Red Hat Security Advisory 2024-8338-03 - An update for NetworkManager-libreswan is now available for Red Hat Enterprise Linux 7.7 Advanced Update Support. Issues addressed include a privilege escalation vulnerability.

    The following advisory data is extracted from:https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8338.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: NetworkManager-libreswan security updateAdvisory ID:        RHSA-2024:8338-03Product:            Red Hat Enterprise LinuxAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:8338Issue date:         2024-10-23Revision:           03CVE Names:          CVE-2024-9050====================================================================Summary: An update for NetworkManager-libreswan is now available for Red Hat Enterprise Linux 7.7 Advanced Update Support.Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:This package contains software for integrating the libreswan VPN software with NetworkManager and the GNOME desktopSecurity Fix(es):* NetworkManager-libreswan: Local privilege escalation via leftupdown (CVE-2024-9050)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-9050References:https://access.redhat.com/security/updates/classification/#importanthttps://bugzilla.redhat.com/show_bug.cgi?id=2313828

Red Hat Security Advisory 2024-8338-03

Red Hat Security Advisory 2024-8329-03 - An update is now available for the Red Hat build of Cryostat 3 on RHEL 8.

    The following advisory data is extracted from:https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8329.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: Red Hat build of Cryostat security updateAdvisory ID:        RHSA-2024:8329-03Product:            CryostatAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:8329Issue date:         2024-10-23Revision:           03CVE Names:          CVE-2024-34155====================================================================Summary: An update is now available for the Red Hat build of Cryostat 3 on RHEL 8.Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:An update is now available for the Red Hat build of Cryostat 3 on RHEL 8.Security Fix(es):* golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)* golang: Calling Parse on a \"// +build\" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)* golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155)* com.graphql-java/graphql-java: Allocation of Resources Without Limits or Throttling in GraphQL Java (CVE-2024-40094)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-34155References:https://access.redhat.com/security/updates/classification/#importanthttps://bugzilla.redhat.com/show_bug.cgi?id=2301456https://bugzilla.redhat.com/show_bug.cgi?id=2310527https://bugzilla.redhat.com/show_bug.cgi?id=2310528https://bugzilla.redhat.com/show_bug.cgi?id=2310529

Red Hat Security Advisory 2024-8329-03

Red Hat Security Advisory 2024-8327-03 - An update for grafana is now available for Red Hat Enterprise Linux 8. Issues addressed include a cross site scripting vulnerability.

    The following advisory data is extracted from:https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8327.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: grafana security updateAdvisory ID:        RHSA-2024:8327-03Product:            Red Hat Enterprise LinuxAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:8327Issue date:         2024-10-22Revision:           03CVE Names:          CVE-2024-9355====================================================================Summary: An update for grafana is now available for Red Hat Enterprise Linux 8.Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es):* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)* dompurify: nesting-based mutation XSS vulnerability (CVE-2024-47875)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-9355References:https://access.redhat.com/security/updates/classification/#importanthttps://bugzilla.redhat.com/show_bug.cgi?id=2315719https://bugzilla.redhat.com/show_bug.cgi?id=2318052

Red Hat Security Advisory 2024-8327-03

Red Hat Security Advisory 2024-8312-03 - An update for NetworkManager-libreswan is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Issues addressed include a privilege escalation vulnerability.

    The following advisory data is extracted from:https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8312.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: NetworkManager-libreswan security updateAdvisory ID:        RHSA-2024:8312-03Product:            Red Hat Enterprise LinuxAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:8312Issue date:         2024-10-23Revision:           03CVE Names:          CVE-2024-9050====================================================================Summary: An update for NetworkManager-libreswan is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions.Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:This package contains software for integrating the libreswan VPN softwarewith NetworkManager and the GNOME desktopSecurity Fix(es):* NetworkManager-libreswan: Local privilege escalation via leftupdown (CVE-2024-9050)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-9050References:https://access.redhat.com/security/updates/classification/#importanthttps://bugzilla.redhat.com/show_bug.cgi?id=2313828

Red Hat Security Advisory 2024-8312-03

Red Hat Security Advisory 2024-8232-03 - Red Hat OpenShift Container Platform release 4.17.2 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include a denial of service vulnerability.

