Tag: post

“There is no security on this earth; there is only opportunity.“

Douglas MacArthur

Man oh man has it been some time since I last wrote an article. I apologize for being away for so long but I am back. Since the last time I wrote I was laid off from my job of 9 years, my roof leaked and flooded my office, the repair job to fix the leak, leaked, and finally my office was fixed and power was restored. Obviously, with more time I on my hands I hope to be pumping out more articles. Time will tell but lets get started!

AI Will Increase Ransomware

The National Cyber Security Centre (NCSC), a part of GCHQ, has warned that artificial intelligence (AI) is expected to increase the global ransomware threat over the next two years. The report concludes that AI is already being used in malicious cyber activity and will likely increase the volume and impact of cyber attacks, including ransomware, in the near term. The use of AI lowers the barrier of entry for novice cyber criminals, enabling relatively unskilled actors to carry out more effective access and information-gathering operations. This, combined with improved targeting of victims afforded by AI, is expected to contribute to the global ransomware threat in the next two years. Ransomware continues to be the most acute cyber threat facing UK organisations. The government has invested £2.6 billion under its Cyber Security Strategy to improve the UK’s resilience, with the NCSC and private industry adopting AI to enhance cyber security resilience. The report suggests that cyber criminals have started developing criminal Generative AI (GenAI) and offering ‘GenAI-as-a-service’. The report emphasizes the importance of secure-by-design AI systems and encourages organisations and individuals to follow ransomware and cyber security hygiene advice to strengthen their defences.

My Thoughts:

No kidding! During my stint handling email security in my previous role, there was a noticeable surge in high-quality phishing emails right after the release of ChatGPT’s version 3 of their Large Language Model (LLM). These AI models significantly streamline the process of crafting sophisticated emails, devising malicious code, and generating various forms of ransomware or payloads. With minimal technical expertise, practically anyone can leverage an LLM to execute malicious actions. While many of these services implement safeguards to thwart nefarious requests, circumventing them isn’t as challenging, as numerous car dealerships have unfortunately discovered. I’ve emphasized this point repeatedly, but it’s worth underscoring — AI is poised to intensify the complexity of the security landscape.

Microsoft’s Senior Exec’s Email Compromised

Microsoft has disclosed a nation-state attack on its corporate systems carried out by the Russian state-sponsored hacking group Nobelium, the same group behind the SolarWinds attack. The attackers, also known as Midnight Blizzard, accessed email accounts of some members of Microsoft’s senior leadership team starting in late November 2023. The attack was detected on January 12, 2024, and Microsoft’s security team activated response processes immediately. The attackers used a “password spray attack” to compromise a legacy non-production test tenant account initially and then used the account’s permissions to access a small percentage of Microsoft corporate email accounts. Microsoft states that the attack was not the result of a vulnerability in its products or services, and there is no evidence that the threat actor had access to customer environments, production systems, source code, or AI systems. The investigation is ongoing, and Microsoft is working with law enforcement and regulators.

My Thoughts:

I recently defended Microsoft amidst a series of compromises to their Azure tenets during a highly sophisticated and distinctive attack sponsored by the Chinese government. However, the frequency of such incidents is making it increasingly challenging to maintain a defensive stance. With a market cap surpassing a trillion dollars, one would expect the capacity to allocate resources for teams dedicated to automating key rotation and decommissioning obsolete legacy environments.

The revelation that a non-production test account was accessible via the public web raises questions, though it’s plausible that we might not have the complete picture. A former security manager I collaborated with consistently emphasized that without robust security policies reinforced by stringent enforcement, developers and engineers are prone to jeopardize systems. In a climate where the mantra is to “move fast and break things,” security often becomes the initial casualty.

HPe has an Email Breach

Hewlett Packard Enterprise (HPE) has disclosed that it was targeted by a cyberattack believed to be sponsored by the Russian government. The company was notified on December 12, 2023, that the threat group Midnight Blizzard and Cozy Bear had hacked into its cloud-based email environment. HPE said it expelled the attackers, but its investigation revealed that the threat actor gained access to its systems and began exfiltrating data in May 2023. The attackers targeted “a small percentage of HPE mailboxes” used by staff in cybersecurity, go-to-market, business segments, and other departments. HPE believes the incident is likely related to earlier activity by the same threat actor, of which it was notified in June 2023.

My Thoughts:

Russian cyber actors remain highly active, with the same group (Cozy Bear) responsible for the Microsoft breach now targeting other U.S.-based tech companies. HP, has not provided comprehensive details on the initial breach method, but my speculation aligns with the notion that they may have exploited employee accounts through password spraying, mirroring the tactics used in the Microsoft incident. It’s noteworthy that SEC disclosures have become a primary source for insights into cybersecurity breaches, yet it’s a wish shared by many that such disclosures would mandate a more thorough exposition of the intrusion techniques employed. If Russian attackers could breach two major companies using a similar approach, it raises concerns about the potential extent of undiscovered breaches across various organizations.

Crypto Holders are Getting Better at Securing their Funds

In the Chainalysis 2023 Crypto Crime Report, findings reveal a notable decline in overall cryptocurrency theft, decreasing by 54.3% from $3.7 billion in 2022 to $1.7 billion in 2023. The significant drop is primarily attributed to a 63.7% decrease in stolen funds from decentralized finance (DeFi) hacking, which totaled $1.1 billion in 2023. The report classifies DeFi attack vectors into on-chain and off-chain categories, emphasizing a shift in vulnerabilities over the year, with compromised private keys becoming more prominent. Additionally, the report highlights the persistent threat of North Korea-affiliated hackers, who stole over $1.0 billion in 2023 across 20 recorded hacks. A case study on the Atomic Wallet exploit illustrates North Korean hackers’ tactics and fund laundering methods. The report suggests that while attackers are becoming more sophisticated, improved security measures and prompt responses from crypto platforms contribute to a decline in funds stolen from cryptocurrency hacks.

My Thoughts:

I’ve been a part of the crypto community since the days when Mt. Gox was the go-to platform for converting crypto into cash, and Bitcoin was a mere $20 per coin. While I wasn’t a major investor and missed out on some spectacular gains, I did experience the downside of the Mt. Gox hack. The absence of regulatory and security frameworks, typical of traditional banks, in the early days of cryptocurrency paved the way for exploitation. Over the past year, many in the crypto space, both users and companies, have come to realize that image and trust are synonymous. The prevalence of fraud and hacking incidents has made the adoption of a new form of currency less appealing. However, I remain optimistic that cryptocurrency will find its place in modern society. It’s absorbing the lessons from other forms of currency, adapting, and evolving in the right directions.

Japan’s Endless Struggle Against APT10: LODEINFO

LODEINFO is a fileless malware first identified in spear-phishing email campaigns since December 2019, often targeting Japanese media, diplomacy, public institutions, defense industries, and think tanks. Associated with the APT10 group, LODEINFO’s infection involves users opening a malicious Word file attached to phishing emails. The malware has evolved with multiple versions, the latest being v0.7.3 as of January 2024. The infection flow begins with a Maldoc that injects LODEINFO into memory. Updates include VBA code changes, adoption of 64-bit architecture support, and the introduction of Remote Template Injection. The Downloader Shellcode decrypts a Fake PEM file, with the malware featuring a unique structure and self-patching mechanisms. LODEINFO’s Backdoor Shellcode, allowing remote access, shows changes in hash calculation algorithms and additional backdoor commands in recent versions. The attacker’s infrastructure consistently utilizes AS-CHOOPA. Detection remains challenging, emphasizing the importance of in-memory scanning and ongoing research to counter LODEINFO’s evolving tactics.

My Thoughts:

The aforementioned report originates from ITOCHU Cyber & Intelligence Corporation in Japan, a significant player in the realm of general trading and investment. Renowned for its robust textile business and successful ventures in China, ITOCHU mirrors the diversified approach of companies like General Electric in the early 2000s. In 2023, the company ventured into the cybersecurity domain, establishing a dedicated entity. Since then, they’ve embarked on sharing insights through a blog, detailing their detection efforts.

