Docker is a well known application that uses operating-system-level virtualization to develop and deliver software in packages called containers. Senior software engineer Aleksa Sarai discovered a flaw that affects all versions of Docker, that could allow an attacker to gain read and write access to any file on the host system. Recently, a proof-of-concept code has been released demonstrating how an attacker could use this vulnerability.
The vulnerability stems from FollowSymlinkInScope function, allowing a basic time-of-check to time-of-use (TOCTOU) attack that gives read and write access to any file on the host system. The purpose of the FollowSymlinkInScope is to “resolve a specified path in a secure manner by treating the processes as if they were inside the Docker container.” The resolved path is not operated on immediately, meaning that an attack could potentially speculate on the gap and then add a symbolic link path that could resolve on the host with root privileges. The docker cp utility is what allows copying content from Docker containers to the host file system.
There are a few different approaches being proposed when it comes to addressing this vulnerability. Sarai proposed making changes to “chrootarchive.” This would allow archive operations to take place in a secure environment where the root is the container “rootfs.” However, this would involve changing a core piece of Docker, which is not feasible. According to Sarai, “Unfortunately, changes to this core piece of Docker are almost impossible (the TarUntar interface has many copies and re-implementations that would all need to be modified to be able to handle a new ‘root’ argument). Therefore, another approach that has been proposed is to pause the container when using the file system. This would not actually prevent all of the possible attacks. However, it would protect against some of the more basic attacks. A patch to do just this has been submitted upstream and is currently under review.
Sarai provided two different scripts to show off the exploit, one for read and one for write. Sarai explained the scripts are “...a fairly dumb reproducer which basically does a RENAME_EXCHANGE of a symlink to “/” and an empty directory in a loop, hoping to hit the race condition. Then our “user” attempts to copy a file from the path repeatedly,” explained the expert. “You can call it like this (note that since this requires exploiting a race condition, only a small percentage of the attempts succeed — however if I had made my reproducer a bit more clever about how quickly it does the RENAME_EXCHANGE it could be more likely to hit the race).” Sarai explained that the success rate with this exploit is about .06%, which seems low, but realistically, it would only take about 12 seconds for this exploit to reach success.
Sources: • https://securityaffairs.co/wordpress/86272/hacking/docker-race-condition-flaw.html
• https://nvd.nist.gov/vuln/detail/CVE-2018-
• https://github.com/moby/moby/pull/39252
Friday, May 31, 2019
Thursday, May 30, 2019
Intel VISA: Through the Rabbit Hole Undocumented Concern ??
The end of last month at Black Hat Asia 2019, Mark Ermolov and Maxim Goryachy from Positive Technologies gave a presentation titled “Intel VISA: Through the Rabbit Hole”. Slashdot characterized the presentation as researchers had discovered and abused new and undocumented features in intel chipsets.
The capability is named Intel Visualization of Internal Signals Architecture (Intel VISA) and it is a utility included in modern Intel chipsets to help with testing/debugging during manufacturing. It is included with Platform Controller Hub (PCH) chipsets, is a part of modern Intel CPUs, and functions much like a logic signal analyzer. It is able to collect signals sent from internal buses and peripherals to the PCH and CPU. Effectively this means unauthorized access to the VISA would expose ANY data to examination by an unscrupulous person to intercept and collect data from the computer memory and function at the lowest possible level.
The real question is: Is there a real threat? The researchers said they have several methods of enabling Intel VISA and capturing data, including the secretive Intel Management Engine (ME) which has been housed in the PCH since the release of the Nehalem processors and 5-Series chipsets. But there are caveats. On the positive side, Intel has not publicly disclosed the feature and is only shared with others under a non-disclosure agreement. Additionally, the feature is disabled by default, so attackers must first figure out how to enable it before exploiting it. On the negative side, the researchers found a way to disable Intel VISA using an older Intel ME vulnerability. Intel released a firmware patch that fixes that particular vulnerability in 2017 (INTEL-SA-00086), but unless there was an explicit update to the firmware (it’s not correctable via OS update) the CPU remains affected.
It’s worth noting that if the attacker has exploited the Intel ME vulnerability, they are well into your system and there is little additional capability offered via VISA that they don’t already have. But back on the negative side, if an attacker finds an alternate to enable VISA, that could indeed become a new attack vector.
The researchers indicated that they know three alternate ways to enable VISA, which they revealed in the presentation slides (link below). The bigger question remains: what other secret or undocumented modes/ features lie in Intel's CPUs? Intel may try to keep them secret from the public, but security through obscurity is no paradigm to follow.
As the researchers proved, people will uncover those secret features, and some will abuse them.
Sources:
• https://i.blackhat.com/asia-19/Thu-March-28/bh-asia-Goryachy-Ermolov-Intel-Visa-Through-the-Rabbit-Hole.pdf
• https://www.zdnet.com/article/researchers-discover-and-abuse-new-undocumented-feature-in-intel-chipsets/
The capability is named Intel Visualization of Internal Signals Architecture (Intel VISA) and it is a utility included in modern Intel chipsets to help with testing/debugging during manufacturing. It is included with Platform Controller Hub (PCH) chipsets, is a part of modern Intel CPUs, and functions much like a logic signal analyzer. It is able to collect signals sent from internal buses and peripherals to the PCH and CPU. Effectively this means unauthorized access to the VISA would expose ANY data to examination by an unscrupulous person to intercept and collect data from the computer memory and function at the lowest possible level.
The real question is: Is there a real threat? The researchers said they have several methods of enabling Intel VISA and capturing data, including the secretive Intel Management Engine (ME) which has been housed in the PCH since the release of the Nehalem processors and 5-Series chipsets. But there are caveats. On the positive side, Intel has not publicly disclosed the feature and is only shared with others under a non-disclosure agreement. Additionally, the feature is disabled by default, so attackers must first figure out how to enable it before exploiting it. On the negative side, the researchers found a way to disable Intel VISA using an older Intel ME vulnerability. Intel released a firmware patch that fixes that particular vulnerability in 2017 (INTEL-SA-00086), but unless there was an explicit update to the firmware (it’s not correctable via OS update) the CPU remains affected.