The following advisory data is extracted from:

https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8232.json

Red Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff

====================================================================  
Red Hat Security Advisory

Synopsis:           Important: OpenShift Container Platform 4.17.2 packages and security update  
Advisory ID:        RHSA-2024:8232-03  
Product:            Red Hat OpenShift Enterprise  
Advisory URL:       https://access.redhat.com/errata/RHSA-2024:8232  
Issue date:         2024-10-23  
Revision:           03  
CVE Names:          CVE-2024-5569  
====================================================================

Summary: 

Red Hat OpenShift Container Platform release 4.17.2 is now available with updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container Platform 4.17.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.17.2. See the following advisory for the container images for this release:

https://access.redhat.com/errata/RHSA-2024:8229

Security Fix(es):

* encoding/gob: golang: Calling Decoder.Decode on a message which contains  
deeply nested structures can cause a panic due to stack exhaustion  
(CVE-2024-34156)  
* github.com/jaraco/zipp: Denial of Service (infinite loop) via crafted zip  
file in jaraco/zipp (CVE-2024-5569)  
* go/parser: golang: Calling any of the Parse functions containing deeply  
nested literals can cause a panic/stack exhaustion (CVE-2024-34155)  
* go/build/constraint: golang: Calling Parse on a \"// +build\" build tag  
line with deeply nested expressions can cause a panic due to stack  
exhaustion (CVE-2024-34158)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.17/updating/updating_a_cluster/updating-cluster-cli.html

Solution:

https://docs.openshift.com/container-platform/4.17/release_notes/ocp-4-17-release-notes.html

CVEs:

CVE-2024-5569

References:

https://access.redhat.com/security/updates/classification/#important  
https://bugzilla.redhat.com/show_bug.cgi?id=2296413  
https://bugzilla.redhat.com/show_bug.cgi?id=2310527  
https://bugzilla.redhat.com/show_bug.cgi?id=2310528  
https://bugzilla.redhat.com/show_bug.cgi?id=2310529

Red Hat Security Advisory 2024-8232-03

Red Hat Security Advisory 2024-8229-03 - Red Hat OpenShift Container Platform release 4.17.2 is now available with updates to packages and images that fix several bugs and add enhancements.

The following advisory data is extracted from:

https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8229.json

Red Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff

====================================================================  
Red Hat Security Advisory

Synopsis:           Important: OpenShift Container Platform 4.17.2 bug fix and security update  
Advisory ID:        RHSA-2024:8229-03  
Product:            Red Hat OpenShift Enterprise  
Advisory URL:       https://access.redhat.com/errata/RHSA-2024:8229  
Issue date:         2024-10-23  
Revision:           03  
CVE Names:          CVE-2024-28180  
====================================================================

Summary: 

Red Hat OpenShift Container Platform release 4.17.2 is now available with updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container Platform 4.17.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing  
Kubernetes application platform solution designed for on-premise or private  
cloud deployments.  
Security Fix(es):

* encoding/gob: golang: Calling Decoder.Decode on a message which contains  
deeply nested structures can cause a panic due to stack exhaustion  
(CVE-2024-34156)  
* jose-go: improper handling of highly compressed data (CVE-2024-28180)  
* go/parser: golang: Calling any of the Parse functions containing deeply  
nested literals can cause a panic/stack exhaustion (CVE-2024-34155)  
* go/build/constraint: golang: Calling Parse on a \"// +build\" build tag  
line with deeply nested expressions can cause a panic due to stack  
exhaustion (CVE-2024-34158)  
* openstack-ironic: Lack of checksum validation on images (CVE-2024-47211)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s)  
listed in the References section.

Solution:

CVEs:

CVE-2024-28180

References:

https://access.redhat.com/security/updates/classification/#important  
https://bugzilla.redhat.com/show_bug.cgi?id=2268854  
https://bugzilla.redhat.com/show_bug.cgi?id=2310527  
https://bugzilla.redhat.com/show_bug.cgi?id=2310528  
https://bugzilla.redhat.com/show_bug.cgi?id=2310529  
https://bugzilla.redhat.com/show_bug.cgi?id=2315010  
https://issues.redhat.com/browse/OCPBUGS-36453  
https://issues.redhat.com/browse/OCPBUGS-38116  
https://issues.redhat.com/browse/OCPBUGS-41552  
https://issues.redhat.com/browse/OCPBUGS-42176  
https://issues.redhat.com/browse/OCPBUGS-42349  
https://issues.redhat.com/browse/OCPBUGS-42607  
https://issues.redhat.com/browse/OCPBUGS-42716  
https://issues.redhat.com/browse/OCPBUGS-42784  
https://issues.redhat.com/browse/OCPBUGS-42803  
https://issues.redhat.com/browse/OCPBUGS-42806  
https://issues.redhat.com/browse/OCPBUGS-42839  
https://issues.redhat.com/browse/OCPBUGS-42842  
https://issues.redhat.com/browse/OCPBUGS-42953  
https://issues.redhat.com/browse/OCPBUGS-42954  
https://issues.redhat.com/browse/OCPBUGS-42958  
https://issues.redhat.com/browse/OCPBUGS-42974  
https://issues.redhat.com/browse/OCPBUGS-42996  
https://issues.redhat.com/browse/OCPBUGS-42997  
https://issues.redhat.com/browse/OCPBUGS-43009  
https://issues.redhat.com/browse/OCPBUGS-43051  
https://issues.redhat.com/browse/OCPBUGS-43069  
https://issues.redhat.com/browse/OCPBUGS-43112  
https://issues.redhat.com/browse/OCPBUGS-43227  
https://issues.redhat.com/browse/OCPBUGS-43312  
https://issues.redhat.com/browse/OCPBUGS-43321

