Skip to content

How to find SonicWall devices on your network

Latest SonicWall vulnerability: (CVE-2024-40766) 

SonicWall disclosed a vulnerability that affects SonicOS management access and SSLVPN software on SonicWall Gen 5, Gen 6, in addition to Gen 7 devices running SonicOS version 7.0.1-5035 or earlier.

CVE-2024-40766 is rated critical with CVSS score of 9.3, and potentially allows for unauthorized resource access by an attacker. There is limited evidence that this vulnerability is being exploited in the wild.

What is the impact?

Successful exploitation of this vulnerability potentially results in unauthorized resource access and in some cases could lead to a DoS after causing vulnerable devices to crash.

Are updates or workarounds available?

SonicWall recommends restricting management access to trusted sources or disabling WAN management from the public Internet. Additionally, SonicWall has released updated firmware and is available for download from mysonicwall.com.

How to find potentially vulnerable systems with runZero

From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:

hw:"SonicWall" type:"Firewall"

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

Linux Security Best Practices

Linux security is top of mind these days as CentOS Linux, one of the most popular open source Enterprise Linux distributions, just sunsetted its final version. No more updates or patches will be released from the community, and it is estimated that there are still tens of thousands of servers running end-of-life CentOS

Whether you are still on CentOS or on another Linux distro, knowing how to secure your Linux server is essential to protecting your systems and keeping unauthorized people and malicious code/malware out.

In this blog, read about Linux security best practices, including some setup/configuration “shortcuts” that can actually weaken your security and increase your risk.

Linux Security: Overview

There are many reasons why you should (or must) secure your Linux servers, but the top two that immediately come to mind are compliance and accountability. 

Compliance Requirements

There are a number of scenarios where securing your Linux server is mandatory. For example:

  • If you process or store any credit card information, there are requirements to secure your server.
  • If you handle medical data, there are HIPAA security requirements.
  • You may have security policies within your company that you need to adhere to.
  • If you interface with 3rd parties, there may be security agreements that all parties need to comply with.

If any of the above apply to your organization, securing your Linux server is not optional. 

Get more information about open source compliance >>

Accountability

  • Having tight security can furnish you with favorable answers when prospects or customers ask about your company’s security history, which is far better than the alternative (aka having a bad reputation due to lax security).  
  • If a security issue does occur, your company could be legally liable to have implemented certain security measures. 

Regardless of why you feel it is necessary to keep your Linux server secure (or how you justify it to others in your company), properly implemented Linux security measures will undoubtedly benefit your business beyond any potential inconveniences that may come to mind when security is mentioned.

Back to top

Common Linux Security Vulnerabilities 

When most people think about Linux vulnerabilities, they think of bugs in software which can result in potential security risks. Recently, CVE-2024-6387 and CVE-2024-6409 were disclosed, and both are vulnerabilities within the OpenSSH package on EL9 (and EL9-based distributions). Very few systems use insecure remote access methods like Telnet these days, but it used to be that you had a choice of having the default Telnet access and/or installing SSH. Luckily, SSH became the default for remote access, but it is still necessary to keep it up-to-date in order to continue enjoying the security that using it provides.

Security vulnerabilities can show up in almost any package. For instance, CVE-2021-43527 is a CVSS score 9.8 remote code execution vulnerability in nss, CVE-2022-25315 is a CVSS score 9.8 overflow/DoS/arbitrary code execution vulnerability in expat, and CVE-2021-35942 is a CVSS score 9.1 overflow/arbitrary memory read vulnerability in glibc. Last year, the high severity Looney Tunables vulnerability (CVE-2023-4911) impacted numerous Linux distributions including CentOS 8, and a critical libwebp vulnerability (CVE-2023-4863) allowed essential heap data structures to be overwritten in CentOS 7 and 8, as well as other open source software that uses the popular code library (NGINX, WordPress, Node.js, and others). 

