Les Bell and Associates Pty Ltd

Welcome to today's daily briefing on security news relevant to our CISSP (and other) courses. Links within stories may lead to further details in the course notes of some of our courses, and will only be accessible if you are enrolled in the corresponding course - this is a shallow ploy to encourage ongoing study. However, each item ends with a link to the original source.

News Stories

GPU and DSP Vulnerabilities Actively Targeted

The security landscape has developed a sudden nasty rash of vulnerabilities in the drivers for GPU (Graphics Processing Unit) and DSP (Digital Signal Processing) chips - and what's worse, these vulns are being actively exploited in attacks.

Qualcomm

Qualcomm was notified by the Google Threat Analysis Group and Google Project zero that three vulnerabilities are under limited, target exploitation. The vulnerabilities are:

• CVE-2023-33106
• CVE-2023-33107
• CVE-2023-33063
• CVE-2022-22071

At the time of writing, most of these do not appear in the National Vulnerability Database, but CVE-2022-22071 was described in Qualcomm's May 2022 Security Bulletin, as a use-after-free vulnerability in Automotive Android OS. There's no real information about the first three vuln's in Qualcomm's October 2023 Security Bulletin, though, other than a statement that:

However, the bulletin does cover three other critical vulnerabilities:

• CVE-2023-24855 (CVSS v3.x score 9.8): Use of out-of-range pointer offset in modem causing memory corruption in Qualcomm’s Modem component occurring when processing security-related configurations before the AS Security Exchange.
• CVE-2023-28540 (CVSS v3.x score 9.1): Improper authentication in Data Modem caused by a cryptographic issue in the Data Modem component arising during the TLS handshake.
• CVE-2023-33028 (CVSS v3.x score 9.8): Memory corruption in the WLAN firmware occurring while copying the pmk cache memory without performing size checks.

ARM Mali GPU Driver

Similarly, Maddie Stone of Google's Threat Analysis Group and Jann Horn of Google Project Zero have disclosed a vulnerabilityin ARM's Midgard, Bifrost, Valhall and Arm 5th Gen GPU architecture kernel drivers:

CVE-2023-4211 (CVSS 3.x score: ARM Mali GPU kernel driver use-after-free vulnerability allows a local non-privileged user to access already freed memory via improper GPU memory processing operations

The issue is fixed in Bifrost, Valhall and Arm 5th Gen GPU Architecture Kernel Driver r43p0, but there is evidence that it is under limited, targeted exploitation, and CISA has added it to its Known Exploited Vulnerabilities Catalog.

ARM, Mali GPU Driver Vulnerabilities, advisory, 2 October 2023. Available online at https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities.

Qualcomm, October 2023 Security Bulletin, advisory, 2 October 2023. Available online at https://docs.qualcomm.com/product/publicresources/securitybulletin/october-2023-bulletin.html.

ShellTorch RCE Vulnerability Affects AI Models

PyTorch is a popular open-source machine learning framework which is widely used in production, often via TorchServe. TorchServe is an open-source package for serving and scaling PyTorch models, primarily used in training and developing AI models. While TorchServe is maintained by Meta and Amazon, it counts Amazon, OpenAI, Tesla, Microsoft, Google and Intel among its users.

Now researchers at Oligo Security have reported the discovery of a number of a number of critical vulnerabilities in TorchServe which provide an exploit chain leading to remote code execution. Thousands of vulnerable instances are publicly exposed, including many at the companies named above.

The default configuration of TorchServe accidentally exposes the management interface to the entire world (by binding to all interfaces rather than just localhost), without any form of authentication. This can be combined with CVE-2023-43654, a server-side request forgery vulnerability (CVSS 3.x score 9.8) in the management interface that provides remote code execution, allowing configuration uploads from any domain. The researchers also found that TorchServe can be exploited via an unsafe deserialization vulnerability in the SnakeYAML library (CVE-2022-1471), giving a malicious model the capability of remote code execution.

The exploitation chain, called "ShellTorch", ends with the complete takeover of an AI model - and there are tens of thousands of exposed instances of vulnerable TorchServe applications around the world.

The vulnerabilities are present in TorchServe versions 0.3.0 through to 0.8.1. However, version 0.8.2 only partially mitigates CVE-2023-43654 by alerting the user to the possibility of uploads from invalid domains. Users should go through additional steps to secure their TorchServe installations by editing the config.properties file:

Oligo have also made available a tool which can check a TorchServe installation for the vulnerabilities. Their blog post contains a full write-up and description.

Levcovich, Idan, Guy Kaplan and Gal Elbaz, ShellTorch: Multiple Critical Vulnerabilities in PyTorch Model Server (TorchServe) (CVSS 9.9, CVSS 9.8) Threatens Countless AI Users - Immediate Action Required, blog post, 3 October 2023. Available online at https://www.oligo.security/blog/shelltorch-torchserve-ssrf-vulnerability-cve-2023-43654.

Upcoming Courses

• SE221 CISSP Fast Track Review, Virtual/Online, 13 - 17 November 2023
• SE221 CISSP Fast Track Review, Sydney, 4 - 8 December 2023

These news brief blog articles are collected at https://www.lesbell.com.au/blog/index.php?courseid=1. If you would prefer an RSS feed for your reader, the feed can be found at https://www.lesbell.com.au/rss/file.php/1/dd977d83ae51998b0b79799c822ac0a1/blog/user/3/rss.xml.

Copyright to linked articles is held by their individual authors or publishers. Our commentary is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License and is labeled TLP:CLEAR.

Welcome to today's daily briefing on security news relevant to our CISSP (and other) courses. Links within stories may lead to further details in the course notes of some of our courses, and will only be accessible if you are enrolled in the corresponding course - this is a shallow ploy to encourage ongoing study. However, each item ends with a link to the original source.