As previously emphasized, email remains one of the most accessible avenues for infiltrating a company, often second only to password spraying. It serves as an open door susceptible to a variety of messages. A notable tactic observed in their report involves the use of a backdoor embedded in a Word document, cleverly exploiting the widespread acceptance of such files. This particular backdoor stands out not only for its persistence but also due to consistent updates by its authors. Moreover, the perpetrators ingeniously utilized Microsoft’s features against them by incorporating a malicious Word template file within the document, effectively concealing it from detection. Adding to the intrigue, the entire attack operates in the system’s memory, further complicating detection and mitigation efforts.

Conclusion

With my office now repaired and a little more time to write, look out for a lot more articles! Good luck to all the engineers out there, and until next time, stay safe!

“When it rains, it pours.”

Someone

Where have I been? I set up everything for my recordings as part of the Security Skim Workflow. I was ready to go, and my roof started leaking in my office. It had been leaking so long that mushrooms grew from my carpet. I didn’t notice because it was leaking behind a guest bed, and the leak was behind the wall. I only found out because my cat and I were playing, and she chased her ball under the bed. I reached down and low, and behind the new carpet was soaking wet, and a mushroom was growing. Hard to believe, but it does happen! Luckily, it was only one mushroom, but my office was damaged. Things have been on hold while I fix the roof leak, rip out the carpet, replace the tach strips, and replace any rot. Anyway, I finally got time to sit down and catch up on the security world, so here we go!

Okta Breach

Okta, a leading identity and access management (IAM) provider, revealed that threat actors accessed files related to 134 of its customers, including Cloudflare, 1Password, and BeyondTrust, following a breach of its backend support case management system. Attackers exploited a service account with permissions to view and update customer cases, accessing HTTP Archive (HAR) files containing session tokens. These session tokens were then used for session hijacking attacks on the targeted customers. Okta’s investigation traced the compromise back to an employee’s personal Google account or device. The incident occurred between September 28 and October 17, with Okta’s security team identifying the issue after suspicious activity was reported on September 29. Okta took remediation measures, including disabling the compromised account and enhancing monitoring of the customer support system.

Key Points:

1. Breach Details: Okta disclosed that attackers accessed files related to 134 customers, including prominent organizations such as Cloudflare, 1Password, and BeyondTrust. The breach involved session tokens used for session hijacking attacks.
2. Attack Vector: Threat actors exploited a service account with permissions to view and update customer cases. The compromised account’s credentials were stored in an employee’s personal Google profile, likely resulting from a compromise of the employee’s personal Google account or device.
3. Timeline and Detection: The breach occurred between September 28 and October 17. Okta’s security team initiated an investigation on September 29 following a report from 1Password. Suspicious activity was identified on October 13, leading to the discovery of unauthorized access to the customer support system’s Files tab.
4. Remediation Actions: Okta took several remediation actions, including disabling the compromised service account, blocking the use of personal Google profiles on company laptops using Google Chrome, enhancing monitoring of the customer support system, and implementing session token bindings based on network location.
5. Customer Impact: Cloudflare, 1Password, and BeyondTrust confirmed no customer data loss due to the breach. The identities of the other two targeted organizations have not been disclosed.
6. Previous Security Incident: In a separate incident, data of 4,961 current and former Okta employees, including names, health insurance plan numbers, and Social Security numbers, were compromised following a breach at third-party vendor Rightway Healthcare.

Conclusion:

The Okta breach highlights the importance of securing service accounts and employee credentials. Allowing employees to sign into personal accounts and save company passwords in their cloud-connected browser is a big no-no. I have to throw some shade at Facebook because to use their Facebook Business platform, you must use your personal account. They don’t allow you to create a separate business login. This was an absolute nightmare at a company I was working for.

Russian Sandworm Group Disrupted Power in Ukraine

Google-owned cybersecurity firm Mandiant revealed that the Sandworm hacking group, backed by Russia, conducted a disruptive cyber-attack targeting a Ukrainian critical infrastructure organization in late 2022. The intrusion began in June 2022 and involved a multi-event cyber-attack utilizing a novel technique to impact industrial control systems (ICS) and operational technology (OT). The attack culminated in two disruptive events on October 10 and 12, 2022, causing a power outage and deploying a wiper attack to limit investigation efforts. Sandworm leveraged OT-level living off the land (LotL) techniques to gain access to the victim’s substation environment. The attackers employed an optical disc (ISO) image to execute malicious control commands, potentially causing the power outage to coincide with missile strikes on critical infrastructure across Ukraine. Mandiant emphasized the growing maturity of Russia’s offensive OT arsenal and urged OT asset owners to take action to mitigate the threat.

Key Points:

1. Attack Details: Sandworm, tracked as UNC3810 before merging with Sandworm, used OT-level living off the land (LotL) techniques to gain access to the victim’s substation environment. The attackers executed malicious control commands using an optical disc (ISO) image, potentially causing an unplanned power outage coinciding with missile strikes on Ukraine’s critical infrastructure.
2. Timing of Attacks: While Mandiant did not conclusively establish a deliberate connection between the cyber-attack and missile strikes, the timing of the two events was considered highly coincidental. The attacks aimed to exacerbate the psychological toll of the war, with civilians suffering the consequences.
3. Maturity of Offensive OT Arsenal: The attack demonstrated the growing maturity of Russia’s offensive OT capabilities, indicating their ability to recognize novel OT threat vectors, develop new capabilities, and leverage different types of OT infrastructure for attacks.
4. Sandworm Hacker Group: Sandworm, also known as Telebots, Voodoo Bear, and Iron Viking, is linked to the Main Center for Special Technologies (GTsST), a cyber warfare unit of Russia’s military intelligence service (GRU). The group has a history of disruptive and destructive attacks in Ukraine, using wiper malware.
5. Mitigation: Mandiant urged OT asset owners to take action to mitigate the threat posed by Sandworm. Enhanced cybersecurity measures and vigilance are crucial to defending against such attacks.

Conclusion:

The Sandworm hacking group’s attack on Ukrainian critical infrastructure underscores the persistent threat posed by state-backed cyber adversaries. Organizations, particularly those in the critical infrastructure sector, must bolster their cybersecurity measures and collaborate with cybersecurity experts to defend against evolving cyber threats. Cyber attacks are becoming a larger part of the battlefield. Future wars will see many more cyber attacks because the cost ratio of cost vs. damage done will be much lower than a conventional strike.

Flipper Zero Strike Again! DDosing iPhone devices via Bluetooth

Security researcher Jeroen van der Ham experienced disruptive Bluetooth-based attacks on his iPhone during his train commute in the Netherlands. The attacks were carried out by a passenger using a Flipper Zero device, which sent Bluetooth pairing requests to iPhones within radio range. This portable multi-tool for pentesters and geeks can interact with various wireless communications, allowing users to change TV channels, clone hotel key cards, read RFID chips, and disrupt iPhones’ normal use. The Flipper Zero device, which costs $200, democratizes RF (radio frequency) hacking, making previously complex attacks accessible to more individuals. These attacks highlight the vulnerabilities in Bluetooth security and the need for enhanced protections against such disruptions.

