STE WILLIAMS

Researchers Dig into Microsoft Office Functionality Flaws

An ongoing study investigating security bugs in Microsoft Office has so far led to two security patches.

Microsoft Office, ubiquitous on enterprise and personal computers, is a hot target for cybercriminals and a key focus area for researchers hoping to find bugs before the bad guys do.

Stan Hegt and Pieter Ceelen, both security researchers and red teamers with security firm Outflank B.V., have been exploring a range of attack techniques that abuse Microsoft Office features. Their previous research, shown at DerbyCon 2018, demonstrated how abusing legacy functionality (a macro language that predates VBA, for example) bypasses security controls.

Outflank B.V. is a small, specialized security firm focused on red teaming, Hegt explained in an interview with Dark Reading. During most engagements, they attempt to remotely compromise workstations. Remote entry is among the toughest attacker methods, says Hegt. “It forces us to innovate, but we don’t see that much innovation in this respect, in the wild.”

Early findings prompted them to analyze flaws within the functionalities embedded into the Office suite. And since DerbyCon, the duo has continued to research Office and uncover new security holes.

“To dive into Microsoft Office, there’s so much to go into,” says Hegt. “When we dove in with the purpose of DerbyCon, we noticed there were many points to go left or right with additional research. Every path led to more cool stuff we could present to the world.”

As part of their ongoing research, Hegt and Ceelen found “at least two things that were not according to spec” – and resulted in two vulnerabilities being recently patched by Microsoft. One CVE uses the old feature of fields in Microsoft Word, in combination with macro buttons (no VBA required) to steal the contents of any file on disk. Another CVE uses fields in combination with templates and headers to build phishing documents without the use of macros.

“There are plenty of new defenses being built into Microsoft Office, but there are so many archaic features,” Heft continues. “Many times, those archaic features can be exploited to evade or abuse modern defenses.”

Both bugs the team discovered can be exploited to steal information; one steals files, the other goes after credentials. Further, they say, both combine legacy features in ways that likely weren’t foreseen. The researchers note their analysis shows that the kind of Office malware currently seen in the wild is “just the tip of the iceberg” of what’s possible in Office threats.

At Black Hat Asia, coming up March 26-29 in Singapore, Hegt and Ceelen will take the stage to present their talk “Office in Wonderland,” in which they will disclose details on new Word and Excel vulnerabilities, release attack vectors which Microsoft deemed Office features, and demonstrate the security impact of the architectural design of the full Office suite.

Getting Bugged Down

As part of its January Patch Tuesday release, Microsoft issued CVE-2019-0561, a Microsoft Word information disclosure vulnerability discovered as part of Hegt and Ceelen’s research. The flaw exists when Word macro buttons are improperly used, and a successful attacker could target the vulnerability to read arbitrary files from a targeted system, according to Microsoft.

To exploit CVE-2019-0561, an attacker would have to create a malicious file and convince the user to open it. They would have to know the location of the file whose data they want to steal. Microsoft’s patch for CVE-2019-0561 addresses the vulnerability by changing the way some Word functions handle security warnings.

Microsoft’s February Patch Tuesday release yesterday included CVE-2019-0540, addressing another bug discovered by Hegt and Ceelen. This is a Microsoft Office security feature bypass flaw that exists when Office doesn’t validate URLs. Attackers can send victims specially crafted files to trick them into entering credentials and perform a phishing attack.

“A lot of organizations rely on username and password combinations,” says Ceelen. “As an attacker it’s very much in interest to go collect usernames and passwords.” This bug lets attackers send plain docs without any macros, and it will alert the target with a pop-up to enter their credentials. “We slowly see bad guys abusing these techniques,” he continues.

The patch addresses the vulnerability by ensuring Office properly validates URLs. While Ceelen points to an attacker focus on Word and Excel, given they have the longest history, he notes Microsoft has upped its patching game. “We see them making steps in all directions,” Ceelen says.

Both CVE-2019-0561 and CVE-2019-0540 were classified as Important in severity by Microsoft. Neither was publicly known or exploited in the wild prior to the release of their patches.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/endpoint/researchers-dig-into-microsoft-office-functionality-flaws/d/d-id/1333870?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 13/02/2019
  • adm

Ex-US Intel Officer Charged with Helping Iran Target Her Former Colleagues

Monica Witt, former Air Force and counterintel agent, has been indicted for conspiracy activities with Iranian government, hackers.

