AUSCERT Week in Review for 7th September 2018 Greetings, Submissions close shortly for comments on the Assistance and Access Bill 2018. This bill is for communication providers to allow law enforcement to access encrypted communication. The type of assistance the bill has requested includes: – removing one or more forms of electronic protection that are or were applied by, or on behalf of, the provider– assisting access to devices or services– installing, maintaining, testing or using software or equipment or assisting with those activities where the provider is already capable of removing this protection– concealing that any other thing has been covertly performed in accordance with the law Souce: https://www.homeaffairs.gov.au/consultations/Documents/industry-assistance-factsheet.pdf https://www.homeaffairs.gov.au/about/consultations/assistance-and-access-bill-2018 Public feedback is open until September the 10th. For more information on having your say, see https://digitalrightswatch.org.au/2018/08/19/defend-encryption/ Here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: NIST Releases Draft on BGP SecurityDate Published: 05 September 2018URL: https://www.darkreading.com/perimeter/nist-releases-draft-on-bgp-security/d/d-id/1332740Author: Dark Reading StaffExcerpt: “A new draft publication from the NIST National Cybersecurity Center of Excellence (NCCoE) takes aim at security concerns about the Border Gateway Protocol (BGP), the default routing protocol to route traffic among Internet domains. The paper, “Protecting the Integrity of Internet Routing: Border Gateway Protocol (BGP) Route Origin Validation,” is open for public comment until Oct. 15.”—– Google Wants to Kill the URLDate Published: 04 September 2018URL: https://www.wired.com/story/google-wants-to-kill-the-url/Author: Lily Hay NewmanExcerpt: “The focus right now, they say, is on identifying all the ways people use URLs to try to find an alternative that will enhance security and identity integrity on the web while also adding convenience for everyday tasks like sharing links on mobile devices.”—– Five-Eyes nations to force encryption backdoorsDate Published: 03 September 2018URL: https://www.itnews.com.au/news/five-eyes-nations-to-force-encryption-backdoors-511865Author: Juha SaarinenExcerpt: “At the Five Country Ministerial meeting on the Gold Coast last week, security and immigration ministers put forward a range of proposals to combat terrorism and crime, with a particular emphasis on the internet.As part of that, the countries that share intelligence with each other under the Five-Eyes umbrella agreement, intend to “encourage information and communications technology service providers to voluntarily establish lawful access solutions to their products and services.”…While the rhetoric is sharp, the specifics are vague. Governments won’t specify any particular interception technology, and will leave it to technology companies to create the solutions required that provide lawful access capability.”—– Faster internet speeds for Queensland as undersea cable confirmedDate Published: 07 September 2018URL: https://www.brisbanetimes.com.au/national/queensland/faster-internet-speeds-for-queensland-as-undersea-cable-confirmed-20180907-p5029p.htmlAuthor: Tony MooreExcerpt: “State Development Minister Cameron Dick and Sunshine Coast mayor Mark Jamieson announced on Friday that tech giant RTI Connectivity and the Sunshine Coast Council will build the 550-kilometre undersea cable into the Sunshine Coast by 2020.”—– Here are this week’s noteworthy security bulletins: ASB-2018.0209 – [Android] Google Android devices: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/67930“Multiple security vulnerabilities have been identified in the Android operating system prior to the 2018-09-05 patch level.” ASB-2018.0206 – [Win][UNIX/Linux][BSD][Mobile] Mozilla Firefox: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/67834“Multiple vulnerabilities have been identified in Mozilla Firefox prior to version 62. One of these vulnerabilities have been classified as critical.” ESB-2018.2641 – [UNIX/Linux][Debian] curl: Execute arbitrary code/commands – Remote/unauthenticatedhttps://portal.auscert.org.au/bulletins/67782“Zhaoyang Wu discovered that cURL, an URL transfer library, contains a buffer overflow in the NTLM authentication code triggered by passwords that exceed 2GB in length on 32bit systems.” ESB-2018.2631 – [UNIX/Linux] ghostscript: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/67742“Ghostscript contains multiple -dSAFER sandbox bypass vulnerabilities, which may allow a remote, unauthenticated attacker to execute arbitrary commands on a vulnerable system.” Stay safe, stay patched and have a good weekend!Charelle

AUSCERT Week in Review for 31st August 2018 Greetings, Good news, everyone! More than 50% of the Alexa Top 1 Million sites are now actively redirecting to HTTPS. The internet has now scraped a C for transport security – that’s a pass! Now for the slow grind up to a B grade and higher. Unfortunately transport security isn’t the be all and end all, and 130 million people who have stayed in some of China’s biggest hotel chains have had their data sold on the darkweb thanks to a development team leaving a production database dump on their GitHub. At least as the black-hatted entrepreneur was downloading the data, no one was able to read it in transit. And since time is a flat circle, once again Apache Struts is being used to deliver cryptominers onto unsuspecting servers. Here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: Hackers drop crypto mining on vulnerable Strutshttps://www.itnews.com.au/news/hackers-drop-crypto-mining-on-vulnerable-struts-511592Author: Juha SaarinenExcerpt: “Researchers have recorded the first mass automated attacks against servers running unpatched versions of the open source Apache Struts enterprise web application framework. The new vulnerability in Apache Struts was made public four days ago and allows for remote code execution.” —— Data of 130 Million Chinese Hotel Chain Guests Sold on Dark Web Forumhttps://www.bleepingcomputer.com/news/security/data-of-130-million-chinese-hotel-chain-guests-sold-on-dark-web-forum/Author: Catalin CimpanuExcerpt: “A hacker is selling the personal details of over 130 million hotel guests for 8 Bitcoin ($56,000) on a Chinese Dark Web forum. The breach was reported today by Chinese media after several cyber-security firms spotted the forum ad. The seller said he obtained the data from Huazhu Hotels Group Ltd (Huazhu from hereafter), one of China’s largest hotel chains, which operates 13 hotel brands across 5,162 hotels in 1,119 Chinese cities.” —— Alexa Top 1 Million Analysis – August 2018https://scotthelme.co.uk/alexa-top-1-million-analysis-august-2018/Author: Scott HelmeExcerpt: “Here’s the one we’ve all been waiting for, and this one is a pretty big announcement too. Not only because we’ve seen amazing growth in HTTPS again in this crawl, but because we’ve passed through 50% of the Alexa Top 1 Million sites actively redirecting to HTTPS for the first time!” —— Cyber security and digital transformation ministries scrappedhttps://www.itnews.com.au/news/cyber-security-and-digital-transformation-ministries-scrapped-511516Author: Justin HendryExcerpt: “Australia is without a dedicated Cyber Security Minister for the first time in two years after Prime Minister Scott Morrison removed the role from his first ministerial line-up. Changes to the cabinet unveiled by the newly appointed PM on Sunday afternoon deletes any mention of the cyber security remit from the ministry, effectively demoting its importance after it was heavily pushed by Malcolm Turnbull.” —— Here are this week’s noteworthy security bulletins: 1) ESB-2018.2569 – [Win][UNIX/Linux] Joomla!: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/67490 While the Joomla! input filter smartly blacklists PHAR file upload, there were some edge cases that would allow them. If the webserver was configured to execute the files, this would enable webshell upload in the worst case. 2) ESB-2018.2539 – [Win][UNIX/Linux][FreeBSD] Node.js: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/67370 Node.js has patched several vulnerabilities, including out of bounds memory reading and writing. 3) ASB-2018.0205 – [Win][Linux][Virtual] GitLab: Cross-site request forgery – Remote with user interactionhttps://portal.auscert.org.au/bulletins/67570 GitLab has patched some information leaking vulnerabilities, alongside some CSRF/XSS issues. Stay safe, stay patched and have a good weekend! Tim

