My information Resource (blog.mir.net)

 Microsoft
recently blogged about the Recent Nation-State Cyber Attacks that has impacted high
value targets both across the government and private sector. This attack is
also known as Solorigate or Sunburst. This threat actor is believed to be highly
sophisticated and motivated. Relevant security data required for hunting and
investigating such a complex attack is produced in multiple locations – cloud,
on-premises and across multiple security tools and product logs.  Being
able to analyze all the data from a single point makes it easier to spot trends
and attacks. Azure Sentinel has made it easy to collect data from multiple data
sources across different environments both on-premises and cloud with the goal of
connecting that data together more easily. This blog post contains guidance and
generic approaches to hunt for attacker activity (TTPs) in data that is
available by default in Azure Sentinel or can be onboarded to Azure Sentinel.

The
goal of this article is post-compromise investigation strategies and is focused
on TTPs and not focused on specific IOCs.  Azure Sentinel customers are
encouraged to review advisories and IOC’s shared by Microsoft MSRC and security
partners to search on specific IOC’s in their environment using Azure Sentinel. 
Links to these IOC’s are listed in the reference section at the end.

Link to article:

URL: https://techcommunity.microsoft.com/t5/azure-sentinel/solarwinds-post-compromise-hunting-with-azure-sentinel/ba-p/1995095

This week,
the NSA released an announcement saying, “Russian state- sponsored malicious
cyber actors are exploiting a vulnerability in VMware Access and VMware
Identity Manager2 products, allowing the actors access to protected data and
abusing federated authentication.” This vulnerability is tracked as
CVE-2020-4006 (7.2 CVSS score) which was issued on 23 November 2020 but updated
recently with VMWare’s patch release on 3 December 2020.

The issue can be
tracked as VMWare’s advisory VMSA-2020-0027.2. The advisory lists the
impacted products as: VMware Workspace One Access (Access), VMware Workspace
One Access Connector (Access Connector), VMware Identity Manager (vIDM),
VMware Identity Manager Connector (vIDM Connector), VMware Cloud Foundation,
and vRealize Suite Lifecycle Manager.

Exploitation is
via command injection which leads to installation of a web shell allowing
further malicious activity. The exploitation however, requires both password
knowledge and access. Strong passwords and having the web-based management
interface inaccessible from the internet mitigate the issue. Although
patching is the recommended solution, workarounds such as disabling the
configurator service can put a temporary fix in place until patching can be
accomplished.

The release notes that detection
methods are unlikely to identify this exploit since the compromise activity
occurs exclusively inside a TLS tunnel for the web -interface. Indicators in
systems logs can suggest a compromise may have occurred, such an
indicator can look like an exit statement followed by a 3-digit number like
“exit 123”.

The VMWare advisory also provided direct reference to their
knowledge base in a matrix addressing all the impacted products, patches,
versions, workarounds, etc.

This article has
highlighted two things that will likely never change. First, you need to stay
patched and current it’s the best way to be proactive and prevent a compromise
in any system. Second, the human factor will always be vulnerable – be it
spear-fishing or brute force attacks on weak user passwords. Do everything
you can to educate and when that fails, clean and disable bad links and enforce
policy that deters users from making bad choices. You’ve read these countless times before here… but
we can’t tell you anymore. Go do it.

Sources:

CSA_VMWARE ACCESS_U_OO_195076_20.PDF (defense.gov) 

VMSA-2020-0027.2 (vmware.com)

NSA Warns Russian Hacker Exploiting VMware Bug to Breach Corporate Networks (thehackernews.com)

ESET researchers have
recently released information on the discovery of a new backdoor dubbed Crutch that uses Dropbox to exfiltrate
stolen files. Crutch has been seen as
early as 2015 and is believed to be a second-stage backdoor that is deployed
after a victim has already been compromised. Researchers have seen the Skipper implant and the PowerShell Empire post-exploitation
agent used as initial infection vectors. Until July 2019, Crutch v3 used an architecture based on
manual input of commands through Dropbox that are then run on the victim’s
machine. It included a monitor for removable drives that looked for files with certain extensions, such as .pdf, .rtf, .doc, and .docx,
then compressed and staged the
files for exfiltration. These files were then uploaded to a hard-coded Dropbox account controlled
by the attackers. Persistence was maintained by using
hijacked browser processes in Chrome, Firefox,
or OneDrive. In one
instance, the Crutch operator even left a little taunt
for the victim,
running the command “mkdir %temp%Illbeback”.

