blogmirnet – Page 13 – My information Resource (blog.mir.net)

NIST Releases CSWP 31, Proxy Validation and Verification for Critical AI Systems: A Proxy Design Process

NIST Cybersecurity White Paper (CSWP) 31, Proxy Validation and Verification for Critical AI Systems: A Proxy Design Process, is now available. The goal of this work is to increase trust in critical AI systems (CAIS) by developing proxy systems to verify and validate a CAIS.

This document presents a five-phase process for identifying and/or building non-critical proxy systems that have high similarity to critical artificial intelligence (AI) or machine learning (ML) systems. The non-critical proxy system is used to indirectly validate and verify the critical system by enabling the creation of difficult or dangerous test cases in a way that imbues confidence in the scenarios. The results of the test cases presented to the non-critical proxy can then be imputed to the critical system. The process involves a way to demonstrate and measure “similarity” between the two systems.

Open for Public Comment: Supply Chain Traceability Manufacturing Meta-Framework

The National Cybersecurity Center of Excellence (NCCoE) has released for public comment a draft of the Supply Chain Traceability Manufacturing Meta-Framework. The comment period is open through November 15, 2024.

Ensuring supply chain traceability is critical for maintaining product authenticity, compliance, and security in today’s complex, globalized manufacturing ecosystems. As products move through their manufacturing process stages—production, assembly, and distribution—stakeholders face increasing challenges in maintaining visibility into the history and provenance of these products. Improving the traceability of goods and materials throughout the supply chain is critical to identifying disruptions and mitigating these risks.

This publication presents a Meta-Framework designed to address these challenges by providing a structured, industry-tailorable approach to capturing, linking, and retrieving traceability data across diverse supply chains. The goal of the framework is to enhance end-to-end traceability, providing stakeholders with the tools needed to trace product provenance, ensure regulatory compliance, and bolster the resilience of the U.S. manufacturing supply chain.

We Want to Hear from You!

Please review the draft and submit comments online by using the link below [1]. We welcome your input and look forward to your comments.

Join our Community of Interest

By joining the Community of Interest (COI), you will receive project updates and the opportunity to share your expertise to help guide this project. Request to join our NCCoE Manufacturing Supply Chain COI by visiting our project page [2].

URL References:

[1] https://www.nccoe.nist.gov/projects/manufacturing-supply-chain-traceability-using-blockchain-related-technologies#project-promo

[2] https://www.nccoe.nist.gov/projects/manufacturing-supply-chain-traceability-using-blockchain-related-technologies#join-the-coi

Multiple Vulnerabilities in Foxit PDF Reader and Editor Could Allow for Arbitrary Code Execution – PATCH: NOW

OVERVIEW:
Multiple vulnerabilities have been discovered in Foxit PDF Reader and Editor, the most severe of which could result in arbitrary code execution. Foxit PDF Reader is a multilingual freemium PDF tool that can create, view, edit, digitally sign, and print PDF files. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

THREAT INTELLIGENCE:
There are currently no reports of these vulnerabilities being exploited in the wild.

SYSTEMS AFFECTED:

2024.2.3.25184 and earlier versions for Windows.
2024.2.3.25184 and all previous 2024.x versions for Windows.
2023.3.0.23028 and all previous 2023.x versions for Windows.
13.1.3.22478 and all previous 13.x versions for Windows.
12.1.7.15526 and all previous 12.x versions for Windows.
11.2.10.53951 and earlier versions for Windows.
2024.2.3.64402 and all previous 2024.x versions for macOS.
2023.3.0.63083 and all previous 2023.x versions for macOS.
13.1.2.62201 and all previous 13.x versions for macOS.
12.1.5.55449 and all previous 12.x versions for macOS.
11.1.9.0524 and earlier versions for macOS.
2024.2.2.64388 and earlier versions for macOS.