Note: OpenLogic provides CentOS patches for CVEs with CVSS score of 7 or higher for our CentOS LTS customers.

Vulnerabilities (and the bad actors that exploit them) are somewhat beyond our control — but there are other things that can weaken Linux security we can address. I’m talking about choices that get made to save time/effort and make implementation easy, or issues that are do not seem high priority enough to get taken care of in a timely manner. 

Here are a few examples:

  • Using passwordless ssh keys so you don’t have to type your password over and over each day or having the system auto-login when it boots (“Nobody is allowed to touch my workstation.”)
  • Leaving root logged in at the console (“I’m the only one who comes into the data center.”)
  • Turning off SELinux (“It’s too difficult to get it working properly.”)
  • Not updating some or all of the packages on a system (“It’s working right now and I don’t want to risk breaking anything.”)
  • Leaving accounts on a system after an employee has left the company (“They can’t get into our network anymore so there’s no rush to remove their accounts.”)
  • Keeping mission-critical systems running on End-of-Life distributions (“I have too many other things on my to-do list and these have been working just fine for years!”)

Main point: cutting corners when it comes to Linux security is never a good idea and can come back to haunt you.

Back to top

8 Steps to Secure Your Linux Server

In addition to not doing any of the shortcuts above, here are 8 best practices that you should consider:

  1. Harden systems to specific security standards (CIS Benchmarks, PCI-DSS, STIG, etc.) 

Even if there aren’t any explicit requirements to do this, it’s a good idea. This can be made easier by using pre-hardened images. These images can either be created in-house or obtained from a trusted 3rd party like OpenLogic.

Most benchmarks will test and configure the system through hundreds of checks, such as automatically disconnecting idle sessions, and raise flags if auto-login is enabled, or accounts without passwords are detected, and so on. 

    2. Use (and require) strong passwords

Social media is filled with fun little quizzes about your pet’s name, your childhood address, what year you were married, and so forth. First of all, don’t fall for these social engineering tricks that try to get you to share information commonly used in passwords or security questions. If you do accidentally share info like this, a strong password means hackers won’t have enough information to easily figure out how to access your accounts.

Security benchmarks typically configure the system to enforce this, too.

    3. Keep systems updated

You not only need to keep the OS updated but also all of the apps (and any dependencies) on the system.

The fear of breaking something due to an update can be alleviated by having a lab/staging environment where you can test updates (and other changes) in isolation before deploying to production.

If a lab/staging environment is not available, consider a phased deployment to a few systems that, if problems occur, can be taken offline, repaired, and then brought back online.

    4. Plan to migrate systems before they reach end of life (EOL)

True Enterprise Linux distributions have known lifecycles from release through end of life. This information can be used to plan when to upgrade from one OS to another from the start instead of near (or after) the published EOL date.

If they do reach EOL, procure long-term support for the OS and packages/services (such as the CentOS support available from OpenLogic for 5 years after the EOL date).

    5. Implement MFA (Multi-Factor Authentication)

MFA adds another layer of access security for each account so a misplaced Post-It note with your new password on it or a lost thumb drive that contains an SSH key doesn’t automatically allow access to whomever sees/finds it.

    6. Use system configuration to deploy and validate configuration and security consistently

Not only can tools like Ansible or Puppet help with the initial launch of your systems, they can also be used to maintain ongoing compliance and updates of those systems, and reduce MTTR in Disaster Recover (DR) situations in the event that systems need to be rebuilt from scratch.

Comparing configuration management tools for enforcing Linux security? Here’s what to know about Ansible vs. Puppet >>

    7. Incorporate SELinux from the start (and don’t disable it or leave it in passive mode)

The most common SELinux-related problems that are difficult to resolve are due to development and testing (and sometimes, staging) being done with SELinux disabled and the placement of files and directories being where SELinux doesn’t know how to handle them. Then, when SELinux is finally enabled (typically in staging but sometimes in production), everything breaks and SELinux is disabled again and left that way. By placing your files in locations that adhere to SELinux’s expectations, local SELinux policies can be minimized or eliminated.