News Stories

AI Leading to Security Arms Race

We have often seen arms races in infosec over the years, as hackers discover an vulnerability and develop an exploit, the defenders work up a defence against that exploit, the hackers develop a workaround for that defence, the defenders block that workaround, and so the cycle continues until finally, the fundamental vulnerability is fixed with a patch that passes all the regression tests. A classic example is Microsoft's response to directory traversal attacks against IIS, which was met with the Unicode exploit for directory traversal, and when MS blocked that, the bad guys responded with Double Decode and so on it went. . .

The complexity and subtleties of large language models used in generative AI applications, especially chatbots, seems likely to lead to similar arms races, as hackers experiment with jailbreaks and prompt injections to work around programmatic prohibitions intended to prevent the AI apps doing the bad guys' work for them.

In a new example devised by Denis Shiryaev, he was able to overcome Bing Chat's initial refusal to solve a CAPTCHA image. When shown the CAPTCHA as a simple image, Bing Chat immediately recognised it and explained that it could not help, since the CAPTCHA "is a type of challenge-response test used to determine whether or not a user is human".

However, Shiryaev superimposed the CAPTCHA image onto the image of a pair of hands holding a locket, and then submitted that image along with a sob story:

The embedding of the image onto a surround locket and hands, along with the new prompt context of the lost dearly-loved grandma, was enough to jailbreak the Bing Chat block on simple CAPTCHA solving, and it solicitiously replied:

This is yet another way in which a large language model can be tricked into doing something that would normally be forbidden by its inbuilt safeguards. Essentially, GPT-4, which underlies Bing Chat, sets about answering this prompt from a different starting point in its knowledge graph, thus bypassing its defences against simple CAPTCHA-solving.

Microsoft and OpenAI are now going to have to come up with a defence for this - simply filtering for "grandma" and "locket" in prompts would defeat this particular exploit, but is obviously simplistic and easy to get around. One might posit the use of an LLM to examine potentially malicious inputs - but we are now in a recursive spiral which ends in what Douglas Hofstadter termed a "strange loop", since the filtering LLM itself could be exploited, and we ultimately end up against Kurt Gödel's incompleteness theorem.

Expect the fun and games with AI jailbreaks and prompt injection to continue for years to come.

Shiryaev, Denis, I've tried to read the captcha with Bing . . . , X post, 1 October 2023. Available online at https://twitter.com/literallydenis/status/1708283962399846459?s=20.

BunnyLoader: Rapidly-Evolving Malware-as-a-Service

A new piece of malware discovered being sold on cybercrime forums in early September by Zscaler ThreatLabz offers a lot of functionality to its purchasers. Termed "BunnyLoader", this new example of Malware-as-a-Service (MaaS) sells for the princely sum of only $US250, but incorporates the ability to download and execute a second-stage payload, and can also function as a stealer, with the ability to extract system information and user credentials from browsers, to work as a keystroke logger and to replace cryptocurrency wallet addresses on the clipboard with the threat actor's own wallet addresses. The stolen information can then be uploaded in ZIP format to a command and control server.

Written in C/C++, BunnyLoader is a fileless loader; in other words, it can download and execute further malware stages in memory, leaving no artifacts on disk for analysis. It also incorporates antiforensic techniques such as sandbox detection to further avoid analysis. It also offers remote command execution via a reverse shell.

BunnyLoader is also rapidly evolving, with eleven different releases seen by ThreatLabz during September alone. Purchasers get access to a web C2 dashboard listing tasks such as:

• downloading and executing additional malware
• keylogging
• stealing credentials
• manipulating a victim’s clipboard to steal cryptocurrency
• running remote commands on the infected machine

as well as statistics, active tasks and the stealer logs. Running this kind of malware really does not require mAd l33t skillz at all. . .

The Zscaler ThreatLabz blog post provides a detailed technical analysis, as well as IOC's.

Shivtarkar, Niraj and Satyam Singh, BunnyLoader, the newest Malware-as-a-Service, blog post, 29 September 2023. Available online at https://www.zscaler.com/blogs/security-research/bunnyloader-newest-malware-service.

Upcoming Courses

• SE221 CISSP Fast Track Review, Virtual/Online, 13 - 17 November 2023
• SE221 CISSP Fast Track Review, Sydney, 4 - 8 December 2023

These news brief blog articles are collected at https://www.lesbell.com.au/blog/index.php?courseid=1. If you would prefer an RSS feed for your reader, the feed can be found at https://www.lesbell.com.au/rss/file.php/1/dd977d83ae51998b0b79799c822ac0a1/blog/user/3/rss.xml.

Copyright to linked articles is held by their individual authors or publishers. Our commentary is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License and is labeled TLP:CLEAR.

Welcome to today's daily briefing on security news relevant to our CISSP (and other) courses. Links within stories may lead to further details in the course notes of some of our courses, and will only be accessible if you are enrolled in the corresponding course - this is a shallow ploy to encourage ongoing study. However, each item ends with a link to the original source.

News Stories

October is Cybersecurity Awareness Month

It's October already, and it seems like only a year since it was last October. Why is this significant? Because in both Australia and the US, and quite probably elsewhere, it is Cybersecurity Awareness Month, during which governments encourage enterprises to raise awareness, and also to raise public awareness of cybercrime and privacy concerns. The Australian Cyber Security Centre received a cybercrime report every 7 minutes during the 2021-2 financial year, an increase of 13% from the previous year, and there is no reason to believe things have improved in the last year.

We do our bit by making available a short talk for local government and community groups on Baseline Security for Small and Medium Enterprises; we also allow guest access to its accompanying course page whch contains additional resources (all the links within this story point to resources within that course or to external resources). Many of its recommendations are equally applicable to microbusinesses, self-employed professionals and private individuals, and it's no surprise that our recommendations overlap with this year's advice from the government agencies. Let's look at a few key points.