RISK:
Government:

Large and medium government entities: High
Small government entities: Medium

Businesses:

Large and medium business entities: High
Small business entities: Medium

Home users: Low

TECHNICAL SUMMARY:
Multiple vulnerabilities have been discovered in Foxit PDF Reader and Editor, the most severe of which could result in arbitrary code execution. Details of these vulnerabilities are as follows:

Tactic: Execution (TA0002):
Technique: User Execution: Malicious File (T1204.002):

The application could be exposed to a Use-After-Free vulnerability and crash when handling certain checkbox field objects, Annotation objects, or AcroForms, which attackers could exploit to execute remote code or disclose information. This occurs as the application uses a wild pointer or an object that has been freed without proper validation, fails to properly synchronize the annotation items when handling the Reply Note of an annotation using JavaScript, or fails to correctly update the font cache after deleting a page. (CVE-2024-28888, CVE-2024-7725)
The application could be exposed to a Privilege Escalation vulnerability when performing an update or installing a plugin, which attackers could exploit to delete arbitrary files or execute arbitrary code so as to carry out privilege escalation attacks. This occurs due to the incorrect permission assignment on the resources used by the update service, improper signature validation and incomplete certificate check for the updater, weak randomness setting for the name of the temporary folder during a plugin installation, or improper DLL loading without using the built-in manifest file. (CVE-2024-38393)
The application could be exposed to an Out-of-Bounds Read/Write vulnerability and crash when parsing certain PDF files or handling certain Annotation objects, which attackers could exploit to execute remote code. This occurs as the application reads or writes data beyond the boundaries of an allocated object or buffer. (NO CVE ASSIGNED)

Details of lower-severity vulnerabilities are as follows:

The application could be exposed to a Side-Loading vulnerability when performing an update, which attackers could exploit to run malicious payloads by replacing the update file with a malicious one. This occurs as the application fails to validate the integrity of the updater when running the update service. (CVE-2024-41605)
The application could be exposed to a Null Pointer Dereference vulnerability and crash when scrolling certain PDF files with an abnormal StructTreeRoot dictionary entry, which attackers could exploit to launch a Denial of Service attack. This occurs due to the use of a null pointer without proper validation.
A potential issue where the application could be exposed to a Privilege Escalation vulnerability during the deactivation or uninstallation if the application is reinstalled without prior uninstallation, which attackers could exploit to execute malicious actions. This occurs due to the inadequate permission setting for the /usr/local/share/foxit folder used during the installation so that low-privilege attackers can easily tamper with the script files in the directory.

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

RECOMMENDATIONS:
We recommend the following actions be taken:

Apply appropriate updates provided by Foxit to vulnerable systems immediately after appropriate testing. (M1051: Update Software)
- Safeguard 7.1: Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.
- Safeguard 7.4: Perform Automated Application Patch Management: Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.
- Safeguard 7.7: Remediate Detected Vulnerabilities: Remediate detected vulnerabilities in software through processes and tooling on a monthly, or more frequent, basis, based on the remediation process.
- Safeguard 9.1: Ensure Use of Only Fully Supported Browsers and Email Clients: Ensure only fully supported browsers and email clients are allowed to execute in the enterprise, only using the latest version of browsers and email clients provided through the vendor.
Apply the Principle of Least Privilege to all systems and services. Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack. (M1026: Privileged Account Management)
- Safeguard 4.7: Manage Default Accounts on Enterprise Assets and Software: Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.
- Safeguard 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts: Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user’s primary, non-privileged account.
Restrict execution of code to a virtual environment on or in transit to an endpoint system. (M1048: Application Isolation and Sandboxing)
Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring. (M1050: Exploit Protection)
- Safeguard 10.5: Enable Anti-Exploitation Features: Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™.
Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc. (M1021: Restrict Web-Based Content)
- Safeguard 9.2: Use DNS Filtering Services: Use DNS filtering services on all enterprise assets to block access to known malicious domains.
- Safeguard 9.3: Maintain and Enforce Network-Based URL Filters: Enforce and update network-based URL filters to limit an enterprise asset from connecting to potentially malicious or unapproved websites. Example implementations include category-based filtering, reputation-based filtering, or through the use of block lists. Enforce filters for all enterprise assets.
- Safeguard 9.6: Block Unnecessary File Types: Block unnecessary file types attempting to enter the enterprise’s email gateway.
Inform and educate users regarding the threats posed by hypertext links contained in emails or attachments especially from un-trusted sources. Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources. (M1017: User Training)
- Safeguard 14.1: Establish and Maintain a Security Awareness Program: Establish and maintain a security awareness program. The purpose of a security awareness program is to educate the enterprise’s workforce on how to interact with enterprise assets and data in a secure manner. Conduct training at hire and, at a minimum, annually. Review and update content annually, or when significant enterprise changes occur that could impact this Safeguard.
- Safeguard 14.2: Train Workforce Members to Recognize Social Engineering Attacks: Train workforce members to recognize social engineering attacks, such as phishing, pre-texting, and tailgating.

