Daily Perk 4/7/2021

We made it to Wednesday!

Trends of 2021: if it isn’t patched it’s getting ransomware.

Unpatched Fortinet VPNs being targeted by Cring ransomware per Bleeping Computer

Remember that joint FBI CISA warning about APTs scanning for Fortinet SSL VPNs? These attacks exploits CVE-2018-13379 on unpatched Fortigate SSL VPN servers per this Kaspersky report. It gets domain admin creds using Mimikatz, removes backup files, and kills MS Office and Oracle Database processes.

Yes, attackers are actively hunting for them online. And industrial operations in Europe are victims. Those IT networks getting pwned are alongside OT networks running ICS devices and things on that side don’t tend to come back up well. AND – assume that anything compromise will be useful in future attacks as we keep learning.

Wormable Android Malware posing as Netflix per ZDNet

Just take in the first three words. While not “sky is falling” wormable anything is scary, and given the sheer prevalence of Android devices that’s a lot of potential compromise. Compounded by a global pandemic and lockdowns, online entertainment subscriptions like Netflix are the virtual escape for millions.

Check Point researchers have reported on wormable Android malware posing as a legit Netflix app in the Google Play store, which is supposed to be the place to safely get your Android Apps (I know, I know). The malware takes advantage of things we probably gloss over and agree to at installation: overlay permissions and battery optimization ignore, so it can grab credentials and stay on. And permission to reply to WhatsApp messages. With that, it spreads by replying to WhatsApp messages and further malicious links. While this app has now been removed from Google Playstore, be wary of all the others like it and how conditioned we are to just install apps without reviewing their demands thoroughly.

Daily Perk 4/6/2021

Unsecured critical SAP applications under active attack per Bleeping Computer

SAP enterprise applications are used by more than 400,000 organizations globally, which includes 92% of Forbes 2000. Attackers are seeking out exposed, unpatched applications online, and in some cases linking or chaining these vulnerabilities together to increase their success of intrusion. Per cloud security firm Onapsis,

“Observed exploitation techniques would lead to full control of the unsecured SAP applications, bypassing common security and compliance controls, and enabling attackers to steal sensitive data, perform financial fraud or disrupt mission-critical business processes by deploying ransomware or stopping operations”

We know that patching is complicated (don’t get me started 😉) and typically larger organizations are behind by a couple cycles. The truth is that can often be considerably more when legacy systems, proprietary programs and operational concerns factor in.

EtterSilent Maldoc builder per Bleeping Computer

Something to keep watch for. EtterSilent is used to build malware-laden documents that can bypass detection in on Windows, Google and email services etc. It’s gaining popularity of underground forums and getting regular weaponized enhancements either as a malicious macro or an exploit against a vulnerability. These can masquerade as Docusign or Digicert documents that need the macro enabled. It’s been seen to recently drop TrickBot and BazarLoader malwares, which in turn can deliver a nasty ransomware payload. Verify with care.

Daily Perk 4/2/2021

Savour the moment

FBI and CISA warn APTs using 3 Fortinet bugs for access per The Record

If you are running Fortinet, and have an unpatched version of the FortiOS, operating system, you’re gonna be going hunting but not for Easter eggs. Like many recently had to do with their on-prem Exchange servers, you need to go looking for signs of uninvited guests.

Both CISA and the FBI have released a joint report warning that state-backed, well-resourced adversaries (maybe possibly from Iran and China) are leveraging any or all of trio of bugs “to gain access to networks across multiple critical infrastructure sectors to gain access to key networks as pre-positioning for follow-on data exfiltration or data encryption attacks”. This would be the second joint report regarding a Fortinet security issue they have released, with the earlier one in October 2020.

The three security bugs you should have patched and now will are: CVE 2018-13379, CVE-2020-12812, and CVE-2019-5591. But remember – patching after exploitation won’t protect you if they’re already in your network. And you don’t know that unless you go looking.

