IWMW 14 Institutional Web Management Workshop 2010: The Web in Turbulent Times held at the University of Sheffield on 12-14 July 2010

ETSI launches a new group on information exchange between maritime surveillance authorities

Sophia Antipolis, 3 May 2019

ETSI has recently launched a new Industry Specification Group on a European Common Information Sharing Environment Service and Data Model (ISG CDM). The ETSI group will define technical standards to allow data exchange among different maritime legacy systems in a cooperative network. Enhancing information exchange between maritime surveillance authorities is one of the key strategic objectives of the European Union under the Integrated Maritime Policy with increased coordination between different policy areas (transport, environmental protection, fisheries control, border control, general law enforcement, customs and defence).

Read More...

ETSI OSM launches Release TWELVE, with enhanced Network Function resiliency and runtime operations

Sophia Antipolis, 30 June 2022

ETSI OSM is pleased to announce OSM Release TWELVE, the second Long Term Support release of ETSI Open Source MANO and one of its most prolific releases. One of the main new features of Release TWELVE is the ability to heal network functions that may be affected by any kind of infrastructure failure. This healing process, which may be triggered either manually or automatically depending on operator preference, can be applied in all the clouds supported by OSM, in line with OSM’s multi-cloud approach.

Read More...

Starts: Tue, 10 Dec 2024 19:00:00 -0500
12/10/2024 05:30:00PM
Location: Montreal, Canada

Frequently asked questions about a zero-day vulnerability in Fortinet’s FortiManager that has reportedly been exploited in the wild.

Background

The Tenable Security Response Team (SRT) has compiled this blog to answer Frequently Asked Questions (FAQ) regarding a zero-day vulnerability in Fortinet’s FortiManager.

FAQ

What is FortiJump?

FortiJump is a name given to a zero-day vulnerability in the FortiGate-FortiManager (FGFM) protocol in Fortinet’s FortiManager and FortiManager Cloud. It was named by security researcher Kevin Beaumont in a blog post on October 22. Beaumont also created a logo for FortiJump.

What are the vulnerabilities associated with FortiJump?

On October 23, Fortinet published an advisory (FG-IR-24-423) for FortiJump, assigning a CVE identifier for the flaw.

What is CVE-2024-47575?

CVE-2024-47575 is a missing authentication vulnerability in the FortiGate to FortiManager (FGFM) daemon (fgfmsd) in FortiManager and FortiManager Cloud.

How severe is CVE-2024-47575?

Exploitation of FortiJump could allow an unauthenticated, remote attacker using a valid FortiGate certificate to register unauthorized devices in FortiManager. Successful exploitation would grant the attacker the ability to view and modify files, such as configuration files, to obtain sensitive information, as well as the ability to manage other devices.

Obtaining a certificate from a FortiGate device is relatively easy:

Comment
by from discussion
infortinet

According to results from Shodan, there are nearly 60,000 FortiManager devices that are internet-facing, including over 13,000 in the United States, over 5,800 in China, nearly 3,000 in Brazil and 2,300 in India:

When was FortiJump first disclosed?

There were reports on Reddit that Fortinet proactively notified customers using FortiManager about the flaw ahead of the release of patches, though some customers say they never received any notifications. Beaumont posted a warning to Mastodon on October 13:

Post by @GossiTheDog@cyberplace.social

View on Mastodon

Was this exploited as a zero-day?

Yes, according to both Beaumont and Fortinet, FortiJump has been exploited in the wild as a zero-day. Additionally, Google Mandiant published a blog post on October 23 highlighting its collaborative investigation with Fortinet into the “mass exploitation” of this zero-day vulnerability. According to Google Mandiant, they’ve discovered over 50 plus “potentially compromised FortiManager devices in various industries.”

Which threat actors are exploiting FortiJump?

Google Mandiant attributed exploitation activity to a new threat cluster called UNC5820, adding that the cluster has been observed exploiting the flaw since “as early as June 27, 2024.”

Is there a proof-of-concept (PoC) available for this vulnerability/these vulnerabilities?

As of October 23, there are no public proof-of-concept exploits available for FortiJump.

Are patches or mitigations available for FortiJump?

The following table contains a list of affected products, versions and fixed versions.

Fortinet’s advisory provides workarounds for specific impacted versions if patching is not feasible. These include blocking unknown devices from attempting to register to FortiManager, creating IP allow lists of approved FortiGate devices that can connect to FortiManager and the creation of custom certificates. Generally speaking, it is advised to ensure FGFM is not internet-facing.

Has Tenable released any product coverage for these vulnerabilities?

A list of Tenable plugins for this vulnerability can be found on the individual CVE page for CVE-2024-47575 as they’re released. This link will display all available plugins for this vulnerability, including upcoming plugins in our Plugins Pipeline.

Get more information

• Burning Zero Days: FortiJump FortiManager vulnerability used by nation state in espionage via MSPs
• FortiGuard Labs PSIRT FG-IR-24-423 Advisory

Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.