In July of 2019, researchers discovered a newer version of Crutch that was auto- mated rather than
having the operator run commands manually. The
persistence mechanism changed to using a Microsoft
Outlook component, Finder, rather than the browser processes. The drive monitor also got a makeover
and could now monitor local drives as well as removable drives. Interesting
files are still compressed, encrypted, and staged for exfiltration. Instead of
the operator manually uploading them to Dropbox, however, Crutch v4 now uploads the files
automatically using the Windows version of the wget utility.

ESET researchers
have attributed Crutch to the
Russians peaking APT group Turla.
They discovered several strong links between a 2016 version of the Crutch dropper and a Turla tool called Gazer. For instance,
both samples were found on the same machine within
a 5-day period, PDB paths were almost identical, and they both used the exact
same RC4 key to decrypt their payloads.

“Given these
elements and that Turla malware
families are not known to be shared among different groups, we believe that Crutch is a malware family that is part
of the Turla arsenal,” says the ESET
release. Crutch was also discovered
on the network of the Ministry of Foreign Affairs in an undisclosed European
Union country, which also aligns with Turla’s
previous strategies targeting gov- ernments, embassies, and military
organizations.

Sources:

Turla’s ‘Crutch’ Backdoor Leverages Dropbox in Espionage Attacks | Threatpost

Turla Crutch: Keeping the “back door” open | WeLiveSecurity

Experts Uncover ‘Crutch’ Russian Malware Used in APT Attacks for 5 Years (thehackernews.com)

 It’s
been a while since credit card and social security numbers were enough to
supply the criminal market with stolen data. In the last few years there has
been a marked increase in the amount of healthcare data up for sale thanks to
some major data breaches and the notoriously poor security of smaller
healthcare providers.

While it may be improving, there
are still plenty of unpatched systems out there. Even worse, there are some providers using applications that are largely unsupported. A recent
announcement from researchers at Bishop Fox is proof of that.

An open source application called OpenClinic, used for health records
management, was found to have four major 0-day vulnerabilities. The most critical vulnerability is a missing
authentication check where a patient does not have to sign in to
view test results. This would allow an attacker to directly access patient
data with only the path to the file.

The other three
bugs require authentication. A cross-site scripting vulnerability allows an
attacker to “embed a malicious payload within a medical record’s address
field.” With administrator privileges an attacker could upload malicious
files to an endpoint on the server, allowing them to execute arbitrary code.

There is also
a path traversal vulnerability that allows files to be stored outside of
designated directories. All versions of OpenClinic are vulnerable to all four
bugs. The last update to the application was in 2016.

The Bishop Fox team attempted to contact the developers for OpenClinic
three times but received
no response. After
90 days (per their disclosure policy), they
published their findings. OpenClinic appears to no longer be supported and the
changelog suggests that releases were few and far between to begin with.

Unfortunately, a
quick Google search suggests that there are few providers out there still using
the software in some capacity. The exposed records are old, but exposed
nonetheless. The best option for anyone still using the application is to find
an alternative as soon as possible.

Sources:

    ·      Electronic Medical Records Cracked Open by Unpatched OpenClinic Bugs | Threatpost

·      Zero-day vulnerabilities in healthcare records application OpenClinic could expose patients’ test results | The Daily Swig (portswigger.net)

·        What is OpenClinic?  (sourceforge.net)

 Cybercriminals stole $15 million from a U.S. company by inserting themselves in email correspondence relating to legitimate business fund transfers. The tactic is called Business Email Compromise (BEC) and is one of the most financially damaging online crimes according to the FBI. BEC is a lucrative scam because we rely on email to conduct financial business transactions, such as wire transfers. The traditional BEC scam process contains four steps: identifying a target, grooming that target, exchanging information with the victim, and then completing the wire transfer of funds. This scenario requires attackers to convince the victim that they are conducting a legitimate business transaction when they are dealing with a fraud.

