Cyber Attack on Norway govt websites identified to Ivanti Security vulnerability

In recent news, several websites operated by the Norwegian government experienced disruptions due to a possible cyber-attack. The US-CISA has identified that the attack exploited a flaw in the API flow of Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron Core. This vulnerability, classified as CVE-2023-35078, has a severity score of 9 out of 10 and allows hackers to bypass user authentication and gain unauthorized access to EPMM functions and resources.

Ivanti has confirmed that the affected versions of EPMM are 11.4, 11.10, 11.9, and 11.8, but even older versions are also at risk. The company has taken immediate remediation measures by providing an RPM script and a fix to address the vulnerability. They have also communicated with their affected customers through proper channels. Notably, the Department Security and Service Organization (DSS) and the National Security Authority in Norway were among the most impacted entities.

The investigation into the cyber-attack is still ongoing, and Ivanti has not disclosed any information regarding the suspected actors or groups involved in the incident. It is essential to note that Ivanti is the result of a merger between Heat Software and LANDESK, which took place in January 2017. Additionally, in September 2020, Ivanti acquired MobileIron for $870M and integrated its technology into Ivanti Endpoint Manager Mobile (EPMM).

In conclusion, the recent cyber-attack on Norwegian government websites highlights the importance of addressing vulnerabilities in software systems. The use of the