Proactive Patching

Both the major US and Australian agencies are this year recommending proactive patching of devices and systems. For smaller businesses and individuals, there is really no reason not to simply enable the default automatic updates of Microsoft, Apple and Google operating systems and applications. Large enterprises are different; they have complex, mission-critical systems running internally-developed and externally-sourced software which require extensive regression testing of the patches in a lab setting to ensure stability. And while this is being done, these systems are well-defended behind many layers of firewalls, endpoint security and intrusion prevention systems which will prevent their vulnerabilities being successfully exploited.

For small business and individuals, the situation is different; their systems are much simpler, often consisting primarily of the office suites provided by the operating system vendors, who have already done all the required regression testing to ensure that their OS patches don't break their apps, and vice-versa. And their systems are not surrounded by multiple layers of defence, but mininally-defended, so that any delay in applying patches increases the likelihood of successful exploitation.

In short: check for updates on a weekly basis, ideally every Wednesday morning for Windows systems, so as to catch Microsoft's monthly US Tuesday release of patches. Macs, iPhones and Android phones are generally similarly configured to auto-update. Yes, it's sometimes a pain to have to reboot after patches have been applied, but it is well worth it.

Strong Passphrases, Password Managers and Multi Factor Authentication

Both the US and Australian agencies recognise the importance of defending against online credential theft, and are suggesting various defensive techniques:

Strong Passwords - or, better, Passphrases

Unfortunately, the US Cybersecurity and Infrastructure Agency is giving outdated advice stating that "Strong passwords are long, random, unique and include all four character types (uppercase, lowercase, numbers and symbols)". This has long been known to be counter-productive as the resulting passwords are hard to memorize and users inevitable have to write them down or, after several logon failures, will give up and reset their passwords to something simpler. In fact, Special Publication 800-63B from the US National Institute of Standards and Technology, which provides guidance to US government agencies, deprecates any requirements for password complexity, instead recommending support for very long passphrases and only requiring a minimum of eight characters.

It's better to follow the advice of the Australian Cyber Security Center, to use passphrases: "Passphrases are passwords that use 4 or more random words". Just don't use "correct horse battery staple" 😁

Both agencies recommend the use of password managers to generate and store passphrases.

Multi-Factor Authentication

Best of all, enable multi-factor authentication on online accounts, especially email (Gmail, MS Outlook), social media and financial accounts. Where possible, make use of security keys such as Yubikeys (strongest), or mobile app-based authenticator applications such as Google Authenticator, Microsoft Authenticator or Authy (strong). Complain to companies and service providers who do not support these but instead rely on six-digit text-message verification codes (weak), as these are easily hacked and are now deprecated (again, see NIST SP 800-63B).

Backups

The ACSC recommends backing up important files. I'd go further, and recommend backing up each complete system.

The most important point is to store backups offline and, ideally, off-site. In other words, after backing up the system - say, to an external USB hard drive - you should unplug the backup drive so that it cannot be reached by ransomware or any other malware that infects your system. That way, should you fall victim to ransomware, the backup itself will not be encrypted and held ransom, and you can successfully boot from backup media and restore the lost files to get back to work.

Storing a backup off-site provides a last line of defence against disasters such as fires and flooding. While you can arranges this by, for example, storing a copy of backup media in some secure location, it is increasingly easy to make backups to cloud storage such as Amazon S3 or Google Cloud Storage (although this, in turn, introduces new threats unless secured properly).

After doing a detailed comparison of different products a few years ago, I settled on R-Drive Image to backup my Windows systems, buying multiple licences for our machines. It has never let me down and has saved my proverbial behind on several occasions. See https://www.drive-image.com/ for information. I also run both local and cloud backups, nightly, for our office NAS devices.

Controlled Folder Access

Speaking of ransomware, you should be aware that a backup alone cannot provide full protection against modern ransomware gangs. This is because, prior to encrypting and locking up your files, the ransomware uploads copies to the gang's command and control servers, and they may threaten to release your data publicly. It is much better to prevent ransomware - and other malware - from getting a foothold in the first place.

Large enterprises do this via a technique known as application safelisting (also application whitelisting or allowlisting) which will only allow a short list of approved programs to run on users' computers. However, application safelisting software can be quite expensive as it is intended for centralized management of many computers.

A free alternative that is well worth investigating is already built into Windows 10 and later, in the form of Controlled Folder Access. You can find this by going to the Windows Security dashboard (the blue sheild icon in the systray at lower right of the desktop), then clicking "Virus & threat protection" followed by "Manage ransomware protection".

Controlled folder access works with two lists - one of approved application programs, and one of the folders these programs are allowed to access. By default, many popular programs - e.g. the Microsoft Office suite - are enabled by default, as are the folders they generally use. If you have other programs - for example, I have a number of special-purpose editors and word processors - they will need to be added manually (this can be tedious, but stick with it!).

However, once controlled folder access is turned on, other programs - such as ransomware - will be blocked from running, and even the approved programs will be blocked from accessing other folders. There are no 100% guarantees, as there are some advanced techniques which can get around it, but tests have shown that controlled folder access will block most of the common ransomware.

Other Guidance

There's some other plausible advice in the government agencies' Cyber Awareness Month strategies, but it's less actionable and less certain. For example, CISA says, "Recognise & Report Phishing", but all the evidence suggests that this is far from easy - especially now that the phishing operators are using generative artificial intelligence to write better email lures for this and other scams.

Australian Cyber Security Agency, Cyber Security Awareness Month, web page, October 2023. Available online at https://www.cyber.gov.au/learn-basics/view-resources/cyber-security-awareness-month.

US Cybersecurity & Infrastructure Security Agency, Cybersecurity Awareness Month, web page, October 2023. Available online at https://www.cisa.gov/cybersecurity-awareness-month.

Les Bell and Associates, Baseline Security for Small and Medium Enterprises, online course, undated. Available online at https://www.lesbell.com.au/course/view.php?id=7.