Breach: Capital One warns of more exposure from 2019 per Bleeping Computer

Capital One has warned more customers that their SSNs were exposed in a data breach from July 2019. This would be the AWS GitHub theft involving Paige Thompson. Unfortunately it didn’t stop at Capital One. Other companies include Ford, Vodaphone and Michigan State U. The additional SSNs came to light when the bank used new tools to sift through and learned that indeed those SSNs they said weren’t taken actually were. Lessons here about penalties for failure to disclose all the info at the time as per regulations. And to conclude that if it was accessible, it was taken.

Zero-day warning for unsupported, out-dated QNAP storage devices per Threatpost

QNAP NAS or network access storage devices are pretty common. Which makes they them choice targets for attack, especially since they don’t always stay updated, monitored and maintained. We know what happened to thing neglected and unprotected, right?

APT easy as 1-2-3

Two critical zero-day bugs affect legacy QNAP model TS-231 systems: CVE-2020-2509 and CVE-2021-36195. We are talking unauthenticated RCE meaning an attacker doesn’t need credentials. The bugs affect some non-legacy systems too, but those now have patches available. There are a whole lotta boxes out there so take the time, check yours against this list, and update what you can.

Shout out to my security-aware colleague Chuck – this is why I watch for QNAP 😊.

Daily Perk 4/1/2021

Happy Zero-trust Day!

North Korea sets up fake security firm lure per The Hacker News

Remember the reports back in January about North Korean attackers trying to lure security researchers with malware to investigate? They really went all out. There is a fake security firm, “SecuriElite” and social media accounts, like TrendMacro, with links back to the poisoned site. Attackers are getting better at dissolving and reappearing elsewhere, in a game of adversary “whak-a-mole”. Our job is to consider how else, where else, they can play this strategy.

Update: Ubiquiti – it just gets worse per Bleeping Computer

We knew this was coming, right? Ubiquiti now says there was an extortion attempt back in January when that breach happened – but not to worry, no indication that source code or client data was taken. Hmm 🤨 After this past year of extortion ransomware, and the massive pwnage of the Accellion breach, I am sceptical. Especially since there wasn’t really any logging system in place to verify what the attacker got into. There are big lessons in here for all of us.

Don’t neglect your firmware per ZDNet

“Out of sight, out of mind” is not a cyber security best practice. Unfortunately, that sums up how most of us handle firmware updates and awareness. Yet, it’s where we keep credentials and encryption keys. Per the Microsoft Security Signals report for March, 80% of enterprises have had a security incident involving firmware but less than 1/3 of security budgets are invested in protecting it.

Firmware attacks are specialized, and may target UEFI or hardware drivers. Visibility is a problem, because firmware is that layer below what AV and detection services are made to monitor. It’s the purview of advanced persistent adversaries with resources. Think stealth, dwell time and painful compromise – what you can’t see will hurt you.

Daily Perk 3/31/2021

In this together

Patch it Now: per ZDNet, 2 critical vulnerabilities found in VMWare vRealize. These could result in admin credential theft in the AI-based platform that offers “self-driving IT operations management for private, hybrid and multi-cloud environments”. As we continue the mass migration to all things cloud, this opens up a whole new world of vulnerability and exploit possibilities through the universe of third party products and services.

WordPress Warning: per Bleeping Computer there are counterfeit versions of the jQuery Migrate plugin being injected. This plugin is used on over 7.2 million websites so early warning and watch your site

Campaign targets Japan’s industrial sector with fileless malware & backdoors per Securelist

This is an interesting one to be aware of because it involves several strains of fileless malware not seen before in a sophisticated campaign that has been targeting the industrial sector in Japan. Most notable is “Ecipekac”, a “very sophisticated multi-layer malware” with fileless malware payloads P8RAT and SodaMaster.

Kaspersky has been tracking the activity since 2019, and believes it is part of China’s well-established APT10. Fileless malware is hard to detect and doesn’t leave traces behind for forensics and learning afterwards – it’s something associated with an advanced/resourced/ determined threat actor.