It’s worth noting that if the attacker has exploited the Intel ME vulnerability, they are well into your system and there is little additional capability offered via VISA that they don’t already have. But back on the negative side, if an attacker finds an alternate to enable VISA, that could indeed become a new attack vector.
The researchers indicated that they know three alternate ways to enable VISA, which they revealed in the presentation slides (link below). The bigger question remains: what other secret or undocumented modes/ features lie in Intel's CPUs? Intel may try to keep them secret from the public, but security through obscurity is no paradigm to follow.
As the researchers proved, people will uncover those secret features, and some will abuse them.
Sources:
• https://i.blackhat.com/asia-19/Thu-March-28/bh-asia-Goryachy-Ermolov-Intel-Visa-Through-the-Rabbit-Hole.pdf
• https://www.zdnet.com/article/researchers-discover-and-abuse-new-undocumented-feature-in-intel-chipsets/
Steganography techniques that deliver malware
Researchers at Blackberry’s Cylance Labs have discovered novel techniques utilizing steganography, the practice of concealing a file, message, image, or video within another file, message, image, or video, to load malware payloads onto victims’ machines.
The Advanced Persistent Threat (APT) group “OceanLotus”, primarily believed to be Vietnam-based, is using steganography techniques to deliver malware backdoors on compromised systems. The malware loader utilizes steganography techniques to read an encrypted payload contained within an image file to decrypt and execute the malicious payload which loads one of two backdoors onto the machine. The backdoors are associated with OceanLotus’ parent cyber espionage group, APT32, and were first discovered back in 2017, namely the Denes backdoor and the Remy backdoor.
Researchers at Cylance labs pointed out that it would not be difficult to swap out the backdoors for some other malicious payload and that what is essential is the tactic of using steganography to hide the payload and that it would still be just as effective. The threat actor would encode the image with their payload of choice before distributing it with a simple decoder to the target. The obfuscation of the malware payload loading portion of the technique is what’s impressive from a security detection point of analysis.
The group has seemingly avoided discovery using common steganography detection techniques. To accomplish this, they utilize the “bespoke” tool to encode data into the images using a least significant bit approach to both minimize visual differences between the encoded image with it’s original and to avoid detection/ analysis by discovery tools.
“The user does not interact with the image (nor is the image sent via email), rather the image is used to hide the payload from analysts/tools/monitoring software. In a way, the payload is hiding in plain sight, as an image carrying a payload will be virtually indistinguishable from an original image”, said Tom Bonner, BlackBerry Cylance director of threat research.
The payload, once executed and loaded onto the machine, then downloads Dynamic Link Libraries (DLL) and Command and Control communications libraries that are heavily obfuscated with large quantities of useless junk code, said researchers from Cylance. The junk code significantly inflates the library’s size which makes both static analysis and debugging more difficult.
Source:
• https://cyware.com/news/oceanlotus-threat-actor-group-leveragessteganography-to-deliver-backdoors-781be11c
The Advanced Persistent Threat (APT) group “OceanLotus”, primarily believed to be Vietnam-based, is using steganography techniques to deliver malware backdoors on compromised systems. The malware loader utilizes steganography techniques to read an encrypted payload contained within an image file to decrypt and execute the malicious payload which loads one of two backdoors onto the machine. The backdoors are associated with OceanLotus’ parent cyber espionage group, APT32, and were first discovered back in 2017, namely the Denes backdoor and the Remy backdoor.
Researchers at Cylance labs pointed out that it would not be difficult to swap out the backdoors for some other malicious payload and that what is essential is the tactic of using steganography to hide the payload and that it would still be just as effective. The threat actor would encode the image with their payload of choice before distributing it with a simple decoder to the target. The obfuscation of the malware payload loading portion of the technique is what’s impressive from a security detection point of analysis.
The group has seemingly avoided discovery using common steganography detection techniques. To accomplish this, they utilize the “bespoke” tool to encode data into the images using a least significant bit approach to both minimize visual differences between the encoded image with it’s original and to avoid detection/ analysis by discovery tools.
“The user does not interact with the image (nor is the image sent via email), rather the image is used to hide the payload from analysts/tools/monitoring software. In a way, the payload is hiding in plain sight, as an image carrying a payload will be virtually indistinguishable from an original image”, said Tom Bonner, BlackBerry Cylance director of threat research.
The payload, once executed and loaded onto the machine, then downloads Dynamic Link Libraries (DLL) and Command and Control communications libraries that are heavily obfuscated with large quantities of useless junk code, said researchers from Cylance. The junk code significantly inflates the library’s size which makes both static analysis and debugging more difficult.
Source:
• https://cyware.com/news/oceanlotus-threat-actor-group-leveragessteganography-to-deliver-backdoors-781be11c
NIST Mobile Application Single Sign-On: 2nd Draft of SP 1800-13 Available for Comment
The National Cybersecurity Center of Excellence (NCCoE) at NIST is seeking comments on a revised draft of the practice guide NIST SP 1800-13, Mobile Application Single Sign-On. The guide aims to help public safety first responder personnel efficiently and securely gain access to their mission-critical data via mobile devices and applications.
The goal of this project is to illustrate a method for public safety organizations to deploy efficient and interoperable multifactor authentication and single sign-on tools to protect access to sensitive information while meeting the demands of an operational environment that relies on rapid response. This revision of the original NIST SP 1800-13 was updated at the request of the public safety community to incorporate iOS version 12. Organizations are encouraged to review the draft and provide feedback for possible incorporation into the practice guide.