"Miles Morales, the Ultimate Universe's newest Spider-Man, is back in action with a new status quo and a new outlook on life! But now Miles must face with the worst nightmare of the Spider-Man legacy: Norman Osborn, the Green Goblin— the man who killed Peter Parker! Or did he … ? Even as new villains start coming out of the woodwork, Miles finds himself with— a girlfriend! Her name is Katie Bishop, but she has a secret … and it's bad news for Spider-Man! As Miles makes a life-changing decision, he discovers a mind-blowing truth about his family! But what does it have to do with S.H.I.E.L.D.? Doctor Doom steps from the shadows and Spider-Man gathers the mighty Ultimates— but no matter what happens next, this might be the end of the world for Miles Morales!" -- Description provided by publisher.

Often hailed as the heir apparent to Wallace Stegner, Ivan Doig is among the finest chroniclers of the contemporary American West. In Mountain Time, Lexa McCaskell and Mitch Rozier leave their Seattle home to visit Mitch's dying father in Montana. There Mitch clashes with both Lexa and his father as events from the past are explored and difficult memories resurface. "Mountain Time will not dissuade those who rank Doig among the best living American writers."-San Francisco Chronicle

Keith Attle 700258 : Addie May was in many ways before her time. She was strong willed, not afraid to speak her mind, and could distinguish between right and wrong with good common sense. For her, there was no middle ground. This became evident at a very early age as she was born with two strikes against her. First, one leg was shorter than the other, which caused her to limp all of her life and subjecting her to be ridiculed as a child. Secondly, she was left-handed. Today this is not an issue, but for thousands of years, this attribute was associated with witchcraft and devil possession. Addie May's mother tried everything she could to change her but to no avail. Even a sore and blistered hand and punishment by her first-grade teacher did not dissuade her. Her formal education finished at eighth grade, yet she became a court deputy, a bookkeeper for her husband's hugely successful business, a practical nurse, mother, and grandmother. It was the later when I came to know her. Death was a frequent visitor throughout her life. Somehow she was able to mask her inner emotions while smiling and comforting others facing pain, distress, and death. She was a decent, honorable, and compassionate human being who never thought of herself as anything special. This book is a tribute to a woman who never received the recognition she deserved. It is my desire to correct this. It's unfortunate she will never know.

How much does take-up timing for agricultural inputs depend on price? Evidence from an experiment in Nigeria

Insights into buying behavior.

The post How much does take-up timing for agricultural inputs depend on price? Evidence from an experiment in Nigeria appeared first on IFPRI.

Event Begins: Wednesday, November 13, 2024 9:00am
Location: Off Campus Location
Organized By: Kinesiology Community Programs

Lifetime Fitness classes are offered at Briarwood Mall in the JCPenney wing. No experience necessary. Classes are specifically designed for older adults, however, everyone is welcome. Classes are held Monday-Saturday from 9-10am. LTF classes at Briarwood are free, but please consider making a tax-deductible donation.

Matt Horn persevered through the pandemic to open his West Oakland restaurant Horn Barbecue—to the delight of hungry crowds

The timing of the Red Sea attacks could not be worse for Democrats (Politico)

Senior research fellow Joseph Glauber is quoted in a Politico story about how the growing military conflict in a key trade corridor is threatening to unleash economic havoc on the global economy ahead of November. “If energy prices go up and remain high, you’d see food inflation persisting,” said Joe Glauber. He added that potential […]

The post The timing of the Red Sea attacks could not be worse for Democrats (Politico) appeared first on IFPRI.

Optimizing differential expression analysis for proteomics data via high-performing rules and ensemble inference  Nature.com

Deep Plasma Proteomics with Data-Independent Acquisition: Clinical Study Protocol Optimization with a COVID-19 Cohort  ACS Publications

CTA makes getting to school, work, appointments and other destinations across town easier than ever. With the new fall rail schedule now in effect, CTA is back to providing pre-pandemic levels of rail service. When bundled with the purchase of an unlimited rides pass, either the 1-Day ($5) – far more economical and convenient than the price of gas and parking - or the 3-Day ($15) pass – a real budget-saving move – its only makes “cents” to take public transit.

In this session of Planet Money Summer School, we are getting the word out about your brand. How do you convince consumers to buy your product, even if they are only just hearing about it? It's time for sales and marketing!

If you've watched a show like Mad Men or The Office, you know the importance of a strong pitch. It's precision-crafted to show how what you're selling can solve a problem your customer needs solved. Sometimes it even creates the need. Once you've got your sales pitch, it's time to get the word out: marketing. Where to spread that message? How to make it unforgettable? Instantly recognizable? What is going to be your Just do it? Your Think different? Your Where's the beef?

In our case studies today, we look at a product so cleverly marketed, the company doesn't need to market it at all anymore and customers wait years to get it: the Birkin bag. And we hear lessons from some of the world's most time tested salespeople who can and do sell anything, literally. It's all about the four P's: Product, place, promotion and price. Also, a few other tricks we test out.

Find all episodes of Planet Money Summer School here.

This series is hosted by Robert Smith, and produced by Max Freedman. Our project manager is Julia Carney. This episode was edited by Sally Helm and engineered by Josephine Nyounai. The show is fact-checked by Sierra Juarez. Planet Money's executive producer is Alex Goldmark.

Learn more about sponsor message choices: podcastchoices.com/adchoices

NPR Privacy Policy

The folk duo's latest album is named after the East Nashville studio that was destroyed by a devastating tornado outbreak in 2020.

Learn more about sponsor message choices: podcastchoices.com/adchoices

NPR Privacy Policy