    8. Stay on top of account maintenance

By incorporating centralized authentication such as some combination of FreeIPA, Directory Services, SSO, Kerberos, and RADIUS, it becomes very easy to activate, deactivate, or update accounts and their permissions. Most high-end network gear also supports centralized authentication so your entire infrastructure can be secured the same way.

If you don’t have centralized authentication, use tools (like the aforementioned Ansible or Puppet) to keep accounts stored locally on each system in-sync.

Back to top

Final Thoughts 

Unfortunately, there is no shortage of bad actors looking to compromise your system to steal data or otherwise cause harm to your business. Having a secure Linux server and strong Linux security measures means you can sleep well at night because you’re not worried about all of the potential attacks that you have no defenses against, and you’re not prepared for. 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Perforce
The best run DevOps teams in the world choose Perforce. Perforce products are purpose-built to develop, build and maintain high-stakes applications. Companies can finally manage complexity, achieve speed without compromise, improve security and compliance, and run their DevOps toolchains with full integrity. With a global footprint spanning more than 80 countries and including over 75% of the Fortune 100, Perforce is trusted by the world’s leading brands to deliver solutions to even the toughest challenges. Accelerate technology delivery, with no shortcuts.

The pitfalls of hidden costs in SaaS

And why predictable pricing matters

The convenience and many benefits of software-as-a-service (SaaS) solutions are clear, such as increased productivity, collaboration, and flexibility. However, there are a few pitfalls in their adoption that can really sour a buying experience. Perhaps topping this list is the frustration of having to buy software and figure out exactly what’s included — and what isn’t. 

Since pricing is often a key factor that frustrates software buyers, let’s explore common SaaS pricing issues and how Keepit addresses them with a transparent buying process through predictable pricing.

The current reality of buying SaaS solutions

Buying SaaS solutions is often marketed as easy and straightforward, but in practice, it can be more complex than it initially seems, particularly when it comes to understanding the full cost and the features included in a package.

The reality is that for many SaaS solutions, figuring out their pricing seems to be as complex as the software itself (or maybe even more complicated). These pricing challenges can be a significant barrier for businesses trying to make informed decisions about the software they need and how to budget for it. There’s a number of variables making pricing difficult, such as hidden costs, scalability, and feature tiers which often exclude key features you need.

But why is it that complicated pricing is something those buying software deal with so often? Perhaps it’s partly because some companies, eager to capitalize on the growing demand for cloud-based solutions, offer pricing models that seem appealing at first look to get the buyer hooked on their service due to a low sticker price, only to later learn about the true cost of the solution.

However, once buyers adopt a solution, start using it, and then dig deeper, they often encounter hidden fees, unpredictable runaway costs (particularly relevant on services that bill based on data storage and transfer), or missing features from what was sold to them in the sales process and now doesn’t fulfill their needs without significant add-ons. What this amounts to is frustration, mistrust, and dissatisfaction.

And, once a buyer is already in the ecosystem and “hooked,” the sunk-cost fallacy may kick in — whereby a person becomes reluctant to change or replace a service because they have invested heavily in it, even when it’s clear that replacing it would be more beneficial than sticking with it.

Predictable pricing emerges as a welcomed respite to these issues by offering transparency and stability in an otherwise convoluted market, ensuring buyers get exactly what they need, expect, and pay for. But first, let’s look into some of the common issues of SaaS pricing and why it has become a prevalent problem.

Common challenges in SaaS pricing

Confusing offerings

One of the most significant challenges buyers face is deciphering what’s actually included in the software packages they purchase. SaaS providers often bundle features in ways that can be difficult to understand, leaving customers unsure of whether they’re getting the solution they truly need.

This confusion can lead to situations where buyers think they’re buying a comprehensive solution, only to discover later that essential features are either missing or require additional purchases. This not only wastes time and resources but also erodes trust between the buyer and the provider.