Daily Perk 3/30/2021 Updated

Got you a refill!

Ubiquiti Networks Breach: A “Catastrophic” cover up? Per Krebs on Security

This looks really bad. Ubiquiti Networks reported a data breach back in December into January. Apparently, per an insider at Ubiquiti

“it was catastrophically worse than reported, and legal silenced and overruled efforts to decisively protect customers. The breach was massive, customer data was at risk, access to customers’ devices deployed in corporations and homes around the world was at risk”.

Access to Ubiquiti was gained via a third party, AWS. The attackers had admin access to Ubiquiti servers via the Amazon cloud service. Let’s just pause and reflect there. And think about the third party cloud service relationships we all have in play. You can read Krebs’ post for a more detailed account of what ensued. And if you use Ubiquiti, be very suspect. As with what happened to those Exchange servers, once pwned, twice burned. You need to sanitize what may be hiding in there.

Indian’s Fintech platform MobiKwik data breach per The Hacker News up

Thanks to a global pandemic, online payments went from nice to necessity. That’s a lot of sensitive data – payment data. Now, 8 TB of it has been found for sale, believed to be stolen from India’s MobiKwik. They provide a payment gateway and financial services to over 120 million users, including 3 million retailers. The data was being offered for 1.5 bitcoin. There has been a lot of drama with this. As a month ago it first came to light and MobiKwik vehemently denied it. Servers were secured, the data tap shut off briefly. But then the attacker came back, claiming to have all that data. Whatever is going on, this involves is a tremendous amount of sensitive data that impacts people’s lives and livelihood once out there, and it can’t be taken back. We’ve seen the impact of mass data breaches fuelling cybercrime and the dark industry of synthetic identities. As individuals more is expected of us to keep watch over our online presence. This extends in terms of data stewardship and responsible disclosure to those we trust and entrust with out data.

Privacy Cringe 😬: per Threatpost, Intel has been served up a lawsuit for breaking Florida’s wiretapping law. Because – don’t be surprised- they had software on their website to capture the keystrokes and movements of site visitors. Yes, folks like you and I. Yes, that would be the Intel in our computer chips. This was for user analytics on their site. I am sure visitors do not recall giving consent or even being asked. We are going to be confronting an increasing number of ethics and privacy concerns as AI, machine learning and data analytics converge. Be aware.

Good news maybe: for those concerned about SMS hijacks and SIM swap, an update in today’s CyberWire shows major US carriers have addressed the security loophole attacks were leveraging. You can read the article here.

“Broken Trust”: The New Report from the Atlantic Council chronicles supply chain attacks

Atlantic Council Report

This is a link to the PDF report, “Broken Trust: Lesson from Sunburst”, recently released by the Atlantic Council, which looks at seven supply chain attacks to illustrate failures by private sector and governments to identify SolarWinds. The report states the need by federal government to identify “software with the largest potential blast radius” as a preventative measure against more major “sky is falling” cyberattacks like SolarWinds. And where to focus? Per the report “low-profile software used in critical parts of a network or given high-level permission that present valuable targets”.

Thanks to Politico’s weekly cybersecurity email for their insights and making the link available.

Daily Perk 3/29/2021

PHP Git Repository hacked with backdoors per Bleeping Computer

2021 is the year of software supply chain attacks. The latest involves code tampering in the official PHP Git repository. This is alarming because 79% of websites online use PHP as their server-side programming language. Two malicious changes upstream were pushed as “commits” by known PHP developers and maintainers, and made in the name of PHP’s creator.

As supply chain attacks seek to do, this abuses trust, which appears inherent in the commit process that allows for forged sign-offs to come from anyone else locally. To ensure better security going forward, PHP changes will now go through GitHub and not the PHP git server and contributors will need to be added to an authorized group. Sounds good 👍

Critical Netmask bug impacts hundreds if thousands of applications per Bleeping Computer

Netmask is the npm library used worldwide by hundreds of thousands of applications to parse or compare IPv4 addresses and CIDR blocks. It gets 3 million weekly downloads, and 278,000 GitHub repos depend on it.

