Day: September 8, 2023

NEW YORK (NewsNation) — New York City Mayor Eric Adams says thousands of migrants are flocking to the city each month, putting a massive strain on city resources, and the crisis “will destroy” the city, as he reiterated his call for more state and federal help.

“We’re getting no support on this national crisis,” Adams  Adams said at a town hall Wednesday. “I don’t see an ending to this. This issue will destroy New York City.”

Meanwhile, New York’s Legal Aid Society and the Coalition for the Homeless called Adams’ remarks reckless and unproductive fear-mongering.

“This dangerous rhetoric is something you’d expect from fringe politicians on the far right of the political spectrum, not the mayor of a city that has always welcomed and celebrated its diverse and critically important immigrant community,” the organizations said in a joint statement.

Adams said more than 100,000 migrants have passed through New York City since April 2022. Currently, the city is caring for nearly 60,000 — placing the migrants at city-sponsored shelters, hotels and makeshift tent cities.

The migrants’ arrival has provoked angry protests in some communities.

“Every service in the city is going to be impacted,” Adams said. “We’re getting 10,000 migrants a month. One time we were just in Venezuela, now we getting Ecuador, now we getting Russian speaking coming through Mexico, now we’re getting Western Africa.”

Without federal funding, Adams says the crisis could cost the city $12 billion by 2025.

Some New Yorkers believe the crisis could have broader national consequences. Cities like Chicago, Washington, D.C., Los Angeles and Philadelphia are also taking in migrants, but New York City is the epicenter.

“I think it’s gonna destroy the country,” one New Yorker said. “I think everyone has to do it legally. That’s how other people did it and why should it make a difference for anyone else.”

Adams has asked President Joe Biden to sign a special order that would allow migrants to receive special work permits. He says with that authorization migrants would be able to get jobs, legally make money and not rely solely on city social services.

Adams said he hasn’t received a response from the White House.

U.S. CISA warned that nation-state actors are exploiting flaws in Fortinet FortiOS SSL-VPN and Zoho ManageEngine ServiceDesk Plus.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that nation-state actors are exploiting security vulnerabilities in Fortinet FortiOS SSL-VPN and Zoho ManageEngine ServiceDesk Plus.

The US agency has detected the presence of indicators of compromise (IOCs) at an Aeronautical Sector organization as early as January 2023.

The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and Cyber National Mission Force (CNMF) identified the presence of indicators of compromise (IOCs) at an Aeronautical Sector organization as early as January 2023.

The state-sponsored hackers exploited the CVE-2022-47966 RCE vulnerability in Zoho ManageEngine. The CVE-2022-47966 flaw is an unauthenticated remote code execution vulnerability that impacts multiple Zoho products with SAML SSO enabled in the ManageEngine setup. The issue also impacts products that had the feature enabled in the past. The vulnerability was addressed by the company on October 27th, 2022.

The root cause of the problem is that ManageEngine products use an outdated third-party dependency, Apache Santuario.

“This vulnerability allows an unauthenticated adversary to execute arbitrary code when the above SAML SSO criteria is met.” reads the advisory.

In January, Horizon3 researchers released last week a proof-of-concept (PoC) exploit for the CVE-2022-47966 along with technical analysis. The experts developed the PoC exploit by examining the differences between ServiceDesk Plus version 14003 and version 14004. 

“The vulnerability allows an attacker to gain remote code execution by issuing a HTTP POST request containing a malicious SAML response. This vulnerability is a result of  using an outdated version of Apache Santuario for XML signature validation.” reads the analysis. “One of the critical pieces is understanding that the information flow uses the client’s browser to relay all information between the Service Provider (SP) and the Identity Provider (IDP). In this attack, we send a request containing malicious SAML XML directly to the service provider’s Assertion Consumer (ACS) URL.”

The researchers tested their PoC exploit against Endpoint Central, however, they believe it can work on many of the ManageEngine products that share some of their codebase with ServiceDesk Plus or EndpointCentral.

“The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and Cyber National Mission Force (CNMF) identified the presence of indicators of compromise (IOCs) at an Aeronautical Sector organization as early as January 2023.” reads the alert published by the US CISA. “Analysts confirmed that nation-state advanced persistent threat (APT) actors exploited CVE-2022-47966 to gain unauthorized access to a public-facing application (Zoho ManageEngine ServiceDesk Plus), establish persistence, and move laterally through the network. This vulnerability allows for remote code execution on the ManageEngine application.”

The US CISA also reported that multiple APT groups were observed exploiting CVE-2022-42475 to establish a presence on the organization’s firewall device.

In December, Fortinet urged its customers to update their installs to address an actively exploited FortiOS SSL-VPN vulnerability, tracked as CVE-2022-42475, that could be exploited by an unauthenticated, remote attacker to execute arbitrary code on devices.