Although the traditional BEC scam can be successful, most businesses have implemented training to spot these types of efforts. These scams can be thwarted by diligent targets easily, which is why this BEC campaign allowed business transactions to be negotiated by senior executives. Mitiga, the incident response company investigating the occurrence, said the threat actors spent weeks trying to compromise the chosen email accounts. They collected information from the victim’s inbox before setting up email for-warding rules to ensure that if they lost access to the account, they would still receive messages from the compromised account. The attackers also created Microsoft Office 365 email domains, with slight alterations to the domain names, to impersonate both parties of the trans-action when needed and registered these domains with GoDaddy as businesses. They monitored the inboxes for a month gathering information from senior executives about planned financial business transactions, then they took over the conversation at the opportune moment to provide altered wire transfer information using the fake domains.

The attackers still needed to make sure that the executives and financial officers at the company did not see the transaction as suspicious and flag it for investigation as the bank could still block the transfer of funds going to the wrong account. To hide transaction emails from the concerned parties, the attacker set up email filtering rules from the inbox to move emails from specific addresses to a hidden folder. The filtering of communications concerning the money transfer from the legitimate inbox owner lasted for two weeks, which was sufficient time for the attackers to successfully move the funds to a foreign bank account.

Microsoft and law enforcement agencies are investigating the incidents. Still, there is little hope of reclaiming the lost funds once transferred outside US jurisdiction. Mitiga said they have seen a dramatic in-crease in BEC attacks this year. The Mitiga CEO, Tal Mozes, said that BEC attacks are up 63%, mostly originating from African countries and targeting U.S. businesses.

Sources:

• https://www.zdnet.com/article/15-million-business-email-scam-exposed-in-the-us/

• https://www.bleepingcomputer.com/news/security/the-anatomy-of-a-15-million-cyber-heist-on-a-us-company/

• https://www.fbi.gov/scams-and-safety/common-scams-and-crimes/business-email-compromise

 If you Google “Win10 zero-day”, you’ll likely find a number of results. Today’s zero-day is one that involves both Google Chrome and Microsoft Windows and is actively exploited. It has been disclosed with a proof of concept but is still not patched by Microsoft!

The Windows security issue, tracked as CVE-2020-17087, is reported to impact every version of the Windows OS from Windows 7 to the current Windows 10. Google’s Project Zero security team discovered the flaw, notified Microsoft, and provided seven days to patch before Google would disclose the details. Some argue this is a short time before disclosure but Project Zero researchers Ben Hawkes and Tavis Ormandy defended their timeline saying: “We think there’s defensive utility to sharing these details, and that opportunistic attacks using these details between now and the patch being released is reasonable [sic] un-likely”. That’s probably true, as the researchers knew the chained exploit required another vulnerability: CVE-2020-15999, a Chrome browser-based bug which was patched 20 October 2020. These are likely the same reasons why Microsoft can be so calm regarding the vulnerability, as the fix is pushed off until next patch Tuesday on 10 November 2020.

The previously patched Chrome browser bug, CVE-2020-15999, is a heap buffer overflow vulnerability in the “Load_SBit_Png” function of the FreeType 2 library. This is used for font rendering in multiple applications, one of which is Google Chrome. Google’s own security researcher on the Project Zero team, Sergei Glazunov, is credited with the discovery. The attack would be accomplished using social engineering to lure a user to browse a website hosting a specially crafted malicious font file. Glazunov has published a proof-of-concept font file. The Microsoft Windows unpatched bug, CVE-2020-17087, is a buffer overflow vulnerability in the Windows Kernel Cryptography Driver, cng.sys, and the way it processes input/output control. Mateusz Jurczyk, another Project Zero security researcher who discovered the issue, says the bug is the result of a 16-bit integer truncation. A proof of concept was included as an attachment to the Google Project Zero issue tracker entry and has been tested on Windows 10 1903 (64-bit).

As far as the observations in the wild, this chained attack is being used for targeted attacks according to Shane Huntley, Director of Google’s Threat Analysis Group. Microsoft also acknowledged their bug has only been spotted in conjunction with the Chrome vulnerability, which has been patched in Chrome and other Chromium-based browsers.

Sources

• https://www.techradar.com/news/windows-10-zero-day-could-allow-hackers-to-seize-control-of-your-computer

        • https://bugs.chromium.org/p/project-zero/issues/detail?id=2104

        • https://threatpost.com/unpatched-windows-zero-day-exploited-sandbox-escape/160828/

 Cisco is warning of attacks actively exploiting the CVE-2020-3118 vulnerability found to affect carrier-grade routers running the Cisco IOS XR Software. The issue resides in the implementation of the Cisco Discovery Protocol for Cisco IOS XR Software and could allow an unauthenticated attacker to execute arbitrary code on the device. While Cisco has released a patch for this vulnerability back in February of 2020, new research has shown that the use of this vulnerability is prevalent among nation-state actors in gaining access to an organization.

