Patched your Ivanti Connect Secure box in October? Good. You're not done.
The people attacking these boxes found a way around the October fix. Ivanti has patched again.
What happened
Ivanti Connect Secure is the box many businesses use so staff can connect to the office network from home. It's a VPN, a private, protected connection into the office over the internet.
On October 13, Ivanti fixed a flaw that let attackers skip the login on these boxes. Security firm Volexity had caught attackers using it. The Register reported at the time that the attack actually used three flaws together, and Ivanti planned to fix the last one "in the coming weeks."
On October 29, Ivanti fixed the other two, according to The Stack. BleepingComputer reported on November 2 that attackers had been chaining all three since at least October 1. Volexity says the group used them to get full control of boxes that were fully patched at the time.
These were "zero-days." That just means attackers were using the flaws before Ivanti had a fix out.
What this means in plain English
Picture a building with three locked doors between the street and the server room. The attackers had a key for each. In October, Ivanti changed the lock on the first door. These new fixes change the other two.
The sneaky part is how they worked. Most attackers leave something behind, like a hidden back door program, so they can come back. This group didn't. BleepingComputer reports Volexity found no malware and no hidden web page left behind. They broke back in for every single command, then tampered with the logs to cover their tracks. That's why Ivanti's own checking tool, the Integrity Checker, didn't flag anything.
Once inside, The Stack reports they pulled saved passwords off the box, including the ones it uses to check staff logins against the office network. Then they used those to look around the rest of the network and test more passwords.
Why a small business should care
The remote access box sits on the edge of your network, facing the internet, with the keys to everything behind it. If someone controls it, they can see who logs in and grab the passwords it holds.
And a clean scan didn't mean clean here. That's the part that should bother you.
Remote access boxes are what small shops set up once and forget. Is yours on someone's list?
Who's affected
Per The Stack, which lists Ivanti's advisory:
Ivanti Connect Secure 25.1.1.2 and older, and 22.8R2.5 and older, are affected by the two new flaws.
Fixed versions are 25.1.1.3 and 22.8R2.6.
What to do: everyone
You probably won't touch this box yourself. But you can do this:
Find out if your business uses Ivanti Connect Secure for working from home.
If it does, ask whoever looks after it to confirm it's on one of the fixed versions above.
If you get an unexpected prompt to reset your work password, do it through the normal channel, not a link in an email.
What to do: if you run the business
Get the box updated to the latest version now, even if it was patched in October.
Don't accept "the scan came back clean" as proof of anything for this one.
If it was reachable from the internet in October, have it properly checked. Ivanti has a recovery guide for compromised boxes.
Change the passwords the box uses, especially the account it uses to check logins against your office network.
Make sure someone owns this box, with a name, and checks Ivanti's alerts.
Questions to ask your IT provider
What version is our Ivanti box on, and when was it last updated?
Since the Integrity Checker missed this, how did you check whether ours was broken into?
Have the passwords stored on the box been changed since October?
Should we be looking at a different way to give staff remote access?
Sources
BleepingComputer: Ivanti patches two more Connect Secure zero-days chained in attacks
The Stack: Ivanti patches two more CVEs amid highly unusual Connect Secure exploitation
The Register: Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks
Contact Nautalex to see how we can help you with securing remote access for your staff.
