STE WILLIAMS

On Monday 13 May, Facebook revealed that an “advanced cyber actor” has been spying on some users of its ridiculously popular WhatsApp messaging app, thanks to a zero-day vulnerability that allowed hackers to install spyware, silently, just by calling a victim’s phone.

The vulnerability is now fixed, which means that if you’re one of WhatsApp’s 1,500,000,000 users you need to go to the well and drink up the latest version.

There’s a good chance your app’s already updated itself, but this is a serious vulnerability so we advise you to check all the same.

WhatsApp isn’t exactly shouting about this. The Facebook Security page, WhatsApp’s company website and WhatsApp’s Twitter feed are bereft of information.

The What’s New sections of the app’s Google Play and Apple App Store listings would love you to know that with the latest version of the app you can now see stickers in full size when you long press a notification but couldn’t find room for this is the only version that doesn’t allow remote spying.

Instead, Facebook has done the digital equivalent of pinning a security advisory for CVE-2019-3568 to the back of the toilet door in an unlit basement while nobody was looking. It reads as follows:

Description: A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of SRTCP packets sent to a target phone number.

Affected Versions: The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.

What the description is trying to tell you is that some people who knew about this vulnerability used phone calls to vulnerable devices to install spyware that could listens in on calls, read messages and switch on the camera.

The Telegraph reports that a “select number” of users were affected and have linked the WhatsApp-installed spyware to NSO Group – the company behind the notorious spyware-sold-to-governments known as Pegasus.

That description makes the incident sound like an attack against specific individuals rather than an indiscriminate attempt to spy on as many WhatsApp users as possible.

But that doesn’t stop other people abusing the vulnerability in other ways, so you should still update, even if you think you’re unlikely to have been affected by this attack.

How to update WhatsApp

iOS

Go to App Store Updates. If WhatsApp has automatically updated it will say Open next to it, so you don’t need to update it. If it says Update, go ahead and tap that to install the latest version (2.19.51). If you want to check the current version number, go to Settings Help within the app itself.

Android

Go to the Google Play store My Apps Games in the menu. If WhatsApp has automatically updated it will say Open next to it, so you don’t need to update it. If it says Update, go ahead and tap that to install the latest version (2.19.134). If you want to check the current version number, go to Settings Help App Info in the app itself.

Sophos Mobile

If you’re a business using Sophos Mobile, you can check that all your users’ devices are running the latest version of WhatsApp, and remotely update the app where needed.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/4MmzfU99yI8/

Security weaknesses at the heart of some of Cisco’s network routers, switches, and firewalls can be exploited by hackers to hide spyware deep inside compromised equipment.

In order to exploit these flaws, dubbed 😾😾😾 or Thrangrycat by their discoverers, a miscreant or rogue employee needs to be able to log into the vulnerable device as an administrator, and can thus already do a lot of damage or snooping on your enterprise anyway.

What makes 😾😾😾 interesting is that it can be used by an attacker to take that initial privileged access and go deeper, making fundamental changes to the way the equipment boots up so that spyware, once installed, is always secretly present and running, and can’t be patched out or removed. Normally, not even admin users are allowed to do that. The vulnerability allows malicious code to persist on compromised systems.

Technical overview

Thrangrycat comes in two parts. First, there’s a flaw (CVE-2019-1862) in the web-based user interface of the Cisco IOS XE Software that can be exploited by a logged-in administrator to execute commands as root on the underlying Linux-based shell.

A rogue admin can leverage that input-sanitization vulnerability to exploit the second part: it is possible to use the aforementioned root-level access to change the firmware (CVE-2019-1649) used to configure an on-board FPGA chip that’s used to securely boot the equipment.

FPGAs are chips with thousands of logic gates and other circuitry that can be rewired as required on-the-fly to perform custom operations in hardware. How the gates and circuits are connected and interact is defined by a bitstream stored in the motherboard firmware.

Sinister secret backdoor found in networking gear perfect for government espionage: The Chinese are – oh no, wait, it’s Cisco again

READ MORE

The FPGA in this case is configured to implement what Cisco calls its Trust Anchor module: this technology ensures the equipment boots software that is legit and hasn’t been tampered with. It verifies the integrity of the system code before allowing the main processor to execute a bootloader that starts up the whole thing.

Unfortunately, the Trust Anchor module (TAm) doesn’t check that its own data is legit: the bitstream sits unprotected in an SPI flash chip on the motherboard, and can be twiddled with by someone with root access.

Therefore, if you alter this configuration data as root, the next time the kit boots up, the FPGA will read in its tampered-with bitstream from the flash storage. This modified bitstream could cause the TAm to allow any operating system to start up, even one with malware stashed in it, and prevent any more changes to the bitstream stored in the firmware.