A former US Air Force intelligence specialist and counterintelligence agent with the Defense Department has been indicted for conspiring to provide national defense information to four Iranian nationals acting on behalf of the Iranian Revolutionary Guard Corps (IRGC). 

Monica Elfriede Witt, 39, was charged with helping the Iranian nationals target her former US intel agent colleagues via social engineering and spear-phishing attacks that aimed to install backdoor malware on their systems. The four Iranian nationals – Mojtaba Masoumpour, Behzad Mesri, Hossein Parvar, and Mohamad Paryar – were charged with conspiracy and related hacking and identity theft offenses for cyberattack campaigns in 2014 and 2015 against Witt’s former co-workers.

Witt, who defected to Iran in 2013, remains at large, as do Masoumpour, Mesri, Parvar, and Paryar. She also faces charges for allegedly providing the Iranians with information on a classified DoD mission.

Meanwhile, the US Treasury Department issued sanctions today against two Iranian organizations associated with the case, including an Iranian company behind the malware used in the attacks on the US agents.

“The charges unsealed today are the result of years of investigative work by the FBI to uncover Monica Witt’s betrayal of the oath she swore to safeguard America’s intelligence and defense secrets,” said Jay Tabb, FBI Executive Assistant Director for National Security, in a statement. “This case also highlights the FBI’s commitment to disrupting those who engage in malicious cyber activity to undermine our country’s national security. The FBI is grateful to the Department of Treasury and the United States Air Force for their continued partnership and assistance in this case.”

Facebook and ‘Target Packages’
According to the indictment, Witt provided the Iranian nationals with “target packages” to help them social-engineer her former colleagues via phony Facebook and email accounts that tried to lure the victims to click on malicious links or file attachments. In one case, the attackers built a phony Facebook profile and account using the name, information, and real photos from a legitimate US intel agent’s account. They then leveraged that account to target other agents where Witt once worked.

Social media targeting has long been a popular attack tool of Iranian cyber espionage groups. In 2017, researchers at SecureWorks detailed an elaborate attack campaign out of Iran that featured “Mia Ash,” the online persona used by the infamous Iran-based hacker team behind the destructive data-wiping attack on Saudi Aramco as well as other Middle East targets.

The highly detailed and creative social engineering ruse employed Mia – a young, London-based professional photographer who’s also an Arsenal FC fan – as the lure on Facebook, LinkedIn, and blog accounts in order to ultimately drop information-stealing spy malware onto the victim’s machine. 

Another recently identified Iranian hacking team, dubbed APT39 by FireEye, has been spotted going after telecommunications and travel industry firms in order to drill down more deeply on the comings and goings of its cyber espionage targets. APT39 takes a more “personal” touch of getting information on individuals and tries to camoflauge its activities: running an altered version of Mimikatz that bypasses anti-malware tools, for example. 

John Hultquist, director of intelligence analysis for FireEye, says while his firm hasn’t identified the attacks involving Witt, his team sees Iranian hackers regularly employ social media lures.

“Some of these operations have been very compelling, and we have seen connections to flag officers and ambassadors as well as people working in classified spaces,” he says. “However, these operations have never been perfect, and they have often been exposed by cultural blunders and a failure to understand targets. They have been found on many different platforms, including Facebook, LinkedIn, Twitter, YouTube, and even Pinterest.”

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/ex-us-intel-officer-charged-with-helping-iran-target-her-former-colleagues/d/d-id/1333868?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 13/02/2019
  • adm

Ex-US Intel Officer Charged with Helping Iran Target Her Former Colleagues

Monica Witt, former Air Force and counterintel agent, has been indicted for conspiracy activities with Iranian government, hackers.

A former US Air Force intelligence specialist and counterintelligence agent with the Defense Department has been indicted for conspiring to provide national defense information to four Iranian nationals acting on behalf of the Iranian Revolutionary Guard Corps (IRGC). 