For many data protection solutions, they typically add rehydration fees for different tiers of data storage that lead to extra fees in a recovery scenario, as well as the time needed to rehydrate said data. This makes recoveries expensive and affects performance.

Hidden fees and extra costs

Hidden fees are another major pain point in SaaS pricing. Companies often present a base price that seems reasonable, only to tack on extra costs as customers start using the software. A common scenario involves adding users or accessing additional data storage (for gigabit-based storage models), which can suddenly and unpredictably inflate costs far beyond what was initially budgeted.

For example, rehydration fees — charges for accessing archived data — are often not clearly communicated upfront. Similarly, different tiers of data storage can lead to unexpected fees during recovery scenarios, where the need for quick data retrieval makes these costs unavoidable. These surprise expenses not only strain budgets but also impact the overall performance and reliability of the software.

Unpredictable pricing models

Consumption-based pricing models, like those used by AWS, introduce a different kind of challenge. While they offer flexibility, they also create significant uncertainty. Predicting consumption can be incredibly difficult, especially as business needs shift. This unpredictability often results in companies either overestimating their needs and overspending or underestimating and facing unexpected additional costs. The lack of a clear, fixed cost structure makes it hard for businesses to budget effectively, leading to frustration and possibly budget instability.

SaaS buying fatigue

Compounding the problem of dealing with hidden costs and unclear pricing practices in SaaS is the sheer number of applications organizations are utilizing in their portfolios. Peaking at an average of 130 SaaS apps in 2022, organizations are increasingly powered by SaaS tech stacks.

This rapid expansion not only complicates cost management but also exacerbates the issue of unpredictable pricing models, as organizations struggle to accurately forecast expenses and ensure they are getting the full value from each application within such a vast and diverse ecosystem. Buyers may end up asking themselves: Did I buy what fit my needs?

To help alleviate SaaS fatigue (Read: pricing frustrations), we make it easy and predictable to buy our service. Let’s look into how we do things differently at Keepit to make sure our service is always as simple as possible.

 

How Keepit stands out with predictable pricing

Straightforward seat-based pricing

Keepit recognizes the challenges prevalent in SaaS, and therefore we offer a straightforward solution with a simple, predictable seat-based pricing model. Unlike other SaaS providers that complicate pricing with various add-ons and hidden fees, Keepit’s model is simple and transparent: Customers pay based on the number of seats (users) they need, with all essential features included in that price. You pay one flat fee per user which includes everything.

This approach eliminates the guesswork and ensures that there are no surprises down the road and no consumption calculations to make that are common with data-based pricing schemes. There’s no need to calculate costs or approximate data usage; what you see is what you get.

Easy scaling

As businesses grow, their software needs evolve. Keepit makes scaling easy by allowing customers to add seats without worrying about additional hidden costs. There’s no need to estimate increased consumption, adjust for egress or ingress fees, or worry about restore costs.

This simplicity means businesses can focus on growth without being bogged down by complex pricing structures or unpleasantly surprised by budget-breaking hidden fees or data rehydration or transfer fees. When we sell X number of seats, it’s always this price.

Better value with all features “unlocked”

One of the key differentiators for Keepit is that all features are “unlocked” from the start. Customers don’t need to worry about missing out on critical functionalities: Keepit’s packages include unlimited data storage with no extra fees for storage or retention, unlimited free egress and ingress, unlimited point-in-time restores, and included data encryption — both in transit and at rest.

For example, in SaaS data backup and recovery, the difference between a restore with Keepit versus a restore with a competitor is that with Keepit, you get to skip the most time-consuming part — rehydrating data. All data protected with Keepit is stored as hot tier, with full redundancy through dual data centers, so there are never any transfer fees or rehydrating fees.

There’s also no added cost for unlimited retention and departed-user data is retained without additional charges. This comprehensive approach ensures that CISOs and CIOs have full control over their data without the burden of unexpected costs or compromises in data protection.