Key Points:

1. Bluetooth Disruptions: A passenger on a train in the Netherlands used a Flipper Zero device to send Bluetooth pairing requests, causing disruptive pop-up windows and reboots on iPhones within radio range. The attacks made iPhones nearly unusable and affected multiple devices in the same train car.
2. Flipper Zero Device: The Flipper Zero device is a portable multi-tool designed for hacking radio protocols, building access control systems, troubleshooting hardware, cloning electronic key cards and RFID cards, and serving as a universal TV remote. Its open source design allows users to flash custom firmware and expand its capabilities.
3. Democratizing RF Hacking: Flipper Zero’s affordable price and convenient form factor have made it accessible to a broader audience, democratizing RF hacking capabilities. Users can perform various attacks without the need for expensive software-defined radios (SDRs), making RF hacking more accessible to casual technology enthusiasts.
4. Vulnerabilities in Bluetooth Security: The Bluetooth disruptions highlighted the vulnerabilities in Bluetooth security, especially on iPhones. While Android and Windows devices can also be disrupted by Flipper Zero, users can disable notifications to block such attacks on these platforms. However, the attacks have the potential to be highly disruptive, making it challenging to mitigate them effectively.
5. Expanding RF Hacking Capabilities: Flipper Zero and similar devices are expanding the capabilities of RF hacking, making previously insecure RF systems accessible to simple tools. As attacks become more sophisticated and accessible, poorly secured technology becomes increasingly vulnerable.

Conclusion:

The disruptive Bluetooth attacks carried out by the Flipper Zero device underscore the vulnerabilities in Bluetooth security and the broader challenges posed by RF hacking. I actually have one of these devices, and developers are cranking out firmware to make pen testing easier and easier. The device is incredibly useful as a pen testing tool, but people will abuse it. If anything, this device is bringing to light years of RF security neglect.

Microsoft New ‘Secure Future Initiative’ After Attack

Microsoft has announced its new ‘Secure Future Initiative’ (SFI) in response to recent cyberattacks and security vulnerabilities. The initiative aims to prioritize security by default, reworking the Software Development Lifecycle (SDL) to address current cyberattack trends. Microsoft plans to move identity signing keys to a hardened Azure Hardware Security Module (HSM) and confidential computing infrastructure, ensuring encryption at rest, in transit, and during computational processes. Automation will facilitate high-frequency key replacement without human access, reducing the risk of unauthorized access. The company will utilize AI for threat modeling automation and adopt memory-safe languages like Rust to eliminate specific software vulnerabilities.

Microsoft intends to implement Azure tenant baseline controls across internal tenants by default, reducing configuration management effort and ensuring adherence and auto-remediation of settings during deployment. The goal is to achieve 100% auto-remediation without impacting service availability. Additionally, Microsoft aims to reduce the time taken to mitigate cloud vulnerabilities by 50% and will advocate against non-disclosure agreements for third-party researchers to promote transparency in vulnerability reporting.

Key Points:

1. Security by Default: Microsoft’s Secure Future Initiative emphasizes security by default, echoing its early mission to address security issues and root out vulnerabilities in its products.
2. Encryption of Signing Keys: Microsoft plans to move identity signing keys to an integrated, hardened Azure HSM and confidential computing infrastructure, ensuring encryption during all stages, including computational processes. Automation will enable high-frequency key replacement without human intervention.
3. Adoption of Secure Coding Practices: Microsoft will utilize AI for threat modeling automation and adopt memory-safe languages like Rust to enhance security at the language level and eliminate specific software vulnerabilities.
4. Azure Tenant Baseline Controls: Microsoft will implement Azure tenant baseline controls across internal tenants by default, reducing engineering effort for configuration management. The initiative aims for 100% auto-remediation without impacting service availability.
5. Transparency in Vulnerability Reporting: Microsoft intends to reduce the time taken to mitigate cloud vulnerabilities and advocate against non-disclosure agreements for third-party researchers. Promoting transparency in vulnerability reporting is a key focus of the initiative.

Conclusion:

While Microsoft deserves some of the flack for the attack they had, I don’t think they deserve all of it. This wasn’t some simple breach where an employee plugged in a USB they found in the parking lot or logged into their personal account and saved a password. The attackers had the foresight to link a crash dump with a vulnerability in Azure. I am glad they are taking things more seriously, especially since their cloud services have really started to ramp up.

Industrial & Commercial Bank of China Ransomware Attack

The Industrial & Commercial Bank of China (ICBC) is recovering from a ransomware attack that disrupted the U.S. Treasury market, leading to equities clearing issues. ICBC, China’s largest bank and the world’s largest commercial bank by revenue, experienced connectivity problems with DTCC/NSCC, impacting its clearing customers. As a result, ICBC was unable to settle U.S. Treasury trades for other market participants. The incident prompted a temporary suspension of inbound FIX connections and order acceptance. While ICBC has not released an official statement, industry sources have confirmed the ransomware attack. Security expert Kevin Beaumont noted that an ICBC Citrix server, unpatched against the actively exploited NetScaler security bug (‘Citrix Bleed’), is now offline.

Key Points:

1. Ransomware Disruption: ICBC, China’s largest bank, faced a ransomware attack that disrupted the U.S. Treasury market, causing equities clearing issues and connectivity problems with DTCC/NSCC.
2. Impact on U.S. Treasury Trades: The attack prevented ICBC from settling U.S. Treasury trades for other market participants, affecting the bank’s clearing customers and prompting the temporary suspension of inbound FIX connections and order acceptance.
3. ICBC’s Response: While ICBC has not issued an official statement, industry sources have confirmed the ransomware attack. A security expert noted that an unpatched ICBC Citrix server, vulnerable to the ‘Citrix Bleed’ exploit, is now offline.
4. ICBC’s Profile: ICBC is the largest commercial bank in the world by revenue, reporting $214.7 billion in revenue and $53.5 billion in profits in 2022. It serves 10.7 million corporate and 720 million individual customers, with branches in 41 countries, including the United States.

Conclusion:

I don’t normally get to write about Chinese companies getting hit by cyber attackers. They do happen, but because it’s China, we don’t get to hear much about them. Since this bank is listed on a US exchange, they had to report it. What is even more interesting is that a Citrix Server that had the Citrix Bleed bug on it was never patched. We don’t know if that was the cause,, but I wouldn’t be surprised now that it is offline. Some security engineer over there is probably banging his head against the table.

Conclusion

I do hope I can get my office repaired soon. I am doing most of the work myself, so we shall see. I will keep everyone updated! Good luck to all the engineers out there, and until next time, stay safe!

“If it’s smart, it’s vulnerable.”

Twitter User

Well, there was supposed to be an audio recording for this post but I just had my wisdom teeth pulled (all 4)! My mouth is a bit swollen so this post will just be another skim like the last one. Since I last wrote, the security landscape has been absolute hell. Zero days seem to be coming out of the woodwork and large corporations continue to get hit. Here goes nothing:

MGM Breach Update

In my last Security Skim I wrote about the recent cyberattack, MGM Resorts faced. More details have come out since the breach which left customers’ data exposed. The attackers, reportedly a group called Scattered Spider, utilized a technique called vishing, a form of social engineering that manipulates victims through convincing phone calls. The hackers impersonated an employee, gaining access to MGM’s systems and causing widespread disruptions.

Key Points:

1. The Attack: MGM Resorts suffered a cyberattack, impacting their systems for several days. The attack, initiated through vishing, led to disruptions in services, including digital keys, slot machines, and online platforms.
2. Attackers’ Identity: Scattered Spider, a group skilled in social engineering, claimed responsibility. They impersonated an MGM employee, exploiting publicly available information from LinkedIn to access the company’s IT help desk and gain credentials.
3. Data Compromised: Personal customer data, including names, contact details, birthdates, and official identification numbers, was accessed. MGM Resorts has offered affected customers free credit monitoring services.
4. Vishing Technique: Vishing, a blend of voice and phishing attacks, exploits human vulnerability. Attackers use phone calls to impersonate trusted entities, making it a potent method to gain access to systems. Vishing attacks, though not new, have gained prominence due to their effectiveness.
5. Post-Breach Actions: Affected MGM customers should monitor their accounts for unusual activities, consider freezing their credit, and be cautious about phishing emails. Regularly checking bank statements and avoiding suspicious links enhances security.