Red Hat Security Advisory 2024-8229-03

Red Hat Security Advisory 2024-8228-03 - Red Hat OpenShift Container Platform release 4.17.2 is now available with updates to packages and images that fix several bugs.

The following advisory data is extracted from:

https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8228.json

Red Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff

====================================================================  
Red Hat Security Advisory

Synopsis:           Low: OpenShift Container Platform 4.17.2 security and extras update  
Advisory ID:        RHSA-2024:8228-03  
Product:            Red Hat OpenShift Enterprise  
Advisory URL:       https://access.redhat.com/errata/RHSA-2024:8228  
Issue date:         2024-10-22  
Revision:           03  
CVE Names:          CVE-2023-37920  
====================================================================

Summary: 

Red Hat OpenShift Container Platform release 4.17.2 is now available with updates to packages and images that fix several bugs.

This release includes a security update for Red Hat OpenShift Container Platform 4.17.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.17.2. See the following advisory for the container images for this release:

https://access.redhat.com/errata/RHSA-2024:8229

Security Fix(es):

* python-certifi: Removal of e-Tugra root certificate (CVE-2023-37920)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.17/updating/updating_a_cluster/updating-cluster-cli.html

Solution:

https://docs.openshift.com/container-platform/4.17/release_notes/ocp-4-17-release-notes.html

CVEs:

CVE-2023-37920

References:

https://access.redhat.com/security/updates/classification/#low  
https://bugzilla.redhat.com/show_bug.cgi?id=2226586

Red Hat Security Advisory 2024-8228-03

Red Hat Security Advisory 2024-6341-03 - Kube Descheduler Operator for Red Hat OpenShift 5.1.0 for RHEL 9. Issues addressed include a denial of service vulnerability.

The following advisory data is extracted from:

https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6341.json

Red Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff

====================================================================  
Red Hat Security Advisory

Synopsis:           Moderate: Kube Descheduler Operator for Red Hat OpenShift 5.1.0 for RHEL 9  
Advisory ID:        RHSA-2024:6341-03  
Product:            Kube Descheduler Operator  
Advisory URL:       https://access.redhat.com/errata/RHSA-2024:6341  
Issue date:         2024-10-23  
Revision:           03  
CVE Names:          CVE-2024-24788  
====================================================================

Summary: 

Kube Descheduler Operator for Red Hat OpenShift 5.1.0 for RHEL 9

Description:

The Kube Descheduler Operator for Red Hat OpenShift is an optional  
operator that deploys the descheduler, which is responsible for  
evicting pods based on certain strategies.

Security Fix(es):

* golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)  
* golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)  
* net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

Solution:

CVEs:

CVE-2024-24788

References:

https://access.redhat.com/security/updates/classification/#moderate  
https://bugzilla.redhat.com/show_bug.cgi?id=2279814  
https://bugzilla.redhat.com/show_bug.cgi?id=2292787  
https://bugzilla.redhat.com/show_bug.cgi?id=2295310  
https://issues.redhat.com/browse/OCPBUGS-11891  
https://issues.redhat.com/browse/OCPBUGS-41860

Red Hat Security Advisory 2024-6341-03

The longer we avoid reform, the further behind we'll fall in AI innovation — and the more vulnerable we'll be.

Stephen Kines, Chief Operations Officer, Goldilock

October 23, 2024

5 Min Read

Source: Jochen Tack via Alamy Stock Photo

COMMENTARY

Artificial intelligence (AI) technology has become virtually inescapable, and its growth has kickstarted a worldwide AI arms race. But where the US was once at the forefront, it's quickly losing ground to countries like China, because its energy grid cannot support the breakneck pace of innovation. To remain a global AI leader, the federal government needs to make the grid more secure and resilient by addressing three compounding issues. 