This project will result in a publicly available NIST Cybersecurity Practice Guide (NIST SP 1800 series) --a detailed implementation guide of the practical steps needed to implement a cybersecurity reference design that addresses a particular challenge.
The public comment period ends on June 28, 2019. See the publication details for links to the document files and instructions for submitting comments.
Publication details:
https://csrc.nist.gov/publications/detail/sp/1800-13/draft
Project homepage:
https://www.nccoe.nist.gov/projects/use-cases/mobile-sso
Saturday, May 25, 2019
What new in Windows 10 build 1903
Microsoft has always focused on building
the tools and platforms that IT needs to be successful. In this era of
digital disruption, we are working to deliver a modern workplace
experience that is loved by users and trusted by IT. This focus is at
the heart of how we build Windows 10—bringing you the latest advances in
security, IT tools, and productivity, anchored in intelligence powered
by the cloud.
I’m happy to announce that Windows 10,
version 1903 is now available through Windows Server Update Services
(WSUS) and Windows Update for Business, and will be able to be
downloaded today from Visual Studio Subscriptions, the Software Download Center (via Update Assistant or the Media Creation Tool), and the Volume Licensing Service Center[i]. Today marks the start of the servicing timeline for this Semi-Annual Channel release,
and we recommend that you begin rolling out Windows 10, version 1903 in
phases across your organization—validating that your apps, devices, and
infrastructure work well with this new release before broad deployment.
As you look to roll out this new update to
your organization, here are some of the new capabilities that will
enable you to benefit from intelligent security, simplified updates,
flexible management, and enhanced productivity. For a closer look at
these improvements, join me and my colleague Alan Meeus for a one-hour webcast on Tuesday, May 28, 2019, then bring your questions to our next Windows 10 Ask Microsoft Anything (AMA) event on Tuesday, June 4, 2019.
To see the full article go here
Tuesday, May 14, 2019
Microsoft Releases a critical Remote Code Execution vulnerability for Windows 7, Windows Server 2008 R2, and Windows Server 2008
Microsoft released fixes for a critical Remote Code Execution vulnerability, CVE-2019-0708, in Remote
Desktop Services – formerly known as Terminal Services – that
affects some older versions of Windows. The Remote Desktop Protocol
(RDP) itself is not vulnerable. This vulnerability is pre-authentication
and requires no user interaction. In other words, the vulnerability is
‘wormable’, meaning that any future malware that exploits this
vulnerability could propagate from vulnerable computer to vulnerable
computer in a similar way as the WannaCry malware spread across
the globe in 2017. While we have observed no exploitation of this
vulnerability, it is highly likely that malicious actors will write an
exploit for this vulnerability and incorporate it into their malware.
Now that I have your attention, it is important that affected systems are patched as quickly as possible to prevent such a scenario from happening. In response, we are taking the unusual step of providing a security update for all customers to protect Windows platforms, including some out-of-support versions of Windows.
Vulnerable in-support systems include Windows 7, Windows Server 2008 R2, and Windows Server 2008. Downloads for in-support versions of Windows can be found in the Microsoft Security Update Guide. Customers who use an in-support version of Windows and have automatic updates enabled are automatically protected.
Out-of-support systems include Windows 2003 and Windows XP. If you are on an out-of-support version, the best way to address this vulnerability is to upgrade to the latest version of Windows. Even so, we are making fixes available for these out-of-support versions of Windows in KB4500705.
Customers running Windows 8 and Windows 10 are not affected by this vulnerability, and it is no coincidence that later versions of Windows are unaffected. Microsoft invests heavily in strengthening the security of its products, often through major architectural improvements that are not possible to backport to earlier versions of Windows.
There is partial mitigation on affected systems that have Network Level Authentication (NLA) enabled. The affected systems are mitigated against ‘wormable’ malware or advanced malware threats that could exploit the vulnerability, as NLA requires authentication before the vulnerability can be triggered. However, affected systems are still vulnerable to Remote Code Execution (RCE) exploitation if the attacker has valid credentials that can be used to successfully authenticate.
It is for these reasons that we strongly advise that all affected systems – irrespective of whether NLA is enabled or not – should be updated as soon as possible.
Resources
Links to downloads for Windows 7, Windows 2008 R2, and Windows 2008
Links to downloads for Windows 2003 and Windows XP
Source Microsoft TechNet
Now that I have your attention, it is important that affected systems are patched as quickly as possible to prevent such a scenario from happening. In response, we are taking the unusual step of providing a security update for all customers to protect Windows platforms, including some out-of-support versions of Windows.
Vulnerable in-support systems include Windows 7, Windows Server 2008 R2, and Windows Server 2008. Downloads for in-support versions of Windows can be found in the Microsoft Security Update Guide. Customers who use an in-support version of Windows and have automatic updates enabled are automatically protected.
Out-of-support systems include Windows 2003 and Windows XP. If you are on an out-of-support version, the best way to address this vulnerability is to upgrade to the latest version of Windows. Even so, we are making fixes available for these out-of-support versions of Windows in KB4500705.
Customers running Windows 8 and Windows 10 are not affected by this vulnerability, and it is no coincidence that later versions of Windows are unaffected. Microsoft invests heavily in strengthening the security of its products, often through major architectural improvements that are not possible to backport to earlier versions of Windows.
There is partial mitigation on affected systems that have Network Level Authentication (NLA) enabled. The affected systems are mitigated against ‘wormable’ malware or advanced malware threats that could exploit the vulnerability, as NLA requires authentication before the vulnerability can be triggered. However, affected systems are still vulnerable to Remote Code Execution (RCE) exploitation if the attacker has valid credentials that can be used to successfully authenticate.
It is for these reasons that we strongly advise that all affected systems – irrespective of whether NLA is enabled or not – should be updated as soon as possible.