Monica Elfriede Witt, 39, was charged with helping the Iranian nationals target her former US intel agent colleagues via social engineering and spear-phishing attacks that aimed to install backdoor malware on their systems. The four Iranian nationals – Mojtaba Masoumpour, Behzad Mesri, Hossein Parvar, and Mohamad Paryar – were charged with conspiracy and related hacking and identity theft offenses for cyberattack campaigns in 2014 and 2015 against Witt’s former co-workers.

Witt, who defected to Iran in 2013, remains at large, as do Masoumpour, Mesri, Parvar, and Paryar. She also faces charges for allegedly providing the Iranians with information on a classified DoD mission.

Meanwhile, the US Treasury Department issued sanctions today against two Iranian organizations associated with the case, including an Iranian company behind the malware used in the attacks on the US agents.

“The charges unsealed today are the result of years of investigative work by the FBI to uncover Monica Witt’s betrayal of the oath she swore to safeguard America’s intelligence and defense secrets,” said Jay Tabb, FBI Executive Assistant Director for National Security, in a statement. “This case also highlights the FBI’s commitment to disrupting those who engage in malicious cyber activity to undermine our country’s national security. The FBI is grateful to the Department of Treasury and the United States Air Force for their continued partnership and assistance in this case.”

Facebook and ‘Target Packages’
According to the indictment, Witt provided the Iranian nationals with “target packages” to help them social-engineer her former colleagues via phony Facebook and email accounts that tried to lure the victims to click on malicious links or file attachments. In one case, the attackers built a phony Facebook profile and account using the name, information, and real photos from a legitimate US intel agent’s account. They then leveraged that account to target other agents where Witt once worked.

Social media targeting has long been a popular attack tool of Iranian cyber espionage groups. In 2017, researchers at SecureWorks detailed an elaborate attack campaign out of Iran that featured “Mia Ash,” the online persona used by the infamous Iran-based hacker team behind the destructive data-wiping attack on Saudi Aramco as well as other Middle East targets.

The highly detailed and creative social engineering ruse employed Mia – a young, London-based professional photographer who’s also an Arsenal FC fan – as the lure on Facebook, LinkedIn, and blog accounts in order to ultimately drop information-stealing spy malware onto the victim’s machine. 

Another recently identified Iranian hacking team, dubbed APT39 by FireEye, has been spotted going after telecommunications and travel industry firms in order to drill down more deeply on the comings and goings of its cyber espionage targets. APT39 takes a more “personal” touch of getting information on individuals and tries to camoflauge its activities: running an altered version of Mimikatz that bypasses anti-malware tools, for example. 

John Hultquist, director of intelligence analysis for FireEye, says while his firm hasn’t identified the attacks involving Witt, his team sees Iranian hackers regularly employ social media lures.

“Some of these operations have been very compelling, and we have seen connections to flag officers and ambassadors as well as people working in classified spaces,” he says. “However, these operations have never been perfect, and they have often been exposed by cultural blunders and a failure to understand targets. They have been found on many different platforms, including Facebook, LinkedIn, Twitter, YouTube, and even Pinterest.”

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/ex-us-intel-officer-charged-with-helping-iran-target-her-former-colleagues/d/d-id/1333868?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 13/02/2019
  • adm

Windows Executable Masks Mac Malware

A new strain of MacOS malware hides inside a Windows executable to avoid detection.

A new strain of MacOS malware disguises itself as a Windows executable file to evade detection and embed itself on a system. But the malware authors aren’t exactly in the cross-platform avant-garde: the .EXE file that carries the MacOS malware will not, in fact, execute on a Windows machine.

Welcome to the malware rabbit hole.

Researchers from Trend Micro discovered the malware inside the installer for a popular firewall and network monitor called Little Snitch. Inside the standard MacOS .DMG installer is a .EXE file that is part of the mono framework — technology that’s used to allow .NET applications to run across multiple platforms, including MacOS.

The application that begins execution scans the host system for a variety of machine and environment information and sends the data to a CC server. It then downloads potentially unwanted applications (PUAs) that include adware camouflaged as Adobe Flash and a copy of Little Snitch that might, in itself, be compromised.

Malware authors typically use higher-level executables, like Adobe Flash files, JavaScript, or PHP to move between platforms. Most of those file types are now scanned by malware protection software and blocked if malicious behavior is detected.

Because .EXE files will not on their own execute on MacOS, MacOS anti-malware packages don’t typically scan or block them. This attack is aimed squarely at Macs: The .EXE file used to deliver the malware payload returns an error message if someone tries to run it on a Windows system.