Another Twitter user noticed that MGM is emergency hiring cloud engineers to come to Reno to completely rebuild their cloud environment. I’ve seen a lot of breaches in my day but the amount of damage that has been done versus the level of effort that was required is very astonishing. It also sounds like in a panic, MGM shut off the agent to sync Okta to whatever their active directory system was. In doing so, when systems came back on, the attackers still had access as Okta had not synced. I haven’t seen businesses do this enough but I have worked at a couple of places where we do a practice breach with corporate. No one wants a breach but not having a plan and panicking doesn’t help.

CURL Vulnerability is Coming to you this Thursday!

The maintainers of the cURL data transfer project have identified and are actively patching two significant vulnerabilities, including a high-severity bug affecting both the libcurl library and the curl command-line tool. cURL, a widely used open-source tool, facilitates data transfer via various network protocols such as SSL, TLS, HTTP, FTP, and SMTP.

Key Points:

1. Vulnerabilities Identified: The vulnerabilities, tracked as CVE-2023-38545 and CVE-2023-38546, are currently being addressed. The high-severity CVE-2023-38545 is regarded as one of the most severe flaws in the open source tool’s history, prompting an urgent response from the maintainers.
2. Release Date: A new version, curl 8.4.0, is set to be released on October 11, containing fixes for the high-severity CVE and another low-severity vulnerability. The maintainers have shortened the release cycle to address these critical issues promptly.
3. Severity Warning: While specific details about the vulnerabilities and affected versions have not been disclosed publicly, organizations have been alerted to the severity of the high-severity flaw. All versions released over the “last several years” are believed to be vulnerable.
4. Preparation and Response: Organizations using curl and libcurl are advised to inventory and scan their systems to identify potentially vulnerable versions. Immediate implementation of the updates upon release is crucial to safeguard systems against these pressing vulnerabilities. Member distributions have been notified in advance to prepare patches.
5. Impact: Unknown, and details won’t be released until tomorrow!
6. Restricted Disclosure: Details about the vulnerabilities will be disclosed only with the release of curl 8.4.0 on October 11. Access to specific problem details before this date requires a support contract and a valid reason, emphasizing the urgency of preparing for the upcoming updates.

I’ve seen a lot of vulnerabilities this year and in my lifetime but this one scares the crap out of me. Curl is used everywhere, and on many Linux distributions, it comes standard with the install. There are also thousands of devices out there that use Curl, but the manufacturer no longer updates. Expect a lot of patches to be issued over the next couple of days. This one isn’t going to be pretty.

Prolific Cyber Threat Exploits WordPress Vulnerability, Compromising Thousands of Sites

Summary:

A significant cybersecurity threat has emerged as hackers exploit a recently patched vulnerability in the widely used tagDiv Composer plugin for WordPress. This mandatory plugin for the popular themes Newspaper and Newsmag, available through Theme Forest and Envato marketplaces, has been compromised due to a cross-site scripting (XSS) flaw (CVE-2023-3169). This flaw, discovered by researcher Truoc Phan, enables hackers to inject malicious code into webpages, leading to a severity rating of 7.1 out of 10.

Key Points:

1. Exploited Vulnerability: The tagDiv Composer plugin vulnerability allows hackers to inject web scripts that redirect visitors to fraudulent websites, including tech support scams, lottery fraud, and push notification scams. The flaw was partially fixed in version 4.1 and completely patched in version 4.2.
2. Scope of Compromise: Security firm Sucuri has been monitoring this malware campaign, named Balada, since 2017. It estimates that Balada has compromised over 1 million sites in the past six years. In recent months, the number of infections has surged, with more than 17,000 sites affected, nearly double the previous month’s count. Over 9,000 of these new infections were facilitated by exploiting CVE-2023-3169.
3. Attack Techniques: The attackers employ sophisticated techniques, including randomized injections, obfuscation, use of multiple domains and subdomains, abuse of services like CloudFlare, and various approaches to target administrators of infected WordPress sites.
4. Persistence and Control: The Balada threat actor aims for persistent control over compromised sites. They create accounts with administrator privileges and inject scripts targeting logged-in site administrators. These scripts, when loaded, can emulate administrator activities, enabling unauthorized access.
5. Mitigation Measures: Website administrators using the Newspaper or Newsmag themes should diligently inspect their sites and event logs for signs of infection. Sucuri’s post provides indicators of compromise for identification. Removing malicious scripts is crucial, but it’s equally important to check for backdoor code and unauthorized admin accounts to prevent persistent access.

WordPress is such a versatile content management system that I don’t envy the developers who work on the product. Add to that plugins and themes, and the attack surface just gets bigger and bigger. That being said, I love WordPress and don’t plan on using something else.

23andMe Data Breach Exposes User Information

Summary:

Genetic testing company 23andMe confirmed a data breach where a subset of its users’ data was compromised. Hackers accessed the data by guessing login credentials and scraping information from the DNA Relatives feature, impacting users who opted to share their information. The breached data was posted on the BreachForums platform, revealing details about Ashkenazi Jews and users of Chinese descent. The hackers began selling 23andMe profiles for $1 to $10 per account, including display names, sex, birth years, and genetic ancestry results, without raw genetic data.

Key Points:

1. Breach Details: The breach did not involve a system breach but resulted from attackers guessing login credentials and scraping data from the DNA Relatives feature. The compromised information was posted on BreachForums, including details of high-profile individuals like Mark Zuckerberg, Elon Musk, and Sergey Brin.
2. Data Compromised: The breached data included display names, sex, birth years, and some genetic ancestry information but did not contain raw genetic data. The breach involved “credential stuffing,” where attackers reused passwords exposed in other breaches.
3. Credential Stuffing and Account Compromise: The technique of credential stuffing, wherein attackers use exposed credentials to infiltrate accounts with reused logins, was employed. The compromised accounts were then leveraged to scrape data visible in DNA Relatives.
4. Broader Implications: The incident raises concerns about the security of genetic information and the risks associated with sharing sensitive data on platforms designed like social networks. The breach underscores the challenges in safeguarding genetic databases and the potential consequences of making such data publicly available.

In my personal opinion, genetic information should be protected like your bank account is protected. Come up with some form of HIPPA or PCI version for genetic data and require companies like 23andMe to go through the compliance process. The good thing is that the raw genetic data was not compromised. Off the top of my head, I don’t know of many uses for raw genetic data but I have no doubt someone will find a terrible use for it.

Cloudflare, Google, and Amazon AWS Disclose HTTP/2 Rapid Reset Zero-Day Vulnerability

Summary:

Cloudflare, in collaboration with Google and Amazon AWS, has disclosed a novel zero-day vulnerability called the “HTTP/2 Rapid Reset” attack. This vulnerability exploits a weakness in the HTTP/2 protocol, enabling threat actors to generate massive Distributed Denial of Service (DDoS) attacks. By automating a trivial “request, cancel, request, cancel” pattern at scale, attackers can create a denial of service, incapacitating servers or applications using standard HTTP/2 implementations. Cloudflare detected this zero-day vulnerability in late August 2023 and has since mitigated numerous attacks, including one reaching a record-breaking 201 million requests per second.

Key Points:

1. Vulnerability Details: The Rapid Reset attack leverages the HTTP/2 protocol’s stream cancellation feature. Attackers send requests and immediately cancel them repeatedly, overwhelming servers or applications running standard HTTP/2 implementations. Despite using a relatively small botnet of around 20,000 machines, attackers achieved unprecedented request volumes, highlighting the vulnerability’s potency.
2. Impact and Mitigation: Cloudflare mitigated attacks exceeding 201 million requests per second, leading to intermittent edge instability and affecting a small number of customers with 4xx and 5xx errors. Cloudflare has developed purpose-built technology to counter this vulnerability, enhancing its mitigation capabilities. Cloudflare users are protected against this attack.
3. Responsible Disclosure: Cloudflare collaborated with industry partners and initiated responsible disclosure processes to ensure widespread protection against this vulnerability. Web server software partners are developing patches to prevent exploitation.
4. Industrywide Implications: Cloudflare’s transparency enabled early detection of the attack. Threat actors often test their tools on Cloudflare before targeting more vulnerable entities. Organizations are urged to assume a breach mindset, emphasizing proactive measures and ongoing incident management.
5. Recommendations for CSOs: CSOs are advised to understand their network’s external connectivity, assess existing security protections, deploy DDoS protection outside data centers, ensure patches for web servers and operating systems, and consider cloud-based DDoS providers for resilience. Turning off HTTP/2 and HTTP/3 is a last resort option.