Resources
Links to downloads for Windows 7, Windows 2008 R2, and Windows 2008
Links to downloads for Windows 2003 and Windows XP
Source Microsoft TechNet
Wednesday, May 8, 2019
Monday, May 6, 2019
Alert: Phishing Scam Email From "sales@icann.org"
Normally I would not post a Phishing attack but this one seems to be working
|
02 May 2019
LOS ANGELES – 2 May 2019 – The Internet
Corporation for Assigned Names and Numbers ("ICANN") has received
reports that a phishing
email from "sales@icann.org"
has been sent to ICANN contracted parties.
The sales@icann.org
email address, for example, is not a valid ICANN organization email address.
Contracted parties may have recently received emails from "accounting@erp.icann.org",
which is a valid ICANN org email address. If you receive an email from the
"sales@icann.org" address, or
any other suspicious email address, do not respond. Please forward the email
in its entirety to globalsupport@icann.org.
For additional information about phishing
scams, visit https://www.icann.org/resources/pages/phishing-2013-05-03-en.
About ICANN
ICANN's mission is to help ensure a stable,
secure, and unified global Internet. To reach another person on the Internet,
you need to type an address – a name or a number – into your computer or
other device. That address must be unique so computers know where to find
each other. ICANN helps coordinate and support these unique identifiers
across the world. ICANN was formed in 1998 as a not-for-profit public-benefit
corporation with a community of participants from all over the world.
|
New NIST draft practice guide, SP 1800-15, “Securing Small-Business and Home Internet of Things (IoT) Devices
The National Cybersecurity Center of Excellence (NCCoE)
has published a preliminary draft practice guide, SP 1800-15, “Securing
Small-Business and Home Internet of Things (IoT) Devices: Mitigating
Network-Based Attacks Using Manufacturer Usage Description (MUD),” and is
seeking public comments. The popularity of IoT devices is growing rapidly, as
are concerns over their security. IoT devices are often vulnerable to malicious
actors who can exploit them directly and use them to conduct network-based
attacks. SP 1800-15 describes for IoT product developers and implementers an
approach that uses MUD to automatically limit IoT devices to sending and
receiving only the traffic that they require to perform their intended
functions.
We will use this feedback to help shape the next version
of this document.
Please
submit your comments by June 24, 2019. See the publication details link below
for a copy of the document and instructions for submitting comments.
Publication
details:
https://csrc.nist.gov/publications/detail/sp/1800-15/draft
https://csrc.nist.gov/publications/detail/sp/1800-15/draft
New NIST Drafts 8213 Reference for Randomness Beacons: Format and Protocol Version 2
NIST has released Draft NIST Internal Report (NISTIR) 8213, A Reference for Randomness Beacons: Format and Protocol Version 2, for public comment. A randomness beacon is a timed source of public randomness. It pulsates fresh randomness at expected times and makes it available to the public. The pulses contain random values that are timely generated, stored, timestamped, signed and hash-chained in a publicly-readable database. Thereafter, any external user can retrieve—via database queries—any past pulse and its associated data. Beacons offer the potential to improve fairness, auditability and efficiency in numerous societal applications that require randomness. A notable benefit of using public randomness is in enabling after-the-fact verifiability, for the purpose of public transparency.
Draft NISTIR 8213 provides a reference for implementing interoperable randomness beacons. The document defines terminology and notation, a format for pulses, a protocol for beacon operations, hash-chaining and skiplists of pulses, and the beacon interface calls. It also provides directions for how to use beacon randomness, and includes security considerations. With the release of this draft publication, NIST intends to seek constructive feedback from interested parties.
The public comment period for this draft closes on August 5, 2019. See the publication details link below for the document and instructions for submitting comments.
NOTE: A call for patent claims is included on page iv of this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy--Inclusion of Patents in ITL Publications.
Publication detaills:
https://csrc.nist.gov/publications/detail/nistir/8213/draft
NIST Randomness Beacon project:
https://www.nist.gov/programs-projects/nist-randomness-beacon
Saturday, May 4, 2019
E-mail Signature Verification Methods Secuity Issue
E-mail changed the communication world forever, allowing for instant communication as opposed to what is now commonly referred to as “snail mail”. When it was designed, security was not really a concern that was built in. Over time cryptographic methods were developed to help communicators verify the authenticity of senders through electronic signatures, such as the OpenPGP and Signed Multipurpose Internet Mail Extensions (S/MIME) standards. However, new research has discovered some serious flaws in many popular implementations of these methods.
Researchers from Ruhr University Bochum and Münster University of Applied Sciences tested 25 popular e-mail clients from various operating systems including Windows, Linux™, macOS, iOS, and Android as well as web-based clients to see how they fared against signature spoofing attacks. The team used five attack classes with the goal of the attacker being able to “create and send an email with arbitrary content to Bob whose email client falsely indicates that the email has been digitally signed by Alice” where Bob and Alice are legitimate communicators who have securely exchanged cryptographic keys/certificates.
These classes are:
• Exploiting flaws due to mishandling of Cryptographic Message Syntax (CMS).
• Performing GnuPG API injection attacks.
• MIME attacks against handling of partially signed messages.
• Displaying a valid ID on the e-mail header with a false signature.
• Using HTML and CSS to mimic valid signatures in the user interface.
The testing revealed that 14 of 20 OpenPGP clients and 15 of 22 S/MIME clients were at least partially vulnerable to these attacks. Many were able to be tricked with spoofed signatures on all UI levels, with all of the subset being able to spoof a signature even with limitations that could still go unnoticed by users. The only client to show no vulnerabilities on the OpenPGP or S/MIME tests was the web client Horde/IMP. This testing shows that just because certain standards and methods may be in wide use doesn’t necessarily mean they are secure by default. For a full list of tested clients and detailed testing methods and results, please refer to the “johnny-fired” PDF from the researchers linked below.
