Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Next challenges

Recent achievements

  • Global
  • Personal

Recognition

  • Give kudos
  • Received
  • Given

Leaderboard

  • Global

Trophy case

Kudos (beta program)

Kudos logo

You've been invited into the Kudos (beta program) private group. Chat with others in the program, or give feedback to Atlassian.

View group

It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

New year is going to be interesting for security aspects

Hi! 

image.png

As we know the latest security patches is good option.

Unfortunately, now the exploits are creating much faster as expected. 

 

If you're forget to upgrade your infra please do it. Otherwise it is too risky to have not latest releases. 

Windows:

Linux: 

If you want find the exploit to review your infra you can find in github the exploit.

 

Not so long time ago, one of my customer lost an infrastructure of CI/CD and Jira instances. 

Because the attack was used 1 vuln app for Jira 8.5, and then made a privileges escalation trick from jira user to root, and uploaded the shell code. 

And after instance by instance was used for spamming, crypto mining and after ciphering backups (good idea btw). 

 

Please, be aware if you instance exposed through internet.

 

Conclusion:

Don't be shy and do upgrades, and improve upgrade procedure.

 

 

P.S. I think time to upgrade to latest your Atlassian products includes apps as well :) Except cloud :)

 

 

 

Cheers,

Gonchik Tsymzhitov

2 comments

Jimmy Seddon Community Leader Feb 13, 2021

This is a really good point @Gonchik Tsymzhitov!  Some of the dumbest breaches have been caused by a lack of taking the time to keep everything up to date.

Like Gonchik Tsymzhitov likes this

@Jimmy Seddon  Well, about explouts and 0days, of course it's next step. 

Unfortunately, in the world a lot of script kiddies who automate the Metasploit and use masscan to investigate internet :( 

Comment

Log in or Sign up to comment
TAGS

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you