Thus if you get root access, you can hide your backdoor or network surveillance tools in the device’s operating system, then you can change the bitstream in the firmware to allow that malicious code to boot, and block any further attempts to change the bitstream. Then restart, watch your changes come into effect, and spy away.

It’s ingenious, but again, bear in mind, a miscreant would need admin-level access to get started, so you’re probably hosed at that point anyway. Crucially, this vuln means a snoop in your network infrastructure can persist even after you think you’ve flushed them out with software patches and password changes.

Discovery

😾😾😾 was found and reported by a team from Red Balloon Security – specifically, Jatin Kataria, Richard Housley, James Chambers, and Ang Cui – after they spent the past three years digging into FPGA-based gear. In the last year or so they have specifically looked at Cisco’s use of an FPGA chip in its TAm.

“We tried to push the envelope by using direct bitstream manipulation, a relatively new technique,” Dr Ang Cui, the chief scientist of Red Balloon Security, told The Register on Monday. “In 2012, when Cisco was introducing this, no one thought it was possible but seven years later it is.”

The full details are not going to be released until this year’s Black Hat USA security conference in August. Cisco was privately tipped off by Red Balloon Security in November 2018, and only now is the issue public. The 😾😾😾 exploits were tested on a Cisco ASR 1001-X, though plenty of devices are at risk because they use the FPGA-based TAm. The team summarized Thrangrycat thus:

An attacker with root privileges on the device can modify the contents of the FPGA anchor bitstream, which is stored unprotected in flash memory. Elements of this bitstream can be modified to disable critical functionality in the TAm. Successful modification of the bitstream is persistent, and the Trust Anchor will be disabled in subsequent boot sequences. It is also possible to lock out any software updates to the TAm’s bitstream.

Cisco has published advisories on both flaws highlighted by the researchers, and listed all affected products. Switchzilla has issued free patches to install to kill off both bugs. Obviously, if you’ve already been pwned via the secure boot hole then there’s a chance the fix for the FPGA bitstream blunder won’t work, though there is no indication anyone’s actually exploiting Thrangrycat.

Cisco, for one, told us it “is not aware of any malicious use of the vulnerability.” So, get patching. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/05/13/cisco_thrangrycat_vulnerability/

Promo IT security training specialist SANS Institute is bringing three major training events to London this summer and autumn, each offering a bumper programme of intensive courses designed to arm security professionals with the skills they need to defend against data breaches and malicious attacks.

All attendees will have the chance to prepare for valuable GIAC certification, and will be able to put their newfound knowledge to good use immediately. Here are all three, running in July, September, and October, in the UK capital:

SANS London 8-13 July

The first event runs from 8-13 of July at the Grand Connaught Rooms, offering a range of ten courses. All ten courses at SANS London July have an associated GIAC examination. The certification attempt is available at a reduced rate when bundled with training.

In addition to the unique SANS learning experience, SANS London July provides the perfect opportunity to network and socialise with like-minded security practitioners and SANS Instructors as well as the chance to put your skills to the test during the intensive two-night Core NetWars Experience.

Course topics include:

• Intrusion detection in depth
• Mostly but not solely for security analysts. Learn to determine whether an intrusion detection system alert is noteworthy or a false indication. Daily hands-on exercises reinforce the material.
• Smartphone Forensic Analysis In-Depth
• This in-depth smartphone forensic course provides examiners and investigators with advanced skills to detect, decode, decrypt, and correctly interpret evidence recovered from mobile devices.

Also on the agenda are:

• Security essentials bootcamp style.
• Defensible Security Architecture and Engineering.
• Advanced Incident Response, Threat Hunting, and Digital Forensics.
• Advanced Security Essentials – Enterprise Defender.
• Hacker Tools, Techniques, Exploits, and Incident Handling.
• Web App Penetration Testing and Ethical Hacking.
• Network Penetration Testing and Ethical Hacking.
• Security Leadership Essentials For Managers.

Book now to take advantage of the early bird discount. Save 250 EUR when you register and pay for any 4-6 day course by May 29!

Full details and registration are right here.

SANS London 23-28 September

Course topics include:

• Hacker tools, techniques, exploits, and incident handling
• Covers everything from familiar attack methods to the latest cutting-edge ones. Follow a step-by-step process for responding to incidents and examine how attackers undermine systems as well as legal issues such as employee monitoring, working with law enforcement and handling evidence.
• Cloud security architecture and operations
• Companies are keen to save money and gain efficiency by using cloud services but will security prove to be their Achilles’ heel? Start with a brief introduction to cloud security, then go on to policy and governance, technical security principles, cloud architecture, incident handling and application security.
• Automating information security with Python
• Python is a user-friendly language designed to make automating security tasks simpler. Whether you are new to coding or an expert, the course will have you creating programs that make your job easier. Learn to customise or develop your own tools.