Sources:
• https://thehackernews.com/2019/04/email-signature-spoofing.html
• https://github.com/RUB-NDS/Johnny-You-Are-Fired/raw/master/paper/johnny-fired.pdf
• https://www.technadu.com/popular-email-clients-vulnerable-signaturespoofing-attacks/66443/05
Researchers from Ruhr University Bochum and Münster University of Applied Sciences tested 25 popular e-mail clients from various operating systems including Windows, Linux™, macOS, iOS, and Android as well as web-based clients to see how they fared against signature spoofing attacks. The team used five attack classes with the goal of the attacker being able to “create and send an email with arbitrary content to Bob whose email client falsely indicates that the email has been digitally signed by Alice” where Bob and Alice are legitimate communicators who have securely exchanged cryptographic keys/certificates.
These classes are:
• Exploiting flaws due to mishandling of Cryptographic Message Syntax (CMS).
• Performing GnuPG API injection attacks.
• MIME attacks against handling of partially signed messages.
• Displaying a valid ID on the e-mail header with a false signature.
• Using HTML and CSS to mimic valid signatures in the user interface.
The testing revealed that 14 of 20 OpenPGP clients and 15 of 22 S/MIME clients were at least partially vulnerable to these attacks. Many were able to be tricked with spoofed signatures on all UI levels, with all of the subset being able to spoof a signature even with limitations that could still go unnoticed by users. The only client to show no vulnerabilities on the OpenPGP or S/MIME tests was the web client Horde/IMP. This testing shows that just because certain standards and methods may be in wide use doesn’t necessarily mean they are secure by default. For a full list of tested clients and detailed testing methods and results, please refer to the “johnny-fired” PDF from the researchers linked below.
Sources:
• https://thehackernews.com/2019/04/email-signature-spoofing.html
• https://github.com/RUB-NDS/Johnny-You-Are-Fired/raw/master/paper/johnny-fired.pdf
• https://www.technadu.com/popular-email-clients-vulnerable-signaturespoofing-attacks/66443/05
Dells SupportAssist Vulnerability
The Dells SupportAssist software is currently associated with a vulnerability allowing Remote Code Execution (RCE) attacks. It comes pre-installed on virtually all new Dell devices running Windows®, the SupportAssist application "proactively checks the health of your system’s hardware and software. When an issue is detected, the necessary system state information is sent to Dell for troubleshooting to begin."
Dell released an advisory, DSA-2019-051: Dell SupportAssist Client Multiple Vulnerabilities, where it announced "An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables via SupportAssist client from attacker hosted sites." The vulnerability is being tracked as CVE-2019-3719 and comes with a Base Severity score 8.0 HIGH in NIST’s CVE database. MITRE has performed an analysis on the vulnerability and has also added that description to the CVE stating, “Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables.”
Primarily Dell uses the SupportAssist application to be able to install drivers and other software remotely, but to accomplish this, it must be able to detect what is already present on your system. Installing the SupportAssist package installs two packages, the SupportAssistAgent, and the Dell Hardware Support service. The services essentially expose a REST API of sorts which supports the communication between the service and Dell’s websites.
Security researcher Bill Demirkapi who discovered the vulnerability states in his blog “On start, Dell SupportAssist starts a web server (System.Net.HttpListener) on either port 8884, 8883, 8886, or port 8885. The port depends on whichever one is available, starting with 8884. On a request, the ListenerCallback located in HttpListenerServiceFacade calls ClientServiceHandler.ProcessRequest.
ClientServiceHandler.ProcessRequest, the base web server function, starts by doing integrity checks for example making sure the request came from the local machine and various other checks. Later in this article, we’ll get into some of the issues in the integrity checks, but for now most are not important to achieve RCE.”
It should also be noted that Demirkapi discovered the vulnerability in September of 2018 and promptly sent a write up to Dell explaining the RCE vulnerability. Dell confirmed the vulnerability on 11/22/2018 and finally released a patch and advisory on 4/18/2019.
Sources:
• https://nvd.nist.gov/vuln/detail/CVE20193719#vulnCurrentDescriptionTitle
• https://d4stiny.github.io/RemoteCode-Execution-on-most-Dellcomputers
Dell released an advisory, DSA-2019-051: Dell SupportAssist Client Multiple Vulnerabilities, where it announced "An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables via SupportAssist client from attacker hosted sites." The vulnerability is being tracked as CVE-2019-3719 and comes with a Base Severity score 8.0 HIGH in NIST’s CVE database. MITRE has performed an analysis on the vulnerability and has also added that description to the CVE stating, “Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables.”
Primarily Dell uses the SupportAssist application to be able to install drivers and other software remotely, but to accomplish this, it must be able to detect what is already present on your system. Installing the SupportAssist package installs two packages, the SupportAssistAgent, and the Dell Hardware Support service. The services essentially expose a REST API of sorts which supports the communication between the service and Dell’s websites.
Security researcher Bill Demirkapi who discovered the vulnerability states in his blog “On start, Dell SupportAssist starts a web server (System.Net.HttpListener) on either port 8884, 8883, 8886, or port 8885. The port depends on whichever one is available, starting with 8884. On a request, the ListenerCallback located in HttpListenerServiceFacade calls ClientServiceHandler.ProcessRequest.
ClientServiceHandler.ProcessRequest, the base web server function, starts by doing integrity checks for example making sure the request came from the local machine and various other checks. Later in this article, we’ll get into some of the issues in the integrity checks, but for now most are not important to achieve RCE.”
It should also be noted that Demirkapi discovered the vulnerability in September of 2018 and promptly sent a write up to Dell explaining the RCE vulnerability. Dell confirmed the vulnerability on 11/22/2018 and finally released a patch and advisory on 4/18/2019.