Upcoming Courses

• SE221 CISSP Fast Track Review, Virtual/Online, 13 - 17 November 2023
• SE221 CISSP Fast Track Review, Sydney, 4 - 8 December 2023

These news brief blog articles are collected at https://www.lesbell.com.au/blog/index.php?courseid=1. If you would prefer an RSS feed for your reader, the feed can be found at https://www.lesbell.com.au/rss/file.php/1/dd977d83ae51998b0b79799c822ac0a1/blog/user/3/rss.xml.

Copyright to linked articles is held by their individual authors or publishers. Our commentary is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License and is labeled TLP:CLEAR.

Welcome to today's daily briefing on security news relevant to our CISSP (and other) courses. Links within stories may lead to further details in the course notes of some of our courses, and will only be accessible if you are enrolled in the corresponding course - this is a shallow ploy to encourage ongoing study. However, each item ends with a link to the original source.

News Stories

CISA Adds Multiple Exploited Vulnerabilities

This week, CISA has added five vulnerabilities to its Known Exploited Vulnerabilities Catalog:

• CVE-2023-41179 - Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability
• CVE-2023-41991 - Apple Multiple Products Improper Certificate Validation Vulnerability 
• CVE-2023-41992 - Apple Multiple Products Kernel Privilege Escalation Vulnerability
• CVE-2023-41993 - Apple Multiple Products WebKit Code Execution Vulnerability
• CVE-2018-14667 - Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability

CISA, CISA Adds One Known Exploited Vulnerability to Catalog, cybersecurity advisory, 21 September 2023. Available online at https://www.cisa.gov/news-events/alerts/2023/09/21/cisa-adds-one-known-exploited-vulnerability-catalog.

CISA, CISA Adds Three Known Exploited Vulnerabilities to Catalog, cybersecurity advisory, 25 September 2023. Available online at https://www.cisa.gov/news-events/alerts/2023/09/25/cisa-adds-three-known-exploited-vulnerabilities-catalog.

CISA, CISA Adds One Known Exploited Vulnerability to Catalog, cybersecurity advisory, 28 September 2023. Available online at https://www.cisa.gov/news-events/alerts/2023/09/28/cisa-adds-one-known-exploited-vulnerability-catalog.

WebP Vulnerability More Widespread Than First Thought

Of course, Apple should not be singled out over that WebKit code execution vulnerability - lots of browsers (and many server systems) have had to be updated this week due to a vulnerability in the libwebp library for rendering and processing images in the WebP format.

CVE-2023-4863 was initially considered to be a heap-based buffer overflow vulnerability in the Chrome browser. The vulnerability could be exploited by a malicious web page which contains a specially crafted image, giving the attacker remote code execution.  However, the vulnerability is really in some heap memory allocation code in the Huffman compression decoding routine. This was initially tracked as CVE-2023-5129 (since retired and replaced with CVE-2023-4863).

A similar vulnerability existed in Apple's code (CVE-2023-41064) as well as Chrome (CVE-2023-4863). Furthermore, libwebp is widely used in web content management systems, including WordPress and Drupal, as well as web languages such as Python and Node.js.

As we reported earlier this month, CVE-2023-41064, in particular, was exploited in the wild before its discovery by CitizenLab, who reported that it was being used as part of a zero-click deployment chain - called BLASTPASS - for NSO Group's Pegasus spyware.

A new report from Rezilion ties all this together rather nicely, and includes a list of affected products, including browsers, Linux distributions and other software. Rezilion also provide recommended mitigations.

Rezillion, Rezilion Researchers Uncover New Details on Severity of Google Chrome Zero-Day Vulnerability (CVE-2023-4863), blog post, 21 September 2023. Available online at https://www.rezilion.com/blog/rezilion-researchers-uncover-new-details-on-severity-of-google-chrome-zero-day-vulnerability-cve-2023-4863/.

Google, An image format for the Web, developer documentation page, 14 September 2023. Available online at https://developers.google.com/speed/webp.

Upcoming Courses

• SE221 CISSP Fast Track Review, Virtual/Online, 13 - 17 November 2023
• SE221 CISSP Fast Track Review, Sydney, 4 - 8 December 2023

These news brief blog articles are collected at https://www.lesbell.com.au/blog/index.php?courseid=1. If you would prefer an RSS feed for your reader, the feed can be found at https://www.lesbell.com.au/rss/file.php/1/dd977d83ae51998b0b79799c822ac0a1/blog/user/3/rss.xml.

Copyright to linked articles is held by their individual authors or publishers. Our commentary is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License and is labeled TLP:CLEAR.

Welcome to today's daily briefing on security news relevant to our CISSP (and other) courses. Links within stories may lead to further details in the course notes of some of our courses, and will only be accessible if you are enrolled in the corresponding course - this is a shallow ploy to encourage ongoing study. However, each item ends with a link to the original source.

News Stories

Xenomorph Banking Trojan Morphs Again

Back in February last year, researchers at Amsterdam fraud risk firm ThreatFabric encountered a new Android banking trojan which they dubbed Xenomorph, due to its code being partially based on the earlier Alien trojan. At that time, many planned features of Xenomorph had not yet been implemented, suggesting that the malware was still in the early stages of development. However, it was still adequately functional, targeting the customers of 56 different European banks by using Accessibility Services privileges to pup up overlay templates in front of the bank app's genuine login screen, thereby capturing customer credentials. It also intercepted SMS messages and Notifications, allowing it to compromise two-factor authentication.

For this campaign, the trojan was distributed via malicious (trojan-horse) apps on the Google Play Store, but that technique has been less effective as Google has improved its detection of malware in the Play Store. Now, ThreatFabric has uncovered a new Xenomorph campaign, this time using phishing webpages to trick users into side-loading malicious .apk files, thus bypassing Google's filtering.

This new version of the banking trojan has a larger list of targets, including institutions in the US and Portugal, and is also able to target multiple crypto wallets. The ability to add new targets is based on the malware's template system; the C2 server updates a list of URL's from which the malware can fetch new overlays which can capture usernames, passwords, credit card numbers and other data. The overlays are encrypted using a combination of AES and a proprietary algorithm.

