Saint SlashAndGrab, of the Extra Slash

Patron of remote support software, setup wizards that stay reachable, and managed service providers.

Life

On 19 February 2024 ConnectWise published an advisory for ScreenConnect, its remote control software; a few days later, with the exploit public, attacks were already underway. CVE-2024-1709, scored 10, let anyone reach the setup wizard again and create an administrator with no credentials at all; Huntress named it SlashAndGrab. Ransomware and other groups used it to get into the networks of managed service providers' customers.

Prayer

O Saint SlashAndGrab, who enters through the setup door, let our wizards close once they are done. Amen.

How to celebrate

Celebrated by updating ScreenConnect to 23.9.8 or later and counting the administrators nobody remembers creating.

Leave the wizard open, and you've gift-wrapped the house.