**Growing Energy Demands**

First, data center electricity consumption is expected to triple, from 2.5% of the US total in 2022 to 7.5% by 2030. That's equivalent to the energy consumption of one-third of all US homes. We need to squeeze more power generation out of the energy grid, or it won't be able to meet the demand of AI. At the same time, the US must show the world that this can be done sustainably as it continues working toward its net-zero goals. 

Acknowledging this necessity, executives from OpenAI, Nvidia, Anthropic, and Google met at the White House recently for a Roundtable on US Leadership in AI Infrastructure. Following the gathering, the administration announced several new actions to accelerate public-private collaboration, including plans to launch a new Task Force on AI Data Center Infrastructure to coordinate policy across government. 

Time will tell if these efforts help achieve the energy usage and data center capacity required by AI. In the meantime, there are other challenges to consider.

**Utilities Are the New Frontlines of the Cyber War**

Countries like Russia, China, and Iran have a long history of infiltrating US businesses to steal proprietary technology and data. Today, critical infrastructure has become a primary target for cyberattacks by nation-states engaged in geopolitical conflict, and the impact this can have on the ability of the US to prevail in the AI arms race is huge.  

I've seen the chaos critical infrastructure attacks can cause firsthand through my participation in NATO's Defense Innovation Accelerator for the North Atlantic (DIANA), which is aiming to "provide companies with the resources, networks, and guidance to develop deep technologies to solve critical defense and security challenges." Energy is at the top of its agenda and was highlighted as one of three challenges in 2023. 

Rogan Shimmin, challenge manager at DIANA, calls attention to the fact that "these threats are compounded by a significant lack of cyber literacy in the energy sector, which is leading to continued investment in insecure legacy infrastructure and is scaring industry players away from adopting proper security measures." 

**Growing Threat of Climate Change and Severe Weather**

Malicious actors and adversaries aren't the only players who can compromise networks. Severe weather and the heightened energy demand that often results during these instances can also take down networks, as we saw during the 2021 Texas grid collapse. Plus, there's the ongoing possibility of another solar flare knocking out grids, like this year's auroral storms. 

If we continue with business as usual, our energy grids will remain vulnerable to both physical and cyberattacks at any time. As we saw with SolarWinds and the Colonial Pipeline attack, the damage can be catastrophic, not just impacting energy supply but putting the US's position on the world stage at risk. 

**Assessing Recent Federal Efforts for Energy Resiliency**

Fortunately, the federal government recognizes that energy resilience is a priority and has taken measures to support this. Announced in May, the Federal Energy Regulatory Commission's (FERC's) Order No. 1920 outlines a smart grid approach that's a crucial step in addressing long-term transmission planning needs. However, its passage has been hamstrung by political debate in an election year when action is urgently needed.  

In the same vein, the White House launched a Federal-State Modern Grid Deployment Initiative with commitments from 21 leading states. The goal is to bring states together with federal entities and power sector stakeholders in support of modern grid technologies to enable next-level capacity and throughput. The initiative was launched in tandem with the US Climate Alliance's announcement of "policy, technical, and analytical assistance to help participating members advance state-level efforts to carry out these commitments." 

**Is This Enough? Not Really**

These regulations and state-by-state initiatives are a step in the right direction, but they fall short. As the Modern Grid Deployment Initiative alludes, the US must address its energy demands through a level of smart controls, mainly via dynamic line rating (DLR) systems using intelligent sensors and more widely geographically distributed networks. This technology is fundamental to getting more out of networks, and it should be applied to water and other core sectors as well. However, it requires crossing state lines, which is a political hot potato.  

The US must also reduce its attack surface. While DLR and other modern grid technologies can be revolutionary, they exponentially increase the threat of cyberattacks and create new vectors for malicious actors. We have to develop these technologies with a security-first mindset to give utilities a way to stop attacks in their tracks before they can spread, and get back online quickly through better backup and disaster recovery solutions.  

James Appathurai, acting assistant secretary general for innovation, hybrid, and cyber at NATO, argues the ability to disconnect is one of the main security lessons from the Russia-Ukraine war. Upon Russia's first invasion, Ukraine prioritized improving its cyber resilience by building in air gaps through physical network segmentation so its critical infrastructure could be disconnected from the Internet at critical moments. "\[The Internet of Things\] is great, connecting to the Internet for efficiency is great, but you absolutely must build in the worst-case scenario. Being able to run if you are cyberattacked — to air gap, to run on island mode — is very important." 