Xenomorph now also sports a wide range of modules which can manipulate the victim device when specific conditions are met, performing actions like getting admin access, setting itself as the default SMS handler and disabling Play Protect. The new variant adds some new capabilities, such as disabling the screen sleep mode, simulating a touch on a point on the screen, and launching an Activity from a legitimate service.

Investigation of the Xenomorph C2 infrastructure indicates that the same group is also targeting desktop computers with a number of other stealers.

ThreatFabric's report provides a detailed analysis, along with IOC's such as sample digests, C2 server names and a list of its targets.

ThreatFabric Research, Xenomorph Malware Strikes Again: Over 30+ US Banks Now Targeted, blog post, 25 September 2023. Available online at https://www.threatfabric.com/blogs/xenomorph.

Report Provides Details of PRC Threat Actors

A new report produced by the NSA, FBI, CISA, Japan's National Police Agency and National Center of Incident Readiness and Strategy for Cybersecurity details activities by cyber actors linked to the People's Republic of China. The advisory provides the tactics, techniques and procedures of this activity, which has been termed 'BlackTech' (a.k.a. Palmerworm, Circuit Panda and Radio Panda).

BlackTech has demonstrated capabilities such as modifying router firmware without detection and exploiting the router's domain trust relationships to pivot from international subsidiaries to headquarters in Japan and the US, which are the primary targets. The group uses custom malware, dual-use tools and living-off-the-land tactics to target government, industrial, tech, media, electronics and telecomms sectors. The report's authors recommend that multinational corporations review all subsidiary connections, verify access and consider moving to zero trust architectures to limit the extent of a possible BlacTech compromise.

NSA, FBI, et. al., People's Republic of China-Linked Cyber Actors Hide in Router Firmware, cybersecurity advisory, 27 September 2023. Available online at https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-270a.

Upcoming Courses

• SE221 CISSP Fast Track Review, Virtual/Online, 13 - 17 November 2023
• SE221 CISSP Fast Track Review, Sydney, 4 - 8 December 2023

These news brief blog articles are collected at https://www.lesbell.com.au/blog/index.php?courseid=1. If you would prefer an RSS feed for your reader, the feed can be found at https://www.lesbell.com.au/rss/file.php/1/dd977d83ae51998b0b79799c822ac0a1/blog/user/3/rss.xml.

Copyright to linked articles is held by their individual authors or publishers. Our commentary is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License and is labeled TLP:CLEAR.

Welcome to today's daily briefing on security news relevant to our CISSP (and other) courses. Links within stories may lead to further details in the course notes of some of our courses, and will only be accessible if you are enrolled in the corresponding course - this is a shallow ploy to encourage ongoing study. However, each item ends with a link to the original source.

News Stories

Microsoft Adds Passkey Support to Windows 11

Microsoft has, for many years, been engaged in the Sisyphean task of securing an increasingly complex software stack. These two forces are in continual opposition; as the old saw has it, the enemy of security is complexity. But to give them their credit, the Redmondites keep plugging away at it, and things are, gradually, getting better.

The architecture that was reborn with Windows Vista has allowed the firm to take advantage of a range of hardware and software innovations, such as the use of the Trusted Platform Module (TPM) to provide a root of trust for a secure boot process, core isolation features like Hypervisor-protected Code Integrity and enabling the use of shadow stacks - part of Intel's Control-flow Enforcement Technology - for code running in kernel mode, thereby mitigating buffer overflows. While this has caused pain for device driver and application developers who use non-standard techniques - and their users - it has paid off.

The firm has now announced support for passkeys - an implementation of the FIDO2 passwordless authentication system - in Windows 11. Users will be able to create, use and protect passkeys using Windows Hello or Windows Hell for Business, or using their phone, authenticating using their face, fingerprint or device PIN. The Windows 11 implementation will work with multiple browsers including Edge (obviously), Google Chrome, Firefox and others. All we need now is for the mass of web sites to add support for passkeys.

Users with FIDO2 security keys or Windows Hello for Business will now be able to eliminate passwords altogether; in fact Azure Active Directory (now renamed Entra ID) administrators can configure policy so that users will no longer even see the option for password entry at logon. Another new feature is 'Config Refresh', which mitigates attempts to tamper with the registry by resetting it periodically (every 90 minutes by default, but every 30 minutes if desired). There are also new configuration options for the Windows Firewall.

This all represents another step towards a password-less world - something that will come as a relief to security professionals everywhere, as it will dramatically reduce phishing attacks.

In other Microsoft security news, the company's Security Resource Center blog has a nice profile of Australian-born security researcher Rocco Calvi, who has been continually at or near the top of the MSRC Most Valuable Researcher leaderboard in recent years.

MSRC, Journey Down Under: How Rocco Became Australia’s Premier Hacker, blog post, 25 September 2023. Available online at https://msrc.microsoft.com/blog/2023/09/journey-down-under-how-rocco-became-australias-premier-hacker/.

Weston, David, New security features in Windows 11 protect users and empower IT, blog post, 26 September 2023. Available online at https://www.microsoft.com/en-us/security/blog/2023/09/26/new-security-features-in-windows-11-protect-users-and-empower-it/.

RaaS Groups Share Infrastructure, Tools

The Ransomware-as-a-Service ecosystem is a highly dynamic one, with groups splintering, members forming new groups, re-using, adapting and evolving TTP's on a continual basis. It seems that the groups may also share infrastructure, or at least, pass it on to new users. A new report from Group-IB Threat Intelligence and its associates describes a new group, called ShadowSyndicate, that has taken this to new levels.

The key which allowed the Group-IB research team to identify the ShadowSyndicate infrastructure was the presence of the same SSH key fingerprint on many servers - 85 at the time of writing. The group has been working with various ransomware groups and their affiliates since July 2022, using a set of 'off-the-shelf' tools including Cobalt Strike (52 of those servers were used for Cobalt Strike C2), IcedID and Silver malware.