No buyer’s remorse

With Keepit’s clear and transparent pricing, customers can buy with confidence, knowing exactly what they’re getting. There’s no risk of buyer’s remorse because the pricing structure is straightforward and all-inclusive. Buyers receive the coverage and capabilities they need, without the fear of hidden fees or surprises. This transparency builds trust and ensures long-term satisfaction with our customers who know very well what’s out there in terms of pricing practices.

Conclusion: Scale confidently with predictable pricing

As businesses continue to expand their reliance on SaaS solutions, transparent and predictable pricing is not just a nice-to-have — it’s essential. Don’t let hidden costs and complicated pricing models drain your budget and trust. Discover how Keepit’s straightforward, all-inclusive pricing can provide the simplicity and confidence you need to scale your operations without fear of surprise fees.

By focusing on simplicity and transparency, Keepit helps businesses future proof their operations, allowing them to scale confidently without the fear of unexpected costs or the frustration of hidden fees, ultimately fostering a more positive and trustworthy software buying experience.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Keepit
At Keepit, we believe in a digital future where all software is delivered as a service. Keepit’s mission is to protect data in the cloud Keepit is a software company specializing in Cloud-to-Cloud data backup and recovery. Deriving from +20 year experience in building best-in-class data protection and hosting services, Keepit is pioneering the way to secure and protect cloud data at scale.

Perforce Announces Same-Day Support for iOS 18

Perfecto by Perforce provides same-day support for iOS 18 mobile application testing –helping customers prepare their applications for the major release.

 

MINNEAPOLIS, Monday, September 16, 2024 – Perforce Software, a global leader in DevOps solutions, announces that its mobile application testing platform, Perfecto, will support Apple’s latest iOS version, iOS 18, on Monday, September 16, 2024. 

By enabling same-day mobile application testing support for iOS 18 and the new iPhone 16 series—scheduled for release on September 20, 2024—Perfecto encourages app developers and testing teams to prepare their applications to handle the latest iOS version and iPhone devices as soon as they become available. Since most iPhone users upgrade their devices immediately upon release, apps must be ready to handle the change. 

Research from Cambridge Judge Business School has shown that software failures cost enterprise organizations $61 billion annually.

“It is critical that testing and development teams prepare their applications for the latest release on day one,” says Clinton Sprauve, Director of Product Marketing at Perforce. “We are proud to offer day-one support for both the iOS 18 release and the iPhone 16 series in our device cloud.” 

With both beta testing and day-one testing support for the latest operating systems and devices, Perfecto has always enabled customers to prepare their applications ahead of time, keeping them free from bugs or glitches and saving resources and reputation. 

Developers and testing teams will need to test their applications against a host of new features arriving with the release of iOS 18 and the iPhone 16 series, including new customizable home screens, a redesigned photos app, email and note transcription services, message scheduling, and AI-powered features like Image Playground, Genmojis, and the upcoming Apple Intelligence, a beta version of which will be released with the iOS 18.1 update in October. 

Perfecto has consistently been ahead of the curve when it comes to same-day support for new releases—going back to 2007 with the first iPhone release—and continues that trajectory of innovation with the release of iOS 18. The iOS 18 release marks the seventeenth year that Perfecto is supporting a release on day one.

Perfecto’s cloud-based testing lab supports thousands of devices (real and virtual), operating systems, and browsers across the globe. To see the comprehensive list of supported platforms, visit http://www.perfecto.io/supported-devices

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Perforce
The best run DevOps teams in the world choose Perforce. Perforce products are purpose-built to develop, build and maintain high-stakes applications. Companies can finally manage complexity, achieve speed without compromise, improve security and compliance, and run their DevOps toolchains with full integrity. With a global footprint spanning more than 80 countries and including over 75% of the Fortune 100, Perforce is trusted by the world’s leading brands to deliver solutions to even the toughest challenges. Accelerate technology delivery, with no shortcuts.