KBA 135412 - GDPR

It should be reported by Sophos themselves (although others can also report it).

To be fair, aside from the vulnerability itself, the seem to have handled it well so far. What the report doesn't have details of, is what the SQL injection vulnerability was. SQL injections are a known issue so I wonder why the OS didn't filter this one out.

Hi All,

Please reference the following Sophos Uncut article for more info: https://news.sophos.com/en-us/2020/04/26/asnarok/

Data exfiltration process

• Note: This section describes our understanding of the data exfiltration capabilities of the malware at the time of publication of this article, but we have not discovered any evidence that the data collected had been successfully exfiltrated.

Hi All,

Please reference the following Sophos Uncut article for more info: https://news.sophos.com/en-us/2020/04/26/asnarok/

Data exfiltration process

• Note: This section describes our understanding of the data exfiltration capabilities of the malware at the time of publication of this article, but we have not discovered any evidence that the data collected had been successfully exfiltrated.