Other courses on the agenda are as follows:

• Advanced incident response, threat hunting, and digital forensics.
• Security essentials, bootcamp style.
• Intrusion detection in depth.
• Continuous monitoring and security operations.
• Secure Coding in Java/JEE: Developing defensible applications.
• ICS/SCADA security essentials ICS active defence and incident response.

Book now to make the most of the early bird offer. Save 250 EUR when you register and pay for any 4-6 day course by August 21!

More information and registration details are right here.

SANS London 14-19 October

Course topics include:

• Introduction to cyber security
• If you have basic computer knowledge but need an introduction to cyber security, jump-start your education with a hands-on, step-by-step course covering the fundamentals of terminology, computer networks, security policies, incident response, passwords and cryptographic principles.
• Securing Linux/Unix
• An in-depth examination of Linux and Unix security issues covering configuration guidance and practical hints and tips from real-world examples, with daily hands-on exercises.
• Web app penetration testing and ethical hacking
• Web application flaws play a major role in breaches and intrusions. Probe the main vulnerabilities and learn a field-tested process to consistently find them. Just as importantly, learn to help your your organisation understand the business risks and take them seriously.

Also on the agenda are:

• Security essentials, bootcamp style.
• Hacker tools, techniques, exploits and incident handling.
• Securing Windows and PowerShell automation.
• Cloud security and DevOps automation.
• Network penetration testing and ethical hacking.

Book now to make the most of the early bird offer Save 250 EUR when you register and pay for any 4-6 day course by September 11!

All the details are right here.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/05/14/sans_london/

A security flaw in WhatsApp can be, and has been, exploited to inject spyware into victims’ smartphones: all a snoop needs to do is make a booby-trapped voice call to a target’s number, and they’re in. The victim doesn’t need to do a thing other than leave their phone on.

The Facebook-owned software suffers from a classic buffer overflow weakness. This means a successful hacker can hijack the application to run malicious code that pores over encrypted chats, eavesdrops on calls, turns on the microphone and camera, accesses photos, contacts, and other information on a handheld, and potentially further compromises the device. Call logs can be altered, too, to hide the method of infection.

To pull this off this intrusion, the attacker has to carefully manipulate packets of data sent during the process of starting a voice call with a victim; when these packets are received by the target’s smartphone, an internal buffer within WhatsApp is forced to overflow, overwriting other parts of the app’s memory and leading to the snoop commandeering the chat application.

Engineers at Facebook scrambled over the weekend to patch the hole, designated CVE-2019-3568, and freshly secured versions of WhatsApp were pushed out to users on Monday. If your phone offers to update WhatsApp for you, do it, or check for new versions manually. The vulnerability is present in the Google Android, Apple iOS, and Microsoft Windows Phone builds of the app, which is used by 1.5 billion people globally.

“A buffer overflow vulnerability in WhatsApp VoIP [voice over IP] stack allowed remote code execution via specially crafted series of SRTCP packets sent to a target phone number,” said Facebook in an advisory on Monday.

“The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.”

Surveillance

Exploiting this kind of vulnerability is non-trivial, though there are highly skilled organizations and companies out there developing tools that can achieve this level of surveillance, tools that are sold to government agencies and other groups to use against specific targets. This exploit would be perfect for a nation’s spies keen to pry into the lives of persons of interest.

After all, why bother cracking WhatsApp’s strong end-to-end encryption when you can overflow a buffer and hack the code itself?

“This attack has all the hallmarks of a private company known to work with governments to deliver spyware that reportedly takes over the functions of mobile phone operating systems,” Facebook told the Financial Times, which broke the news. “We have briefed a number of human rights organisations to share the information we can, and to work with them to notify civil society.”

Who could such a company be?

Miscreants were first spotted exploiting the bug in early May to infect and compromise victims’ smartphones, and changes were made in WhatsApp’s backend software to block further attacks prior to the team rolling out fully patched versions of the app to users. It is not yet clear how many people were targeted and spied on in total, though the WhatsApp team is still investigating. Prosecutors in the US have been alerted.

It’s believed NSO Group built the exploits and surveillanceware used against WhatsApp users this month. The Israeli outfit, valued at $1bn, sells a highly capable spyware package, dubbed Pegasus, to governments around the world, ostensibly only allowing the suite to be used to snoop on and snare criminals and terrorists. Victims usually get a text message that tries to trick them into following a link that fetches and installs the software nasty. Now it seems NSO found a way to avoid any user interaction to achieve an automatic, silent infection.