The researchers also linked ShadowSyndicate to a Quantum ransomware campaign in September 2022, Nokoyama ransomware campaigns in October and November 2022, and ALPHV activity in February 2023. It is possible ShadowSyndicate has also been associated with Royal, Cl0p, Cactus and Play ransomware campaigns, with connections between ShadowSyndicate's infrastructure and Cl0p/Truebot, which is one of the most successful ransomware operators.

The ShadowSyndicate infrastructure is widely dispersed - most of it is in Panama, Cyprus or the Russian Federation, but there are servers in locations such as the Seychelles, the Netherlands and Honduras.

The Group-IB blog post provides a full analysis as well as IOC's such as IP addresses, and domain names.

Switzer, Eline and Joshua Penny, Dusting for fingerprints: ShadowSyndicate, a new RaaS player?, blog post, 26 September 2023. Available online at https://www.group-ib.com/blog/shadowsyndicate-raas/.

Upcoming Courses

• SE221 CISSP Fast Track Review, Virtual/Online, 13 - 17 November 2023
• SE221 CISSP Fast Track Review, Sydney, 4 - 8 December 2023

These news brief blog articles are collected at https://www.lesbell.com.au/blog/index.php?courseid=1. If you would prefer an RSS feed for your reader, the feed can be found at https://www.lesbell.com.au/rss/file.php/1/dd977d83ae51998b0b79799c822ac0a1/blog/user/3/rss.xml.

Copyright to linked articles is held by their individual authors or publishers. Our commentary is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License and is labeled TLP:CLEAR.

Welcome to today's daily briefing on security news relevant to our CISSP (and other) courses. Links within stories may lead to further details in the course notes of some of our courses, and will only be accessible if you are enrolled in the corresponding course - this is a shallow ploy to encourage ongoing study. However, each item ends with a link to the original source.

News Stories

New Backdoor Targets Middle East Journalists, Dissidents

A new backdoor, which targets journalists, dissidents and political activists in the Middle East with the objective of cyber-espionage, has been discovered by ESET researchers. The backdoor, dubbed Deadglyph, is attributed to the Stealth Falcon APT, also known as FruityArmor, which is associated with the United Arab Emirates, and was originally discovered by Citizen Lab, who saw it conducting spyware attacks. It was also seen in 2019, when ESET analyzed an unusual backdoor it was then using.

The Deadglyph loading chain components (Image: ESET)

The initial loader of the Deadglyph backdoor is the only component that resides as a disk file in the victim machine. It is a small DLL, with only one exported function which operates as a registry shellcode loader. It first RC4-decrypts the path to the encrypted shellcode in the registry, then derives a unique RC4 key from the system UUID, using it to decrypt the shellcode it retrieves from the registry and then executes it. Deriving the key from the system UUID prevents successful decryption and execution on a different computer.

Interestingly, the VERSIONINFO resource of this and other components mimics the name 'Microsoft Corporation', using both Greek and Cyrillic Unicode characters - a form of homoglyph attack. It is this feature, along with the presence of hexadecimal ID's like 0xDEADB001 and 0xDEADB101 in its configuration. that gave the backdoor its name.

The registry shellcode contains an minimally-encrypted payload and the corresponding decryption code. Once decrypted, the body consists of a PE (Portable Executable) loader and a PE file; the latter is the native part of the backdoor, termed the Executor. This loads and decrypts its AES-encrypted configuration (keys and other settings, which are subsequently stored in the registry), then initializes the .NET runtime and loads the embedded .NET part of the backdoor, termed the Orchestrator, which is in the .rsrc section of the Executor. Once the Orchestrator is running, the Executor provides a library of native code functions which it will use.

The Orchestrator is the main component of Deadglyph; it first loads its configuration, then establishes a connection to a command and control server, using a number of threads to perform various tasks, including checking the environment for likely security-related processes - if any of these is detected, the backdoor will either pause C2 communications while the suspicious process is present, or terminate and uninstall itself. The other threads are used for periodic communication with the C2 server and to execute the received commands.

Two modules are used for C2 communications - a Network module and a Timer module. Again, the architecture is cautious to evade analysis: if it cannot establish a connection to the C2 server for a preset interval, then the backdoor terminates and uninstalls itself. The Network module communicates with the C2 server using a custom binary protocol with encrypted content is used underneath TLS/SSL, and has the ability to discover proxy configuration in the event it is on a network protected by a proxy web server.

The commands from the C2 server take the form of three types of tasks: Orchestrator tasks, which are used for configuring the backdoor; Executor tasks, which execute additional modules; and Upload tasks, which send the output of commands and errors to the C2 server. Interestingly, the backdoor does not implement the code for most of its commands - the traditional design. Rather, each command is delivered in the form of an additional module in PE format or as shellcode. This means that Deadglyph is almost infinitely extensible, and also that its capabilities cannot be fully analyzed unless and until all command/modules are captured.

However, the ESET researchers were able to capture three modules: a process creator, which provides remote command execution; an information collector, which profiles the system via Windows Management Instrumentation API queries; and a file reader, which can read a file and return it to the Orchestrator for subsequent uploading - this module was observed retrieving a victim's MS Outlook data file.

The exact exploitation mechanism by which Deadglyph infects a target system is not known; however, while investigating it, the ESET researchers discovered a .CPL (Control Panel extension) file which had been uploaded to VirusTotal from Qatar, and which appeared to be related to Deadglyph.

The ESET report provides IOC's, along with a mapping to MITRE ATT&CK techniques.

ESET Research, Stealth Falcon preying over Middle Eastern skies with Deadglyph, blog post, 22 September 2023. Available online at https://www.welivesecurity.com/en/eset-research/stealth-falcon-preying-middle-eastern-skies-deadglyph/.

