-tools-1215-release-notes/index.htmlCrucially OpenSSL has been updated.
Now this is just for my own curiosity. When Backup Jobs complete, Veeam runs Health Checks on the backup files to check for any corruption on the vbks. What happens if the VBR server goes offline whilst a Health Check job was in progress? Does it carry on from where it left off, or does it start the whole process again?Additionally, would it affect the vbk files in any way?
I came across this in the Veeam KB and thought I would post it here. Especially if you are running vulnerability scanning software in your environment and .NET and ASP.NET is being flagged up as being vulnerable and needs to be patched. KB4410: How to Upgrade .NET and ASP.NET Runtimes When Using Veeam ONE
VMware have released an advisory for CVE-2022-31705 just in time for the weekend!Impacted Products:VMware ESXi VMware Workstation Pro / Player (Workstation) VMware Fusion Pro / Fusion (Fusion) VMware Cloud FoundationDescriptionVMware ESXi, Workstation, and Fusion contain a heap out-of-bounds write vulnerability in the USB 2.0 controller (EHCI). VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.3.Known Attack VectorsA malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed. More here: https://www.vmware.com/security/advisories/VMSA-2022-0033.html
Intel have advised there is a new vulnerability affecting their processors. It looks like there are quite a few processors affected:CVEID: CVE-2023-23583Description: Sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege and/or information disclosure and/or denial of service via local access.CVSS Base Score: 8.8 HighCVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hhttps://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00950.html I expect they will try and mitigate via a firmware or BIOS update. Additional info:https://blogs.vmware.com/security/2023/11/cve-2023-23583.html https://thehackernews.com/2023/11/reptar-new-intel-cpu-vulnerability.html
In case you missed the annoucement, Microsoft have released more information on their upcoming server version called, Windows Server 2025.More info here:https://techcommunity.microsoft.com/t5/windows-server-insiders/announcing-windows-server-preview-build-26040/m-p/4040858 https://techcommunity.microsoft.com/t5/windows-server-news-and-best/introducing-windows-server-2025/ba-p/4026374If you want to give it a try, the Canary version can be downloaded after joining the Insiders Preview:https://www.microsoft.com/en-us/software-download/windowsinsiderpreviewserverAnyway, I thought I would try it out and trying installing Veeam B&R on it. I mean, why not? New server OS, and the first thing to go on there is Veeam? Let’s do it.Long story short, it was plain sailing and Veeam B&R installed successfully.Confimation screen of Veeam Backup & Replication 12.1 being installed successfully Veeam B&R Console with no jobs configuredUsual caveats apply if you are going to be testing it
Hi Folks,Following on from the news regarding a backdoor in the Linux library xz, a Yara Rule is now available that can be used in Veeam 12.1 if you do not utilise a vulnerability scanner in your environment. Great way to check by leveraging Veeam to do the scanning for you. There is more info about the vulnerability on the post by @JMeixner :Yara Rule can be found here: https://github.com/Neo23x0/signature-base/blob/master/yara/bkdr_xz_util_cve_2024_3094.yar
This seems to have been gaining traction with exploitations now being seen in the wild’A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word.’More here: https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
For those of you who still run Exchange on-prem, there are 2 zero days currently being exploited in the wild:CVE-2022-41040: A Server Side Request Forgery (SSRF) issue. CVE-2022-41082: A remote code execution (RCE) issue.No information on when there will be a patch. To mitigate, add a blocking rule in “IIS Manager -> Default Web Site -> Autodiscover -> URL Rewrite -> Actions”“.*autodiscover\.json.*\@.*Powershell.*” (excluding quotes)More guidance here: https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/
Hi Folks, VMware has released a Security Advisory with the recommend to patch now. More here:https://www.vmware.com/security/advisories/VMSA-2024-0006.htmlCVE-2024-22252 CVE-2024-22253 CVE-2024-22254 CVE-2024-22255Impacted Products:VMware ESXi VMware Workstation Pro / Player (Workstation) VMware Fusion Pro / Fusion (Fusion) VMware Cloud Foundation (Cloud Foundation)
Just a heads up, especially for those folks that use AnyDesk. They’ve just announced a breach:https://www.bleepingcomputer.com/news/security/anydesk-says-hackers-breached-its-production-servers-resets-passwords/So far, they’ve changed their code signing certificate but a lot of info is still thin on the ground.Official statement: https://anydesk.com/en/public-statement
With the daily news of ransomware and organisations getting hacked, a big one this week was from Cloudflare getting hacked. A long read I recommend reading is the blog entry they published:https://blog.cloudflare.com/thanksgiving-2023-security-incident https://thehackernews.com/2024/02/cloudflare-breach-nation-state-hackers.htmlSummary: In November 2023, Cloudflare experienced a security breach. A threat actor gained access to their internal systems using stolen credentials. The attacker explored various resources, including the wiki, bug database, and source code repositories. Cloudflare promptly detected and blocked the intruder, conducted an investigation, and implemented security measures. Fortunately, no customer data or systems were compromised during this incident.