The CVE-2022-42475 flaw is a heap-based buffer overflow weakness that resides in FortiOS sslvpnd that allowed unauthenticated attackers to crash targeted devices remotely or gain remote code execution.

“A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.” reads the advisory published by the security vendor. “Fortinet is aware of an instance where this vulnerability was exploited in the wild,”

In the attack detailed in the CISA alert, as early as January 2023, APT actors exploited the vulnerability CVE-2022-47966 for initial access to the target organization. The attackers gained access to a web server hosting the public-facing application, Zoho ManageEngine ServiceDesk Plus.

Threat actors achieved root level access on the web server and created a local user account named ‘Azure’ with administrative privileges.

Then the nation-state actors downloaded malware, enumerated the network, collected administrative user credentials, and performed lateral movement. It is unclear if the attackers gained access to proprietary information or altered it.

“Additional APT actors exploited CVE-2022-42475 on the organization’s firewall device, which was indicated by multiple successful VPN connections from known-malicious IPs between February 1-16, 2023. It was identified that APT actors compromised and used disabled, legitimate administrative account credentials [T1078.003] from a previously hired contractor—of which the organization confirmed the user had been disabled prior to the observed activity.” continues the alert. “Analysis identified that a common behavior for these threat actors was to use disabled administrative account credentials and delete logs from several critical servers in the environment [T1070.001]. This prevented the ability to detect follow-on exploitation or data exfiltration. CISA and co-sealers were also unable to further track the activity due to the organization not having Network Address Translation (NAT) IP logging enabled.”

The attackers have initiated multiple Transport Layer Security (TLS)-encrypted sessions to multiple IP addresses, indicating successful exchanges of data transfer from the firewall device.

Nation-state actors disabled administrative account credentials to delete logs from several critical servers in the targeted network.

The attackers used a Meterpreter as an interactive shell that allowed them remotely control the system.

Between early-February and mid-March 2023, the government experts observed the presence of anydesk.exe on three hosts. The attackers compromised one host and moved laterally to install the executable on the remaining two.

The actors used the legitimate ConnectWise ScreenConnect client to download and utilize the credential dumping tool Mimikats.

The attackers also failed in attempting to to exploit the CVE-2021-44228 Apache Log4j vulnerability in the ServiceDesk system.

“Advance persistent threat actors often scan internet-facing devices for vulnerabilities that can be easily be exploited and will continue to do so.” concludes the alert published by US Cyber Command.

“CNMF and our interagency partners urge organizations to review this CSA and implement the recommended mitigation strategies, which include CISA’s cross-sector cybersecurity performance goals and NSA’s recommended best practices for securing remotely accessible software.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Fortinet FortiOS SSL-VPN)

The post Nation-state actors exploit Fortinet FortiOS SSL-VPN and Zoho ManageEngine ServiceDesk Plus, CISA warns appeared first on Security Affairs.

U.S. stock index futures were subdued on Friday as investors awaited a fresh inflation reading next week after recent economic data stoked worries interest rates could remain higher for longer.

Stronger-than-expected services activity data and a fall in weekly jobless claims have dented investor sentiment, dragging the S&P 500 (.SPX) and Nasdaq (.IXIC) 1.4% and 2% lower so far this week, respectively.

The Consumer Price Index reading for August is due on Sept. 13, while the Federal Reserve’s policy decision is scheduled for Sept. 20.

“While our base case is for no further hikes in this cycle, we expect economic uncertainty to keep equity markets volatile and range-bound in the coming months,” said Mark Haefele, chief investment officer at UBS Global Wealth Management.

Traders see a 93% chance of interest rates staying at current levels in September, while pricing in a 55.4% chance for a pause in rate hikes in the November meeting, according to CME FedWatch Tool.

Shares of Apple (AAPL.O) were flat in premarket trading after a two-day selloff following news that Beijing had ordered central government employees in recent weeks to stop using iPhones at workplaces.

Another report on Friday said China was expanding iPhone restrictions to local governments and state-owned companies.

Wall Street analysts see a small hit to Apple’s revenue this year from the curbs, with Morgan Stanley saying the worst case scenario was a 4% drop.

At 7:07 a.m. ET, Dow e-minis were down 30 points, or 0.09%, S&P 500 e-minis were down 4.25 points, or 0.1%, and Nasdaq 100 e-minis were down 22 points, or 0.14%.

Investors also digested mixed commentary from several Fed speakers on Thursday.

New York Fed President John Williams kept his options open over future interest rate policy and Dallas Fed President Lorie Logan said while it “could be appropriate” to skip a rate hike in the upcoming meeting, more policy tightening might be needed.

