Cyber Brief
Security news, explained for CS students
Twelve real incidents, newest first. Each brief covers what happened, how it worked, and the lesson you can apply to your own code. Every brief links to its official vulnerability record.
July 2024 · OpenSSH · CVE-2024-6387
regreSSHion: an old bug comes back
Researchers at Qualys found a race condition in the OpenSSH server on glibc-based Linux. If a client failed to log in before the timeout, a signal handler ran code that was not safe to run inside a signal handler. With enough attempts, an attacker could get remote code execution as root without logging in.
The bug was a regression: a fix for a similar 2006 issue (CVE-2006-5051) had been accidentally undone by a later code change.
Lesson: when you fix a bug, add a test that fails if the bug ever returns. Regression tests exist for exactly this.
March 2024 · xz Utils · CVE-2024-3094
The xz backdoor: a two-year supply chain attack
A contributor using the name "Jia Tan" spent about two years earning trust as a maintainer of xz, a compression library used by many Linux systems. Versions 5.6.0 and 5.6.1 shipped with a hidden backdoor in the release tarballs, aimed at the SSH server on some distributions.
It was caught before reaching most stable releases because an engineer, Andres Freund, noticed SSH logins taking about half a second longer than usual and dug into why.
Lesson: your project trusts every dependency and every maintainer behind it. And when something is oddly slow, curiosity is a security skill.
January 2024 · Ivanti Connect Secure · CVE-2023-46805 and CVE-2024-21887
Ivanti Connect Secure: two bugs make one break-in
Ivanti Connect Secure is a VPN appliance that many organisations use to let staff into their networks. Attackers chained two flaws: an authentication bypass in its web component, and a command injection bug that only logged-in administrators should have been able to reach. Together, they let an attacker with no password run commands on the device.
Exploitation started before a fix existed, and the US Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive 24-01 ordering federal agencies to act.
Lesson: "only admins can reach that code" is not a security control on its own. Validate input everywhere, because one bug can remove the wall you were relying on to stop another.
October 2023 · Citrix NetScaler · CVE-2023-4966
Citrix Bleed: stolen sessions outlive the patch
A buffer over-read in Citrix NetScaler ADC and Gateway devices let attackers read memory that contained valid session tokens. With a stolen token, an attacker could take over a user's logged-in session, skipping the password and multi-factor authentication entirely. Ransomware groups used it against many organisations.
Patching closed the hole, but sessions already stolen kept working, so the advice was to patch and end every active session.
Lesson: a session token is as good as a password. Give them expiry times, make them revocable, and think about what an attacker already has when you fix a bug.
May 2023 · MOVEit Transfer · CVE-2023-34362
MOVEit: SQL injection at scale
MOVEit Transfer is file-transfer software used by many companies and governments. The Cl0p ransomware group exploited a SQL injection flaw in its web application to steal files from a large number of organisations before a patch was available.
SQL injection has been understood for over twenty years, yet it still turns up in commercial products.
Lesson: never build SQL by gluing strings together. Use parameterised queries, for example cur.execute("SELECT * FROM users WHERE id = ?", (user_id,)).
December 2021 · Apache Log4j · CVE-2021-44228
Log4Shell: when logging runs code
Log4j 2, a very widely used Java logging library, supported "lookups": special text like ${jndi:ldap://...} inside a log message would be interpreted, not just written down. If an attacker could get that text logged (in a username, a chat message or an HTTP header), the server could fetch and run the attacker's code.
Because Log4j was buried deep in so many dependency trees, many teams first had to work out whether they used it at all.
Lesson: treat all user input as data, never as instructions. And know what is in your dependency tree; tools that generate a software bill of materials (SBOM) help.
January 2021 · sudo · CVE-2021-3156
Baron Samedit: a ten-year-old bug in sudo
Researchers at Qualys found a heap buffer overflow in sudo, the Unix tool that lets permitted users run commands as root. A mistake in how it handled backslashes in command-line arguments meant any local user, even one not allowed to use sudo at all, could become root. The bug had been in the code since 2011.
Lesson: code that runs with high privileges deserves the most careful review, and age is not proof of safety. Manual memory handling in C is a common source of this kind of bug, which is one reason memory-safe languages are gaining ground in systems code.
January 2018 · Modern CPUs · CVE-2017-5753
Spectre: when the processor guesses ahead
To run faster, modern processors guess which way a program will go and start running instructions early ("speculative execution"). If the guess is wrong, the results are thrown away, but traces stay behind in the CPU cache. Spectre showed that a program could trick the processor into speculatively reading secret data, then recover it by timing how fast memory accesses were.
It affected processors from several major manufacturers, and fixes needed changes to operating systems, browsers and compilers, some at a cost in speed.
Lesson: abstractions leak. Code can be logically correct and still reveal secrets through timing. It is why security-sensitive code, like password comparison, should take the same time whatever the input.
2017 · Apache Struts · CVE-2017-5638
Equifax: the patch that was not applied
A remote code execution flaw in the Apache Struts web framework was disclosed and patched in March 2017. Equifax had not updated a public-facing system, and attackers used the flaw to access personal data of roughly 147 million people.
Lesson: a fix only protects you once it is deployed. Keeping dependencies updated is unglamorous, important work; tools like Dependabot make it easier.
May 2017 · Windows SMBv1 · CVE-2017-0144
WannaCry: a worm with a kill switch
WannaCry ransomware spread on its own between Windows machines using the EternalBlue exploit for the old SMBv1 file-sharing protocol. Microsoft had released a patch (MS17-010) two months earlier, but many systems, including parts of the UK's National Health Service, were not updated.
Its spread slowed when a researcher registered a domain name the malware checked before running, which acted as an accidental kill switch.
Lesson: turn off old protocols you do not need, and read malware the way you would read any program. Its logic can contain its own off switch.
September 2014 · GNU Bash · CVE-2014-6271
Shellshock: code hidden in environment variables
Bash could import function definitions from environment variables, but it kept executing any commands placed after the function body. Web servers running CGI scripts copied HTTP headers into environment variables, so a crafted header could run commands on the server.
Lesson: parsers are an attack surface. Anything that reads untrusted text needs to stop exactly where the valid input ends.
April 2014 · OpenSSL · CVE-2014-0160
Heartbleed: trusting a length field
OpenSSL's TLS "heartbeat" feature let one side send a message and its length, and the other side echoed it back. OpenSSL trusted the stated length without checking it against the real message, so a request claiming to be large returned up to 64 KB of whatever sat next to it in the server's memory, including private keys and passwords.
Lesson: never trust a length, index or size that came from outside your program. Check bounds, or use memory-safe languages and APIs that check them for you.