A critical networking bug was identified, CVE-2021-28918, affecting how netmask handles when IPv4 decimal addresses have a leading zero. It could lead to server-side request forgery bypasses or remote file inclusion. Which impacts the ability of appliances or tools like Web Application firewalls to protect and defend, or perimeter security controls. Fixes are available on Npm downloads.

New Spectre Vulnerabilities found in Linux per The Hacker News

Ah, the wonderful world of speculative attacks aka known as the “sky is falling!” Spectre and Meltdown introduced us to a series of vulnerabilities allowing for things that were “never supposed to happen”. We know “trust but verify”, but need to add “never say never”.

Two new vulnerabilities could potentially allow attackers to bypass mitigations and get their paws on sensitive information from the kernel memory. All versions of Linux prior to 5.11.8 are affected. Patches were being released as of March 20.

Daily Perk 3/252021

The goal is in sight!

Patch it Now: WordPress Woes per Wordfence

WordPress sites are prime targets and rapidly exploited for unpatched vulnerabilities. If you are using Thrive Theme Legacy and plugins, about 100,000 sites are vulnerable and being actively exploited since patches were released March 12. The attached link to Wordfence will tell you what to do. There’s a couple other fixes for the Facebook for WordPress plugin that were highlighted today and found on over 500,000 sites that need your attention. Stay safe!

QNAP brute force attacks ongoing per Bleeping Computer

NAS boxes are great for storage and QNAP is very common. Unfortunately that has made it a prime target for attacks, including targeted ransomware. Right now attackers are using automation assistance to crack credentials for the boxes. There are recommendations out now to secure your QNAP: change the default access port number, make your password really strong, then enable password policies and finally disable the admin account that is being targeted currently. That takes a little more work but worth it. The link to the article walks you through what you need to do 😊

Patch It Now: Critical bug fix for Cisco Jabber per Bleeping Computer. The bug affects Jabber client software for Windows, macOS, Android and iOS. With some work, a remote authenticated attacker could execute arbitrary programs on a device with the vulnerable Jabber software running. I know it’s an enterprise org thing, so there’s plenty of patching to be done before somebody starts exploiting it.

Daily Perk 3/23/2021

CISA warns of threat to power grid from critical flaws in GE Universal Relay per The Hacker News

CISA issued an advisory March 16 warning of critical vulnerabilities in GE’s Universal Relay power management devices. GE has released patches for 9 vulnerabilities affecting numerous relay models. Exploitation of these unpatched flaws could let attackers reboot the UR, access sensitive information, gain privileged access to go deeper and cause more harm, or create a denial of service condition. Also of note is firmware versions prior to 8.1x were found using weak encryption and MAC algorithms for SSH communication (trust me not good) so they were more vulnerable to brute-force attacks for initial access.

Critical infrastructure, like power utilities, is essential to our daily lives, but most people don’t realize there isn’t just standard IT in use, but specialized operational tech systems, often left in place for years with the mindset “if it ain’t broke don’t fix it”. As these once-sequestered systems get increasingly connected or exposed to the Internet, they are less patched and more susceptible to compromise than standard IT.

Sierra Wireless hit by ransomware attack per Bleeping Computer

There has been a steady increase in both the size of the target and the ransom demanded. Sierra Wireless, a major global IoT solutions provider, disclosed they were hit March 20. The company sells products and services a number of verticals: healthcare, industry, energy, technology and more. The company is not sharing more except that they shut down manufacturing plants worldwide and they have “a clear separation between its internal IT and customer facing products and services”.

Telecom communications are critical infrastructure, and never more so than during a pandemic. We know attackers will aim for the pain points to ensure payment. I expect more attacks will be delivering disruptions to essential services at mass scale.

Patch It Now: Google reports targeted exploitation of unpatched devices with Qualcomm chipsets. CVE-2020-11261 It isn’t world on fire and local access to the device is needed – watering hole delivery of evil code will also work.