I highly recommend you go and read the Cloudflare write-up linked in the first paragraph. I’d be curious to see what the resolution on this will be as HTTP/3 is most likely compromised as well. Reverting back to HTTP/1.1 isn’t really an option, as that comes with a ton of performance hits.

Conclusion

I hope you enjoyed the skim, and I will see you all next week. PLEASE make sure to keep your eye on Curl and libcurl tomorrow! Good luck to all the engineers out there, and until next time, stay safe!

“Nothing is more permanent than a temporary solution”

Old Russian Proverb

A lot has happened since I last posted a Security Skim. Some of it had to do with life getting in the way, but a lot of it had to do with the fact that I am making some changes to the Security Skim. On top of having a blog post, these articles will also be posted on Substack and YouTube. Wait, did you say Youtube? Yup, in the not-to-distant future, I will be posting these articles in video format as well! More information to come, but for now, let’s get to it.

Apple Zero-Day in the Wild (Please Update Your Devices)

If you haven’t already, please update any devices you have from Apple that you actively use. Even devices that are no longer supported got an update!

Apple released security updates to address two zero-day exploits used against a member of a civil society organization in Washington, D.C., as reported by Citizen Lab, an internet watchdog group specializing in government malware investigations. One of these exploits was a zero-click vulnerability, meaning no user interaction was required for the attack. It was part of an exploit chain used to deliver NSO Group’s malware, Pegasus, and could compromise iPhones running the latest iOS version without any victim interaction. Citizen Lab reported this vulnerability to Apple, which promptly released a patch.

It’s suggested that Apple may have discovered the second vulnerability while investigating the first. Apple also patched the second vulnerability, which it attributed to itself. Citizen Lab referred to this exploit chain as BLASTPASS because it involved PassKit, a framework for integrating Apple Pay into apps.

John Scott-Railton of Citizen Lab emphasized that civil society plays a crucial role in identifying cybersecurity threats for billions of devices worldwide. He also recommended that all iPhone users update their devices. Additionally, both Citizen Lab and Apple’s Security Engineering and Architecture team believed that Lockdown Mode, an opt-in security feature enhancing some protections and blocking others to reduce the risk of targeted attacks, could have prevented these exploits. The exploits were as follows:

ImageIO

Available for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later

Impact: Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Description: A buffer overflow issue was addressed with improved memory handling.

CVE-2023-41064: The Citizen Lab at The University of Torontoʼs Munk School

Wallet

Available for: iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later

Impact: A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Description: A validation issue was addressed with improved logic.

CVE-2023-41061: Apple

Chrome Zero Day (Related to the Apple Zero Day?)

Two Zero Days in less than a week!

Google has released an emergency security update for Chrome 116 to address a critical zero-day vulnerability, marked as CVE-2023-4863. This vulnerability is related to a heap buffer overflow issue in the WebP component of the browser. WebP is an image format supported by modern browsers like Chrome, Firefox, Safari, Edge, and Opera.

Notably, Google stated that there is evidence of an active exploit for CVE-2023-4863 in the wild. The bug was reported to Google on September 6 by Apple Security Engineering and Architecture (SEAR) and The Citizen Lab at The University of Toronto’s Munk School. Google does not plan to provide a bug bounty for this flaw.

Heap buffer overflow issues occur when an application writes more data to a memory buffer than it can hold, potentially leading to application crashes or arbitrary code execution. Google has not disclosed specific details about the bug or how it is being exploited.

The involvement of SEAR and Citizen Lab in discovering this vulnerability suggests that it may have been exploited by the same commercial spyware vendor NSO, often involved in assisting government agencies with surveillance activities. NSO has been known to typically target Android users with complex exploit chains that may include Chrome exploits.

This is the fourth zero-day vulnerability that Google has patched in Chrome in 2023, following previous patches for vulnerabilities like CVE-2023-3079, CVE-2023-2033, and CVE-2023-2136.

Users are encouraged to update their Chrome browser to the latest version (version 116.0.5845.187 for macOS and Linux, versions 116.0.5845.187/.188 for Windows) to mitigate the risk associated with this zero-day vulnerability.

In the future, I may write about the NSO group. Every year, this company comes up in the news. They seem good at finding security flaws in Apple software to exploit for their spyware. Supposively, they only sell their software to governments. Still, we all know that some governments care less privacy than others.

MGM Shutdown by Cyber Attack (Ongoing)

I don’t have much technical information on this attack. As of this writing, their website is still down, and their casino floors are still affected. The MGM Resorts attack is unusual because it disrupted daily business operations for an extended period, which is not typical of most cyberattacks that focus on data breaches and are often discovered after the fact. If I had to guess, they were either hit with a ransomware attack or the MGM cyber security team took down the affected systems themselves.

The company detected the issue on Sunday evening and initiated an investigation with assistance from cybersecurity experts. Law enforcement, including the FBI, was notified. As of now, the FBI has not provided additional information on the incident.

MGM Resorts is one of the world’s largest casino-hotel companies, generating significant revenue from its properties. In Las Vegas alone, it handles approximately 12 million room nights per year. The cyberattack disrupted crucial reservation systems for hotel rooms and restaurant reservations for over 24 hours. MGM Resorts has not yet provided further details about the incident.

The hospitality sector is a prime target for cybercriminals due to the wealth of personal data it holds, including names, addresses, passports, and credit card information. Previous data breaches have affected major hotel brands, making the industry a lucrative target for cyberattacks.

Microsoft Patch Tuesday (More Zero Days!)

Microsoft faced new zero-day vulnerabilities in its September 2023 Patch Tuesday, and the security response team has identified two of them as actively exploited in the wild:

1. CVE-2023-36802 – Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability:
   • This vulnerability is a privilege escalation flaw in Microsoft Streaming Service Proxy, part of the Microsoft Stream video communications service.
   • It has a severity score of 7.8/10, according to the Common Vulnerability Scoring System (CVSS).
   • An attacker could gain SYSTEM privileges on a compromised system if successfully exploited.
2. CVE-2023-36761 – Microsoft Word Information Disclosure Vulnerability:
   • This zero-day vulnerability is an information-disclosure issue found in Microsoft Word.
   • Exploiting this vulnerability could lead to the disclosure of NTLM hashes, which could potentially be used maliciously.

Microsoft has urged Windows system administrators to apply the available fixes promptly to mitigate these vulnerabilities.

The discovery of the privilege escalation flaw in Microsoft Streaming Service Proxy was credited to IBM X-Force security researcher Valentina Palmiotti and Microsoft’s internal threat-intelligence and malware-hunting teams.

However, Microsoft did not release additional details about the ongoing attacks or indicators of compromise (IOCs) related to these zero-day vulnerabilities, which is standard practice.

In total, Microsoft addressed approximately 65 documented flaws in its September Patch Tuesday, covering a range of software components, including Windows, Microsoft Office, Azure, Exchange Server, and Windows Defender. You can always rely on Microsoft to have an interesting patch Tuesday!

Adobe Again

This wouldn’t be the Security Skim without an Adobe Zero Day now, would it?

Adobe has released security updates to address a zero-day vulnerability in Acrobat and Reader that has been actively exploited in attacks. Here are the key details:

Zero-Day Vulnerability:

• The zero-day vulnerability is tracked as CVE-2023-26369.
• It affects both Windows and macOS systems.
• The vulnerability allows attackers to gain code execution after exploiting an out-of-bounds write weakness.
• Threat actors can exploit it in low-complexity attacks without requiring special privileges.
• However, the flaw can only be exploited by local attackers and requires user interaction.