AUSCERT Week in Review for 24th August 2018 AUSCERT Week in Review24 August 2018 Greetings, “Six of the best”, no more, and no less.  That is indeed the number of new articles gathered for this week. Yet, for those of you who painfully understand the meaning behind “six of the best”, reading the six articles listed may indeed feel like it is a bit of similar reprimand.  Well, the reading is great material and nicely composed, but the stories contained in the news articles are painful to reminiscence to articles you may have read about 15 years ago. Fraudulent online purchases, websites being owned, credentials being stolen and traded – these are all stories could have been dated August 2003. Yet, they are happening today.   So, please read these articles today, and bear the lessons they inflict.  Then take it upon yourself to do one thing that can possibly avoid this and persist with it for the next fifteen years.  It could be changing default credentials every network attached appliance you touch – with permission from the owners of course – be they from work, yours, or your friends and families. Or perhaps evangelise the “Stop-Think-Connect”[1] mantra to the click addicted. Or, it could be putting yourself in the forefront of reviewing code at work or in a public repository, making that code that little bit more secure. Or, it could be taking on a policy of ensuring you update every system you touch, or at least raise up the need to update every system you touch, be it in the data center or at an internet-cafe.   It sounds like a huge task, but should it be taken on gradually, and concertedly, perhaps we won’t need to take another six-of-the-best in August 2033.  After all there is plenty of time to achieve this,.. right?.. or… is that the very thing we told ourselves fifteen years ago, that has landed us in the place we are today?   Enjoy.. [1]https://www.stopthinkconnect.org/ As for the news, here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: Title:  Vulnerability Affects All OpenSSH Versions Released in the Past Two DecadesURL:    https://www.bleepingcomputer.com/news/security/vulnerability-affects-all-openssh-versions-released-in-the-past-two-decades/Date:   August 22, 2018Author: Catalin Cimpanu Excerpt:“A vulnerability affects all versions of the OpenSSH client released in the past two decades, ever since the application was released in 1999.” ——- Title:  Australia Battles Fraudulent Online PurchasesURL:    https://www.bankinfosecurity.com/australia-battles-fraudulent-online-purchases-a-11408Date:   August 22, 2018Author: Jeremy Kirk Excerpt:“There’s bad news in Australia when it comes to payment card fraud: It’s growing. The biggest source of that fraud is online payments made without the physical card, or card-not-present fraud. That’s due to fraudsters re-using stolen payment card details. CNP fraud in Australia totaled AU$476.3 million (US$350.6 million) last year, up 13.9 percent from 2016, according to a report released Wednesday by the Australian Payments Network, an industry group that collects payments statistics. The figure has risen annually since 2012, when it was $183.1 million.” ——- Title:  Legacy System Exposes Contact Info of BlackHat 2018 AttendeesURL:    https://www.bleepingcomputer.com/news/security/legacy-system-exposes-contact-info-of-blackhat-2018-attendees/Date:   August 22, 2018Author: Ionut Ilascu Excerpt:“Full contact information of everyone attending the BlackHat security conference this year has been exposed in clear text, a researcher has found. The data trove includes name, email, company, and phone number. The BlackHat 2018 conference badge came embedded with a near-field communication (NFC) tag that stored the contact details of the participant, for identification or for vendors to scan for marketing purposes.” ——- Title:  Adobe security updates address 2 critical code execution flaws in Photoshop.URL:    https://securityaffairs.co/wordpress/75539/hacking/adobe-photoshop-flaws.html   Date:   August 22, 2018Author: Pierluigi Paganini Excerpt:“Adobe released updates to address two critical code executions flaws that affect Photoshop for Windows and macOS versions of Photoshop CC. The vulnerabilities, tracked as  CVE-2018-12810 and CVE-2018-12811, are memory corruption issues that could be exploited by a remote attacker to execute arbitrary code in the context of the targeted user.” ——- Title:  Netflix, HBO GO, Hulu passwords found for sale on the Dark WebURL:    https://nakedsecurity.sophos.com/2018/08/22/netflix-hbo-go-hulu-passwords-found-for-sale-on-the-dark-web/Date:   22 Aug 2018 Author: Lisa Vaas Excerpt:“The report from Irdeto found that thieves are selling hundreds of stolen logins for popular “over-the-top” (OTT) services such as pay TV and video on demand on Dark Web marketplaces. Besides HBO GO credentials, the company spotted listings for logins to 42 services, including Netflix, DirecTV and Hulu. All told, during the month of April, Irdeto spotted 854 sets of credentials, listed by 69 separate vendors on 15 marketplaces. On average, an account’s credentials are fetching $8.71 (about £6.60) for one-time use. Some Dark Web sellers are also selling bundles of credentials for several services at higher prices.” ——- Title:  New Apache Struts RCE Flaw Lets Hackers Take Over Web ServersURL:    https://thehackernews.com/2018/08/apache-struts-vulnerability.htmlDate:   August 22, 2018Author: Mohit Kumar Excerpt:“Semmle security researcher Man Yue Mo has disclosed a critical remote code execution vulnerability in the popular Apache Struts web application framework that could allow remote attackers to run malicious code on the affected servers. Apache Struts is an open source framework for developing web applications in the Java programming language and is widely used by enterprises globally, including by 65 percent of the Fortune 100 companies, like Vodafone, Lockheed Martin, Virgin Atlantic, and the IRS. The vulnerability (CVE-2018-11776) resides in the core of Apache Struts and originates because of insufficient validation of user-provided untrusted inputs in the core of the Struts framework under certain configurations.” ——- And lastly, here are this week’s noteworthy security bulletins (in no particular order): 1) ASB-2018.0201 – ALERT [Win][UNIX/Linux] Apache Struts 2: Execute arbitrary code/commands – Remote/unauthenticatedhttps://portal.auscert.org.au/bulletins/67162It is possible to perform a RCE attack… (CVE-2018-11776) 2) ESB-2018.2515.2 – UPDATE [Ubuntu] Linux kernel: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/67270…could use this to gain elevated privileges. (CVE-2018-13405) 3) ESB-2018.2427 – [Linux][Mac] F5 BIG-IP APM client: Root compromise – Existing accounthttps://portal.auscert.org.au/bulletins/66898…can allow an unprivileged user to get ownership of files owned by root on the local client host. (CVE-2018-5546) 4) ESB-2018.2517 – ALERT [Appliance] IBM Security Access Manager Appliance: Execute arbitrary code/commands – Remote/unauthenticated https://portal.auscert.org.au/bulletins/67278…could allow remote code execution when Advanced Access Control or Federation services are running. (CVE-2018-1722) 5) ESB-2018.2513 – [Appliance] BD Alaris: Unauthorised access – Remote/unauthenticatedhttps://portal.auscert.org.au/bulletins/67258…may allow a remote attacker to gain unauthorized access to various Alaris Syringe pumps and impact the intended operation of the pump … (CVE-2018-14786) Wishing you the best from AUSCERT and stay safe as we will need you next week to keep users safe,Geoffroy