NSO Group has been bragging that it has no-click install capabilities for quite some time. The real story here is that WhatsApp found the damn thing.

— Eva (@evacide) May 13, 2019

Pegasus, once installed on a victim’s device, can record phone calls, open messages, activate the phone’s camera and microphone for further surveillance, and relay back location data. While NSO claims it carefully vets its customers, the malware has been found on the phones of journalists, human rights campaigners, lawyers, and others.

Rap for WhatsApp chat app chaps in phone-to-pwn security nap flap

READ MORE

Citizen Lab, the Canadian non-profit that helps monitor the spread of Pegasus and its ilk, said someone tried to use the VoIP exploit as late as Sunday night to infect a UK-based human rights’ lawyer’s phone as Facebook engineers in London and San Francisco raced to push out patched versions of their software. However, we’re told, the intrusion attempt failed due to backend defenses put in place earlier that week.

It’s also understood the unnamed lawyer has helped people in Mexico and Saudi Arabia, who claim they have fallen victim to NSO Group’s spyware, sue the company in Israel. However, the exploit developers denied any shenanigans.

“Under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies,” the Israeli company said in a statement. “NSO would not, or could not, use its technology in its own right to target any person or organisation, including this individual [the UK lawyer].”

Meanwhile, Amnesty International and others will this week urge the Israeli military to ban the export of NSO Group’s software on the grounds it’s sold to governments with, ahem, questionable track records on human rights. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/05/14/whatsapp_zero_day/

Security weaknesses at the heart of some of Cisco’s network routers, switches, and firewalls can be exploited by hackers to hide spyware deep inside compromised equipment.

In order to exploit these flaws, dubbed 😾😾😾 or Thrangrycat by their discoverers, a miscreant or rogue employee needs to be able to log into the vulnerable device as an administrator, and can thus already do a lot of damage or snooping on your enterprise anyway.

What makes 😾😾😾 interesting is that it can be used by an attacker to take that initial privileged access and go deeper, making fundamental changes to the way the equipment boots up so that spyware, once installed, is always secretly present and running, and can’t be patched out or removed. Normally, not even admin users are allowed to do that. The vulnerability allows malicious code to persist on compromised systems.

Technical overview

Thrangrycat comes in two parts. First, there’s a flaw (CVE-2019-1862) in the web-based user interface of the Cisco IOS XE Software that can be exploited by a logged-in administrator to execute commands as root on the underlying Linux-based shell.

A rogue admin can leverage that input-sanitization vulnerability to exploit the second part: it is possible to use the aforementioned root-level access to change the firmware (CVE-2019-1649) used to configure an on-board FPGA chip that’s used to securely boot the equipment.

FPGAs are chips with thousands of logic gates and other circuitry that can be rewired as required on-the-fly to perform custom operations in hardware. How the gates and circuits are connected and interact is defined by a bitstream stored in the motherboard firmware.

Sinister secret backdoor found in networking gear perfect for government espionage: The Chinese are – oh no, wait, it’s Cisco again

READ MORE

The FPGA in this case is configured to implement what Cisco calls its Trust Anchor module: this technology ensures the equipment boots software that is legit and hasn’t been tampered with. It verifies the integrity of the system code before allowing the main processor to execute a bootloader that starts up the whole thing.

Unfortunately, the Trust Anchor module (TAm) doesn’t check that its own data is legit: the bitstream sits unprotected in an SPI flash chip on the motherboard, and can be twiddled with by someone with root access.

Therefore, if you alter this configuration data as root, the next time the kit boots up, the FPGA will read in its tampered-with bitstream from the flash storage. This modified bitstream could cause the TAm to allow any operating system to start up, even one with malware stashed in it, and prevent any more changes to the bitstream stored in the firmware.

Thus if you get root access, you can hide your backdoor or network surveillance tools in the device’s operating system, then you can change the bitstream in the firmware to allow that malicious code to boot, and block any further attempts to change the bitstream. Then restart, watch your changes come into effect, and spy away.

It’s ingenious, but again, bear in mind, a miscreant would need admin-level access to get started, so you’re probably hosed at that point anyway. Crucially, this vuln means a snoop in your network infrastructure can persist even after you think you’ve flushed them out with software patches and password changes.

Discovery

😾😾😾 was found and reported by a team from Red Balloon Security – specifically, Jatin Kataria, Richard Housley, James Chambers, and Ang Cui – after they spent the past three years digging into FPGA-based gear. In the last year or so they have specifically looked at Cisco’s use of an FPGA chip in its TAm.

“We tried to push the envelope by using direct bitstream manipulation, a relatively new technique,” Dr Ang Cui, the chief scientist of Red Balloon Security, told The Register on Monday. “In 2012, when Cisco was introducing this, no one thought it was possible but seven years later it is.”