REFERENCES:

Foxit:
https://www.foxit.com/support/security-bulletins.html?srsltid=AfmBOooLCtdUTMd0tlqH_ZPf9_ye4PeyjiMy5oH9RZjMNWwSkKxnepxc

CVE:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7725
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28888
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38393
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41605

NIST Releases Supplemental Cybersecurity Framework Spreadsheet

Supplemental Spreadsheet: Cybersecurity Framework 1.1 to 2.0 Core Transition Changes Overview

As organizations start to transition from using CSF 1.1 to implementing CSF 2.0, NIST is providing users with a resource to compare and contrast CSF 1.1 and CSF 2.0. This new supplemental document is intended as an aid to anyone who is transitioning a CSF 1.1 Organizational Profile, conducting mapping, or converting other CSF 1.1 Core content to use the CSF 2.0 Core. This document also provides information about how Categories and Subcategories have transitioned from NIST CSF 1.1 to 2.0. This document, along with other CSF 2.0 supplemental materials can be found on our Computer Security Resource Center page under the ‘supplemental material’ section.

Critical Patches Released for VMware vCenter Server and GitLab (CVE-2024-38812, CVE-2024-45409

Broadcom recently issued important patches for VMware, addressing two critical vulnerabilities in its vCenter Server platform, the more severe of them being CVE-2024-38812. Due to the vulnerability, the company cites risk of potential Remote Code Execution (RCE) attacks.

Go here for details

Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure

Summary
The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and National Security Agency (NSA) assess that cyber actors affiliated with the Russian General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155) are responsible for computer network operations against global targets for the purposes of espionage, sabotage, and reputational harm
since at least 2020. GRU Unit 29155 cyber actors began deploying the destructive WhisperGate malware against multiple Ukrainian victim organizations as early as January 13, 2022. These cyber actors are separate from other known and more established GRU-affiliated cyber groups, such as Unit 26165 and Unit 74455.

To mitigate this malicious cyber activity, organizations should take the following actions today:
 Prioritize routine system updates and remediate known exploited vulnerabilities.
 Segment networks to prevent the spread of malicious activity.
 Enable phishing-resistant multifactor authentication (MFA) for all externally facing account services,
especially for webmail, virtual private networks (VPNs), and accounts that access critical systems.

Read the full article here

SpyAgent Harnesses OCR to Discover Crypto Seed Phrases

Image Source: McAfee

Security researchers recently discovered an Android mobile malware dubbed SpyAgent. Using optical character recognition (OCR), SpyAgent parses through saved screenshots to search for cryptocurrency seed phrases. These phrases are 12-24 words and are provided as a backup key to restore access to cryptocurrency wallets. Threat actors can use these seed phrases to access stolen cryptocurrency wallets.

SpyAgent’s campaign begins with a phishing attack by sending malicious links through text or direct messages on social media platforms. Threat actors pose as a reputable business or a trusted person to trick users into clicking malicious links. Once clicked, these links will direct its target to an imitation website, often created to mimic the appearance of a legitimate website. Users will be prompted to install an app that loads the SpyAgent malware onto the victim’s device. If installed, the malicious app will request permission to access sensitive information and the ability to run in the background, which, if granted, will allow the threat actors to compromise the infected device further.