Sources:
• https://nvd.nist.gov/vuln/detail/CVE20193719#vulnCurrentDescriptionTitle
• https://d4stiny.github.io/RemoteCode-Execution-on-most-Dellcomputers
Thursday, May 2, 2019
Windows Server Summit 2019 on May 22nd, 2019
Wednesday, May 22, 2019
9:00 AM–11:00 AM Pacific Time
You’ll also:
- Discover what’s new in Windows Server 2019, Windows Admin Center, and Azure Stack HCI.
- Learn how to take advantage of Azure services to integrate your on-premises environment with the cloud.
- Get tips and tricks to modernize your evolving applications and infrastructure before support for Windows Server 2008 and 2008 R2 ends.
- Innovations in Microsoft’s hybrid strategy: Deep dive into Microsoft’s hyperconverged technologies and how to add hybrid services from Azure.
- Modernize Windows Server apps and workloads: Learn about security, Remote Desktop Services, containers, and features on demand.
- New in management and security: See what’s new in Windows Admin Center, System Center 2019, and Windows Server 2019.
- Insights and best practices: Chat with Windows Server community experts.
- Looking ahead: Learn more about Windows Server Semi-Annual Channel and Windows Server on Azure.
Register here
Hawkeye malware kit
Researchers have found a new version of the Hawkeye malware kit and have noticed that alongside technical advances, they’ve included some business improvements.
While Hawkeye has been a product since 2013, the recent change in ownership at the end of 2018 has decided that change beyond just its capabilities is in order. Providing a business via a licensing model extends the longevity and security of a revenue source and maintains the sales relationship with minimal effort. Including a terms of service that forbids illicit use sheds a small degree of liability, but including a restriction against their product being scanned by antivirus software seems to negate any possible plausible deniability. These steps seem to be an effort to distance the provider from the “troubled youth” of the malware and legitimize it to some degree but utterly fails to actually reform it.
The malware itself is found in ongoing malware campaigns since mid 2018, before the regime change. The formula adheres to many of the usual suspects: vague emails about fiscal functions and duties that sound urgent, confirmations and audits of things that require oversight, general notices of company gatherings with details not contained in the body of the email, and other pedestrian and mundane pieces of bait for the weaponized Excel hook. Sometimes an RTF or Doc file is used for older campaigns and occasionally the malicious document is stored a few more steps away in a drobox or other file sharing location.
The current attacks use the CVE-2017-11882 vulnerability, a buffer overflow vulnerability in Excel’s equation editor. It triggers the memory handling error when the data sent for the font name is too long which then allows the attacker to execute arbitrary code on the victims machine with the victims level of privilege.
At this point the attacker downloads a payload from an attacker controlled server, which decompiles itself and retrieves a final payload which cements Hawkeye in the user’s system. The researchers found tools not used in the current campaign such as Anti-Virtual machine detection, USB drive infection, and others.
Hawkeye itself offers keylogging, systems monitoring, and other espionage tools as well as a way to exfiltrate data collected and technical support for as long as your license is valid. The latest campaign hinges on a vulnerability that has since been patched. As always, update your programs and be vigilant of any suspicious documents.
Sources:
• https://securityaffairs.co/wordpress/84008/malware/hawkeyestealer.html
• https://blog.talosintelligence.com/2019/04/hawkeye-reborn.html
• https://threatpost.com/hawkeye-keylogger-malspam-campaigns/143807/
While Hawkeye has been a product since 2013, the recent change in ownership at the end of 2018 has decided that change beyond just its capabilities is in order. Providing a business via a licensing model extends the longevity and security of a revenue source and maintains the sales relationship with minimal effort. Including a terms of service that forbids illicit use sheds a small degree of liability, but including a restriction against their product being scanned by antivirus software seems to negate any possible plausible deniability. These steps seem to be an effort to distance the provider from the “troubled youth” of the malware and legitimize it to some degree but utterly fails to actually reform it.
The malware itself is found in ongoing malware campaigns since mid 2018, before the regime change. The formula adheres to many of the usual suspects: vague emails about fiscal functions and duties that sound urgent, confirmations and audits of things that require oversight, general notices of company gatherings with details not contained in the body of the email, and other pedestrian and mundane pieces of bait for the weaponized Excel hook. Sometimes an RTF or Doc file is used for older campaigns and occasionally the malicious document is stored a few more steps away in a drobox or other file sharing location.
The current attacks use the CVE-2017-11882 vulnerability, a buffer overflow vulnerability in Excel’s equation editor. It triggers the memory handling error when the data sent for the font name is too long which then allows the attacker to execute arbitrary code on the victims machine with the victims level of privilege.
At this point the attacker downloads a payload from an attacker controlled server, which decompiles itself and retrieves a final payload which cements Hawkeye in the user’s system. The researchers found tools not used in the current campaign such as Anti-Virtual machine detection, USB drive infection, and others.
Hawkeye itself offers keylogging, systems monitoring, and other espionage tools as well as a way to exfiltrate data collected and technical support for as long as your license is valid. The latest campaign hinges on a vulnerability that has since been patched. As always, update your programs and be vigilant of any suspicious documents.
Sources:
• https://securityaffairs.co/wordpress/84008/malware/hawkeyestealer.html
• https://blog.talosintelligence.com/2019/04/hawkeye-reborn.html
• https://threatpost.com/hawkeye-keylogger-malspam-campaigns/143807/
Security Issues with Macro enabled Systems
Macro enabled Office documents are a useful tool for automating advanced calculations in document files but they have a long history of abuse as well. They are easy to spot as documents containing embedded Visual Basic for Applications (VBA) code have a ‘m’ at the end of the filename, e.g .xlsm or .docm. When opening these files Microsoft Office asks if you would like to enable the embedded macros, and for good reason. They can be used to run malicious code on a target system or infect the computer with malware.