AUSCERT Week in Review for 17th August 2018 AUSCERT Week in Review17 August 2018 Greetings,Another week gone by, and this one has not been any thinner in bulletins to process. Have you ever applied lots of pressure to a wet bar of soap? It may be a worth-while experiment to perform the next time you get access to a soap bar if the physics are not quite understood. Well, entities are a bit like a bar of wet soap and are keen to avoiding legal problems, whilst maintaining a loyal and satisfied customer base.  After all that is how “quality” is defined, a satisfied customer base.  This may soon become a more complicated juggling act for organisations handling user data either, in transit or at rest, from a service they provide or equipment they manufacture.  Trying to squeeze access to data may result in organisations deciding to relinquish any possibility of access to this user data as legal ramification increase. Adding the risk of time served may alter the way an organisation may provide a service or build a product. Squeezing organisation hard in this manner may diminish, as the chance to get to the data sought slips away. So, should organisations deal with user data, at rest or in transit, from services or equipment manufactured, then perhaps the first news story of this week is worth while to look at and keep an eye if this legislation passes.  For if it does, organisations may have to re-assess their policy, denying themselves access to user-submitted data, lest time be served.      As for the news, here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: Title:  Australians who won’t unlock their phones could face 10 years in jailURL:    https://nakedsecurity.sophos.com/2018/08/16/australians-who-wont-unlock-their-phones-could-face-10-years-in-jail/Date:   August 16, 2018Author: Danny Bradbury     Excerpt:“The Australian government wants to force companies to help it get at suspected criminals’ data. If they can’t, it would jail people for up to a decade if they refuse to unlock their phones.” ——- Title:  Hundreds of Instagram accounts were hijacked in a coordinated attack URL:    https://securityaffairs.co/wordpress/75377/hacking/instagram-accounts-hacked.htmlDate:   August 15, 2018 Author: Pierluigi Paganini     Excerpt:“Hundreds of Instagram accounts were hijacked in what appears to be the result of a coordinated attack, all the accounts share common signs of compromise. Alleged attackers have hijacked Instagram accounts and modified personal information making impossible to restore the accounts.” ——- Title:  PhishPoint Phishing Attack – A new technique to Bypass Microsoft Office 365 ProtectionsURL:    https://securityaffairs.co/wordpress/75382/hacking/phishpoint-phishing-attacks.htmlDate:   August 15, 2018 Author: Pierluigi Paganini     Excerpt:“Security experts from the cloud security firm Avanan have discovered a new technique dubbed PhishPoint, that was used by hackers to bypass Microsoft Office 365 protections. PhishPoint is a new SharePoint phishing attack that affected an estimated 10% of Office 365 users over the last 2 weeks. The experts are warning of the new technique that was already used in attacks by scammers and crooks to bypass the Advanced Threat Protection (ATP) mechanism implemented by most popular email services, Microsoft Office 365.” ——- Title:  Academics Discover New Bypasses for Browser Tracking Protections and Ad BlockersURL:    https://www.bleepingcomputer.com/news/security/academics-discover-new-bypasses-for-browser-tracking-protections-and-ad-blockers/Date:   August 16, 2018 Author: Catalin Cimpanu     Excerpt:“Security and user privacy protections included in browsers, ad blockers, and anti-tracking extensions are not as secure as everyone believes, a team of three academics from the Catholic University in Leuven, Belgium (KU Leuven) have revealed yesterday. Their work consisted of analyzing anti-tracking settings that are built into modern browsers, but also the ones provided by some popular extensions (add-ons).” ——- Title:  Princess Evolution Ransomware is a RaaS With a Slick Payment SiteURL:    https://www.bleepingcomputer.com/news/security/princess-evolution-ransomware-is-a-raas-with-a-slick-payment-site/Date:   August 15, 2018 Author: Lawrence Abrams     Excerpt:“A new variant of the Princess Locker ransomware is being distributed called Princess Evolution. Like its predecessor, Princess Evolution is a Ransomware as a Service, or RaaS, that is being promoted on underground criminal forums. As this ransomware is being distributed through different affiliates, there are numerous methods that are possibly being used to distribute this ransomware… ..Unfortunately, at this time there is no known way to decrypt files encrypted by Princess Evolution. For those who are interested in discussing this ransomware or receiving support, you can use our dedicated Princess Evolution Support & Help topic.” ——- And lastly, here are this week’s noteworthy security bulletins (in no particular order): 1)ESB-2018.2401 – [SUSE] kernel: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/66786…local users to create files with an unintended group ownership allowing attackers to escalate privileges by making a plain file executable and SGID… 2)ESB-2018.2379 – [Cisco] Cisco Web Security Appliance (WSA): Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/66698CVE-2018-0428 …could allow an authenticated, local attacker to elevate privileges to root… 3)ESB-2018.2361 – [Debian] kernel: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/66626…local users to create files with an unintended group ownership allowing attackers to escalate privileges by making a plain file executable and SGID… 4)ESB-2018.2325 – [SUSE] cups: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/66458…a local privilege escalation to root and sandbox bypasses… 5)ESB-2018.2403 – [Win] Tridium Niagara: Administrator compromise – Existing accounthttps://portal.auscert.org.au/bulletins/66794…using a disabled account name and a blank password, granting the attacker administrator access… Wishing you the best from AUSCERT and stay safe as we will need you next week to keep users safe,Geoffroy

AUSCERT Week in Review for 10th August 2018 Greetings, As another week comes to a close, here’s a collection of articles for you to enjoy. Have you ever considered the impact cryptomining has on the environment? On a side note, AUSCERT is hiring! The position is for a Senior Information Security Analyst. If interested, you can find more details at (https://www.seek.com.au/job/36851253). Here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: Ramnit is back and contributes in creating a massive proxy botnet, tracked as ‘Black’ botnet Date Published: 08/08/2018 Author: Pierluigi Paganini Excerpt: “In 2015, Europol partnering with several private technology firms announced the takedown of the Ramnit C2 infrastructure.   A few months later Ramnit was back, the researchers at IBM security discovered a new variant of the popular Ramnit Trojan.   Recently the experts observed that the “Black” botnet campaign has infected up 100,000 systems in two months, and this is just the tip of the iceberg because according to researchers a second-stage malware called Ngioweb is already spreading.   There is the concrete risk that Ramnit operators are using the two malware to build a large, multi-purpose proxy botnet that could be used for many fraudulent activities (i.e. DDoS attacks, ransomware-based campaigns, cryptocurrency mining campaigns).   “Recently we discovered the Ramnit C&C server (185.44.75.109) which is not related to the previously most prevalent botnet “demetra”. According to domain names which are resolved to the IP address of this C&C server, it pretends to control even old bots, first seen back in 2015. We named this botnet “Black” due to the RC4 key value, “black”, that is used for traffic encryption in this botnet.” reads the analysis published by Checkpoint security.” —– Exploit kits: summer 2018 review Date Published: 07/08/2018 Author: Jerome Segura Excerpt: “In addition, we have witnessed many smaller and unsophisticated attackers using one or two exploits bluntly embedded in compromised websites. In this era of widely-shared exploit proof-of-concepts (PoCs), we are starting to see an increase in what we call “pseudo-exploit kits.” These are drive-by downloads that lack proper infrastructure and are typically the work of a lone author. In this post, we will review the following exploit kits: RIG EK GrandSoft EK Magnitude EK GreenFlash Sundown EK KaiXin EK Underminer EK Pseudo-EKs”” —– Hacker swipes Snapchat’s source code, publishes it on GitHub Date Published: 07/08/2018 Author: Matthew Hughes Excerpt: “The repository has a description of “Source Code for SnapChat,” and is written in Apple’s Objective-C programming language. This strongly suggests that the repo contained part or whole of the company’s iOS application, although there’s no way we can know for certain. It could just as easily be a minor component to the service, or a separate project from the company.   There are two other clues to the identity of the person who published the leaked Snapchat code.   According to the i5xx GitHub account, his name is Khaled Alshehri. This should be taken with a grain of salt, however. For starters, there’s nothing stopping the user from listing a fake name. Furthermore, according to several people TNW has spoken to, the surname “Alshehri” isn’t especially common in Pakistan.   The profile also links to an online business in Saudi Arabia offering a mixed bag of tech services, from security scanning and iCloud removal, to software development and the sale of iTunes giftcards.” —– DeepLocker: How AI Can Power a Stealthy New Breed of Malware Date Published: 08/08/2018 Author: Marc Ph. Stoecklin Excerpt: “What is unique about DeepLocker is that the use of AI makes the “trigger conditions” to unlock the attack almost impossible to reverse engineer. The malicious payload will only be unlocked if the intended target is reached. It achieves this by using a deep neural network (DNN) AI model.   The AI model is trained to behave normally unless it is presented with a specific input: the trigger conditions identifying specific victims. The neural network produces the “key” needed to unlock the attack. DeepLocker can leverage several attributes to identify its target, including visual, audio, geolocation and system-level features. As it is virtually impossible to exhaustively enumerate all possible trigger conditions for the AI model, this method would make it extremely challenging for malware analysts to reverse engineer the neural network and recover the mission-critical secrets, including the attack payload and the specifics of the target. When attackers attempt to infiltrate a target with malware, a stealthy, targeted attack needs to conceal two main components: the trigger condition(s) and the attack payload.   DeepLocker is able to leverage the “black-box” nature of the DNN AI model to conceal the trigger condition. A simple “if this, then that” trigger condition is transformed into a deep convolutional network of the AI model that is very hard to decipher. In addition to that, it is able to convert the concealed trigger condition itself into a “password” or “key” that is required to unlock the attack payload.” —- ICS Threat Broadens: Nation-State Hackers Are No Longer the Only Game in Town Date Published: 07/08/2018 Authors: Israel Barak and Ross Rustici Excerpt: “The honeypot contained bait to entice attackers, including three Internet facing servers (Sharepoint, SQL and domain controller) with remote access services like RDP and SSH and weak passwords. Nothing was done to promote the servers to attackers. However, the servers’ DNS names were registered and the environment’s internal identifiers used a moniker that resembled the name of a major, well-known electricity provider.   Two days after the honeypot was launched, Cybereason determined that a black market seller had discovered it based on a toolset that had been installed in the environment. The tool — xDedic RDP Patch — is commonly found in assets that are being sold in the xDedic black market. It allows a victim and an attacker to use the same credentials to simultaneously log-in to a machine using RDP (Remote Desktop Protocol).   The seller also installed backdoors in the honeypot servers by creating additional users, another indicator that the asset was being prepared for sale on xDedic. The backdoors would allow the asset’s new owner to access the honeypot even if the administrator passwords were changed, a scenario that could have otherwise prevented the adversaries from accessing the servers.” Here are this week’s noteworthy security bulletins: 1) ESB-2018.2271 – [Linux][Debian] linux kernel: Multiple vulnerabilities A vulnerability in TCP stream reassembly in the Linux kernel was addressed by a number of vendors this week. Dubbed “SegmentSmack”. The vulnerability allows a remote attacker to crash a vulnerable system by sending a stream of crafted TCP/IP packets. Juniper, F5 Networks and Citrix are among them. 2) ESB-2018.2277 – [Win][UNIX/Linux][FreeBSD] tcp: Denial of service – Remote/unauthenticated Yet another Denial of Service vulnerability targeting TCP. This vulnerability is centred around an inefficient data structure for holding received TCP segments prior to reassembly. An attacker could cause a Denial of service condition by sending a stream of crafted, segmented TCP traffic contributing to a large number of segments awaiting reassembly, leading to CPU resource exhaustion. A patch has been introduced that limits the reassembly queue size per connection. 3) ESB-2018.2279 – [Printer] HP Ink Printers: Multiple vulnerabilities Owners of HP Ink printers had cause to be concerned over a buffer overflow vulnerability triggered by a crafted file received over the network. If exploited, the buffer overflow could lead to code execution or a denial of service condition. HP has released firmware updates to address the issue. Stay safe, stay patched, stay cool and have a good weekend! Nicholas

AUSCERT Week in Review for 3rd August 2018 Greetings, As another week comes to a close, give yourselves a pat on the back, because Aussies are almost immune from ransomware attacks!! All the more reason to not let our guard down and keep looking for and applying threat indicators to prevent and detect ransomware activity. Also this week, more ransomware authors seem to be joining forces to deliver their respective malware in a one-two punch using the sample malspam runs. Potential motives: Economies of scale? Easier propagation? This however, undoubtedly remains the year of the cryptojacker.   Hope you enjoy reading this week’s selection of articles: New version of AZORult stealer improves loading features, spreads alongside ransomware in new campaign  Date Published: 30/07/2018 Authors:  Proofpoint staff Excerpt: “AZORult is a robust information stealer & downloader that Proofpoint researchers originally identified in 2016 as part of a secondary infection via the Chthonic banking Trojan. We have since observed many instances of AZORult dropped via exploit kits and in fairly regular email campaigns as both a primary and secondary payload.   Recently, AZORult authors released a substantially updated version, improving both on its stealer and downloader functionality. It is noteworthy that within a day of the new update appearing on underground forums, a prolific actor used the new version in a large email campaign, leveraging its new capabilities to distribute Hermes ransomware. It is always interesting to see malware campaigns where both a stealer and ransomware are present, as this is less common [1], and especially disruptive for recipients who initially may have credentials, cryptocurrency wallets, and more stolen before losing access to their files in a subsequent ransomware attack.” —– Massive Coinhive Cryptojacking Campaign Infects 170,000 MikroTik Routers Date Published: 02/08/2018 Author: Catalin Cimpanu Excerpt: “According to Kenin, the attacker used one of those PoCs to alter traffic passing through the MikroTik router and inject a copy of the Coinhive library inside all the pages served through the router.   We know it’s only one threat actor exploiting this flaw because the attacker used only one Coinhive key for all the Coinhive injections he performed during the past week.   