According to the researchers, this particular implementation of the new technique is likely a research project on the part of malware authors. “We think that the cybercriminals are still studying the development and opportunities from this malware bundled in apps and available in torrent sites, and therefore we will continue investigating how cybercriminals can use this information and routine,” they wrote in their post on the findings.

As for how to avoid this attack, some anti-malware packages are beginning to pick up and scan these .EXE files for malicious intent. If your organization doesn’t have such software, then be sure that multi-layer security is in place and remind users to only download applications from fully vetted and verified sources.

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/cloud/windows-executable-masks-mac-malware/d/d-id/1333876?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 13/02/2019
  • adm

Windows Executable Masks Mac Malware

A new strain of MacOS malware hides inside a Windows executable to avoid detection.

A new strain of MacOS malware disguises itself as a Windows executable file to evade detection and embed itself on a system. But the malware authors aren’t exactly in the cross-platform avant-garde: the .EXE file that carries the MacOS malware will not, in fact, execute on a Windows machine.

Welcome to the malware rabbit hole.

Researchers from Trend Micro discovered the malware inside the installer for a popular firewall and network monitor called Little Snitch. Inside the standard MacOS .DMG installer is a .EXE file that is part of the mono framework — technology that’s used to allow .NET applications to run across multiple platforms, including MacOS.

The application that begins execution scans the host system for a variety of machine and environment information and sends the data to a CC server. It then downloads potentially unwanted applications (PUAs) that include adware camouflaged as Adobe Flash and a copy of Little Snitch that might, in itself, be compromised.

Malware authors typically use higher-level executables, like Adobe Flash files, JavaScript, or PHP to move between platforms. Most of those file types are now scanned by malware protection software and blocked if malicious behavior is detected.

Because .EXE files will not on their own execute on MacOS, MacOS anti-malware packages don’t typically scan or block them. This attack is aimed squarely at Macs: The .EXE file used to deliver the malware payload returns an error message if someone tries to run it on a Windows system.

According to the researchers, this particular implementation of the new technique is likely a research project on the part of malware authors. “We think that the cybercriminals are still studying the development and opportunities from this malware bundled in apps and available in torrent sites, and therefore we will continue investigating how cybercriminals can use this information and routine,” they wrote in their post on the findings.

As for how to avoid this attack, some anti-malware packages are beginning to pick up and scan these .EXE files for malicious intent. If your organization doesn’t have such software, then be sure that multi-layer security is in place and remind users to only download applications from fully vetted and verified sources.

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/cloud/windows-executable-masks-mac-malware/d/d-id/1333876?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 13/02/2019
  • adm

Security firm beats Adobe by patching reader flaw first

Adobe has patched a flaw that enabled attackers to slurp a user’s network authentication details – but not before someone else patched it first.

Security researcher Alex Inführ discovered a flaw in Adobe Reader which enabled a malicious PDF file to trigger a callback from the program. A compromised program would communicate with a server using Microsoft’s SMB protocol, sending it the user’s hashed authentication details.

The flaw stemmed from the XML Form Architecture (XFA), which is an XML structure inside a PDF that enables users to fill out forms. Loading a remote XML-based stylesheet relating to XFA with an insecure HTTPS-based URL prompts a file to ask for user confirmation before visiting that URL. By using a Universal Naming Convention (UNC) path, the attacker can stop that security dialog appearing. The result is that the infected file causes the user’s machine to send their NTML (NT Lan Manager) v2 hash to the attacker.

That’s pretty significant, because this hash is the digest of a password for the Windows NT Lan Manager authentication protocol. Various hackers have already detailed methods of cracking the NTLMv2 hash using automated tools.

Adobe released a patch for the flaw yesterday, 12 February 2019, labelling the vulnerability CVE 2019-7089 as a critical data leakage issue. However, security firm Acros Security beat the software vendor to the punch by releasing its own patch on Monday.

Acros’s 0patch service specialises in micropatches, which are applied in memory, rather than in an alteration to the program binary. Micropatches are keyhole surgery, designed to block a specific exploit from compromising a program.