Researchers at Checkpoint recently uncovered a new malicious document campaign targeting government finance entities and several embassies in Europe. If these documents are opened with macros enabled they drop multiple malicious AutoHotKey scripts onto the target system and begin communicating with command and control servers to exfiltrate data. Specifically the document drops 4 files, the AutoHotKey program itself and 3 scripts used to gather information or take control of the computer. ‘htv.ahk’ is the most dangerous of the 3 scripts dropped, it grabs a malicious version of Teamviewer, executes it, and then sends login credentials to the attackers server.
The malicious version of Teamviewer has a few interesting modifications. First it completely hides the running instance so that the attacker can take control without the user receiving any notifications the way that the standard version would provide. It also allows for the transfer and execution of additional .exe and .dll files onto the target machine. The standard version of Teamviewer only supports transferring files; execution would be done through the Windows GUI. Later versions of the malicious Teamviewer application also provide a more traditional command and control mechanism via text based commands. This interface allows the attacker to do much more including searching for files or download and execution of files from an external webserver.
Checkpoint acknowledges that in most cases it is difficult to provide attribution for attacks such as these. In this case however they were able to find posts on a clearnet hacking forum with code samples identical to the ones used in the campaign. Beyond the identical code samples the user ‘EvaPicks’ was also talking about techniques used in the campaign.
Most high end firewalls will inspect macro enabled document files with extra scrutiny because of attacks like this. AutoHotKey is also frequently detected as malicious software by anti virus programs despite its legitimate use in task automation. Regardless end users must remain vigilant when opening files from unknown sources in order to protect sensitive information and equipment.
Sources:
• https://research.checkpoint.com/finteam-trojanized-teamviewer-againstgovernment-targets/
• https://threatpost.com/teamviewer-attacks-state-department/144014/
Researchers at Checkpoint recently uncovered a new malicious document campaign targeting government finance entities and several embassies in Europe. If these documents are opened with macros enabled they drop multiple malicious AutoHotKey scripts onto the target system and begin communicating with command and control servers to exfiltrate data. Specifically the document drops 4 files, the AutoHotKey program itself and 3 scripts used to gather information or take control of the computer. ‘htv.ahk’ is the most dangerous of the 3 scripts dropped, it grabs a malicious version of Teamviewer, executes it, and then sends login credentials to the attackers server.
The malicious version of Teamviewer has a few interesting modifications. First it completely hides the running instance so that the attacker can take control without the user receiving any notifications the way that the standard version would provide. It also allows for the transfer and execution of additional .exe and .dll files onto the target machine. The standard version of Teamviewer only supports transferring files; execution would be done through the Windows GUI. Later versions of the malicious Teamviewer application also provide a more traditional command and control mechanism via text based commands. This interface allows the attacker to do much more including searching for files or download and execution of files from an external webserver.
Checkpoint acknowledges that in most cases it is difficult to provide attribution for attacks such as these. In this case however they were able to find posts on a clearnet hacking forum with code samples identical to the ones used in the campaign. Beyond the identical code samples the user ‘EvaPicks’ was also talking about techniques used in the campaign.
Most high end firewalls will inspect macro enabled document files with extra scrutiny because of attacks like this. AutoHotKey is also frequently detected as malicious software by anti virus programs despite its legitimate use in task automation. Regardless end users must remain vigilant when opening files from unknown sources in order to protect sensitive information and equipment.
Sources:
• https://research.checkpoint.com/finteam-trojanized-teamviewer-againstgovernment-targets/
• https://threatpost.com/teamviewer-attacks-state-department/144014/
TajMahal is a highly modular piece of malware ALERT
With today’s cyber-focused society, there are numerous security companies constantly on the lookout for new variants of malware and threats that haven’t been seen before. So when new malware is discovered that not only provides a wide array of capabilities but also remained under the radar for 5 years, it begs further investigation. Researchers at Kaspersky Lab recently uncovered such a malware, which they dubbed TajMahal.
TajMahal is a highly modular piece of malware that was discovered in late 2018 attacking a Central Asian diplomatic agency. It contains 80 different plugins for various capabilities, one of the highest amounts ever seen with an APT. The developers of TajMahal have also made it very stealthy, including using behavioral detection avoidance and creating a new codebase from the ground up rather than using existing code from other sources. The malware contains 2 main modules: Tokyo and Yokohama.
While the initial stage of infection is unclear, the first stage of TajMahal is the Tokyo package. This contains 3 modules that install backdoors on the system, run PowerShell scripts, and establish contact with command and control servers. This module then downloads the second package, Yokohama.
Yokohama is the main data exfiltration module that contains most of the plugins used for obtaining data. It includes “backdoors, loaders, orchestrators, C2 communicators, audio recorders, keyloggers, screen and webcam grabbers, documents and cryptography key stealers, and even its own file indexer for the victim's machine” according to the re Exodus searchers. It can even see files that were accessed on removed USB drives and then copy that specific file the next time the drive is plugged in. The stolen data is exfiltrated using an XML file named TajMahal, hence the name researchers gave the malware itself.
While TajMahal has only been seen attacking the one organization, researchers have found some aspects of the malware that lead them to believe there may be other versions out in the wild that haven’t been detected yet. Samples studied so far suggest that the group behind the malware has been active since the Fall of 2014, so it is doubtful this will be the last that is seen from them.
Sources:
• https://thehackernews.com/2019/04/apt-malware-framework.html
• https://threatpost.com/meettajmahal/143644/
• https://securelist.com/projecttajmahal/90240/
TajMahal is a highly modular piece of malware that was discovered in late 2018 attacking a Central Asian diplomatic agency. It contains 80 different plugins for various capabilities, one of the highest amounts ever seen with an APT. The developers of TajMahal have also made it very stealthy, including using behavioral detection avoidance and creating a new codebase from the ground up rather than using existing code from other sources. The malware contains 2 main modules: Tokyo and Yokohama.