The full details are not going to be released until this year’s Black Hat USA security conference in August. Cisco was privately tipped off by Red Balloon Security in November 2018, and only now is the issue public. The 😾😾😾 exploits were tested on a Cisco ASR 1001-X, though plenty of devices are at risk because they use the FPGA-based TAm. The team summarized Thrangrycat thus:

An attacker with root privileges on the device can modify the contents of the FPGA anchor bitstream, which is stored unprotected in flash memory. Elements of this bitstream can be modified to disable critical functionality in the TAm. Successful modification of the bitstream is persistent, and the Trust Anchor will be disabled in subsequent boot sequences. It is also possible to lock out any software updates to the TAm’s bitstream.

Cisco has published advisories on both flaws highlighted by the researchers, and listed all affected products. Switchzilla has issued free patches to install to kill off both bugs. Obviously, if you’ve already been pwned via the secure boot hole then there’s a chance the fix for the FPGA bitstream blunder won’t work, though there is no indication anyone’s actually exploiting Thrangrycat.

Cisco, for one, told us it “is not aware of any malicious use of the vulnerability.” So, get patching. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/05/13/cisco_thrangrycat_vulnerability/

Three marketing tools, including the Best Of The Web security logomark, were compromised in supply chain attacks, allegedly leaving website customers leaking their users’ sensitive information.

In the latest breaches to highlight the dangers of insecure software supply chains, attackers compromised three marketing services by injecting obfuscated JavaScript to install code that scraped information from thousands of websites, including user login information and credit-card details.

On May 12, Willem de Groot, a security analyst with Sanguine Security, announced that digital-marketing tool Picreel, open-source Web form plugin Alpaca, and Best Of The Web’s security logomark program had all been compromised and implanted with obfuscated JavaScript code to collect information on the visitors to any site that used the three online tools. The attack likely allowed the criminals behind the code to record keystrokes from thousands of websites, de Groot says.

“The economics of this is that, if you hack one project or supplier, you get a huge multiplier for your effort, so it is all about return on investment for the attacker,” he says. “So if he has to spend a couple weeks digging through code on a single project, but then be able to compromise thousands of stores, then that is a good investment from his perspective.”

The attack underscores that companies need to better track the risk they assume when using third-party code — especially popular open source components. Anywhere between 40% and 90% of Web application code is typically from open source components, and when companies rely on third-party services, they have to take into account that code as well, says Mike Bittner, associate director of digital security and operations at The Media Trust, a software security firm.

“Most companies have not done an audit of how much third-party code their websites and applications use, the full inventory of what is being used, and then buckling down and staying up to date,” he says. “When an app is rolled out, most companies will do their due diligence and do security testing. But after that, many will not keep up to date on the security and don’t realize their risk.”

Supply chain attacks have become a much bigger problems for companies. Often, online criminals and nation-state actors will compromise the network of a less-secure supplier as a side door into a more-secure target company. However, attackers are also targeting open source software projects and commercial software as a way to insert vulnerabilities or malicious code that can later be activated. 

In 2018, for example, security researchers notified system-management utilities maker Piriform — recently acquired by Avast — that the latest version of its Windows utility CCleaner had been infected with malware during development. And late last year, software supply-chain management firm Sonotype revealed that hackers had attempted to inject malicious code into open source software 11 times in the past 30 months.

On Sunday, de Groot announced that hackers had compromised marketing firm Picreel’s website plugin, collecting information from users of the more than 1,200 sites using the tool. Picreel removed the code, according to de Groot, but did not return a request for comment from Dark Reading.

The same day, de Groot reported that content management system provider Cloud CMS had also been impacted by a similar hack, but only a small numbers of Cloud CMS customers that used the Alpaca forms plugin and the default content distribution network (CDN) were actually impacted, according to the company. 

“This file is not part of Cloud CMS, cloudcms.com, or any of our products, customer websites, data, or applications,” said Michael Uzquiano, chief technology officer at Cloud CMS, in a statement emailed to Dark Reading. “The security of Cloud CMS, its customers, and its products has not been compromised.”

After being notified by de Groot, the company quickly disabled the free Alpaca CDN, determined the hacker had injected code at the end of the minified Alpaca file, and then reinstantiated the CDN using Amazon S3 and a clean set of files.

“Typically, folks download this from GitHub and build it on their own,” Uzquiano said. “They then integrate it into their products. The free CDN version runs on Amazon Cloud Front, using an origin-backed distribution. It is offered as a convenience to help people try out Alpaca quickly.”

In perhaps the most ironic breach, attackers compromised the JavaScript behind the Best Of The Web security logo program that checks sites before displaying the logomark. The company is investigating the issues, said Brian Prince, CEO of Best of the Web.