Affected Products and Versions:

• The vulnerability impacts various versions of Acrobat and Acrobat Reader, including Acrobat DC and Acrobat Reader DC (Continuous), as well as Acrobat 2020 and Acrobat Reader 2020 (Classic).

Adobe’s Response:

• Adobe classified this vulnerability with a maximum priority rating.
• The company strongly advises administrators to install the update as soon as possible, ideally within a 72-hour window from the release of the security advisory.

Additional Vulnerabilities Addressed:

• Adobe also addressed security flaws in Adobe Connect and Adobe Experience Manager software.
• These flaws could allow attackers to gain arbitrary code execution on systems running unpatched software.
• The vulnerabilities fixed in Adobe Connect and Adobe Experience Manager could be used to launch reflected cross-site scripting (XSS) attacks, potentially accessing sensitive information stored by the target’s web browsers.

Adobe has been actively addressing security vulnerabilities in its software, including zero-day exploits. Administrators and users are urged to keep their Adobe software up to date to mitigate these risks and enhance security. Honestly, as much as I love some of Adobes products, I am starting to think that, like Flash, we should kill Acrobat and Reader. Whenever I get a request at work that someone wants to install Acrobat or Reader, I flinch. I know that once those programs are installed on a machine, that machine is instantly one of the most vulnerable machines on the network. It’s definitely up there with Java SE being installed.

Conclusion

I hope you enjoyed the skim, and I will see you all next week. Good luck to all the engineers out there, and until next time, stay safe!

“It takes 20 years to build a reputation and a few minutes of a cyber-incident to ruin it”

Stephane Nappo

Last week I didn’t update the latest security news or the in Defense of Microsoft post due to the Maui Wildfires. While I don’t live in Maui, my wife and her family do. We are fortunate that they are ok and didn’t lose their homes. However, they do own a large self-storage business in Lahaina and a lot of their customers completely lost their homes. Everything they had left in their lives was in those storage units. I spent the week getting a Starlink terminal out to the self-storage and writing Python scripts to access their customer data. It’s been a trying week for everyone on the island. My father-in-law has been flying supplies back in forth every day since the disaster. If you have time, please go to Redcross and read how you can help. From the calls I have been a part of, they need food and water. With that said, here is this week’s Security Skim.

MLS Provider Rapattoni Hit By Cyber Attack

A cyberattack on Rapattoni, a California-based company that provides essential online services for tracking home listings, has disrupted home buyers, sellers, real estate agents, and listing websites across the United States for five days. Rapattoni offers Multiple Listing Services (MLS) to regional real estate groups, facilitating access to data about homes on the market, purchase offers, and sales. The attack, suspected to be a ransomware incident, has rendered MLS systems unusable, impacting the ability to list new homes, update prices, mark homes as pending or sold, and list open houses. Rapattoni is actively working to restore systems and investigate the attack’s nature and scope.

One of the things I am learning while writing these skims is how many unknown companies underpin much of the online world. I am not a real estate agent, I am sure Rapattoni is well known in those circles, but I doubt many would know who they are outside it. It hasn’t been confirmed as a ransomware incident, but if it is, it shows how quickly one malicious pdf or a user downloading a fake program can destroy a business. Without network segregation, without email security, it can all go up in smoke. A decade ago, a friend told me about how the insurance company he worked at had recently been infected by ransomware. The infection was so nasty they were throwing out laptops and servers and outright replacing them.

Synack Red Team Finds Vulnerabilities ScrutisWeb (ATM Monitoring)

In early 2023, security researchers from the Synack Red Team (SRT) identified several vulnerabilities (CVE-2023-33871, CVE-2023-38257, CVE-2023-35763, and CVE-2023-35189) in the ScrutisWeb web application developed by France-based company Iagona. These vulnerabilities were patched in July 2023 with the release of ScrutisWeb version 2.1.38. The SRT members involved in the discovery were Neil Graves, Jorian van den Hout, and Malcolm Stagg.

ScrutisWeb is a secure solution used for monitoring banking and retail ATM fleets. It enables organizations to track ATMs and respond quickly to any issues. The vulnerabilities discovered by the SRT team allowed unauthorized users to perform various actions, potentially compromising sensitive information and gaining control over the application.

The vulnerabilities included:

1. CVE-2023-33871: Absolute Path Traversal Exploiting this vulnerability allowed attackers to download configurations, logs, and databases from the server by manipulating a parameter in the URL.
2. CVE-2023-35189: Remote Code Execution (RCE) This vulnerability enabled unauthenticated users to upload and execute arbitrary scripts on the server, potentially leading to command injection.
3. CVE-2023-38257: Insecure Direct Object Reference (IDOR) By manipulating a parameter in an HTTP POST request, attackers could retrieve sensitive user account information, including encrypted passwords.
4. CVE-2023-35763: Hardcoded Encryption Key The researchers discovered a hardcoded encryption key used in the application’s encryption mechanism, allowing them to decrypt passwords and gain unauthorized access.

Exploiting these vulnerabilities could provide an attacker with significant control over the ScrutisWeb application, potentially enabling them to monitor and manipulate activities on ATMs within a fleet. The ability to upload and execute custom software on ATMs could facilitate malicious activities such as bank card exfiltration and Swift transfer redirection.

Iagona promptly addressed these vulnerabilities by releasing an update to ScrutisWeb (version 2.1.38). The discovered vulnerabilities highlight the importance of robust security practices in software development. I’ve worked at two companies with hardcoded encryption keys in their code. It shouldn’t be common, but it is. For those who don’t know the Synack Red Team, check out their site. They are a company that created a platform to crowdsource vulnerabilities.

Massive Ransomware Attack Hits Canadian Dental Service, Affecting 1.5 Million Individuals

Canadian dental benefits administrator, Alberta Dental Service Corporation (ADSC), has informed approximately 1.47 million individuals that their personal information was compromised in a ransomware attack that was initially discovered on July 9. The full extent of the data breach was determined two weeks later. The breach affected individuals enrolled in the Alberta Government’s Dental Assistance for Seniors Plan, Low-Income Health Benefits Plans, and Quikcard. Quikcard brokers and dental service providers that received direct payment for health claims were also impacted.

The attackers had unauthorized access to ADSC’s network for over two months before deploying file-encrypting malware. During this period, they copied specific data from compromised systems, including files containing personal and banking information. The compromised information includes names, addresses, birth dates, government identification numbers, details of dental benefits claims, personal bank account numbers, corporate emails, and corporate bank accounts.

ADSC managed to recover the affected systems and data with minimal operational impact. While the ransomware gang responsible for the attack is not explicitly named, ADSC President Lyle Best confirmed that a ransom payment was made to the 8Base ransomware gang. The attackers provided proof that the stolen data was deleted after the payment was made. The initial intrusion vector was a phishing email, and ADSC was able to restore the encrypted data from backups. The organization has taken steps to protect accessed or copied personal and corporate information from fraudulent misuse.

Let’s be honest. There is no way the ransomware gang deleted the data. They still have it and will probably sell it to a willing buyer. Two months is a long time for an attacker to have persistent access to your network. I wasn’t able to find out how the attack happened, but I believe that government agencies or administrators should be held to the same standard as banks.

Clorox Halts Operations Amid Cyberattack, Takes Systems Offline

Clorox, a major cleaning products manufacturer, has taken certain systems offline in response to a recent cyberattack. The company detected unusual activity on its IT systems and promptly halted the activity while implementing additional security measures. As a result, some operations are temporarily impaired, and workarounds are being utilized to ensure continued service to customers. While the exact nature of the attack was not disclosed, the company informed law enforcement and is collaborating with third-party cybersecurity experts for investigation and system restoration. Clorox did not confirm data theft or provide an estimated timeline for system recovery. The investigation is ongoing, and the company is committed to updating stakeholders as appropriate.

