BeyondTrust patches Remote Support zero-day exploited since August

[Niamh]

BeyondTrust has urged customers to patch an actively exploited authentication bypass in its Remote Support product. BleepingComputer's Sergiu Gatlan reports that the flaw affects Remote Support version 26.2.3 and earlier. It lets unauthenticated remote attackers perform file operations on unpatched appliances

Cloud customers were patched on 8 October. Self hosted customers who do not have automatic updates switched on need to patch manually, and quickly. The Shadowserver Foundation sees more than 1,400 internet exposed instances

Mandiant believes a China linked espionage group has been exploiting the flaw since late August. The attackers deployed a web shell and a tunnelling tool, gained root access, wiped logs and moved sideways into other systems. Mandiant says any appliance that was reachable and vulnerable during that period should be treated as potentially compromised

BeyondTrust has more than 20,000 customers, including 75 percent of the Fortune 100. That makes its products an attractive target. Earlier BeyondTrust flaws were used in an attack on the US Treasury, so this is not the first time its remote support tools have been in the spotlight

Remote support tools are powerful by design, because they let technicians access other computers. That same power makes them a prize for attackers. Organisations using BeyondTrust should patch now and look carefully for signs of compromise going back to August

Should remote access tools face stricter security requirements? And how does your organisation monitor tools like this?

BeyondTrust patches zero-day exploited in attacks since Augustwww.bleepingcomputer.com