These in-memory patches don’t replace regular software patches, which can make more fundamental structural changes to fix program errors, they’re there to act as a sticking plaster until the vendor applies its own fix. Vendors usually roll up patches into bundles that they release all at once, making it easier for administrators to handle all of the software fixes in one go. Yesterday, on one of its regular patch Tuesdays, Adobe fixed 71 vulnerabilities across a range of products.

Acros applied its own micropatch over two weeks after a vulnerability was published and one day before the vendor released its own official fix. The timing makes the benefits of such an in-memory patch questionable for handling zero-days (vulnerabilities for which there are no patches).

Acros co-founder Mitja Kolsek told Naked Security that the company is currently moving its product out of beta, which accounts for the delay in releasing a patch. However, he added that handling zero-days is a side benefit, rather than the focus of his business. He told us:

Patch administrators (our main target market) are justifiably more concerned about N-days, i.e., vulnerabilities that already have official patches but for one reason or another can’t be applied, and often for a very long time. This is the gap we want to close.

Accepting third party patches brings its own risks. Vendors may be reluctant to support customers who experience problems after applying third party patches, and a willingness to accept third party patches could create new opportunities for supply chain attacks.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/GXMSuBOU5f8/

  • 13/02/2019
  • adm

620 million records from 16 websites listed for sale on the Dark Web

The pockets of credential stuffers and spammers have been potentially fattened by another 617 million pilfered accounts, hacked out of 16 websites and now allegedly up for sale on the Dark Web.

The Register reports that a seller on the Dream Market – a Dark Web marketplace hidden by the encrypted layers of Tor – began offering these stolen databases with this many accounts on Monday:

  • Dubsmash: 162 million
  • MyFitnessPal: 151 million
  • MyHeritage: 92 million
  • ShareThis: 41 million
  • HauteLook: 28 million
  • Animoto: 25 million
  • EyeEm: 22 million
  • 8fit: 20 million
  • Whitepages: 18 million
  • Fotolog: 16 million
  • 500px: 15 million
  • Armor Games: 11 million
  • BookMate: 8 million
  • CoffeeMeetsBagel: 6 million
  • Artsy: 1 million
  • DataCamp: 700,000

The Register has contacted all of the sites, many of which are photography, game or fitness oriented. The publication has also listed summaries of what is, or was, purportedly for sale and for what asking price.

Some of the sites have previously reported breaches, while some told the Register to hold that thought – they’d need to check with their IT and legal departments about the alleged breaches.

One example:

Dubsmash: 161,549,210 accounts for 0.549 BTC ($1,976) total

11GB of data taken in December 2018. Each account record contains the user ID, SHA256-hashed password, username, email address, language, country, plus for some, but not all the users, the first and the last name. This alleged security breach has not been previously publicly disclosed. Dubsmash is a video-messaging application popular with millennials and younger folk.

New York City-based Dubsmash has hired law firm Lewis Brisbois to probe the online sale. Partner Simone McCormick told us:

Our office has been retained to assist Dubsmash in this matter. Thank you for your alert. We immediately launched an investigation. We plan to notify any and all individuals as appropriate. Again, thank you for bringing this to our attention.

The Dark Web seller is believed to be outside the US. He or she told the Register that the Dubsmash data has been purchased by at least one person.

He or she claims to be the hacker who exfiltrated the databases, each of which is being sold seperately. The hacker said that they typically extracted the credentials by exploiting security vulnerabilities within web apps to pull off remote code execution. Most of the records were stolen last year, the hacker/seller told the Register.

The records appear legitimate. At least some of the sites have confirmed the breaches. The records consist mainly of account holder names, email addresses, and hashed passwords that have to be cracked before they can be used. That’s cold comfort, however, in the case of passwords hashed using the obsolete MD5 algorithm, including some records from 500px.

Fortunately, 500px said that it’s now notifying users about the site being hacked and plans to reset all user passwords. It’s already forced password resets for passwords that were weakly hashed with MD5.

This haul represents a lot of purloined databases, and there are a commensurately large number of details available in the Register’s report. If you’re a user of any of those websites, there’s a good chance you’re already been notified, either when the site was breached last year or when it found out it was breached this week. If you haven’t already been notified, you might want to check out what’s up with your account(s) by looking them up in the Register’s article.

