2024 Security BSides // John Hammond
summary
ConnectWise ScreenConnect has an authentication bypass via a trailing slash on /s/setupwizard.aspx (CVE‑2024‑1708) that immediately grants admin access and a chained one-to-many RCE via plugin install (CVE‑2024‑1709) that enables pushing Cobalt Strike, LockBit or miners downstream. A proof‑of‑concept script lands on GitHub and mass exploitation follows, Huntress notifies ~1,600 at‑risk endpoints and pushes a micro‑patch to about 669 reachable systems to block the flaw before full vendor remediation.
AI-written summary · about
chapters (9)
- 0:00Introduction and speaker background
- 7:25Screen Connect vulnerabilities overview
- 12:27Authentication bypass exploit demo
- 17:45Remote code execution impact
- 22:25Rapid response and team activation
- 26:22Exploit spreads and community response
- 31:41Defensive strategies and micro-patching
- 38:00Lessons in cyber resilience
- 41:33Q&A session
related talks
47mToolShell, Patch Bypass, and the AI That Might Have Seen It Coming
27mExploited CVEs of 2024: Lessons for Vendors and Defenders
01h 02mPrompt-Jacking: The Rise of a New Supply Chain Risk
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
58mHacking in 2016 - How is our systems broken?
50mStranger Danger: Your Java Attack Surface Just Got Bigger
36mChained to Hit: Discovering New Vectors to Gain Remote and Root Access in SAP Enterprise Software
25mGlobal Threat Brief: Hacks and Adversaries Unveiled