San Francisco Federal Reserve Bank President Mary Daly is due to speak later in the day.

Among individual stocks, Faraday Future Intelligent Electric (FFIE.O) jumped 9.0% before the bell. The electric-vehicle maker said there were efforts to spread misinformation about the company and manipulate market sentiment.

Adobe (ADBE.O) rose 1.8% after Mizuho upgraded the software firm to “buy” from “neutral”.

DocuSign (DOCU.O) added 3.1% as the e-Signature product provider beat second-quarter results estimates and raised its annual revenue forecast.

GameStop (GME.N) fell 2.3% on a report that the U.S. Securities and Exchange Commission was investigating the videogame retailer’s chairman, Ryan Cohen.

---

A Spanish prosecutor filed a complaint with the High Court against suspended soccer federation President Luis Rubiales for sexual assault and coercion over the allegedly unsolicited kiss on the lips of player Jenni Hermoso, the prosecutor’s office said on Friday.

Kolomoyskiy Arrest Seen As A ‘Key Test’ Of Zelenskiy’s Anti-Corruption Campaign  Radio Free Europe / Radio Liberty

According to an October 2022 Pew survey, “88% of US adults say that marijuana should be legal for medical and recreational use.” While marijuana legalization is gaining more and more cultural acceptance, effectively regulating drugs has long flummoxed policy and lawmakers. Some are even starting to have second thoughts, especially when it comes to how to practically enforce legal sales. In fact, voters in Oklahoma – one of the nation’s leading weed markets –overwhelmingly rejected recreational legalization earlier this year, even though voters backed medical marijuana legalization by a double-digit margin in 2018. Those who argue “Yes” for marijuana legalization say legalization creates more problems for our legal system because it requires extra enforcement to crack down on already robust illegal markets to make way for new, regulated, and legal markets. Additionally, competition from illegal weed markets is undercutting legal sales, which means the expected revenue stream from a legalized industry is far lower than expected. Those who argue “No” say legalization can reduce the burden on law enforcement and criminal justice systems, allowing resources to be redirected to more pressing issues. They also highlight marijuana’s medical benefits, such as for pain management and treatment of certain health conditions, which have made a difference in people’s lives. 

 

With this context, it’s time to debate — and reconsider — “Is Legalizing Marijuana A Mistake?” 

Arguing Yes: Paul J. Larkin, Jr, Senior Legal Research Fellow in the Meese Center for Legal and Judicial Studies at the Heritage Foundation and Teresa Haley, senior policy advisor at the Foundation for Drug Policy Solution   

Arguing No: Toi Hutchinson, CEO of the Marijuana Policy Project; former member of the Illinois Senate, and Cat Packer, Director of Drug Markets and Legal Regulation at Drug Policy Alliance  

Emmy award-winning journalist John Donvan moderates

Learn more about your ad choices. Visit podcastchoices.com/adchoices

Zelensky awarded Budanov the rank of Lieutenant General  Odessa Journal

MOSCOW (Reuters) – The U.S. Central Intelligence Agency, which is trying to recruit more Russians as spies, has released a video targeting Moscow officials with an appeal to tell the truth about a system it said is riddled with lying sycophants.

CIA Director William Burns said in July that disaffection among some Russians over the war in Ukraine was creating a rare opportunity to recruit spies, and that the CIA was not letting it pass.

The agency released the video in Russian entitled “Why I made contact with the CIA – for myself” on social media which shows what is clearly supposed to be a Russian official walking through the snow of what looks like a Russian city.

“I insisted to everyone that it was unscrupulous to distort the truth in reports but those who rose through the ranks were those who did that very thing,” the voice over says in Russian.

“Before I believed that the truth had some value,” the video shows as the actor playing a Russian official enters a Russian government building and shows his pass above the double-headed eagle of Russia.

“Those around you may not want to hear the truth. But we do,” the video says before detailing ways to contact the CIA, which is based in Langley, Virginia. “Integrity has rewards.”

After major failures over the 9/11 attacks and the U.S. war in Iraq, U.S. and British spy agencies claimed an intelligence victory over the Russian invasion of Ukraine by warning of the Kremlin’s plans way in advance.

Moscow is so difficult for Western spies to operate in that they developed “Moscow Rules” in Soviet times to guard against complacency. It has been updated for modern Russia.

Russia accuses Britain and the United States of supporting Ukraine in an attempt to cleave Russia apart and grab its natural resources – assertions Washington and London deny.

Putin, a former KGB spy who served in what used to be East Germany, has restored some of the clout of the once-mighty Soviet intelligence agencies though the CIA says the Kremlin chief was poorly informed about the real situation in Ukraine ahead of his decision to invade.

A selection from what European papers are saying.