news 
FBI Warns Of Brute-Force Password Spy Attacks—What You Need To Know
The Federal Bureau of Investigation (FBI) has issued a warning regarding brute-force password attacks, specifically targeting Chinese-branded web cameras and digital video recorders. The alert highlights the danger posed by weak passwords and unresolved vulnerabilities.
According to the FBI’s notification, threat actors are using a remote access Trojan known as HiatusRAT to gain unauthorized access to devices. Since at least July 2022, these malicious cyber actors have been monitoring and exploiting devices in the U.S., Australia, Canada, New Zealand, and the United Kingdom.
To be specific, the FBI warns that attackers are scanning for vulnerabilities such as CVE-2017-7921, CVE-2018-9995, CVE-2020-25078, CVE-2021-33044, and CVE-2021-36260. In addition to targeting known vulnerabilities, hackers are also exploiting weak vendor-supplied passwords.
The FBI advises a series of measures to mitigate these HiatusRAT attacks:
Firstly, it is crucial to limit the use of devices mentioned in the warning or isolate them from the network. It’s essential to monitor networks regularly and establish security policies, user agreements, and patching plans to address threats posed by malicious cyber actors.
Secondly, ensure that operating systems, software, and firmware are patched as soon as manufacturer updates become available. If devices are no longer supported by their manufacturers, consider removing them from your network.
Thirdly, avoid using default passwords for these devices or weak passwords. Instead, implement a strong password policy requiring unique and complex passwords. This should be done for all users.
Finally, the FBI recommends enforcing multi-factor authentication whenever possible and scanning networks for open and unnecessary ports to eliminate potential vulnerabilities.
In light of this warning, it is crucial that you strengthen your device’s security posture by adhering to these guidelines.
Source: http://www.forbes.com