“Earlier today, we were notified that the script we use to display trust seals that we host on Amazon’s content delivery network (CDN) was compromised,” he told Dark Reading in an emailed statement. “We took immediate action to remedy the situation and are in the process of informing those who were affected. We will be conducting a full security audit of our hosted accounts to ensure that this does not happen again.”

The common denominator between the different compromises appears to be that the JavaScript was stored in Amazon Simple Storage Service (S3) buckets. So either the developers left the storage servers open to public access or they may have published the digital keys to the S3 buckets to the cloud, de Groot says.

“These companies have not disclosed the original entry vector,” he says. “However, what you often see is developers mistakenly store the secret access codes into their Github repositories and then they leak. And if you have these access codes, you have control of the content.”

Related Content

• Chinese APT Backdoor Found in CCleaner Supply Chain Attack
• Third-Party Cyber-Risk by the Numbers
• Financial Firms Scrutinize Third-Party Supplier Risk
• From ‘O.MG’ to NSA, What Hardware Implants Mean for Security
• Amazon Rolls Out AWS Security Hub

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/attacks-on-javascript-services-leak-info-from-websites/d/d-id/1334694?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

New form of ransomware MegaCortex shares commonalities with LockerGoga, enterprise malware recently seen in major cyberattacks.

MegaCortex, a newly discovered form of ransomware that targets global organizations, was found to share similarities with LockerGoga, a known form of malware seen in enterprise attacks.

Sophos researchers published initial findings related to MegaCortex late last week. The active ransomware variant sends victims a note designed to read as if it’s from Morpheus, Laurence Fishburne’s character in The Matrix. MegaCortex was spotted hitting several enterprise customers across the US, Europe, and Canada, with 47 attack attempts within a 48-hour period.

A few traits of MegaCortex made the campaign stand out. Victims reported the attacks originated from a compromised domain controller, and adversaries used stolen admin credentials to run a PowerShell script using the compromised controller — both traits that make it unique, says Jessica Bair, senior manager of advanced threat solutions at Cisco Systems.

Researchers note this ransomware is mostly seen among businesses with existing Emotet and Qbot infections, both of which can be used as launching points to distribute other malware. Given this, organizations previously exposed to either threat should prioritize remediation.

In the week since its early findings were disclosed, the Sophos team has become aware of more attacks involving MegaCortex and updated their research to reflect additional data on the tools, techniques, and other specifics that were not known at the time of publication.

“Since last week we have learned a lot more of the small details about the behavior and tooling used by MegaCortex,” says Chet Wisniewski, Sophos’ principal research scientist. “Many of these details are similar or identical to another ransomware named LockerGoga,” however, there isn’t much code similarity between them. Still, there are a few interesting similarities:

Links to LockerGoga
LockerGoga is a form of ransomware recently used in a major cyberattack against Norwegian aluminum firm Norsk Hydro, where it disrupted critical operations across North America and Europe. The incident forced Norsk Hydro to transition to manual operations at multiple plants; so far, it has cost the manufacturer $40 million. Once on a system, LockerGoga, which appears to be designed for targeted campaigns, changes passwords and forcibly logs victims out of systems.

The two forms of ransomware appear to behave the same way, Wisniewski explains. In both, operators leverage a compromised domain controller to push malware out to machines on a target network. From there, they open a reverse shell from the internal network to one of their command-and-control (C2) servers to execute the attacks. At least one of the C2 addresses that MegaCortex contacts has also been used by LockerGoga, researchers explain in a blog post.

MegaCortex also renames the files it plans to encrypt before encrypting them, which is unusual for ransomware — except LockerGoga, which does the same. “We suspect this may be used to prevent the malware from unintentionally encrypting files twice on an infected machine,” says Wisniewski. The tactic has another effect: it makes those renamed files “un-double-clickable” as it removes the file type association of the document with its parent application.

One of the most obvious similarities is the batch file used in the attack, Wisniewski continues. Many researchers think it’s “virtually identical” to batch files used to kill processes during LockerGoga attacks. Still, he says, none of the individual similarities are enough to make any attribution to MegaCortex’s origin. At this time, they remain a “large number of interesting coincidences.”

Contemplating Cryptographic Certificates
MegaCortex uses signed binaries with the common name (CN) mimicking the same CN used in the signed binaries of completely unrelated malware families. For example, researchers queried a CN on the cryptographic certificate used to sign one of the MegaCortex malware executables. They found malware from Rietspoof, a financial-services credential stealer with no code similarity or link to MegaCortex.