Furthermore, Kenin says that he also identified some cases where non-MikroTik users were also impacted. He says this was happening because some Brazilian ISPs were using MikroTik routers for their main network, and hence the attacker managed to inject the malicious Coinhive code in a massive amount of web traffic.   In addition, Kenin says that because of the way the attack was performed, the injection worked both ways, and not necessarily only for traffic going to the user. For example, if a website was hosted on a local network behind an affected MikroTik router, traffic to that website would also be injected with the Coinhive library.” —– Australians almost immune from ransomware, topping lists for data safety Date Published: 31/07/2018 Author: Richard Chirgwin Excerpt: “Take a bow, Australians: we may have had 242 breaches sent to the information commissioner this quarter, but almost nobody fell victim to ransomware attacks. Of all the data breaches reported to the Office of the Australian Information Commissioner (OAIC) between April and June this year, only two were ransomware attacks. However, given the MyHealth Record debate in Australia, the statistics paint a grim picture: the health sector recorded the most notifiable breaches from April to June. The OAIC data, published today, is the first full quarter of data breach statistics since the notification regime came into force on 22 February 2018. Breach notifications rose in each of the months covered by the report, which probably indicates rising business awareness of the legislation: there were 65 notifications in April, 87 in May, and 90 in June, a total of 242 in the quarter.” —– Bisonal Malware Used in Attacks Against Russia and South Korea Date Published: 31/07/2018 Author: Kaoru Hayashi and Vicky Ray Excerpt: “Attacks using Bisonal have been blogged about in the past. In 2013, both COSEINC and FireEye revealed attacks using Bisonal against Japanese organizations . In October 2017, AhnLab published a report called “Operation Bitter Biscuit,” an attack campaign against South Korea, Japan, India and Russia using Bisonal and its successors, Bioazih and Dexbia. We believe it is likely these tools are being used by one group of attackers.   Though Bisonal malware has been in the wild for at least seven years and frequently updated, the actors keep using same high-level playbooks. Common features of attacks involving Bisonal include:   Usually targeting organizations related to government, military or defense industries in South Korea, Russia, and Japan. In some cases, the use of Dynamic DNS (DDNS) for C2 servers. The use of a target or campaign code with its C2 to track victim or attack campaign connections. Disguising the Bisonal malware as a PDF, Microsoft Office Document or Excel file. The use of a decoy file in addition to the malicious PE file In some cases, code to handle Cyrillic characters on Russian-language operating systems. We observed all these characteristics in the latest attacks against both Russia and South Korea.” —- Blueprints for 3D printed guns stay offline for now — but we should still be worried Date Published: 01/08/2018 Authors:  Abhimanyu Ghoshal Excerpt: “The truth is that the aforementioned legal battles don’t matter a whole lot right now: DD actually made the files available last Friday on its DEFCAD site, so they’ve already fallen into the hands of those who want them. There’s also a GitHub repository maintained by a group called FOSSCAD, where you can find designs for a range of pistols, rifles, and ammo.   All this points to the fact that we’re getting rather uncomfortably close to a future where anyone with access to a 3D printer could fabricate an untraceable plastic gun that fires real bullets – and could do real damage.” —– Here are this week’s noteworthy security bulletins: 1) ESB-2018.2201 – [Linux] IBM QRadar : Multiple vulnerabilities IBM’s QRadar SIEM had multiple updates this week that addressed multiple vulnerabilies introduced by Apache Tomcat, Java and OpenSSL components. 2) ESB-2018.2218 – [Win][Linux][Solaris][AIX] IBM Security Identity Manager: Execute arbitrary code/commands – Remote/unauthenticated IBM’s Security Identity Manager also had an update addressing a remote code execution vulnerability introduced by Apache Commons. 3) ASB-2018.0188 – [Appliance] Intel Puma: Denial of service – Remote/unauthenticated 2018-08-01 A serious vulnerability was identified in Intel Puma chipsets, widely used in Home Gateways and Cable modems. The vulnerability potentially allows a remote attacker to starve the processors of resources by sending crafted network traffic to the device, giving rise to a denial of service situation. The vendor is apparently working with device manufacturers to roll out a fix. Stay safe, stay patched, keep warm and have a good weekend! Nicholas

AUSCERT Week in Review for 27th July 2018 AUSCERT Week in Review27 July 2018 Good afternoon, and welcome to the end of another week in Infosec. This week saw a brief respite from the cold, harsh Queensland winter.In the AUSCERT office we’re definitely looking forward to the warmer months! Thanks to our members who were able to attend our Melbourne Member meet-upearlier this week, and anyone who stopped by our booth at the 2018 SecurityExhibition & Conference. We appreciate all the feedback we’ve gotten! Here are some of the significant news stories from this week: —– New Spectre attack enables secrets to be leaked over a networkAuthor: Peter BrightDate: 27 July 2018https://arstechnica.com/gadgets/2018/07/new-spectre-attack-enables-secrets-to-be-leaked-over-a-network/ “Researchers from Graz University of Technology, including one of theoriginal Meltdown discoverers, Daniel Gruss, have described NetSpectre:a fully remote attack based on Spectre. With NetSpectre, an attacker canremotely read the memory of a victim system without running any code onthat system.” — Google Chrome Now Labels HTTP Sites as ‘Not Secure’Author: Brian BarrettDate: 24 July 2018https://www.wired.com/story/google-chrome-https-not-secure-label “Nearly two years ago, Google made a pledge: It would name and shamewebsites with unencrypted connections, a strategy designed to spur webdevelopers to embrace HTTPS encryption. On Tuesday, it finally is followingthrough. With the launch of Chrome 68, Google now will call out sites withunencrypted connections as “Not Secure” in the URL bar.” — Google: Security Keys Neutralized Employee PhishingAuthor: Brian KrebsDate: 23 July 2018https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/ “Google has not had any of its 85,000+ employees successfully phished ontheir work-related accounts since early 2017, when it began requiring allemployees to use physical Security Keys in place of passwords and one-timecodes, the company told KrebsOnSecurity.” — Singapore govt health database hackedAuthor: Staff WriterDate: 20 Jul 2018https://www.itnews.com.au/news/singapore-govt-health-database-hacked-498782 “A major cyberattack on Singapore’s government health database resultedin the personal information of about 1.5 million people – including PrimeMinister Lee Hsien Loong – being stolen. The “deliberate, targeted and well-planned,” attack aimed at patients whovisited clinics between May 2015 and July 4 this year, the health ministrysaid in a statement.” Here are this week’s noteworthy security bulletins (in no particular order): 1. ESB-2018.2133 – Bluetooth devices: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/65666 Several Bluetooth implementations, including Apple, Broadcom and Intel,are vulnerable to Man In The Middle attacks, as a result of a missing stepin validating elliptic curve parameters. 2. ESB-2018.2153 – ClamAV: Denial of service – Remote with user interactionhttps://portal.auscert.org.au/bulletins/65750 Vulnerabilities in ClamAV could cause a hang when scanning speciallycrafted PDF or HWP files. 3. ESB-2018.2129 – python-cryptography: Access confidential data –Remote/unauthenticatedhttps://portal.auscert.org.au/bulletins/65650 A vulnerability in a popular cryptography library could expose sensitivedata. ——- Stay safe, stay patched, and have a good weekend! Anthony and the team at AUSCERT