The only information we have on this is Clorox’s Form 8K filing. All public statements have basically been the same as the 8K filing statement. This could end up being very bad or a case where they got the drop on the attacker.

Conclusion

I’ll publish the Microsoft article next week as I am still busy helping my family in Maui. Things should get back on schedule next week. I hope you enjoyed the skim, and I will see you all next week. Good luck to all the engineers out there, and until next time, stay safe!

“Even the bravest cyber defense will experience defeat when weaknesses are neglected.”

Stephane Nappo

A lot has happened in the week since I last posted. There were so many different attacks going on that I cherry-picked the most interesting ones. I am also wrapping up a post in defense of Microsoft and its recent lapses in security. This week, we have a Salesforce zero-day, a Citrix remote-code-execution vulnerability that is still being targeted, Cannon printer issues, and multiple Chinese APT making a beachhead in sensitive systems.

Salesforce Zero-Day

A sophisticated phishing campaign has been discovered, exploiting a zero-day vulnerability in Salesforce’s email services. This allows attackers to create targeted phishing emails using Salesforce’s domain and infrastructure. The phishing emails appear to come from Meta, but are sent from an “@salesforce.com” domain email address. The messages claim that the recipients’ Facebook accounts are under investigation for impersonation, prompting them to click a link that leads to a fraudulent landing page. The attack is notable because the phishing kit is hosted as a game under the Facebook apps platform using the domain apps.facebook[.]com.

I’ve seen this kind of attack via Sendgrid several years back. Despite all the news software bugs and zero-days get, email is still, by and large, the easiest way to steal data or get access to a system. I was part of a group at an old job that had to investigate a client’s Sendgrid account that had been taken over. The attacker then used the client’s account to send more phishing emails that looked legit. The attacker mostly targeted utility companies and even accessed one European power provider. In this case, attackers figured out a way to abuse automation in Salesforce’s software, which allowed them to impersonate it. Tie those emails into Facebook to spread the net wider, and you get more and more accounts. If I ever write about security, chapter one will probably begin with email.

Old Citrix Remote Execution Flaw Still Being Abused

I wrote about this RCE back in July, so why am I bringing it up again? Well, a report from, The Shadow-Server Foundation states that over 640 Citrix servers are showing as being compromised. The report, which I can’t link here as you need to either be on their mailing list, states that they saw over 15,000 servers as vulnerable when the zero-day was reported. That number has dropped significantly but is still being actively attacked. The report states that the flaw was immediately attacked by both China and Russia. The USA has given affected parts of the government till August 8th to patch their systems.

This whole mess shows how quickly attackers move and how slow some businesses can be to remediate the issues. As a cybersecurity engineer, you not only have to stay on top of every threat, but once you have found a flaw, you must get your business to move fast enough to fix the issue. I must say it’s a lot easier for attackers than for defenders.

Cannon Wifi Security Issues

Giving printers access to the interest was probably one of the dumber things mankind has ever done. Canon has issued a warning to users of various inkjet printer models, including home, office, and large format devices. It has been discovered that when these printers are initialized, their Wi-Fi connection settings are not properly wiped from the device’s memory as they should be. This oversight could potentially allow unauthorized access to sensitive data.

The issue affects a wide range of Canon printer models, spanning various ser

ies. Canon has published a document to help users determine if their specific printer model is impacted. To mitigate the risk, Canon advises users to wipe their Wi-Fi settings before allowing third party access to the printer, such as during repairs or when transferring ownership.

Basically, some programmers thought initialization was different than a reset and wipe. Frankly, that’s an easy mistake to make. For those that remember, I wrote a post in my old blog about users not resetting their devices when they return them. When I ran my reseller business, I would buy returns from Target, Amazon, or Best Buy. Many of the tech I would get would still have Apple, and Google Accounts signed in. I had full access to their lives. Wipe your stuff, people!

China Strike Again!

I have written about China a lot in the Cyber Security space. Being a US citizen, they often come up regarding breaches and attacks. I was going to mention these reports last week, but more information has come out over the following weeks, and I have decided to combine it all here. The reports in question come from Kaspersky and the New York Times:

• Zirconium’s Data Exfiltration: A hacking group known as Zirconium, believed to be working for the Chinese government, has used a set of advanced spying tools over two years to establish a “permanent channel for data exfiltration” within the industrial infrastructure. This group aims to steal data from its targets, primarily focusing on industrial and information entities across various sectors. The tools they employ include advanced implants that allow for remote access, data gathering, and exfiltration.
• Volt Typhoon’s Disruption Potential: Another Chinese hacking group referred to as Volt Typhoon has been targeting critical infrastructure, possibly linked to the People’s Liberation Army. This group’s objective is to establish long-term abilities to cause disruptions within US military bases, potentially for use during conflicts. These attacks involve planting malicious code deep within networks controlling power grids, communications systems, and water facilities serving military bases.
• Microsoft Cloud Breach: A Chinese APT, tracked as Storm-0558, targeted Microsoft’s Azure and Exchange cloud services. They acquired an inactive signing key that allowed them to forge tokens for authenticating enterprise accounts on Azure Active Directory. This breach allowed the hackers to track email accounts of about 25 organizations, including the US Departments of State and Commerce.

I’ll be writing a whole article about the Microsoft Cloud Breach this week, so I’ll avoid that one for now. The other two come as no surprise to me. Whether we like it or not, future warfare with peer nation-states won’t be with missiles and bullets but drones and cyber warfare. Think of these breaches into power control units, utilities, and government networks as tunnels under the United States. The more of these tunnels you have, the more troops you can funnel into the country and take it over. These tunnels aren’t static. Eventually, the USA finds one and destroys it. China has to keep building more so that if war finally comes, they will have many tunnels to choose from. Don’t get me wrong, the US is doing the same to China; we aren’t angels. That being said, I hope we never go to war with China. As the world gets more digital, we become more reliant on these digital systems. If there ever is a war, I can guarantee you the first strike isn’t going to be from a missile but from an attacker who can cause chaos at the click of a button.

Conclusion

On that bleak note, I hope you have a great rest of your week! I should have the Microsoft article out sometime this week. I hope you enjoyed the skim, and I will see you all next week. Good luck to all the engineers out there, and until next time, stay safe!

If you spend more on coffee than on IT security, you will be hacked. What’s more, you deserve to be hacked.

Richard Clarke

Sorry for the late post but the real world got in the way. That being said this week we got an Intel Meltdown-like flaw on AMD Chips, Ubuntu privilege escalation bug, a VMware information disclosure vulnerability, and lastly a shortage of Security Engineers in the United Kingdom. Let’s get started:

AMD Zenbleed Bug

AMD’s newer consumer, workstation, and server processors have been found to have a significant bug that can lead to data leakage at a rate of up to 30 kilobytes per core per second. The vulnerability, known as “Zenbleed” (CVE-2023-20593), was discovered by Tavis Ormandy, a member of Google’s Project Zero security team. Exploiting this bug could grant attackers access to sensitive information, such as encryption keys, root, and user passwords, from any system using an AMD Zen 2 architecture-based CPU.

The article is a bit technical as it involves understanding registers and the C language but essentially, Tavis used Fuzzing to figure out that by triggering specific registers within a precise window you can get a AMD Zen 2 processor to mispredict incorrectly to reveal information. What’s worse is that it affects basic C operations which means it can be done anywhere on the system (Virtual Machines, containers, via software, or even processes). The affected processors are:

• AMD Ryzen 3000 Series Processors
• AMD Ryzen PRO 3000 Series Processors
• AMD Ryzen Threadripper 3000 Series Processors
• AMD Ryzen 4000 Series Processors with Radeon Graphics
• AMD Ryzen PRO 4000 Series Processors
• AMD Ryzen 5000 Series Processors with Radeon Graphics
• AMD Ryzen 7020 Series Processors with Radeon Graphics
• AMD EPYC “Rome” Processors

AMD did announce that it will push a fix this month to its EPYC and PRO lineup but not to its consumer lineup. The reason for this is most likely to protect its biggest cloud clients who will be ripe targets for this kind of data leak. As frustrating as it is consumers will have to wait for a fix while AMD does the work on its cloud clients first. Personally, I would love to see a fix pushed out both for consumers and enterprise customers at the same time but I understand having a bug like that in the cloud is a major issue. On a separate note, I love guys who find these kinds of flaws via Fuzzing. The idea of throwing random unexpected data at a processor to see if it throws exceptions or crashes is something special. It just goes to show it’s impossible for an engineer to plan for everything.

