Connect with us

Cars

Cisco’s warning: Patch now, critical SSH flaw affects Nexus 9000 fabric switches

Published

on

Cisco: DNS attacks will undermine trust in the internet
Sophisticated hacking group taps wide set of vulnerabilities as part of their global hacking spree.

Cisco has revealed that its Nexus 9000 fabric switches have a critical flaw that could allow anyone to remotely connect to a vulnerable device using Secure Shell (SSH) and control it with root user privileges.

The company disclosed the bug on Tuesday and has given it a severity rating of 9.8 out of 10. 

The issue stems from SSH key management in the Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software. Cisco mistakenly put a default SSH key pair in the devices that an attacker could grab by connecting to the device over IPv6.

“An attacker could exploit this vulnerability by opening an SSH connection via IPv6 to a targeted device using the extracted key materials. An exploit could allow the attacker to access the system with the privileges of the root user,” Cisco explains, noting it can’t be exploited over IPv4.  

SEE: 10 tips for new cybersecurity pros (free PDF)

The bug was found by external security researcher Oliver Matula from ERNW Enno Rey Netzwerke. 

There are no workarounds, so Cisco is encouraging customers to update the software. 

The bug affects the 9000 Series Fabric Switches in ACI mode if it is running Cisco NX-OS Software release before 14.1(1i).  

Cisco has fixes available for several other vulnerabilities acting the Nexus 9000 software, all of which affect systems running Cisco NX-OS Software release prior to 14.1(1i)  

ERNW’s Matula also reported a medium-severity path traversal flaw in the Nexus 9000 ACI mode software that would allow a local attacker with valid credentials to use ‘symbolic links’ to overwrite potentially sensitive system files.   

Another fix in Cisco NX-OS Software 14.1(1i) is a high-severity elevation of privilege flaw that allowed a local attacker with valid admin credentials for a device to execute arbitrary NX-OS commands as the root user. 

“The vulnerability is due to overly permissive file permissions of specific system files. An attacker could exploit this vulnerability by authenticating to an affected device, creating a crafted command string, and writing this crafted string to a specific file location,” Cisco explains.  

Pre-14.1(1i) NX-OS also wasn’t properly validating TLS client certificates sent between components of an ACI fabric. 

An attacker with a certificate that is trusted by the Cisco Manufacturing certificate authority and the corresponding private key could present a valid certificate while attempting to connect to the targeted device.  

“An exploit could allow the attacker to gain full control of all other components within the ACI fabric of an affected device,” Cisco notes. 

More on Cisco and security

Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Cars

Hertz massive Tesla Model 3 EV order sends interest rocketing

Published

on

Hertz today made a whopper of an announcement, revealing that it will be ordering 100,000 Teslas over the next year and adding those EVs to its fleet. Not only that, but Hertz will also install several thousand chargers at its network of locations around the US and Europe. With this move, Hertz says that it will “offer the largest EV rental fleet in North America and one of the largest in the world.”

Specifically, Hertz said today that it would purchase 100,000 Tesla Model 3s and those cars will start being available at airport and neighborhood locations across the US and Europe in November. At first, Hertz says its EV fleet will only be available in major markets within the US and “select cities” in Europe, but it seems the company is looking to expand availability rather quickly.

By the end of 2022, Hertz says it plans to have these Tesla Model 3s available in 65 markets, expanding further to 100 markets by the end of 2023. In all, Hertz plans to install 3,000 Tesla superchargers at various locations in the US and Europe as well. Perhaps unsurprisingly, this announcement sent Tesla’s stock on something of a surge this morning, but even more important is the impact this could have on the public perception of electric vehicles.

Hertz says that EVs will comprise more than 20% of its global rental fleet when the order is complete. In addition to placing this order, Hertz has also hired NFL star Tom Brady for an ad campaign centered around renting, driving, and charging these Tesla Model 3s. On Hertz’s website, we see that charging will be included in EV rentals, but only for a limited time. Beyond February 1st, 2022, it sounds like renters will have to foot the bill for charging.

It’s an ambitious plan, but in today’s announcement, Hertz cautions that the order of 100,000 Tesla Model 3s may be impacted by factors outside of its control. Specifically, the company is talking about the global semiconductor shortage, which could impact the production of computing hardware for some time to come. In any case, look for the option to rent a Tesla Model 3 to start popping up at Hertz locations next month.