AUSCERT Week in Review for 20th July 2018 AUSCERT Week in Review20 July 2018 Good afternoon, and welcome to the end of another week in Infosec. This week saw the quarterly Oracle patch day come with a record-breakingnumber of CVEs. I hope our members can keep up with the huge amount ofpatching required to use Oracle products! In addition, the Australian government launched My Health Record thisweek, and was promptly bombarded with opt-out requests. Asking to store(and share) your personal medical data for the rest of your life may notgo down well with many australians, especially as scandals involving databreaches and misuse become more and more common. Here are some of the significant news stories from this week: —– Defence attacked over new technology restrictionsAuthor: Julian BajkowskiDate: 19 July 2018https://www.itnews.com.au/news/defence-attacked-over-new-technology-restrictions-498612 “Australia’s top universities have blasted a massive expansion ofintrusive powers proposed by the Department of Defence. The new powers would allow Defence to enter and search all technologyprojects in Australia and restrict and dictate how information from themis shared between researchers and industry.” —Oracle product vulnerabilities hit all-time highAuthor: Juha SaarinenDate: 18 July 2018https://www.itnews.com.au/news/oracle-product-vulnerabilities-hit-all-time-high-498543 “The July 2018 Critical Patch Update (CPU) set of security fixes for Oracleproducts released overnight closes no fewer than 334 vulnerabilites,up from 251 in April and more than the highest number remedied so far,308 in July 2017. Of the 334 flaws, 61 are considered as critical with high CommonVulnerabilities Scoring System ratings of 9.0 to 10.0.” —My Health Record systems collapse under more opt-outs than expectedAuthor: StilgherrianDate: 16 July 2018https://www.zdnet.com/article/my-health-record-systems-collapse-under-more-opt-outs-than-expected/ “Australians attempting to opt out of the government’s new centralised healthrecords system online have been met with an unreliable website. Those phoningin have faced horrendous wait times, sometimes more than two hours, oftento find that call centre systems were down as well, and staff unable to help. The Australian Digital Health Agency (ADHA), which runs the My HealthRecord system, is reportedly telling callers that they weren’t expectingthe volume of opt-outs.” Here are this week’s noteworthy security bulletins (in no particular order): 1. ESB-2018.2076 – Cisco Policy Suite: Root compromise –Remote/unauthenticatedhttps://portal.auscert.org.au/bulletins/65426 Several vulnerabilities in Cisco Policy Suite have a large impact. 2. ESB-2018.2075 – ffmpeg: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/65330 Vulnerabilities in ffmpeg could lead to a crash or code execution fromviewing/processing malicious video files. 3. ESB-2018.2103 – Jenkins: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/65534 A new vulnerability in Jenkins could allow users to move the configuration file to a new location. ——- Stay safe, stay patched, and have a good weekend! Anthony and the team at AUSCERT

AUSCERT Week in Review for 13th July 2018 AUSCERT Week in Review13 July 2018 Two package compromises this week serve as a reminder that we all rely on each other’s code, which few of us have the luxury of auditing. ESLint, a linter for JavaScript-family languages, published a malicious package which stole Node Package Manager credentials from developers. (While I have this soapbox, linters are great and should be used for any code you write – even if that’s “only” shell scripting, try out ShellCheck!) Microsoft Patch Tuesday also took place this week, with more vulns which could hijack Edge purely from opening a malicious page. If your users ask why they’re advised to delete spam emails, you can point them to the presence of these bugs in almost every Patch Tuesday. In accordance with tradition, here are some interesting news articles from the week: Patch Tuesday, July 2018 EditionAuthor: Brian KrebsDate: 10 July 2018https://krebsonsecurity.com/2018/07/patch-tuesday-july-2018-edition/ Microsoft and Adobe each issued security updates for their products today. Microsoft’s July patch batch includes 14 updates to fix more than 50 security flaws in Windows and associated software. Separately, Adobe has pushed out an update for its Flash Player browser plugin, as well as a monster patch bundle for Adobe Reader/Acrobat. Postmortem for Malicious Packages Published on July 12th, 2018Author: ESLint ProjectDate: 12 July 2018https://eslint.org/blog/2018/07/postmortem-for-malicious-package-publishes On July 12th, 2018, an attacker compromised the npm account of an ESLint maintainer and published malicious versions of the eslint-scope and eslint-config-eslint packages to the npm registry. On installation, the malicious packages downloaded and executed code from pastebin.com which sent the contents of the user’s .npmrc file to the attacker. An .npmrc file typically contains access tokens for publishing to npm. The malicious package versions are eslint-scope@3.7.2 and eslint-config-eslint@5.0.2, both of which have been unpublished from npm. The pastebin.com paste linked in these packages has also been taken down. Malware Found in Arch Linux AUR Package RepositoryAuthor: Catalin CimpanuDate: 10 July 2018https://www.bleepingcomputer.com/news/security/malware-found-in-arch-linux-aur-package-repository Malware has been discovered in at least three Arch Linux packages available on AUR (Arch User Repository), the official Arch Linux repository of user-submitted packages.[…] No other malicious actions were observed, meaning the acroread package wasn’t harming users’ systems, but merely collecting data in preparation for… something else. Airport security card company reveals data hack as AFP investigatesAuthor: ABC NewsDate: 12 July 2018http://www.abc.net.au/news/2018-07-12/afp-investigating-airport-security-card-data-hack/9981796 A company that issues Aviation Security Identity Cards (ASICs) — designed to stop organised criminals and terrorists from accessing planes and other restricted airport zones — has been hacked, leading to concerns that Australian airport security may have been compromised as a result. Here are this week’s noteworthy security bulletins (in no particular order): 1. ESB-2018.2011 – [Appliance] Universal Robots Robot Controllers: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/65058 Industrial robots would execute arbitrary code sent to certain TCP ports. 2. ESB-2018.2021 – ALERT [UNIX/Linux][Debian] cups: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/65098 The Common UNIX Printing System patched a root compromise vulnerability. 3. ESB-2018.1984 – [Apple iOS] Apple iOS: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/64922 Multiple memory corruption and data leak issues in WebKit, used by Safari & other browsers, plus a crash when a China-region phone received the Taiwanese flag emoji. 4. ESB-2018.1756.2 – UPDATE [Win][UNIX/Linux] BIND: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/63966 Regression caused defaults to work incorrectly in the BIND nameserver, allowing denials of service (including DNS reflection attacks) and examining the DNS cache. Stay safe, stay patched and have a good weekend,David and the team at AUSCERT