Prior to upgrading to Veeam V12, ensure that, "Transform previous backup chains into rollbacks" is not enabled in your environment. If it is, the upgrade will fail as per KB4390: Feature Deprecation: "Transform previous backup chains into rollbacks" (veeam.com)I just wanted to point out a slight caveat when checking our environment. If you decide to check each job setting and disable the option, bear in mind, if you have a snapshot job with storage integration, it may still show as enabled. Normally a snapshot job looks like as follows without an option to select the backup chain option: However, running the PowerShell command:Get-VBRJob | where {$_.BackupTargetOptions.TransformIncrementsToSyntethic -eq $True}returns the following: This can be easily sorted by running:Set-VBRJobAdvancedBackupOptions -Job "Job Name" -TransformIncrementsToSyntetic $false
For those folks who run Fortinet Devices:A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.The vulnerability has already been exploited in the wild. CVSSv3 score is 9.3 with a rating of Critical so patch as soon as possible.More info: PSIRT Advisories | FortiGuard
Just thought I would post this. Veeam B&R 11a is no longer officially supported. However, if you have not seen it, Veeam has published a Patch, P20240304, for those who have not been able to upgrade to Version 12 yet. Most importantly, the following were patched:VMware Virtual Disk Development Kit (VDDK) was updated to 7.0.3.4 to address CVE-2023-38545. OpenSSL was updated to v1.0.2zi to address CVE-2023-2650. liblz4 was updated to v1.9.4 to address CVE-2021-3520. zlib was updated to v1.2.13 to address CVE-2022-37434. PuTTY was updated to 0.80 to address CVE-2023-48795.More here:https://www.veeam.com/kb4245If you are still running Version 11, please upgrade to version 12. It's a smooth upgrade :)
I’ve been following this which is has been in the news a lot recently.Rather than try and breach into organisations this group tends to recruit insiders to provide an easy way in.One of the reasons why it’s so important to have immutable backups.https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/Krebs on Security
For those who have not yet seen the announcement, there is more info here: KB4374: Veeam Backup for Google Cloud - Critical Vulnerability (CVE-2022-43549)In short:CVSS v3 Score: 10.0 (Critical) Veeam Updater component should have automatically applied the update To verify, check for Veeam Updater version 6.0.0.814
Hello everyone! Apologies for the delay in this installment of Security Fridays. There have been quite a few things going on. I was in New York for a conference, and then it was my best friend's wedding followed by more wedding invitations to attend. The weather has been glorious, and I hope you have been making the most of summer so far.Today, we're talking about the external attack surface of an organization.When it comes to securing an organization, a huge emphasis is placed on patching workstations, securing the internal network, segregating devices, and network traffic scanning, among other things. All of this takes place internally.However, what about your external-facing assets, systems, and interfaces? For example, think of it as a locked door that only allows certain traffic through. What if the door has a weakness? A pane of glass that has developed a hairline crack that can only be seen at the right angle. If you're not looking for it, you may not see it.To understand the ex
In this series of posts, I'll discuss cybersecurity and tools that can improve your cybersecurity posture. Usual caveats apply and at your own risk. This week, I wanted to start off by discussing Vulnerability Scanning. It is one of the best starting points when trying to determine the security status of the current environment. Vulnerability scanning is a critical tool for identifying potential security weaknesses in computer systems and networks. By scanning for vulnerabilities, potential areas of weakness can be identified and steps can be taken to prevent them from being exploited by hackers and other malicious actors. Another main advantage is that it can help stay ahead of the constantly evolving threat landscape and assist in remediation priorities. What is Vulnerability Scanning?In short, it is the process of using automated software tools to scan computers and networks for potential vulnerabilities. This is done by scanning for and detecting known vulnerabilities in software,
Hi Folks, Happy Friday!Just wanted to share some awesome content I came across that is published by Veeam and well worth a read:What Is Azure Security? Fundamentals & Key Concepts - https://www.veeam.com/blog/what-is-azure-security-fundamentals-key-concepts.html The Top 5 Benefits of Automating Your Cybersecurity Plan - https://www.veeam.com/blog/top-5-benefits-automating-cyber-security-plan.html Getting Started with Kubernetes Security: A Beginner’s Guide - https://www.veeam.com/blog/getting-started-kubernetes-security.html What Is Separation of Duties in Cybersecurity? - https://www.veeam.com/blog/separation-of-duties-cybersecurity.html Mastering YARA Rules: Malware Detection and Analysis - https://www.veeam.com/blog/yara-rules-malware-detection-analysis.html Top Threats in Microsoft 365 Security - Top Threats in Microsoft 365 Security (veeam.com)
LastPass have just announced a Security incident on their platform limited to their Development environment with apparently no compromise to user vaults.More here: https://blog.lastpass.com/2022/08/notice-of-recent-security-incident/
Hey folks, Here is a quick check for a Friday afternoon when it comes to your Veeam B&R installations. If you have installed Veeam B&R years and years ago and keep updating to the latest version of Veeam, have a look at the default Veeam generated Self-Signed certificate.This can be found under the Main Menu > Options > CertificateInspect the ‘Signature hash algorithm’ attribute and if it shows as ‘sha1’ it might be worth re-generating the certificate. If you have vulnerability scanners, it should pick this up.Even better, instead of using the Self-Signed Certificate, replace it with one signed by your Internal CA - https://helpcenter.veeam.com/docs/backup/vsphere/tls_internal_ca.html?ver=120To re-generate the certificate, some instructions can be found here - https://helpcenter.veeam.com/docs/backup/vsphere/self_signed_tls.html?ver=120Just bear in mind the following:IMPORTANTIf you update the TLS certificate used on the backup server, you must also update info about the
Already have an account? Login
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.
Sorry, our virus scanner detected that this file isn't safe to download.