Continue Reading

Cars

Bently Mulliner to unveil new bespoke collections at the Fort Lauderdale Boat Show

Published

on

Bentley Mulliner has curated three new bespoke design collections for its American clientele. The Mulliner Nauticus Collection will debut at the Fort Lauderdale International Boat Show this October 27 to 31, 2021. The Nauticus Collection includes four Continental GT V8 Convertible models dressed in a fancy yachting theme.

The Continental GT Nauticus Collection has Aegean Blue and Ghost White paint with custom 22-inch Aegean Blue polished wheels. Wearing Bentley Mulliner’s carbon fiber Styling Specification, each Nauticus Bentley also gets a carbon front splitter, side skirts, rear spoiler, and rear diffuser. Also, the interior is resplendent in Brunel, Linen, and Portland leather in bespoke color splits, while the center console is home to open-pore chevron light veneers.

“This timeless classic further highlights the infinite possibilities and abilities in which to blend art and technology into a unique emotion and experience,” said Peter Brandt, Holmann Automotive Vice President and General Manager of Bentley Fort Lauderdale. “The individuality and distinctiveness of the Mulliner design aesthetics perfectly align with our pursuit of creating unique customer experiences.”

Meanwhile, Bentley of Manhattan commissioned the Mulliner Skyline Collection for the Flying Spur, Continental GT Convertible, and Bentayga luxury SUV. As expected, the Skyline Collection draws inspiration from the breathtaking skyscrapers of the Big Apple.

All members of the Mulliner Skyline Collection will wear a unique Onyx black paint applied by hand and robots, said Bentley. Other noteworthy features include 22-inch black and silver alloy wheels, darker exterior trim, LED welcome lighting, and premium silver interior trim.

Last but not least is the Mulliner Miami Collection, inspired by Miami’s colorful lifeguard stations and pulsating art scene. The collection includes the Flying Spur, Bentayga, and Continental GT finished in bright Orange, Blue, and Lime Green paint. Inside, Bentley’s Miami Collection gets two-tone painted piano veneers, Klein Blue leather upholstery, and bespoke quilting, among many others.

“Our dealers are very involved in each of their local markets and communities with appreciation to maximize the ability to promote Bentley’s craftsmanship,” said Mike Rocco, Vice President of Sales & Operations for Bentley Americas. “The opportunity to expand inventory offering to customers and present a truly unique experience through the Personal Commissioning Guide is remarkable.”

Continue Reading

Cars

Vazirani Ekonk is possibly the world’s lightest electric car

Published

on

Indian electric automaker Vazirani is not as mainstream as Tesla and other legacy EV makers, but what will soon change with the launch of Ekonk performance EV. The Ekonk is a low-drag performance concept that signifies the birth of Vazirani’s assault in the burgeoning EV category. The name ‘Ekonk’ is a derivative from Indian scriptures representing the divine light, “where for the first time design and innovation comes together,” said the company.

From the looks of it, the Ekonk is a dedicated performance contender, and it’s doing it the old school way: By shedding weight. Vazirani claims Ekonk is the world’s lightest electric car, and losing pounds in an EV is hard to do without losing a wheel or two. Tipping the scales at around 1627 pounds (738kg), the Ekonk is almost as lightweight as other three-wheeled EVs like the Arcimoto (590 kg) and Daymak Spiritus (620 kg).

In addition, Ekonk is lighter than the Aptera solar EV (816 kg), and it has four wheels instead of three, so Vazirani may be up to something here. How did they do it? “Biomimicry – studying how animals and humans use breathing to regulate their body temperatures – combined with some ancient Indian manufacturing techniques resulted in the invention of the DiCo technology,” said Chunky Vazirani, CEO of Vazirani.

Vazirani’s proprietary DiCo battery cooling technology “allows the batteries to cool directly with the air, as opposed to needing liquid cooling,” adds Vazirani. The carmaker adds DiCo is the first solid-state direct cooling system that utilizes nanoparticle technology to enhance the range and performance of any EV.

The automaker did not mention the battery capacity, but it did say Ekonk can rush to 60 mph from a dead stop in 2.5-seconds and has a top speed of 192 mph. Also, we have no idea how many motors are hiding underneath Ekonk’s aerodynamically optimized body shell, but Vazirani claims 722 horsepower and mountains of torque.

Additionally, Ekonk is a proper driver’s car. Vazirani said Ekonk has no driver aids, with just the electric motors and the wheels separating the driver from the road. It’s not a bad-looking thing, either, but the absence of a fixed or foldable roof means this car is a genuine track toy. If you don’t like a speedster, Vazirani also has the Shul hyper EV (with two doors and a roof) with the same DiCo battery cooling technology.

Continue Reading

Trending