While the primary goal is to steal cryptocurrency seed phrases, researchers have found that it also targets phone contacts, text messages, photos, and device information. This campaign has mostly been localized to South Korea but has begun a tentative expansion into the United Kingdom. Security researchers have also found signs that an iOS variant is in early development. Cryptocurrency has often been the target of malware campaigns, including one targeting MacOS Bitcoin and Exodus wallet users this past January and an older Android malware campaign utilizing OCR to capture cryptocurrency wallet credentials.

Recommendations

Refrain from clicking links found in text messages and direct messages sent from unverified sources.
Type official website URLs into browsers manually.
Avoid installing apps outside the Google Play store, and be wary of granting invasive and unnecessary permissions to apps.
Obtain software from legitimate developers or companies after analyzing customer reviews.
Forward SMiShing messages to 7726 (SPAM) and report the messages to mobile carriers.

GRU Unit Linked to Multiple Cyberattacks on Critical Infrastructure

The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and several partner-nation organizations attributed various cyber operations to Unit 29155, also known as EMBER BEAR , a group affiliated with the Russian General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center. These operations include espionage, sabotage, reputational harm, attempted coups, influence operations, and assassination attempts in Europe. Since 2020, the group has expanded its campaigns to include offensive cyber operations.

Prior to the Russian invasion of Ukraine on February 24, 2022, the Russian group conducted cyberattacks as early as January 13, 2022, using the WhisperGate malware as a preemptive strike to prepare the field for the upcoming military operations. Unit 29155 uses common red teaming techniques and publicly available tools, which can lead to misattribution. They use VPNs to anonymize their activity and typically exploit weaknesses in internet-facing systems. Additionally, they target critical infrastructure and key resource sectors, including government services, financial services, transportation systems, energy, and healthcare sectors of various NATO countries, as well as Europe, North America, Latin America, and Central Asia. Analysts assess that Unit 29155 cyber actors include junior active-duty GRU officers under the direction of experienced leadership. These individuals are enhancing their technical skills by performing cyber operations and intrusions. Furthermore, Unit 29155 cyber actors rely on non-GRU actors, including known cyber-criminals and enablers, to conduct their operations. Their recent focus appears to target and disrupt aid efforts to Ukraine.

Recommendations

Users are encouraged to educate themselves and others on state-sponsored cyber threats to prevent victimization. Implement cybersecurity best practices to reduce risk and increase resiliency to cyber threats. Avoid clicking links, responding to, or otherwise acting on unsolicited text messages or emails. Use strong, unique passwords and enable multi-factor authentication (MFA) for all accounts where available, choosing authentication apps or hardware tokens over SMS text-based codes. Keep systems up to date and apply patches after appropriate testing. Utilize monitoring and detection solutions to identify suspicious login attempts and user behavior. Enforce the principle of least privilege, disable unused ports and services, and use web application firewalls (WAFs). Employ a comprehensive data backup plan and ensure operational technology (OT) environments are segmented from information technology (IT) environments. Regularly perform scheduled backups, keeping an updated copy offline in a separate and secure location, and testing it regularly. Cyber incidents can be reported to the FBI’s IC3 and the NJCCIC.

Comparison of Random Number Generation Standards and Guidelines: SP 800-90 Series and AIS 20/31 | Draft NIST Report

The initial public draft (ipd) of NIST Interagency Report (IR) 8446, Bridging the Gap between Standards on Random Number Generation: Comparison of SP 800-90 Series and AIS 20/31, is now available for public comment.

This report studies the cryptographic random number generation standards and guidelines written by Germany’s Federal Office for Information Security (BSI) and NIST, namely AIS 20/31 and the NIST Special Publication (SP) 800-90 series. It compares these publications, focusing on the similarities and differences in their terminology, assumptions, and requirements. The report also aims to improve communications between all involved parties, promote a shared understanding, and reduce and resolve inconsistencies in related standards.

The public comment period is open through December 20, 2024. See the publication details for a copy of the draft; comments can be submitted to [email protected]. Comments received in response to this request will be posted on the NIST website after the due date.

Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution – PATCH NOW

OVERVIEW:
Multiple vulnerabilities have been discovered in Apple products, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

THREAT INTELLEGENCE:

There are currently no reports of the vulnerabilities being exploited.

SYSTEMS AFFECTED:

Versions prior to iOS 18 and iPadOS 18
Versions prior to macOS Sequoia 15
Versions prior to tvOS 18
Versions prior to watchOS 11
Versions prior to visionOS 2
Versions prior to iOS 17.7 and iPadOS 17.7
Versions prior to macOS Sonoma 14.7
Versions prior to macOS Ventura 13.7

RISK:
Government:

Large and medium government entities: High
Small government entities: Medium

Businesses:

Large and medium business entities: High
Small business entities: Medium

Home users: Low

TECHNICAL SUMMARY:
Multiple vulnerabilities have been discovered in Apple products, the most severe of which could allow for arbitrary code execution. Details of the vulnerabilities are as follows:

Tactic: Execution (TA0002):

Technique: Exploitation for Client Execution (T1203):

An attacker with physical access may be able to use Siri to access sensitive user data. (CVE-2024-40840)
An app may be able to enumerate a user’s installed apps. (CVE-2024-40830)
An attacker with physical access to a locked device may be able to Control Nearby Devices via accessibility features. (CVE-2024-44171)
An attacker may be able to see recent photos without authentication in Assistive Access. (CVE-2024-40852)
A remote attacker may be able to cause a denial-of-service. (CVE-2024-27874)
Unpacking a maliciously crafted archive may allow an attacker to write arbitrary files. (CVE-2024-27876)
An app may be able to record the screen without an indicator. (CVE-2024-27869)
A malicious Bluetooth input device may bypass pairing. (CVE-2024-44124)
An app may be able to access sensitive user data. (CVE-2024-44131, CVE-2024-40847)
An app may be able to access user-sensitive data. (CVE-2024-40850, CVE-2024-44170, CVE-2024-44184, CVE-2024-44153, CVE-2024-44177, CVE-2024-44152, CVE-2024-44166, CVE-2024-40859, CVE-2024-40842)
Processing a maliciously crafted file may lead to unexpected app termination. (CVE-2024-27880, CVE-2024-44154, CVE-2023-4504, CVE-2024-41957)
Processing an image may lead to a denial-of-service. (CVE-2024-44176)
An app may be able to cause unexpected system termination. (CVE-2024-44169)
Network traffic may leak outside a VPN tunnel. (CVE-2024-44165)
An app may gain unauthorized access to Bluetooth. (CVE-2024-44191)
Processing maliciously crafted web content may lead to an unexpected process crash. (CVE-2024-44198)
An app may be able to access information about a user’s contacts. (CVE-2024-40791)
An app may be able to cause a denial-of-service. (CVE-2024-44183, CVE-2024-23237)
Processing a maliciously crafted image may lead to a denial-of-service. (CVE-2023-5841)
An app may gain unauthorized access to Local Network. (CVE-2024-44147)
An app may be able to overwrite arbitrary files. (CVE-2024-44167)
An unencrypted document may be written to a temporary file when using print preview. (CVE-2024-40826)
Private Browsing tabs may be accessed without authentication. (CVE-2024-44202, CVE-2024-44127)
An app may be able to leak sensitive user information. (CVE-2024-40863, CVE-2024-44129)
An attacker with physical access may be able to access contacts from the lock screen. (CVE-2024-44139, CVE-2024-44180)
An attacker may be able to cause unexpected app termination. (CVE-2024-27879)