“We’re not sure why they would do this,” says Wisniewski. “Often things are thrown in to confuse those investigating the attacks, a sort of ‘false flag operation.'” The certificates for MegaCortex were issued by different authorities from the certificates they were mimicking; for example, that of Rietspoof. Some certificate authorities are now revoking the certificates used in MegaCortex attacks, Wisniewski says.

Investigation into certificates yielded another interesting finding: researchers noticed the address used by the certificate — a street address located in London suburb Romford — is connected to more than 74,000 registered UK businesses. There is also evidence the same address has been used in signing certificates that were then used to sign unrelated malware binaries. They’re still looking into this.

“We do not really understand how an apparent residential address ended up being used as a business address for some 74,000+ companies currently or formerly registered in the UK,” says Wisniewski, who adds that site for The Companies House — the United Kingdom’s registrar for companies — permits visitors to access only the first 1,000 records of this search.

Related Content:

• Demystifying the Dark Web: What You Need to Know
• Attacks on JavaScript Services Leak Info From Websites
• Hackers Still Outpace Breach Detection, Containment Efforts
• Data Dump Purportedly Reveals Details on Previously Unknown Iranian Threat Group

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/perimeter/lockergoga-megacortex-ransomware-share-unlikely-traits/d/d-id/1334696?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A linked pair of vulnerabilities could allow an attacker to take over many different types of Cisco networking components.

A recently discovered flaw in Cisco IOS XE software with the HTTP Server feature enabled could allow a user with stolen credentials to execute code on a Cisco networking device with root privileges — a significant privilege escalation attack. Dubbed Thrangrycat by the researchers at Red Balloon Security who discovered the linked pair of vulnerabilities, these flaws, designated CVE-2019-1862, would allow an attacker to first bypass the Cisco Trust Anchor module (TAm), then conduct a remote code injection with root execution.

In the first exploit, an attacker would manipulate the bitstream responsible for defining the Field-Programmable Gate Array (FPGA) that holds the code for TAm — code that executes from the FPGA hardware at boot and is designed to insulate the device from boot-time exploits. In addition to bypassing secure boot, the attack code locks all future software updates out of the TAm.

Once the TAm is compromised, the attacker can log into the device and execute code at root privilege. Cisco has released a firmware update that patches the vulnerability, and acknowledges that there are no operational work-arounds to Thrangrycat.

The company plans to present details of the vulnerability and exploit at Black Hat USA 2019 in Las Vegas.

For more, read here and here. 

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/thrangrycat-claws-cisco-customer-security/d/d-id/1334698?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

ScarCruft has evolved into a skilled and resourceful threat group, new research shows.

ScarCruft, an advanced persistent threat group known for attacking organizations with links to the Korean peninsula, has become more dangerous.

An analysis of recent data associated with the group shows that it has acquired new tools and is testing new exploits in preparation for future campaigns, Kaspersky Lab said Monday.

Telemetry associated with ScarCruft shows that the threat actor has also developed an interest in attacking mobile devices and has increasingly begun adapting legitimate tools and services in its espionage campaigns.

One of the new tools that ScarCruft has developed is a rare Bluetooth device-harvester designed to collect the names and addresses of Bluetooth devices, device type, whether it is connected, and whether it requires authentication. The malware leverages the Windows Bluetooth API to fingerprint Bluetooth devices, Kaspersky Lab said.

Victims of the ongoing campaign include investment firms and trading companies in Russia and Vietnam that appear to have links to the North Korean government. Entities in North Korea and Hong Kong also have been targeted in its latest campaign.

“ScarCruft has shown itself to be a highly-skilled and active group,” Kaspersky Lab said in a report. “Based on ScarCruft’s recent activities, we strongly believe that this group is likely to continue to evolve.”

Security researchers consider ScarCruft—also known as Reaper and Group 123—to be one of the most active APT groups in the Asian region. It is a Korean-language speaking group that is likely state-sponsored and focused on collecting information pertaining to North Korea and on businesses with connections to the reclusive country.

The group also has been targeting diplomatic missions around the world according to Kaspersky Lab. ScarCruft’s victims have included organizations in China, India, South Korea, Kuwait, and Nepal.

ScarCruft attracted some attention early last year for employing an Adobe Flash zero-day exploit in an attack campaign dubbed Operation Daybreak that targeted more than two-dozen high-profile organizations. At the time, Kaspersky Lab researchers believed the threat group had purchased the exploit in the dark market using cryptocurrency, rather than developing the exploit on its own. The researchers assessed then that the group did not have the ability to develop a zero-day exploit.

Continued Evolution

But ScarCruft has ramped up its activities over the past year and has developed into a resourceful and skilled adversary, according to Kaspersky. Like most other threat groups these days, ScarCruft’s typical attack strategy is to gain an initial foothold at a targeted organization using spear-phishing emails or watering-hole attacks. During the initial infection stage, ScarCruft downloads a dropper capable of bypassing Windows User Account Control on the compromised system.