But wait, there’s more

The seller told the Register that s/he’s got as many as 20 databases. They said that they’re keeping some to themselves for private use, whatever that may mean. The seller/hacker also said that they’ve swiped about a billion accounts since they first began siphoning servers in 2012.

The goal: to make some money, to teach people a lesson about taking security seriously (such as by using two-factor authentication [2FA]), to make life easier for other hackers. … and to settle a score with a co-conspirator.

The crook waxed philosophical:

I don’t think I am deeply evil. I need the money. I need the leaks to be disclosed.

Security is just an illusion. I started hacking a long time ago. I’m just a tool used by the system. We all know measures are taken to prevent cyber attacks, but with these upcoming dumps, I’ll make hacking easier than ever.

Just a “tool used by the system?” A-yuh.

Here’s another tool: the 2FA that the seller thinks, rightly, that people should use to fend off laissez-faire operators like him/her.

This hacker/seller is trying to make it easier for other hackers to break into our accounts. Let’s all make it harder.

Another tool that can protect us from credential-stuffing thieves: unique, difficult to guess passwords, one for each website or service we use, so these burglars can’t try to break into multiple accounts when they slurp our credentials off one source and stuff them everywhere else they can think of to see if they can get in.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Mw90EmHssDs/

  • 13/02/2019
  • adm

Ep. 019 – Android holes, iOS screengrabbing and USB poo [PODCAST]

The Naked Security podcast pokes a stick into the latest critical security bugs in Android, investigates the dubious art of iOS screenshots you didn’t know about, and marvels at the USB drive that survived a seal’s digestive tract.

With Anna Brading, Paul Ducklin, Mark Stockley and Matthew Boddy.

This week’s stories:

If you enjoy the podcast, please share it with other people interested in cybersecurity, and give us a vote on iTunes and other podcasting directories.

Listen and rate via iTunes...
Sophos podcasts on Soundcloud...
RSS feed of Sophos podcasts...

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/3WX-8AMIN8E/

  • 13/02/2019
  • adm

Evil USB O.MG Cable opens up Wi-Fi to remote attacks

Take a look at one of your USB cables and you’ll probably see an icon. It might look like a trident, with a vector, circle and square stemming off the main branch.

What do those three symbols mean? You can find multiple suggestions online. We’re less inclined to believe that it was created by Al Gore to represent a three-pronged attack on the earth, and more comfortable with the suggestion that the icon likely indicates that the cable delivers three things: data, power, and audio/video.

Well, thanks to a tinkerer, that USB icon is going to need a fourth tine, perhaps ending in an image of a burglar – because he’s rigged a USB cable to allow remote attackers to attack via Wi-Fi. Security researcher Mike Grover, who goes by the alias MG, has implanted this open door into a USB-C cable that looks like any other innocuous cable you’d see lying around in a conference room.

Why bother with USB drives? They’re already suspicious enough. Go for the cable instead, his thinking was.

The cable, dubbed the O.MG Cable, can be plugged into a Linux, Mac or Windows computer and allows attackers to execute commands over Wi-Fi as if they were sitting in front of the system, issuing commands with a mouse and keyboard.

That’s because the operating system detects the cable as part of an input device, or what’s known as a human interface device (HID). Because operating systems consider HID devices to be input devices, they can be used to input commands as if those commands are being typed on a keyboard.

Grover tweeted a video of himself as he plugged an O.MG Cable into a target computer, stepped away, and sent instructions from his mobile phone. First step: open a phishing site on the system…

Next, he instructed the remotely controlled computer to navigate to the cable’s project page. Grover says the rigged cable can be used to do all these things and more:

  • Update and trigger malicious payloads
  • Kick other systems of Wi-Fi networks
  • Reflash systems

Grover told Bleeping Computer that the cable can even be configured to overcome a computer’s inactivity lock, by, for example, imitating tiny mouse movements:

It ‘works’ just like any keyboard and mouse would at a lock screen, which means you can type and move the mouse. Therefore, if you get access to the password you can unlock the device. Also, if the target relies on an inactivity timer to auto lock the machine, then it’s easy to use this cable to keep the lock from initiating by simulating user activity that the user would not notice otherwise (tiny mouse movements, etc).