AUSCERT Week in Review for 6th July 2018 AUSCERT Week in Review06 July 2018 Greetings, This week’s events have reminded us to be careful of the software we install. Between browser extensions gone rogue and a major software foundation’s GitHub account serving compromised content, consider whose code you might have run without knowing it. The AUSCERT bulletins service is nearly at number 2,000 by early July, making this the busiest year on record. If you want to change your subscription settings, your inbox may thank you. Log in to the member portal at https://wordpress-admin.auscert.org.au to make the change. If you get stuck or have any questions, contact us at auscert@auscert.org.au! In the news this week: ‘Stylish’ browser extension steals all your internet historyhttps://robertheaton.com/2018/07/02/stylish-browser-extension-steals-your-internet-history/Date: 02 July 2018Author: Robert Heaton Unfortunately, since January 2017, Stylish has been augmented with bonus spyware that records every single website that I and its 2 million other users visit (EDIT – I am told that the Chrome version has had tracking since January 2017, but the Firefox version has only had it since March 2018). Stylish sends our complete browsing activity back to its servers, together with a unique identifier. This allows its new owner, SimilarWeb, to connect all of an individual’s actions into a single profile. And for users like me who have created a Stylish account on userstyles.org, this unique identifier can easily be linked to a login cookie. … Stylish’s transition from visual Valhalla to privacy Chernobyl began when the original owner and creator of Stylish sold it in August 2016. In January 2017 the new owner sold it again, announcing that “Stylish is now part of the SimilarWeb family”. The SimilarWeb family’s promotional literature lists “Market Solutions To See All Your Competitors’ Traffic” amongst its interests. [AUSCERT adds: Recall also https://www.theregister.co.uk/2017/09/15/pretend_python_packages_prey_on_poor_typing/ from last year.] Gentoo GitHub Organization hackedhttps://wiki.gentoo.org/wiki/Github/2018-06-28Date: 01 July 2018 An unknown entity gained control of an admin account for the Gentoo GitHub Organization and removed all access to the organization (and its repositories) from Gentoo developers. They then proceeded to make various changes to content. Gentoo Developers & Infrastructure escalated to GitHub support and the Gentoo Organization was frozen by GitHub staff. Gentoo has regained control of the Gentoo GitHub Organization and has reverted the bad commits and defaced content. The entity attempted to wipe user content by adding “rm -rf” to various repositories; however this code was unlikely to be executed by end users due to various technical guards in place. Iranian APT Poses As Israeli Cyber-Security Firm That Exposed Its Operationshttps://www.bleepingcomputer.com/news/security/iranian-apt-poses-as-israeli-cyber-security-firm-that-exposed-its-operations/Author: Catalin CimpanuDate: 03 July 2018 According to Israeli cyber-security firm ClearSky Security, the company says the Iranian APT copied its official website and hosted on a lookalike domain at clearskysecurity.net (the official ClearSky website is located at ClearSkySec.com). “Charming Kitten built a phishing website impersonating our company,” ClearkSky said yesterday. “They copied pages from our public website and changed one of them to include a ‘sign in’ option with multiple services.” “These sign-in options are all phishing pages that would send the victim’s credentials to the attackers,” ClearSky said. “Our legitimate website does not have any sign in option.” Another day, another data breach. Do you even care any more?http://www.abc.net.au/news/science/2018-07-06/data-breach-fatigue-ticketmaster-ticketfly-linkedin/9943720Author: ABC NewsDate: 05 July 2018 Dr Chen and his team used sentiment-analysis tools to track the emotional content of 18,764 tweets containing the hashtag #OPMHack. After events associated with the hack — from the initial breach announcement to the OPM director’s resignation — they saw a large drop-off in reaction. In other words, Dr Chen said, “we can see that the public is gradually losing interest in reacting to this news”. Here are this week’s noteworthy security bulletins (in no particular order): 1. ESB-2018.1949 – [Win][Linux] Drupal Universally Unique IDentifier: Create arbitrary files – Existing accounthttps://portal.auscert.org.au/bulletins/64782 A major Drupal module had an arbitrary file upload vulnerability. 2. ESB-2018.1952 – [Debian] dokuwiki: Execute arbitrary code/commands – Remote with user interactionhttps://portal.auscert.org.au/bulletins/64794 Reflected file download vulnerability in DokuWiki allowed execution of arbitrary code. 3. ASB-2018.0145 – [Android] Google Android devices: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/64650 Android’s July patch release fixed several critical bugs. 4. ESB-2018.1931 – [RedHat] python: Access confidential data – Remote/unauthenticatedhttps://portal.auscert.org.au/bulletins/64706 Python2.7 disables the insecure 3DES cypher suites by default.   Stay safe, stay patched and have a good weekend,AUSCERT

AUSCERT Week in Review for 29th June 2018 AUSCERT Week in Review29 June 2018 Greetings, Business Email Compromise (BEC) has been in the news this week, with a flurry of incidents and investigations. Do you have two-factor authentication enabled on your Outlook accounts? It’s the single easiest way to foil these attacks. Privacy and consent haven’t been solved yet, but the revelation that the HealthEngine booking system was selling personal health data to ambulance-chasers has made waves this week. The Drupalgeddon v3 vulnerability is still being exploited by cryptocurrency miners. If you haven’t patched yet, please make it a priority. Of the data breaches around the world, three caught our eye: Adidas, Exactis (a marketing and aggregation firm) and Ticketmaster. Exactis in particular may have exceeded the infamous Equifax breach in scope. In the news this week: MasterChef finalist caught in conveyancing hacker attackhttps://www.brisbanetimes.com.au/business/companies/masterchef-finalist-caught-in-conveyancing-hacker-attack-20180622-p4zn4o.html Date:    22 June 2018Author: Simon Johanson A former Masterchef contestant and her family are homeless after hackers stole $250,000 from their home sale. MasterChef finalist Dani Venn woke to a housing nightmare on Monday when it was confirmed $250,000 from the settlement of her semi-rural property on the outskirts of Melbourne was stolen after her conveyancer’s account was hacked. Two people charged over alleged email scamhttp://www.police.nsw.gov.au/news/news_article?sq_content_src=%2BdXJsPWh0dHBzJTNBJTJGJTJGZWJpenByZC5wb2xpY2UubnN3Lmdvdi5hdSUyRm1lZGlhJTJGNzEyNDQuaHRtbCZhbGw9MQ Date:    28 June 2018Author: NSW Police A man and woman will face court next month after being charged over alleged email scams netting more than $70,000. Detectives from the State Crime Command’s Cybercrime Squad established Strike Force Cabernet to investigate organised criminal groups committing large scale business email compromises. Medical appointment booking app HealthEngine sharing clients’ personal information with lawyershttp://www.abc.net.au/news/2018-06-25/healthengine-sharing-patients-information-with-lawyers/9894114 Date:    26 June 2018 Author: ABC News Health Minister Greg Hunt has ordered an “urgent review” of Australia’s biggest online doctor appointment booking service, HealthEngine. The ABC earlier reported that the HealthEngine app has funnelled hundreds of users’ private medical information to law firms seeking clients for personal injury claims. Hackers Exploit Drupal Flaw for Monero Mininghttps://www.securityweek.com/hackers-exploit-drupal-flaw-monero-miningAuthor: Ionut Arghire Date:    22 June 2018 Tracked as CVE-2018-7602 and considered a highly critical issue that could result in remote code execution, the vulnerability impacts Drupal’s versions 7 and 8 and was addressed in April this year. Last month, hackers were observed targeting both security vulnerabilities to deliver a variety of threats, including cryptocurrency miners, remote administration tools (RATs) and tech support scams. Trend Micro now says they noticed network attacks exploiting CVE-2018-7602 to turn affected systems into Monero-mining bots. As part of the observed incidents, the exploit fetches a shell script that retrieves an Executable and Linkable Format-based (ELF) downloader. Articles about the most significant data breaches: Equifax: https://www.cnet.com/news/exactis-340-million-people-may-have-been-exposed-in-bigger-breach-than-equifax/Adidas: https://www.bloomberg.com/news/articles/2018-06-28/adidas-says-millions-of-u-s-customers-being-alerted-of-breachTicketmaster: https://security.ticketmaster.com.au Here are this week’s noteworthy security bulletins (in no particular order): 1. ASB-2018.0138 – [Win][UNIX/Linux][Mobile] Mozilla Firefox: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/64390 Memory corruption leading to probable remote code execution, cross-site request forgery, crashes and a sandbox escape. 