Ubuntu Unprivileged Elevation Gain

Two recent Linux vulnerabilities in the Ubuntu kernel have raised concerns as they could allow unprivileged local users to gain elevated privileges on a large number of devices. Ubuntu, a widely used Linux distribution with over 40 million users, is impacted by these flaws, known as CVE-2023-32629 and CVE-2023-2640.

These two issue stem from Overlayfs, a file system that has had security issues in the past. It actually took me a bit of time to find a PoC of the attack (Thank You Serbian Hacking Forum). Eventually, I would like to get around to writing about my overall love, hate relationship with Ubuntu and one day I will. The attack does require already having access to the affected system but could be useful chained together with other attacks.

VMware Information Disclosure Vulnerability

Another day another unprivileged elevation gain. Much like the Ubuntu vulnerabilities listed above, VMware has posted a bulletin stating, “the VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs.”

Basically, if you already have a user account and you want to gain admin rights you can look at the system audit logs to gain admin credentials. By default, VMware disables access to audit logs for normal users. I guess if your VMware admin isn’t giving you the access you need, you can always look at the audit logs!

UK Shortage of Security Engineers

The UK government released its annual report on the cyber security workforce in the UK. You can download their report from their website here but here are the basic details:

• 50% of all UK businesses have a basic cyber security skills gap, while 33% have an advanced cyber security skills gap. These figures are similar to 2022 and 2021.
• There were 160,035 cyber security job postings in the last year. This is an increase of 30% on the previous year. 37% of vacancies were reported as hard-to-fill (down from 44% in 2022, but same as 2021).
• Only 17% of the cyber sector workforce is female (down from 22% last year, but similar to 2021 and 2020) and 14% of senior roles are filled by women.
• There is an estimated shortfall of 11,200 people to meet the demand of the cyber workforce (down from 14,100 last year, largely due to slower growth of the sector).

I’ve skimmed through most of the report (it’s 100 pages) and honestly most of it doesn’t surprise me. Cyber security is an arms race and for every defense that is built, the attackers will find two different holes to penetrate those defenses. The fact that only 17% of the workforce is female also doesn’t surprise me and is a big issue. In all my years of work, I have only had 3 females that were on my team, and all at different companies. Even when I was actively interviewing and hiring candidates, it was rare to find a woman under the waves of male candidates. I do hope this changes in the future as women are just as capable as men in this field.

Conclusion

There was a Mikrotik vulnerability released this week that I wanted to talk about but after writing three paragraphs about it I decided I would actually make a blog post about it. I have a MikroTik router which makes it a lot easier to play with the PoC. Anyways, I hope you enjoyed the skim and I will see you all next week. Good luck to all the engineers out there and until next time, stay safe!

Give a man a zero-day and he’ll have access for a day, teach a man to phish and he’ll have access for life.

Unknown

My last post on recent security breaches and other security news drove a lot of traffic to the site. I also got a couple of comments stating how you all like quick and simple explanations of each threat. I mainly wrote because it keeps me updated and aware of the security threats around me in my career field. So I’ve decided to make this a weekly review of all the fun security threats engineers get to deal with. My goal is to release it every Wednesday, as that gives me time to cherry-pick the threats I want to write about. So without further ado, here is this week’s Security Skim:

Google Employee Pilot Program Disables Internet

This first one is not a security issue but rather a security engineer’s wet dream. First reported by CNBC’s Jennfier Elias, Google is running a pilot program that disables internet access to a lucky 2,500 employees. In the leaked memo, Google stated that its employees are constantly targets of cyber-attacks. In order to limit the attack surface they have decided to disable access to the internet and only allow internal tools like Gmail and Google Drive. I can’t imagine how the security team managed to pull that one off but kudos to them. For the employee, I am sure there was a lot of “feedback” that may end up reversing that policy. Also, even without the internet, email via Gmail is still a very good method of getting access to an employee. I am sure Google’s email security infrastructure is good, but nothing is perfect.

Cloudflare Releases Quarterly DDos Report

For those of you who don’t know, Cloudflare usually releases a quarterly DDos report. I am not going to spend a lot of time going over it because it is worth taking the time to read. That being said, the interesting bit for me was the mention of, “an alarming uptick in highly-randomized and sophisticated HTTP DDoS attacks over the past few months.” Threat actors deliberately engineer attacks to bypass mitigation systems by closely mimicking browser behavior, using advanced techniques like high randomization on user agents and JA3 fingerprints. At my current job, I am seeing a lot of this, and boy, is it like playing wack a mole. The report goes on to take about the overall rise in DNS-based attacks, and the move from Lot device-based attacks to VPS-based attacks (I have seen a lot of this as well). As I said, go read it when you have time because it’s worth your time.

Adobe ColdFusion 0-Day

Adobe seems to be in hot water again. Over the last week not one, not two, but three CVE’s were reported for their ColdFusion software. When first reported by Rapid7 and Crowdstrike (Love you guys) the exploits weren’t being exploited. Within a couple of days, Rapid7 reported that their customers were seeing them being exploited. Without realizing it Rapid7 and Crowdstrike had released a 0-day without Adobe having the chance to fix the issue. The CVE’s are:

• CVE-2023-29298, Improper Access Control vulnerability that could result in a Security feature bypass (Score of 7.5)
• CVE-2023-29300, affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution (Score of 9.8)
• CVE-2023-29301,  affected by an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a Security feature bypass (Score of 7.5)

All told the vulnerabilities allow an attacker to drop a web shell on the affected devices easily. To make matters worse, Adobe’s patch of CVE-2023-29298 was incomplete per Rapid7. There are already POCs floating around on GitHub and the attack is very trivial.

Citrix ADC and Citrix Gateway Security N-day

Yesterday Citrix released a security bulletin about three CVE’s affecting their ADC and Gateway products. The three are as follows:

• CVE-2023-3466, Cross-site scripting attack requiring the victim to access an attacker-controlled link in the browser while being on a network with connectivity to the NSIP (Score of 8.3)
• CVE-2023-3467, A privilege escalation vulnerability requiring authenticated access to NSIP or SNIP with management interface access (Score of 8)
• CVE-2023-3519,  Unauthenticated remote code execution requiring ADC or Gateway to be configured as a Gateway or AAA Server (Score of 9.8)

While the first two aren’t great, CVE-2023-3519 is a real doozy. Most Citrix ADC’s and Citrix gateways are configured as gateways so this affects a lot of devices. The attack itself is not complicated and I have already seen multiple POCs floating around.

Hacked Hikvision Cameras Used to Sell Child Porn

This one hits close to home as I have a child on the way. As reported by IPVM, hacked Hikvision Camera access is being sold on Telegram channels specifically for child porn. Their investigation found, “…widespread sales offers for nude videos, including “cp” (child porn), “kids room”, “family room”, “bedroom of a young girl”, “gynecological office”, and many others.” All of the footage came from Hikvision Cameras that either had not had their firmware updated or used weak passwords. The hackers used the Hik-Connect app to generate QR codes to easily shares these feeds with their customers. Before the Telegram channels were shut down, they had over 7,000 users. While the report didn’t mention any specific CVE, this is a good reminder to always change the default passwords of your devices and be careful buying smart devices. You never know what they could be leaking out to the internet.

Conclusion

It’s been a rough week for security teams and I hope that all of you take some time out for yourselves. Until next time, stay safe!