The federal government needs to acknowledge this urgency and implement regulations that will ensure a more resilient and secure electrical grid. We must push past the partisan divide, as the longer we avoid reform, the further behind we'll fall in AI innovation, and the more vulnerable we'll be. 

**About the Author**

Chief Operations Officer, Goldilock

Stephen Kines is the chief operations officer (COO) and co-founder of Goldilock. He served in the Canadian military and currently represents Goldilock in NATO on the DIANA program. Stephen is also an international corporate lawyer who has been a general counsel for international law firms, as well as ultra-high net worth individuals and families. His expertise is in technology transactions with a positive-ESG impact.

The US Needs a Better Energy Grid to Win the AI Arms Race

Despite a law enforcement sweep last May, the sophisticated downloader malware is re-emerging.

Source: Antony Cooper via Alamy Stock Photo

Just a few months after Europol launched a full-scale disruption effort against malware botnets, one of its primary targets — a downloader malware called Bumblebee — seems to have staged a revival.

The sophisticated piece of malware has been widely used by cybercriminals to break into corporate networks, and its effectiveness is precisely what drew law enforcement's attention. In May, Europol launched full-scale takedowns of a variety of botnets, including IcedID, Trickbot, Smokeloader, SystemBC and Pickabot, as well as Bumblebee. The multipronged effort, dubbed Operation Endgame, was a splashy and highly publicized action to hunt down and stop cybercriminals hiding in their jurisdiction.

In addition to May's botnet bust-up, Operation Endgame added eight Russian nationals to Europe's list of most wanted fugitives for their alleged roles as developers of the Emotet botnet. By mid-June, Operation Endgame made an arrest: a 28-year-old Ukrainian man accused of working as a developer for Russian ransomware groups Conti and LockBit.

**Bumblebee Takes Flight Again**

The botnet was first identified and named by the Google Threat Analysis Group in March 2022. Since its takedown in May, there hadn't been any sign of Bumblebee, until now. Researchers at Netskope found a new instance of Bumblebee being used in combination with a payload not typically associated with the botnet, indicating this is a new iteration of the malware downloader.

Related:Dark Reading News Desk Live From Black Hat USA 2024

"The infection chain used to deliver the final payload is not new, but this is the first time we have seen it being used by Bumblebee," the Netskope researchers wrote in a recent blog post. "These activities might indicate the resurfacing of Bumblebee in the threat landscape."

Its re-emergence would hardly come as a surprise. Other valuable botnet strains like Emotet have likewise risen from the dead. Though disrupted for a time by law enforcement in 2021, Emotet returned with a vengeance and new functionality.

Bumblebee is known for spreading through a variety of methods, including phishing, malicious advertising, and SEO poisoning, explains Patrick Tiquet, vice president of security and architecture for Keeper Security.

And Bumblebee's latest attack chain is even more difficult for defenders to spot than previous versions, according to Tamir Passi, senior product director at DoControl. "What makes this version particularly concerning is its sophistication," Passi says. "Instead of the noisy, obvious attacks we've seen before, it's using a stealthier approach that makes it harder to detect. The attackers are leveraging legitimate tools like MSI installers — it's basically hiding in plain sight."

Related:Anti-Bot Services Help Cybercrooks Bypass Google 'Red Page'

Scarier still is what happens after Bumblebee gets inside a corporate network, he adds.

"But here's the real kicker — this isn't just about compromising individual machines," Passi says. "Once attackers gain access, they can potentially harvest credentials and access all sorts of corporate resources, including SaaS applications. Think about it — one successful phishing email could lead to widespread access across your entire cloud environment."

With stakes that high, cybersecurity teams need to rely on a healthy combination of user awareness training, a zero-trust cybersecurity model, strong password security, and more, Tiquet advises.

Law enforcement organizations will continue to do what they can to tamp down the effectiveness of large cybercrime operations, but along with enterprise cybersecurity teams, they are up against formidable, highly motivated adversaries.

"The re-emergence of Bumblebee after Operation Endgame demonstrates the adaptability of the group believed to be responsible for its development," says Callie Guenther, senior manager of cyber-threat research at Critical Start. "Despite law enforcement efforts to disrupt their activities, the actors quickly reintroduced Bumblebee, indicating well-prepared contingency plans."

Related:Anonymous Sudan Unmasked as Leader Faces Life in Prison

Latest News