Attackers don’t necessarily have to be located close to the cable to issue commands over Wi-Fi. Grover told Bleeping Computer that the Wi-Fi chip in the cable can be preconfigured to connect to a Wi-Fi network, where an attacker could potentially open a reverse shell to a remote computer, enabling commands to be executed from remote locations.

A rigged cable could be neutered with what’s known as a USB condom: a small dongle that blocks data transmission but allows for recharging. However, that wouldn’t stop the potential for a de-authentication attack, Grover said.

He suggested that the de-authentication attack could enable an attacker who can’t get into the vicinity of the targeted computer – but who’s managed to get the O.MG cable in there – to shove a victim off the Wi-Fi and onto the cable:

You aren’t in range of a wireless target, but the target person is. Using this cable, you can get them to carry the attack hardware inside a controlled area. Maybe to disrupt a camera? Maybe a fun disruption/diversion for another attack. (Imagine distributing a dozen inside an office and suddenly IT/Sec is focused on the chaos).

Indistinguishable from normal USB cables

Grover’s been working on nefarious cables for a while. Earlier prototypes from last year were born from Mr. Self Destruct: a self-destructing USB keystroke injector that can be programmed to do things on a computer and then to explode. In a Hak5 video posted in May 2018, he shows how he put one of those early prototypes together.

That prototype was practically indistinguishable from cables you see lying around in conference rooms. It did have a repair cap on the business end that was fatter than an unadulterated cable, but you’d likely have needed to put the two side by side to notice any difference.

Now that Grover has refined his design, that difference has vanished. He says the bad and the good cables are now indistinguishable.

Oh, and about that condom…

Sorry, but Grover popped a hole in that safety dongle …by creating a BadUSB Condom.

You may ask, how practical is it to get both the bad cable and the popped USB condom into the vicinity of a target system? Let’s hope we never find out.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/gtolxtwCVJY/

  • 13/02/2019
  • adm

Another flaw found in macOS Mojave’s privacy protection

Ever since Apple announced enhanced privacy protection for macOS Mojave 10.14 last September, a dedicated band of researchers has been poking away at it looking for security flaws.

Embarrassingly for Apple, it’s not proved a tough challenge with the first turning up on launch day when one researcher reported a surprising bypass of privacy protection using an ordinary app (i.e. no admin permission) to access the address book.

Accessed via System Preferences Security Privacy Privacy, other reported bypasses followed soon after, all apparently addressed by updates to Mojave.

Last week, just when it looked as if Apple might have got on top of the issue, StopTheMadness browser extension developer Jeff Johnson announced a new issue affecting all versions of Mojave including the 10.14.3 supplemental update released only days earlier.

According to Johnson, he discovered a way to access ~/Library/Safari without asking the system or user for permission – a directory that should only be accessible via privileged apps such as the macOS Finder.

There are no permission dialogs, it Just Works™. In this way, a malware app could secretly violate a user’s privacy by examining their web browsing history.

The only caveat was that the bypass doesn’t work for sandboxed apps and applied to those running outside that as “notarised” apps (i.e. those signed by a Developer ID that have passed Apple’s automated malware checks).

In a subsequent interview with Bleeping Computer, Johnson said he’d stumbled on the issue while working on his own Safari extension through an unspecified API:

So the bypass is nothing complex, it just requires Mac developer knowledge.

Just not iOS

Apple’s problem getting this feature to work is that it is trying to juggle two pressures that on iOS look easy by comparison – channelling apps’ access to sensitive folders (including Mail, Messages, Cookies, and Suggestions) through a consent layer without that becoming a chore.

It must also avoid causing problems for older apps built for a time when software’s right to access the information it wanted was taken for granted.

Is Apple closer to solving these niggles? The problem is the issue keeps getting bigger every time it’s looked at.

For instance, it appears to be common knowledge that privacy protection is powerless to stop someone bypassing it using Secure Shell to localhost (with remote login enabled).

Or perhaps using a ‘denial-of-patience’ attack in which a malevolent app continuously invokes tccutil to reset privacy settings until the user gives up in a hail of consent dialogues.

Johnson said he’d reported his discovery to Apple, which means that a future Mojave update should fix the bypass.

It’s already got its hands full fixing other security issues such as the KeySteal flaw that might allow an attacker to access passwords in the KeyChain password manager.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/kqdKqKKbOUM/

  • 13/02/2019
  • adm