Processing maliciously crafted web content may lead to universal cross site scripting. (CVE-2024-40857)
A malicious website may exfiltrate data cross-origin. (CVE-2024-44187)
An attacker may be able to force a device to disconnect from a secure network. (CVE-2024-40856)
An app may be able to access protected user data. (CVE-2024-44188, CVE-2024-40837, CVE-2024-27858, CVE-2024-44186, CVE-2024-44149, CVE-2024-40801)
A malicious app with root privileges may be able to modify the contents of system files. (CVE-2024-40825)
An app with root privileges may be able to access private information. (CVE-2024-44130)
An app may be able to access sensitive data logged when a shortcut fails to launch another app. (CVE-2024-44182)
Processing a maliciously crafted video file may lead to unexpected app termination. (CVE-2024-40845, CVE-2024-40846, CVE-2024-40841)
An app may be able to bypass Privacy preferences. (CVE-2024-44164, CVE-2024-40814)
An attacker may be able to read sensitive information. (CVE-2024-40848)
An app may be able to modify protected parts of the file system. (CVE-2024-44168, CVE-2024-44151, CVE-2024-44178, CVE-2024-40860, CVE-2024-40843)
An application may be able to read restricted memory. (CVE-2024-27860, CVE-2024-27861)
A camera extension may be able to access the internet. (CVE-2024-27795)
An app may be able to access protected files within an App Sandbox container. (CVE-2024-44135)
An app may be able to break out of its sandbox. (CVE-2024-44132, CVE-2024-44146, CVE-2024-44148)
An Automator Quick Action workflow may be able to bypass Gatekeeper. (CVE-2024-44128)
Privacy Indicators for microphone or camera access may be attributed incorrectly. (CVE-2024-27875)
An app may be able to access a user’s Photos Library. (CVE-2024-40831)
An app may be able to gain root privileges. (CVE-2024-40861)
Processing a maliciously crafted texture may lead to unexpected app termination. (CVE-2024-44160, CVE-2024-44161)
An app may be able to read sensitive location information. (CVE-2024-44181, CVE-2024-44134)
A malicious app may be able to access notifications from the user’s device. (CVE-2024-40838)
Multiple issues in OpenSSH. (CVE-2024-39894)
Visiting a malicious website may lead to user interface spoofing. (CVE-2024-40797)
A malicious application may be able to leak sensitive user information. (CVE-2024-44125)
A malicious application may be able to access private information. (CVE-2024-44163)
A shortcut may output sensitive user data without consent. (CVE-2024-44158)
An app may be able to observe data displayed to the user by Shortcuts. (CVE-2024-40844)
An app may be able to read arbitrary files. (CVE-2024-44190)
On MDM managed devices, an app may be able to bypass certain Privacy preferences. (CVE-2024-44133)
Visiting a malicious website may lead to address bar spoofing. (CVE-2024-40866)
A non-privileged user may be able to modify restricted network settings. (CVE-2024-40770)
A logic issue existed where a process may be able to capture screen contents without user consent. (CVE-2024-44189)
An app may be able to read sensitive data from the GPU memory. (CVE-2024-40790)
A malicious application may gain access to a user’s Keychain items. (CVE-2024-44162)
An attacker may be able to determine the Apple ID of the owner of the computer. (CVE-2024-40862)
An unprivileged app may be able to log keystrokes in other apps including those using secure input mode. (CVE-2024-27886)