This vulnerability is due to improper validation of string input from select fields in the Cisco Discovery Protocol messages. The Cisco Discovery Protocol is a Layer 2 protocol that is used to share information about Cisco equipment, including the operating system and IP address. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected de-vice. A successful exploit could allow the attacker to cause a stack overflow, which could enable the attacker to execute arbitrary code with administrative privileges on an affected device. The affected Cisco routing platforms include the Network Convergence System (NCS) 540, NCS 560, NCS 5500, 8000, and ASR 9000 series routers. The vulnerability also affects third-party white box routers and Cisco products with the Cisco Discovery Protocol enabled both on at least one interface and globally. Those devices include ASR 9000 Series Aggregation Services Routers, Carrier Routing System (CRS), IOS XRv 9000 Router, as well as the NCS 1000 Series, 5000 Series, and 6000 Series routers.

In October 2020, the Cisco Product Security Incident Response Team (PSIRT) released an updated advisory that detailed reports of an attempted exploitation of this vulnerability in the wild. In addition, the U.S. National Security Agency (NSA) included the CVE-2020-3118 vulnerability among 25 security vulnerabilities currently targeted or exploited by Chinese state-sponsored threat actors. “The findings of this research are significant as Layer 2 protocols are the under-pinning for all networks, and as an attack surface are an under-researched area and yet are the foundation for the practice of network segmentation,” VP of Research at Armis, Ben Seri said.

As stated, Cisco fixed the CVE-2020-3118 vulnerability back in February of 2020. System administrators should look to see if any of their devices are susceptible to this vulnerability and update them immediately. Cisco also provides administrators with workarounds if they are not able to immediately patch these devices.

Sources

• https://www.bleepingcomputer.com/news/security/cisco-warns-of-attacks-targeting-high-severity-router-vulnerability/

• https://securityaffairs.co/wordpress/109816/hacking/cisco-cve-2020-3118-flaw-attacks.html

 When deploying new software for your enterprise, there are a number of things to consider: cost, hardware, and what value it provides. One area of consideration often lacking is how to ensure the software stays up to date and doesn’t become a security liability. Containerized applications usually excel in this area because they can be deployed and upgraded with ease. In a lot of cases you just restart the application and it’s automatically updated to the latest version. Virtual appliances follow a similar idea, keeping the application isolated to its own virtual environment so that it can be managed with ease. Containers and virtual appliances aren’t magic – they require long term management from whoever publishes them to stay secure. What happens when vendors forget about their own virtual appliances? Orca Security, a security company focusing on cloud applications, recently set out to answer this question.

In a quest to quantify the state of virtual appliance security, Orca recently scanned over 2200 virtual appliances from 540 vendors. Before actually running the scans, they devised a scoring system ranging from 0-100 taking into account factors such as operating system version and application version. They also looked for known vulnerabilities such as HeartBleed, DirtyCOW, and many high CVSS scoring vulnerabilities in both the system as a whole and the specific applications running on the appliance. This system was used to grade appliances from A+ to F based on the numerical score.

The results of their scans were concerning. Only 8% of the appliances scanned received an A+ rating. 12% received a B rating, 25% received a C rating, 16% received a D rating, with the remaining 15% of the appliances receiving an F rating. Over 400,000 vulnerabilities were found across all the scanned appliances once everything was complete. Unsurprisingly it was found that appliances which received more frequent updates fared better in the vulnerability scans. They found that almost half of the appliances had received no updates in the year before their scans started. Only 16.8% of them had been updated in the 3 months leading up to the scanning.

Orca believes that poor internal security processes are responsible for the majority of the vulnerable appliances. When appliances or software reach end of life they remain available for an unknown amount of time, resulting in people actually using them. In some cases, the publisher may not even be aware that they’re still offering severely outdated software for download. It is important to verify that your infrastructure remains patched and up to date, virtual or not.

Sources

• https://www.csoonline.com/article/3584767/half-of-all-virtual-appliances-have-outdated-software-and-serious-vulnerabilities.html

• https://orca.security/virtual-appliance-security-report/

Title: Secure your GitHub deployment using Microsoft Cloud App Security
URL: https://techcommunity.microsoft.com/t5/microsoft-security-and/secure-your-github-deployment-using-microsoft-cloud-app-security/ba-p/1882423
Overview: Welcome to newest post in our series on how to protect your API
Connected Apps using Microsoft Cloud App Security (Microsoft CAS).

Title: Hunt across cloud applications activities with Microsoft 365
Defender advanced hunting
URL: https://techcommunity.microsoft.com/t5/microsoft-365-defender/hunt-across-cloud-applications-activities-with-microsoft-365/ba-p/1893857
Overview: We’re thrilled to share that the new CloudAppEvents table
is now available as a public preview in advanced hunting for Microsoft 365
Defender.

Title: How to export data from Splunk to Azure Sentinel
URL: https://techcommunity.microsoft.com/t5/azure-sentinel/how-to-export-data-from-splunk-to-azure-sentinel/ba-p/1891237
Overview: We have published several Blog posts on how Azure Sentinel can be
used  Side-by-Side with 3^rd Party SIEM tools,  leveraging
cloud-native SIEM and SOAR capabilities to forward enriched alerts.

Title: Meet the Microsoft Pluton processor – The security chip designed
for the future of Windows PCs
URL: https://www.microsoft.com/security/blog/2020/11/17/meet-the-microsoft-pluton-processor-the-security-chip-designed-for-the-future-of-windows-pcs/
Overview: In collaboration with leading silicon partners AMD, Intel, and
Qualcomm Technologies, Inc., we are announcing the Microsoft Pluton security
processor. This chip-to-cloud security technology, pioneered in Xbox and Azure
Sphere, will bring even more security advancements to future Windows PCs and
signals the beginning of a journey with ecosystem and OEM partners.

Title: MCAS Ninja: What’s a CASB and Why Do I Need One?
URL: https://techcommunity.microsoft.com/t5/microsoft-security-and/mcas-ninja-what-s-a-casb-and-why-do-i-need-one/ba-p/1896575
Overview: As an IT professional of 20 years, I can recall the days of
supporting line of business applications hosted in a corporate datacenter,
behind a firewall, where IT had complete control. As Software as a Service
(SaaS) started becoming the new modern line of business apps, a new challenge
presented itself – the infrastructure behind that app is outside IT’s control.
Not having controls to govern access (nor the data) in the app posed
significant risks to the organization, not to mention a lack of visibility into
the compliance and security posture of the app.

Title: Key layers for developing a smarter SOC with CyberProof-managed
Microsoft Azure security services
URL: https://www.microsoft.com/security/blog/2020/11/17/key-layers-for-developing-a-smarter-soc-with-cyberproof-managed-microsoft-azure-security-services/
Overview: This blog post is part of the Microsoft Intelligent Security
Association (MISA) guest blog series. Learn more about MISA here.  
Security teams are struggling to reduce the time to detect and respond to
threats due to the complexity and volume of alerts being generated from
multiple security technologies. With more workloads being migrated to the…

Title: Forrester TEI study: Azure Sentinel delivers 201 percent ROI over
3 years and a payback of less than 6 months
URL: https://www.microsoft.com/security/blog/2020/11/16/forrester-tei-study-azure-sentinel-delivers-201-percent-roi-over-3-years-and-a-payback-of-less-than-6-months/
Overview: 2020 has been a transitional year, ushering in broad changes in how,
and where, we work. Security operations (SecOps) teams face more significant
challenges than ever as they protect the organization in this rapidly changing
environment. These teams need a flexible, cost-effective, and efficient
solution to empower their employees, improve security, and optimize costs
against…

Title: Gartner names Microsoft a Leader in the 2020 Magic Quadrant for
Cloud Access Security Brokers
URL: https://www.microsoft.com/security/blog/2020/11/18/gartner-names-microsoft-a-leader-in-the-2020-magic-quadrant-for-cloud-access-security-brokers/
Overview: The past few months have changed the way we work in many ways,
working from home, social distancing, and remote operations have all had impacts
on our previously known ways of life. At Microsoft, we have been working hard
to assist our customers adjust to this rapidly changing and evolving work
environment. As has been…