Upcoming Courses

• SE221 CISSP Fast Track Review, Virtual/Online, 13 - 17 November 2023
• SE221 CISSP Fast Track Review, Sydney, 4 - 8 December 2023

These news brief blog articles are collected at https://www.lesbell.com.au/blog/index.php?courseid=1. If you would prefer an RSS feed for your reader, the feed can be found at https://www.lesbell.com.au/rss/file.php/1/dd977d83ae51998b0b79799c822ac0a1/blog/user/3/rss.xml.

Copyright to linked articles is held by their individual authors or publishers. Our commentary is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License and is labeled TLP:CLEAR.

Welcome to today's daily briefing on security news relevant to our CISSP (and other) courses. Links within stories may lead to further details in the course notes of some of our courses, and will only be accessible if you are enrolled in the corresponding course - this is a shallow ploy to encourage ongoing study. However, each item ends with a link to the original source.

News Stories

$A10 million Turns Up Unexpectedly - What Would You Do?

When $A10.47 million was suddently deposited into her account by a cryptocurrency exchange, the answer was obvious to a hard-working immigrant - invest in real estate, vehicles, art and furniture. After years of hard work, life was good - until the mistake was realized, her bank set out to recover the funds, ands she was arrested attempting to flee the country.

The case, which has implications for the operation of systems to process failed transactions, started when the partner of a Malaysian immigrant to Australia, Thevamanogari Manivel, tried to open an account with crypto exchange Crypto.com, making an initial transfer of funds from Manivel's bank account. The exchange rejected the payment, however, because the name on the bank account did not match the name on the crypto account. So far, so good.

But a Bulgaria-based worker who processed the refund did so by directly entering the data into an Excel spreadsheet - and entered the account number into the refund amount column. Instead of refunding $A100, the bank transferred over $A10 million into Manivel's account. When her partner discovered this the following day, he told her to transfer the funds into a joint account at a different bank, telling her he had won a competition run by Crypto.com.

It was over a year later that Crypto.com detected the error and tried to recover the funds from the bank, but when the bank contacted her, Manivel assumed this was likely a scam - and on calling the bank, was told that it probably was. To safeguard the remaining money, she and her partner transferred the remaining $A4 million to Malaysia. She was arrested while attempting to board a flight to Malaysia in March 2022, after which she spent 209 days in custody.

Prior to the windfall, Manivel had been a struggling immigrant, taking low-paid jobs while studying aged care and pathology at night school and saving enough money to bring her children to Australia. On pleading guilty to a charge of recklessly dealing with the proceeds of crime, she was sentenced to an 18 month community corrections order with six months' intensive compliance and unpaid community work in addition to time already spent in custody. The sentencing judge remarked that the money had been recovered and no sinister intent was proven - up to the point where her bank had informed her of the error.

Manivel seems to have returned to the straight and narrow, now studying for a B.Sc., but now her visa could be rescinded. Her partner, Jatinder Singh, was charged with theft and will face a plea hearing on 23 October.

All this started with a simple data entry error in a spreadsheet; such manual processes are sometimes used to deal with unusual transaction problems, but this illustrates the need for appropriate safeguards such as separate review to meet segregation of duties requirements, and the implementation of input validation - something easily implemented, even in spreadsheets. Crypto.com says that it has updated its refund and withdrawal systems after this incident.

Taylor, Josh, A crypto firm sent a disability worker $10m by mistake. Months later she was arrested at an Australian airport, The Guardian, 24 September 2023. Available online at https://www.theguardian.com/australia-news/2023/sep/24/a-crypto-firm-sent-a-disability-worker-10m-by-mistake-months-later-she-was-arrested-at-an-australian-airport.

Upcoming Courses

• SE221 CISSP Fast Track Review, Virtual/Online, 13 - 17 November 2023
• SE221 CISSP Fast Track Review, Sydney, 4 - 8 December 2023

These news brief blog articles are collected at https://www.lesbell.com.au/blog/index.php?courseid=1. If you would prefer an RSS feed for your reader, the feed can be found at https://www.lesbell.com.au/rss/file.php/1/dd977d83ae51998b0b79799c822ac0a1/blog/user/3/rss.xml.

Copyright to linked articles is held by their individual authors or publishers. Our commentary is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License and is labeled TLP:CLEAR.

Welcome to today's daily briefing on security news relevant to our CISSP (and other) courses. Links within stories may lead to further details in the course notes of some of our courses, and will only be accessible if you are enrolled in the corresponding course - this is a shallow ploy to encourage ongoing study. However, each item ends with a link to the original source.

News Stories

The Worst Privacy-Invading Devices? Cars

The integration of embedded processors into cars began with simple devices for engine control, some diagnostics and the very basic 'trip computer' to help drivers estimate trip times. But as silicon has become both more powerful and less expensive than mechanical devices for displaying information on the dashboard, cars have become more electronic than mechanical. Add ubiquitous connectivity, smartphone integration and GPS for navigation, and your car is probably the smartest device you own. All this culminates in battery electric vehicles, of course, in which the car's intelligence is completely integrated with the drive train and other basic functionality.

So as you drive around, the car's systems know not just how fast you are going, but where you are, where you are going, whether you will run out of fuel before you get there, the driving conditions, the streaming service music you are playing and a lot more.

Now researchers with the Mozilla Foundation have researched the data-gathering capabilities of 25 different car brands, along with what the manufacturers do with that data and the terms of their privacy policies (I say 'manufacturers' but if the recent moves of BMW and others are any guide, we may soon have to think of them as 'service providers'. Think transportation-as-a-service). The results are startling:

Every car brand collects more personal data than necessary, using that information for purposes other operating the vehicle and maintaining a customer relationship (a performance much worse than even mental health smartphone apps, only 63% of which earned the "*Privacy Not Included" label). Furthermore, most of them go beyond using the data internally for marketing and related purposes, and share (84%) or even sell (76%) personal information. 56% say they can share your information with governments or law enforcement in response to a request - not a court order or warrant, but a request.

Only two of the brands say that drivers have the right to have their personal data deleted - presumably to comply with the EU General Data Protection Regulation.

