Podcast Covers VMware Exploitation, a Telnet Flaw and Breach Claims

Summary

The hosts discuss CISA’s directive to patch actively exploited CVE-2024-37079 in VMware vCenter Server, claimed Nike data theft, a longstanding Telnet authentication bypass, and Shiny Hunters’ voice-phishing claims tied to data leaks.

Key points

The hosts say CISA directed federal agencies to patch CVE-2024-37079 within three weeks, describing active exploitation and remote code execution through a heap overflow in vCenter Server’s DCER RPC implementation.
They say the VMware flaw requires no privileges or user interaction and has no workaround; they advise keeping management interfaces off the public internet and accessing them through a VPN.
World Leaks claimed to have stolen about 1.4 terabytes of Nike internal data. Nike had not confirmed either a breach or the alleged data theft.
The hosts report that the Everest ransomware group exposed data belonging to 72.7 million Under Armour users.
The discussion describes a Telnet daemon authentication bypass in which client-supplied environment variables can be used to request root access. The flaw was said to have existed for more than 11 years, and the package creator reportedly recommended uninstalling Telnet.
Shiny Hunters claimed responsibility for a voice-phishing campaign targeting Octa credentials. The hosts linked it to breaches at Crunchbass and Betterment and leaked SoundCloud data; Google and Microsoft had not confirmed impact on their services or customers.

Article Details

Topics: [03:16] CISA directive and active exploitation of a VMware vCenter Server vulnerability
[07:13] World Leaks’ claim of Nike data theft
[08:44] Reported Everest ransomware-group data exposure at Under Armour
[10:10] Longstanding Telnet daemon authentication bypass and removal advice
[13:52] Shiny Hunters’ voice-phishing claim and associated data leaks