While the initial stage of infection is unclear, the first stage of TajMahal is the Tokyo package. This contains 3 modules that install backdoors on the system, run PowerShell scripts, and establish contact with command and control servers. This module then downloads the second package, Yokohama.
Yokohama is the main data exfiltration module that contains most of the plugins used for obtaining data. It includes “backdoors, loaders, orchestrators, C2 communicators, audio recorders, keyloggers, screen and webcam grabbers, documents and cryptography key stealers, and even its own file indexer for the victim's machine” according to the re Exodus searchers. It can even see files that were accessed on removed USB drives and then copy that specific file the next time the drive is plugged in. The stolen data is exfiltrated using an XML file named TajMahal, hence the name researchers gave the malware itself.
While TajMahal has only been seen attacking the one organization, researchers have found some aspects of the malware that lead them to believe there may be other versions out in the wild that haven’t been detected yet. Samples studied so far suggest that the group behind the malware has been active since the Fall of 2014, so it is doubtful this will be the last that is seen from them.
Sources:
• https://thehackernews.com/2019/04/apt-malware-framework.html
• https://threatpost.com/meettajmahal/143644/
• https://securelist.com/projecttajmahal/90240/
Spyware Now Targets iOS
The Exodus spyware now also exists in the iOS ecosystem. The package can take and deliver audio recordings, pictures, contacts, and location data. The spyware researchers note that the iOS version of the spyware delivers itself via phishing sites that imitate mobile carriers from Italy and Turkmenistan. According to research by both Lookout and Security without Boarders, the spyware appears to have developed over the span of 5 years.
The spyware works in three stages: first it lands on the victim’s machine with a lightweight dropper, then it fetches a larger second stage payload which contains several binaries, finally, the third stage typically uses the Dirty COW exploit (CVE20165195) to obtain root privileges on the infected device. Technical details suggest that it may have started life as a legitimate package for government or law-enforcement use. Details indicate that the software was very likely a well-funded project intended for the lawful intercept market. The software makes use of valid certificate-pinning and public key encryption for command-and-control communications, and geo-restrictions, along with a comprehensive well-implemented suite of surveillance features.
The Android samples led researchers to samples of an iOS variant. The attackers spoofed both Wind Tre SpA, and TMCell sites. An Italian mobile and a Turkmenistan state owned carrier respectively. In order to spread the iOS version outside of the App Store, the cybercriminals abused Apple’s enterprise provisioning system. Allowing them to sign the apps with legitimate Apple certificates. The Apple Developer Enterprise program is intended to allow organizations to distribute proprietary/in-house apps to their employees without the use of the iOS App Store. The apps themselves dovetail with the phishing sites, recommending that user keep the apps installed and under WiFi coverage to be contacted by operators for assistance. While the iOS version of the app seems to be more crude than the android counterpart. It might not have the ability to leverage known vulnerabilities, but it was still able to utilize well known API’s to exfiltrate contacts, photos, videos and audio recordings using a required push notification setting.
Exodus is thought to be linked to eSurv, an Italian software developer based in Catanzaro in Calabria who is well known for software specializing in CCTV management, surveillance drone, and facial and license-plate recognition software. eSurv is currently under investigation by Italian authorities per local news reports. Each of the phishing sites contain links to metadata such as the application name, version, icon, and an URL for the IPA file. An IPA package must contain a mobile provisioning profile with an enterprise’s certificate to be distributed outside the app store. All these packages used provisioning profiles with distribution certificates associated with the company Connexxa S.R.L.
Sources:
• https://it.slashdot.org/story/19/04/08/221253/exodus-spyware-foundtargeting-apple-ios-users
• https://threatpost.com/exodus-spyware-apple-ios/143544/
The spyware works in three stages: first it lands on the victim’s machine with a lightweight dropper, then it fetches a larger second stage payload which contains several binaries, finally, the third stage typically uses the Dirty COW exploit (CVE20165195) to obtain root privileges on the infected device. Technical details suggest that it may have started life as a legitimate package for government or law-enforcement use. Details indicate that the software was very likely a well-funded project intended for the lawful intercept market. The software makes use of valid certificate-pinning and public key encryption for command-and-control communications, and geo-restrictions, along with a comprehensive well-implemented suite of surveillance features.
The Android samples led researchers to samples of an iOS variant. The attackers spoofed both Wind Tre SpA, and TMCell sites. An Italian mobile and a Turkmenistan state owned carrier respectively. In order to spread the iOS version outside of the App Store, the cybercriminals abused Apple’s enterprise provisioning system. Allowing them to sign the apps with legitimate Apple certificates. The Apple Developer Enterprise program is intended to allow organizations to distribute proprietary/in-house apps to their employees without the use of the iOS App Store. The apps themselves dovetail with the phishing sites, recommending that user keep the apps installed and under WiFi coverage to be contacted by operators for assistance. While the iOS version of the app seems to be more crude than the android counterpart. It might not have the ability to leverage known vulnerabilities, but it was still able to utilize well known API’s to exfiltrate contacts, photos, videos and audio recordings using a required push notification setting.
Exodus is thought to be linked to eSurv, an Italian software developer based in Catanzaro in Calabria who is well known for software specializing in CCTV management, surveillance drone, and facial and license-plate recognition software. eSurv is currently under investigation by Italian authorities per local news reports. Each of the phishing sites contain links to metadata such as the application name, version, icon, and an URL for the IPA file. An IPA package must contain a mobile provisioning profile with an enterprise’s certificate to be distributed outside the app store. All these packages used provisioning profiles with distribution certificates associated with the company Connexxa S.R.L.
Sources:
• https://it.slashdot.org/story/19/04/08/221253/exodus-spyware-foundtargeting-apple-ios-users
• https://threatpost.com/exodus-spyware-apple-ios/143544/
Subscribe to:
Posts (Atom)