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

RECOMMENDATIONS:

We recommend the following actions be taken:

Apply the stable channel update provided by Apple to vulnerable systems immediately after appropriate testing. (M1051: Update Software)
- Safeguard 7.1 : Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.
- Safeguard 7.2 : Establish and Maintain a Remediation Process: Establish and maintain a risk-based remediation strategy documented in a remediation process, with monthly, or more frequent, reviews.
- Safeguard 7.6 : Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets: Perform automated vulnerability scans of externally-exposed enterprise assets using a SCAP-compliant vulnerability scanning tool. Perform scans on a monthly, or more frequent, basis.
- Safeguard 7.7 : Remediate Detected Vulnerabilities: Remediate detected vulnerabilities in software through processes and tooling on a monthly, or more frequent, basis, based on the remediation process.
- Safeguard 16.13 Conduct Application Penetration Testing: Conduct application penetration testing. For critical applications, authenticated penetration testing is better suited to finding business logic vulnerabilities than code scanning and automated security testing. Penetration testing relies on the skill of the tester to manually manipulate an application as an authenticated and unauthenticated user.
- Safeguard 18.1 : Establish and Maintain a Penetration Testing Program: Establish and maintain a penetration testing program appropriate to the size, complexity, and maturity of the enterprise. Penetration testing program characteristics include scope, such as network, web application, Application Programming Interface (API), hosted services, and physical premise controls; frequency; limitations, such as acceptable hours, and excluded attack types; point of contact information; remediation, such as how findings will be routed internally; and retrospective requirements.
- Safeguard 18.2 : Perform Periodic External Penetration Tests: Perform periodic external penetration tests based on program requirements, no less than annually. External penetration testing must include enterprise and environmental reconnaissance to detect exploitable information. Penetration testing requires specialized skills and experience and must be conducted through a qualified party. The testing may be clear box or opaque box.
- Safeguard 18.3 : Remediate Penetration Test Findings: Remediate penetration test findings based on the enterprise’s policy for remediation scope and prioritization.
Apply the Principle of Least Privilege to all systems and services. Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack. (M1026: Privileged Account Management)
- Safeguard 4.7: Manage Default Accounts on Enterprise Assets and Software: Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.
- Safeguard 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts: Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user’s primary, non-privileged account.
Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc. (M1021: Restrict Web-Based Content)
- Safeguard 2.3: Address Unauthorized Software: Ensure that unauthorized software is either removed from use on enterprise assets or receives a documented exception. Review monthly, or more frequently.
- Safeguard 2.7: Allowlist Authorized Scripts: Use technical controls, such as digital signatures and version control, to ensure that only authorized scripts, such as specific .ps1, .py, etc., files, are allowed to execute. Block unauthorized scripts from executing. Reassessbi-annually, or more frequently.
- Safeguard 9.3: Maintain and Enforce Network-Based URL Filters: Enforce and update network-based URL filters to limit an enterprise asset from connecting to potentially malicious or unapproved websites. Example implementations include category-based filtering, reputation-based filtering, or through the use of block lists. Enforce filters for all enterprise assets.
- Safeguard 9.6: Block Unnecessary File Types: Block unnecessary file types attempting to enter the enterprise’s email gateway.
Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring. (M1050: Exploit Protection)
- Safeguard 10.5: Enable Anti-Exploitation Features: Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™.
Block execution of code on a system through application control, and/or script blocking. (M1038:Execution Prevention)
- Safeguard 2.5 : Allowlist Authorized Software: Use technical controls, such as application allowlisting, to ensure that only authorized software can execute or be accessed. Reassess bi-annually, or more frequently.
- Safeguard 2.6 : Allowlist Authorized Libraries: Use technical controls to ensure that only authorized software libraries, such as specific .dll, .ocx, .so, etc., files, are allowed to load into a system process. Block unauthorized libraries from loading into a system process. Reassess bi-annually, or more frequently.
- Safeguard 2.7 : Allowlist Authorized Scripts: Use technical controls, such as digital signatures and version control, to ensure that only authorized scripts, such as specific .ps1, .py, etc., files, are allowed to execute. Block unauthorized scripts from executing. Reassess bi-annually, or more frequently.
Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior. (M1040: Behavior Prevention on Endpoint)
- Safeguard 13.2 : Deploy a Host-Based Intrusion Detection Solution: Deploy a host-based intrusion detection solution on enterprise assets, where appropriate and/or supported.
- Safeguard 13.7 : Deploy a Host-Based Intrusion Prevention Solution: Deploy a host-based intrusion prevention solution on enterprise assets, where appropriate and/or supported. Example implementations include use of an Endpoint Detection and Response (EDR) client or host-based IPS agent.

REFERENCES:

Apple:
https://support.apple.com/en-us/100100
https://support.apple.com/en-us/121250
https://support.apple.com/en-us/121238
https://support.apple.com/en-us/121248
https://support.apple.com/en-us/121240
https://support.apple.com/en-us/121249
https://support.apple.com/en-us/121241
https://support.apple.com/en-us/121239
https://support.apple.com/en-us/121246
https://support.apple.com/en-us/121247
https://support.apple.com/en-us/121234