2. ESB-2018.1854 – [Win][UNIX/Linux] Jenkins plugins: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/64390 Major plugins for Jenkins were subject to a mixed bag of vulnerabilities: cross-site request forgery, storage of credentials in plaintext, unauthorised config viewing, zip file directory traversal, etc. 3. ESB-2018.1865 – [RedHat] ansible: Access privileged data – Existing accounthttps://portal.auscert.org.au/bulletins/64430 Credentials were logged in cleartext. 4. ESB-2018.1874 – [RedHat] Red Hat Virtualization Manager: Access confidential data – Existing accounthttps://portal.auscert.org.au/bulletins/64466 More cleartext credential logging. 5. ESB-2018.1891 – [Appliance] F5 products: Denial of service – Existing accounthttps://portal.auscert.org.au/bulletins/64538 Linux kernel bug dating back to 2012 allowed authenticated (local) users to deny service.   Stay safe, stay protected and have a good weekend,David and the team at AUSCERT

AUSCERT Week in Review for 22nd June 2018 AUSCERT Week in Review22 June 2018 Greetings, As Friday 22nd June comes to a close, I’d like to bring your attention to an old read from 1996, but a good read titled “Smashing The Stack For Fun And Profit” [1].  Why bring to light this 1996 classic? Well, because it highlights that it is hard to wipe out a class of vulnerability.  Even, 22 years on, and a whole lot of smart people at the problem, with today’s automatic code checking, and secure coding frameworks, classes of vulnerabilities still get through to production.  Also, the time between a fix being available and news of it can be weeks. For example, Firefox was out with a release on the 6th June with [mfsa2018-14] and it seem to only make general news this week on Monday 18th June.  Surely nothing bad could really happen in a couple of weeks.Yes, incidents will happen and a function in an organisation that has its fingers on the pulse of these incidents, that can analyse the depth of the impact can be a worthwhile investment in cyber security.Incidents could be just a wake-up call, with port 8000 being suddenly and unusually requested “en masse”.  Could that function be able to find the relationship of those port requests with the “XiongMai uc-httpd 1.0.0 Buffer Overflow Exploit” and then check if it reached any exposed IoT in the organisation, with the vulnerable code.Sounds simple but the difficulty is in the detail. Just drop the words “Vulnerability Management” around the work place and look for the reaction.  Perhaps, you only need to fine tune your VM SOPs by adding a task of digesting some industry news and perhaps some advisories of the week.  Enjoy.   Here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: ——- Title:  Google Developer Discovers a Critical Bug in Modern Web BrowsersURL:  https://thehackernews.com/2018/06/browser-cross-origin-vulnerability.htmlDate:  20th June 2018 Author: Mohit Kumar Excerpt:“Discovered by Jake Archibald, developer advocate for Google Chrome, the vulnerability resides in the way browsers handle cross-origin requests to video and audio files, which if exploited, could allow remote attackers to even read the content of your Gmail or private Facebook messages.” ——- Title:  Botnets never Die, Satori REFUSES to Fade AwayURL:    http://blog.netlab.360.com/botnets-never-die-satori-refuses-to-fade-away-en/Date:   15th June 2018Author: NetLab Excerpt:“Two days ago, on 2018-06-14, we noticed that an updated Satori botnet began to perform network wide scan looking for uc-httpd 1.0.0 devices. Most likely for the vulnerability of XiongMai uc-httpd 1.0.0 “ ——- Title:  Apple macOS Bug Reveals Cache of Sensitive Data from Encrypted DrivesURL:    https://thehackernews.com/2018/06/apple-macos-quicklook.htmlDate:   18th June 2018Author: Swati Khandelwal Excerpt:“Security researchers are warning of almost a decade old issue with one of the Apple’s macOS feature which was designed for users’ convenience but is potentially exposing the contents of files stored on password-protected encrypted drives.” ——- Title:  SamSam ransomware: controlled distribution for an elusive malware URL:    https://blog.malwarebytes.com/threat-analysis/2018/06/samsam-ransomware-controlled-distribution/Date:   19th June 2018Author: Malwarebytes Labs Excerpt:“SamSam ransomware has been involved in some high profile attacks recently, and remains a somewhat elusive malware. In its time being active, SamSam has gone through a slight evolution, adding more features and alterations into the mix. These changes do not necessarily make the ransomware more dangerous, but they are added to make it just a bit more tricky to detect or track as it is constantly changing.” ——- Title:  All That Port 8000 Traffic This Week! Yeah, That’s Satori Looking for New BotsURL:    https://www.bleepingcomputer.com/news/security/all-that-port-8000-traffic-this-week-yeah-thats-satori-looking-for-new-bots/Date:   15th June 2018Author: Catalin Cimpanu Excerpt:“The PoC code was for a buffer overflow vulnerability (CVE-2018-10088) in XionMai uc-httpd 1.0.0, a lightweight web server package often found embedded inside the firmware of routers and IoT equipment sold by some Chinese vendors.The exploit allows an attacker to send a malformed package via ports 80 or 8000 and execute code on the device, effectively taking it over.” ——- Title:  Firefox fixes critical buffer overflowURL:    https://nakedsecurity.sophos.com/2018/06/18/firefox-fixes-critical-buffer-overflow/Date:   18th June 2018Author: Maria Varmazis Excerpt:“Earlier this month Mozilla announced a security advisory (MFSA2018-14) for its Firefox browser, noting that version 60.0.2 of both Firefox and Firefox Extended Support Release (ESR) as well as the legacy ESR (ESR 52.8.1) now have a fix for a critical-level buffer overflow vulnerability.” ——- Title:  Google’s Newest Feature: Find My HomeURL:    https://www.tripwire.com/state-of-security/vert/googles-newest-feature-find-my-home/#.WyfDEMLoy-g.twitterDate:   18th June 2018Author: Craig Young Excerpt:“Despite all of these efforts to thwart unwanted online tracking, it turns out that our connected gadgets may not only uniquely identify us but, in some cases, they can reveal precise physical locations. In this blog post, I will reveal a new attack against Google Home and Chromecast devices that does exactly that.” ——- Here are this week’s noteworthy security bulletins (in no particular order): 1.    ESB-2018.1810 – ALERT [Cisco] Cisco NX-OS: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/64198CVE-2018-0313 A successful exploit could allow the attacker to execute arbitrary commands with root privileges. 2.    ESB-2018.1809 – ALERT [Cisco] Cisco FXOS and Cisco NX-OS: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/64194CVE-2018-0304 …which could allow the attacker to read sensitive memory content, create a DoS condition, or execute arbitrary code as root. 3.    ESB-2018.1836 – [Win][Linux][IBM i][HP-UX][Solaris][AIX] IBM WebSphere Application Server: Multiple vulnerabilities    https://portal.auscert.org.au/bulletins/64302CVE-2014-0114 …to manipulate the ClassLoader and execute arbitrary code on the system. 4.    ESB-2018.1834 – [Win][UNIX/Linux] phpMyAdmin: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/64294CVE-2018-12581 …attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin. 5.    ESB-2018.1829 – [Win] Delta Industrial Automation COMMGR: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/64274CVE-2018-10594 This may allow remote code execution, cause the application to crash, or result in a denial-of-service condition in the application server. Wishing you the best from AUSCERT and hope to see you safe next week,Geoffroy P.S. Just as an exercise, of the bulletins AUSCERT processed this week, it may be instructive to count how many of them hints at the 1996 technique.