The dropper then executes the next payload, which takes advantage of code that organizations normally use for penetration testing in order to escalate privileges. “In order to evade detection at the network level, the malware uses steganography, hiding the malicious code in an image file,” Kaspersky Lab said in its report.

ScarCruft also installs ROKRAT, a backdoor that is designed to harvest information from computers and devices on the compromised network and to send the stolen data to either Box, Dropbox, Yandex.Disk, and pCloud.

At least one of ScarCruft’s recent victims was an organization that another Korean-speaking threat group called DarkHotel had already previously compromised. Campaigns of the two groups have overlapped previously as well, suggesting that both groups are interested in the same targets despite having very different tools, techniques, and procedures.

“This leads us to believe that one group regularly lurks in the shadow of the other,” the Kaspersky Lab report said.

Related Content:

• North Korean APT Group Employed Rare Zero-Day Attack
• Asian APT Groups Most Active in Q2
• Sony Hackers Still Active, ‘Darkhotel’ Checks Out Of Hotel Hacking
• The 2019 State of Cloud Security 

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/korean-apt-adds-rare-bluetooth-device-harvester-tool/d/d-id/1334699?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

When creating security metrics, it’s critical that test methodologies cover multiple scenarios to ensure that devices perform as expected in all environments.

Networks are a complex collection of components defined by many different standards. These standards help solve network problems ranging from security to performance and usability.

An open standard is a publicly available standard that can be consumed in a variety of ways for deploying a secure solution for a network. Readers of open security standards use them to understand how a technology might be useful to solve security on the network. Implementers of open standards can create solutions to address documented security issues. Network operators read standards to understand how the different implementations work together to make a complete security solution.

These network solutions often come from different sources, which leads to the creation of a variety of testing procedures and methodologies to ensure that network components support all the security and performance requirements of the network users. Since the majority of standards are also open, it would make sense that the methods for testing are also open. But often this isn’t the case, and I think it should be.

The Case for Open Security Testing Standards
The argument I often hear against open testing standards is because network component engineers can see the test and create a solution based on the known criteria. This, to use a grade school analogy, seems like cheating since the test questions are known in advance, making it possible for a network operator to engineer their products to pass the test. If the tests have full coverage for the security features that a network operator wants, then it doesn’t matter if they know what is being tested. The outcome of the testing will be a network component that shows compliance to the full coverage of test cases. By creating an open testing environment, network component engineers can build a solution that will meet the network operators’ requirements.

When creating security metrics, it’s critical that test methodologies cover multiple scenarios to ensure that devices perform as expected in all environments. For security test methodologies, it may be necessary to randomize input parameters to cover all use cases in order to detect devices that have tuned device performance to meet test case needs rather than the needs of real use cases. For example, when measuring if a firewall detects CVEs, it’s important to run a traffic mix with vulnerabilities to ensure the device detects and blocks attacks under a variety of conditions.

Another advantage of open testing standards is that they give users and network operators the ability to see what security testing is performed and how testing is performed. Knowing what security test cases are being performed allows the operator to confirm that the test meets specific requirements. If not, they can add additional tests.

Creating a Feedback Loop
If there is an organization responsible for maintaining the standard, operators can feed that information back to cover missing areas so that in the future the network operator won’t have to run additional testing. Knowing how network components are tested also lets network operators and users better understand the meaning of results because results alone often don’t give enough context about the testing conditions of the network component. For example, it’s important to understand if a device passes security tests when there is no load but doesn’t detect attacks when it’s under load.

It’s also important to compare security results from different networking providers as a means of increasing transparency into testing methodologies, which also leads to better decision-making processes. In other words, open testing standards provide an “apples to apples” comparison opportunity. In security performance testing, for example, the results of a bandwidth test on a firewall can change greatly based on the security features that are enabled. If no open standard exists to specify that information, a user might be looking at results for two different implementations and not understand that the results differ depending on what features are enabled.

Implementers of security standards are aided by having open testing standards offering better visibility into what network operators are interested in validating. Network operators are aided by open standards testing to allow them to achieve comparisons that make network decisions easier.

Related Content:

• 6 Ways to Anger Attackers on Your Network
• Open Security Tests Gain Momentum with More Lab Partners
• Taming the Wild, West World of Security Product Testing

 

 

 Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Timothy Winters is a senior manager at the University of New Hampshire InterOperability Laboratory (UNH-IOL). He works with companies from all over the world to develop broad-based, flexible testing strategies to cost-effectively meet network interoperability … View Full Bio

Article source: https://www.darkreading.com/risk/how-open-testing-standards-can-improve-security/a/d-id/1334633?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple