Alexei Zhurba

Don't Panic, but patch when you can 🚨 Critical Security Alert: Uncovering the regreSSHion Vulnerability (CVE-2024-6387) in OpenSSH 🚨 ☁️ Francesco ☁️ Cipollone has done an analysis of regreSSHion a vulnerability CVE-2024-6387 identified in OpenSSH, with some scary escalation and risk to glibc-based Linux systems. This vulnerability, a signal handler race condition, can potentially allow unauthenticated remote code execution with root privileges. 🛡️ What You Need to Know: Impact: Affects millions of OpenSSH server instances, including approximately 700,000 external internet-facing instances. Exploitation Complexity: High—It requires around 10,000 attempts under ideal lab conditions, which is about 1.4 days. Real-world factors like network jitter and SSH background noise can significantly extend this timeframe. Affected Systems: Notably affects GKE images, Redhat 6-7, Fedora, and more. Newer systems running x86_64 / AMD64 are harder to exploit due to ASLR. Why This is Hard to Implement: The exploitation process is highly complex, restricted by login timeouts and concurrent connection limits. Furthermore, real-world conditions introduce additional challenges, making widespread in-the-wild exploitation less likely but still possible. #openssh #aspm #vulnerability #ssh

1

3 comentarios

FIDO Alliance Working on Making Passkeys Portable Across Platforms: The FIDO Alliance is developing new specifications to enable secure transfer of passkeys between different password managers and platforms. Announced this week, the initiative is the result of collaboration among members of the FIDO Alliance's Credential Provider Special Interest Group, including Apple, Google, Microsoft, 1Password, Bitwarden, Dashlane, and others. From a report: Passkeys are an industry standard developed by the FIDO Alliance and the World Wide Web Consortium, and were integrated into Apple's ecosystem with iOS 16, iPadOS 16.1, and macOS Ventura. They offer a more secure and convenient alternative to traditional passwords, allowing users to sign in to apps and websites in the same way they unlock their devices: With a fingerprint, a face scan, or a passcode. Passkeys are also resistant to online attacks like phishing, making them more secure than things like SMS one-time codes. The draft specifications, called Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF), will standardize the secure transfer of credentials across different providers. This addresses a current limitation where passkeys are often tied to specific ecosystems or password managers. Further reading: Passwords Have Problems, But Passkeys have more. Read more of this story at Slashdot.

3

European Central Bank publish paper 'Adopting TIBER-EU will help fulfil DORA requirements' #DORA sets out a number of requirements for threat-led penetration testing #TLPT. This paper outlines how the European framework for threat intelligence-based ethical red teaming – the TIBER-EU framework – can help competent authorities and financial entities fulfil those requirements. View paper here https://lnkd.in/eE_TScZ7

3

To make better Security decisions for the future, you best study the past. In 1993, Christoph Schuba released a paper entitled “ Addressing Weaknesses in the Domain Name System Protocol.” In it, he outlined several vulnerabilities, including the technique of DNS cache poisoning. In Oct 2008 the late Dan Kaminsky and Dr Paul Vixie, both Internet Hall of Fame inductees and cited DNS experts, flew into Microsoft headquarters in Redmond to show exceutives how DNS was inherently vulnerable to exploitation and attack due to the weakness of 16-bit transaction IDs. Microsoft 'patched' their DNS Servers... On March 3, 2011 the below DNS article was authored by the Counter Threat Intelligence Team at Secureworks. In 2016 DYN, one of the world's leading DNS providers suffered a DNS attack and took out large swathes of the U.S. knocking entire regions offline. Throughout the Fall of 2018 a large number of Federal Agencies suffered DNS attacks taking them offline for over a month. On Jan 22, 2019 @CISA issued M-19-01 an Emergency Directive on DNS Tampering and Abuse. On July 14, 2020 Microsoft issued CVE-2020-1350 which carried a CVSS of 10 on DNS vulnerabilities on their servers. On Dec 8, 2020 SolarWinds discovered a major cyberattack that included a DNS attack. DNS Tampering and Abuse enables unbridled Access into Networks and Infrastructure. DNS attacks account for a vast number of cyberattacks and have been steadily growing over the last decade or more. They say ignorance is a choice. If that statement is true, then many of today's experts, clearly ignorant of the criticality of DNS, arei either ignorant through their choice, or they are complicit by choice... Facts can be stubborn things, however as the brilliant Paul Mockapetris, the Father of DNS from 1983-1986 states: 'Over 95% of all Cyberattacks, Malware, and Bots rely upon DNS.' This is one fact you would be an utter fool to ignore. Every organization should ask their CISO and Cyber Teams, Red, Blue, or Purple, internal, or external, where DNS controls and Management fit within their management and portfolio. I guarantee you will be truly shocked to discover few, very few even look at DNS. That means, to quote Paul Mockapetris that a vast percentage of Cyberattacks, Malware, and Bots aren't even being considered, let alone controlled and managed. In other words, as the adage goes, it really is a case of 'When, not if' as the organization simply has no defence of this critical area... We are happy to assist and guide any and every organization through the DNS minefield. #WhitethornShield FBI Cyber Division Federal Bureau of Investigation (FBI) The White House GCHQ National Cybersecurity Coordination Center (NCSCC) #DNS #PKI

46

6 comentarios

----- Acquisition tool: New version available! - iOS Unified Logs Investigation ----- Thank you so much to everyone who has written to me in recent weeks to test my little iOS Unified Logs extraction tool 🙏 . The numerous feedbacks have been very positive, and I am grateful to you for also taking the time to submit your improvement ideas 💡. As recently mentioned to Derek Eiri (his article available here: https://lnkd.in/euCT-n_5), a new version of the tool is now ready! Here are the small updates that I am delighted to share with you: 1) Two files that allow you to automatically install dependencies so that you no longer have to do it manually (it was annoying I know ...). 2) A detailed ReadMe documenting the various steps necessary for the proper functioning of the tool. 3) The addition of the libimobiledevice library, which allows the tool to automatically retrieve the connected device's name, UDID, OS version, GB capacity, model, and much more 🔥. → All information will also be available in the extraction report, which will therefore be a bit more complete. You will find more information and some photos documenting the tool on my website (a truly interesting challenge to have created this website). Have a look there: https://lnkd.in/eyd85Sic And as usual, I am available on LinkedIn and via email at [email protected] if you have any questions related to the tool or the investigation of the iOS Unified Logs. #iosforensics #forensicsciences #UnifiedLogs #iosunifiedlogs #digitalforensics #digitalinvestigation #Investigation #Forensics #eDiscovery #appleforensics #mobileforensics #dfir #computerforensics #cyberforensics

64

2 comentarios

Join Paul Laudanski & Ignacio Favro on August 21 for 'An Anatomy of An Attack: C2 Applications' Here is your chance to ask your burning questions and get a copy of the full report. Register via the link in the comments ⬇️ #SAPsecurity #webinar #security

17

1 comentario

👩‍💻 Interesting APT Research and Cybersecurity News of the Week 🎯 Vulnerability and exploit statistics for Q3 show an increase in disclosed CVE information and a faster emergence of public PoCs. However, real cyberattacks are mostly fueled by last year's vulnerabilities. https://lnkd.in/dfYXf6fG 👽 APT35/Charming Kitten is targeting the aerospace and semiconductor industries with spear-phishing leading to fake job listing sites. https://lnkd.in/d6ETKr6y 🤯 Two reports reveal how APT Turla/Secret Blizzard compromised Storm-0156/Transparent Tribe infrastructure to deploy Turla's implants on Tribe's victims. It is reported (https://lnkd.in/dMKznXyu) that there have been six such cases. https://lnkd.in/ecqBkAdG https://lnkd.in/dc92yMWN 🍏 A relatively large-scale scan (2,500 devices) for Pegasus spyware found 7 infections. This is a very high percentage, significantly changing the perception of commercial spyware as a rare, targeted threat. The authors note that those who opted to scan their smartphones are likely high-risk groups, so the percentage might be lower in the general population. https://lnkd.in/d8RkQRyD 🆔 New phishing campaigns exploit DocuSign's web form creation feature. Three out of four recently published forms are phishing attempts.  https://lnkd.in/dzvRQ2dD 💻 Cloudflare domains are increasingly used in phishing — specifically, pages[.]dev and workers[.]dev. https://lnkd.in/dKNjhfD9 🖥 Overview of the Paranodeus group's malicious arsenal. In addition to info-stealers and ransomware, they even have a rare type — a screen locker, granddad of modern ransomware. https://lnkd.in/dq3esg-m 😑 Analysis of the Android banker Droidbot: https://lnkd.in/dc_JypNw ▶️ Detailed analysis of the Rust version of the Akira ransomware. This is a useful read for reverse engineers — much attention is given to the challenges posed by the compiler itself. https://lnkd.in/e3VuYA9S ⚪️ The Gafgyt/Lizkebab botmasters are expanding their operations. In addition to IoT devices, they are adding misconfigured Docker servers to their DDoS botnet. https://lnkd.in/dwe9VRKC #news #digest #APT

14

2 comentarios

The telecommunications sector is being hacked by aggressive nation states (this time China's Salt Typhoon group). The National Security Agency, Cybersecurity and Infrastructure Security Agency, and Federal Bureau of Investigation (FBI) have jointly published an alert outlining good basic security principles for the communications sector. I emphasize basic, because telcos and all other critical infrastructure heavyweights should already be doing the basics! If the NSA, CISA, and FBI need to reiterate this information to telcos, it highlights a problem that many aren't consistently adhering to fundamental #cybersecurity practices which should have been in place for more than a decade!

24

1 comentario

The Internet Archive has confirmed a third security breach on October 20, 2024, in what has become a series of escalating cyberattacks. Hackers were able to exploit unrotated Zendesk API tokens to gain access to the platform that manages the Archive's support tickets. Despite previous warnings and multiple breaches earlier this month, the organization had not or were unable to secure the system adequately, leaving the tokens vulnerable to continued exploitation. The attackers were still able to access and potentially download sensitive support data, including personal identification documents submitted by users. This breach follows two major attacks earlier in October, which have compounded the damage to the Archive's infrastructure. The Internet Archive is a nonprofit digital library that was established in 1996 by Brewster Kahle with the goal of providing "universal access to all knowledge." It is widely known for its Wayback Machine, which archives websites and allows users to view them as they appeared in the past, making it a valuable resource for historians, researchers, and the general public. Beyond websites, the Archive hosts millions of digital items, including books, music, audio files, videos, and software. This vast collection preserves cultural and historical materials that might otherwise be lost. The organization operates primarily on donations and has played an essential role in maintaining digital history. #internet #archive #security #breach #cyberattack

2

1 comentario

🚀 2 more RCSA templates for comments 🚀 I’ve just completed a test on the NIS and NIS2 directives, with risk item deduplication and role name standardization. 🔍 **Key Highlights:** - **NIS Directive** (EU) 2016/1148 - **NIS 2 Directive** (EU) 2022/2555 For those interested in a closer look at the processing results, here are the links to the sample templates 🔗 [NIS Directive Sample Template](https://lnkd.in/e-XUXNt3)  🔗 [NIS 2 Directive Sample Template](https://lnkd.in/eNY35eAf) #NIS #NIS2 #RiskManagement #Compliance #Regulatory #CyberSecurity #DataProtection

8

3 comentarios

🚨 Security Vulnerability Alert: Lawo AG vsmLTC Time Sync (vTimeSync) 🚨 Earlier this year, researchers Sandro Einfeldt & Dennis Jung identified for the SEC Consult Vulnerability Lab a significant vulnerability in the Lawo AG vsmLTC Time Sync (vTimeSync) component. The issue, a path traversal flaw, allowed unauthenticated attackers to download arbitrary files from the operating system, potentially exposing sensitive information and putting systems at risk.   While the discovery was made in early 2024, Lawo AG has now released a #patch after careful development and testing. Though it took time to resolve, we appreciate that good things sometimes require thorough attention to detail, especially when securing systems from such security risks.   ❗We strongly encourage all users to update to the latest version to protect their systems against this #vulnerability. As always, ensuring timely patch management and vigilant security practices are key to safeguarding infrastructure.   📄 Full advisory and technical details here: https://lnkd.in/daj-SEX3 🔐 Take action now and make sure you're up to date! #CyberSecurity #infosec #patchmanagement #pathtraversal

5

This latest update on CVE-2024-3400, a critical vulnerability in PAN-OS software, underlines the urgency for organizations to implement security measures and update systems. With the exploitation already underway by what appears to be a state-backed actor, and evidence of sophisticated tactics such as lateral movement and credential theft, immediate action is required. Unit 42's identification of this attack campaign as Operation MidnightEclipse and their subsequent release of threat hunting queries and indicators of compromise are critical tools for organizations using Cortex XDR. Volexity's findings that the attackers are using a Python backdoor named UPSTYLE, alongside their comprehensive detection advice, further equip organizations to respond effectively to these incidents. The attacks' initial discovery on March 26 and the ensuing series of attempts highlight the attackers’ persistence and the evolution of their methods. Volexity’s observation of their targeted approach, seeking out domain backup DPAPI keys and directory credentials, suggests a methodical strategy aimed at gaining deep access to affected networks. Given the attackers’ use of firewall service accounts for internal pivoting and targeting of workstations, it's clear that the consequences of a successful breach could be severe, leading to widespread access to sensitive data. The implications are particularly dire for organizations with affected firewall devices, which now face the risk of having sensitive credentials compromised. Volexity's recommendation to preserve forensic artifacts before rebuilding or wiping appliances is crucial. This will help maintain evidence for further investigation and potentially identify other compromised systems within the network. With some fixes now available and others on the horizon, it's essential for PAN-OS users to stay vigilant, update their systems as soon as possible, and monitor their networks closely for signs of intrusion. The expectation that the threat actor will intensify their activities in the coming days only adds to the urgency for organizations to act swiftly to secure their environments. #credentialtheft #sensitivedata #stayvigilant #softwareupdates #threatactors #networksecurity #firewalls #securitymeasures

5

Researchers at Kaspersky identified a threat group called Twelve, which first surfaced in April 2023 amid the Russian-Ukrainian conflict. Since then, the group has been targeting Russian government organisations with a destructive method of attack, encrypting and deleting victim data. Both groups target organisations in Russia and utilise similar malware, open-source tools, and procedures. BlackJack emerged in late 2023, claiming responsibility for multiple attacks. They rely on publicly available tools such as PuTTY and AnyDesk for remote access and use Ngrok for maintaining persistence in compromised networks. BlackJack and Twelve employ nearly identical versions of LockBit ransomware and Shamoon-based wipers, often placing them in the same network directories. The groups share additional similarities in command execution, naming conventions, and the use of tools like PsExec and Mimikatz. There are few slight differences between the groups. For example, BlackJack uses AnyDesk for remote access, whereas Twelve incorporates additional tools such as chisel, BloodHound, adPEAS, and CrackMapExec. This reliance on open-source utilities underlines the groups’ hacktivist nature, allowing them to operate without proprietary tools while still causing substantial damage to their targets. The report also details a recent discovery of a new activity closely resembling the operations of BlackJack and Twelve. While attribution is not confirmed, the malware samples and techniques indicate a strong connection to the cluster of activity involving these groups. Both groups focus on damaging their targets rather than seeking financial gain, primarily by encrypting and deleting data from the organisations they attack, confirming their hacktivist nature.

1