Another concern is a lack of assurance that the companies comply with good cybersecurity practices - for example, the researchers could not find out whether any of the cars encrypt the personal information they store. Email requests for clarification were mostly ignored, but a review of public breach disclosures over the last three years showed that 17 of the 25 car brands have a bad track record for leaks, hacks and breaches.

The companies' privacy policies make for concerning reading. Among the data categories collected by Nissan, according to their policy, is your "sexual activity". Kia can also collect information about your "sex life", apparently. In fact, six of the companies state that they can collect your genetic information or characteristics. The companies may also claim that their  policies also apply to passengers and it is the responsbility of the driver to inform them of this, ignoring the fact that just reading the policy to your passengers could take hours!

While most of the companies claim to comply with the Alliance for Automative Innovation's Consumer Protection Principles, but it seems that none of them actually comply in practice. And you really have little choice, since all the brands are similar and those that do allow you to opt out will dramatically reduce the smart functionality of the vehicle.

In short, you may wish to reconsider buying that new high-end EV.

Caltrider, Jen, Misha Rykov and Zoë MacDonald, It’s Official: Cars Are the Worst Product Category We Have Ever Reviewed for Privacy, Mozilla *Privacy Not Included review, 6 September 2023. Available online at https://foundation.mozilla.org/en/privacynotincluded/articles/its-official-cars-are-the-worst-product-category-we-have-ever-reviewed-for-privacy/.

Upcoming Courses

• SE221 CISSP Fast Track Review, Virtual/Online, 13 - 17 November 2023
• SE221 CISSP Fast Track Review, Sydney, 4 - 8 December 2023

These news brief blog articles are collected at https://www.lesbell.com.au/blog/index.php?courseid=1. If you would prefer an RSS feed for your reader, the feed can be found at https://www.lesbell.com.au/rss/file.php/1/dd977d83ae51998b0b79799c822ac0a1/blog/user/3/rss.xml.

Copyright to linked articles is held by their individual authors or publishers. Our commentary is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License and is labeled TLP:CLEAR.

Welcome to today's daily briefing on security news relevant to our CISSP (and other) courses. Links within stories may lead to further details in the course notes of some of our courses, and will only be accessible if you are enrolled in the corresponding course - this is a shallow ploy to encourage ongoing study. However, each item ends with a link to the original source.

News Stories

Cloud Cryptojacking Operation Uses Multiple AWS Services

A new cloud-native cryptojacking operation attributed to Indonesian hackers could cost victims massive amounts as it unexpectedly consumes cloud services before they realize what is occurring. The operation, dubbed AMBERSQUID by the Sysdig researchers who uncovered it, makes use of a number of less-commonly-used AWS services such as the Amplify build and deployment platform, the ECS and Fargate container orchestration service, Codebuild, CloudFormation and EC2 Auto Scaling.

The AMBERSQUID deployment process (Image: Sysdig)

The researchers found AMBERSQUID in an innocuous container image while analysing over 1.7 million Linux images on Docker Hub; static scanning of the image showed no indicators or malicious binaries, and it was only when the image was run that its cryptojacking, using multiple services, was revealed. A number of Docker Hub user accounts are related to this operation - while some have been abandoned, others remain active. When launched, the Docker images download a cryptominer binary from a GitHub account and then run it.

The exploitation begins with execution of a script called amplify-role.sh, which creates the "AWSCodeCommit-Role" role, and then uses it throughout the process in order to add full access permissions for the various AWS services. The scripts that follow use the various services to first, create a private repository for the CodeCommit service in every region, which is then used as a source for the other services, then create five Amplify web apps, running the miner as it does does so, then uses ECS and Fargate to start each container, using 2 virtual CPU's and 4 GB of memory, A similar process is used to run the miner in Codebuild, CloudFormation., EC2 AutoScaling and the Sagemaker deployment tool for machine learning models,

The resulting resource utilization can be very expensive for the victim - assuming a relatively modest number of regions and instance scaling, it would be $US2,244 per day, but it could easily be much more.

While AMBERSQUID targets AWS, the same techniques could be used to exploit similar deployment services offered by other cloud service providers. Defenders tend to focus on the possibility of cryptominers being installed on conventional IaaS instances in EC2, Google Compute Engine, etc. but this case demonstrates that other services need to be secured and monitored as well, with quotas and alerts set even for services not currently in use.

Brucato, Alessandro, AWS’s Hidden Threat: AMBERSQUID Cloud-Native Cryptojacking Operation, blog post, 18 September 2023. Available online at https://sysdig.com/blog/ambersquid/.

Latest Aussie Ransomware Victim: Pizza Hut

Pizza Hut Australia is the latest company to fall victim to a ransomware attack, disclosing the detection of an incident in early September. Subsequent analysis revealed that an unauthorised third party had accessed the data of 193,000 customers, including names, delivery addresses and instructions, email addresses and contact numbers. No usable credit card data or other financial details were exposed.

The affected customers have been contacted by the company, which has also notified the Australian Cyber Security Centre and the Office of the Australian Information Commissioner.

Rawling, Caitlin, Pizza Hut says nearly two-hundred thousand customers affected by data breach, ABC News, 20 September 2023. Available online at https://www.abc.net.au/news/2023-09-20/pizza-hut-customers-affected-by-cyber-hack/102881804.

Upcoming Courses

• SE221 CISSP Fast Track Review, Virtual/Online, 13 - 17 November 2023
• SE221 CISSP Fast Track Review, Sydney, 4 - 8 December 2023

These news brief blog articles are collected at https://www.lesbell.com.au/blog/index.php?courseid=1. If you would prefer an RSS feed for your reader, the feed can be found at https://www.lesbell.com.au/rss/file.php/1/dd977d83ae51998b0b79799c822ac0a1/blog/user/3/rss.xml.

Copyright to linked articles is held by their individual authors or publishers. Our commentary is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License and is labeled TLP:CLEAR.