Publications

AUSCERT Week in Review for 4th October 2019 AUSCERT Week in Review04 October 2019 This week the ANU publicly released their report on the Nov 2018 breach oftheir administrative systems. This report is unique in that, as per thereport’s Forward, “provides details on the attack including the methodsused by the attacker” and “this publicly available report is the first ofits kind in Australia following a cyber attack on a public institution”. Members are encouraged to review the report to understand some of thethreats also faced by them and where possible incorporate the valuablelessons learned.     New Checkm8 jailbreak released for all iOS devices running A5 to A11 chipsDate: 27 SeptemberAuthor: ZDNet A security researcher has released today a new jailbreak that impactsall iOS devices running on A5 to A11 chipsets — chips included in allApple products released between 2011 and 2017, spanning eight generationsof devices, from iPhone 4S to iPhone 8 and X. Victorian hospitals targeted in ransomware attackDate: 1 OctoberAuthor: ABC News The Victorian Government is investigating the scale of a ransomwareattack by “sophisticated cyber criminals” on some of the state’s majorregional hospitals that has forced healthcare providers to go offline. Critical Remote Code Execution Vulnerability Patched in Exim Email ServerDate: 1 October A Critical vulnerability recently addressed in the popular open-sourceemail server Exim could lead to remote code execution.   Inside a massive cyber hack that risks compromising future leaders around the globeDate: 2 October Without anyone clicking on a link, a massive cyber attack of unprecedentedsophistication gained access to private information of potentiallyhigh-ranking officials across the globe. Thanks to the release of a 5,000-word report into the incident, the publiccan see for the fist time how sophisticated and extensive the attack onthe ANU was.   ANU hackers built ‘shadow ecosystem’ to stay hidden for six weeksDate: 3 October  

AUSCERT Week in Review for 27th September 2019 Greetings, This week has been a mix of something old and something new. On the old side, a vBulletin zero-day gained attention, and whilst this was shocking news to some, it was old news to others as we learned it had been an exploited commodity for years. It’s good to be in the know it seems. Being in the know was echoed by Atlassian who published a community article stating their intention to retire support for Internet Explorer, coming at the same time as ZDNet’s report that Microsoft had released two brand-spanking patches, one to plug an IE zero-day, and the other squash a Defender bug. In a change of tact, interesting to hear that hackers are looking into new methods of injecting card stealing code on “Layer 7” routers to steal payment card details, instead of utilising websites. Whether this focus change is due to frustration in having their lovingly crafted websites taken-down, or in wanting to remain undetected for longer, one things is certain, this should highlight an organisations need to perform effective asset management and patch management practices. And in considering vulnerable assets, we should also consider those non-traditional or non-managed devices that connect to our networks and become potential threat vectors. As remote working practices are becoming more widely accepted, InsiderPro reported to the evolution of the Bring Your Own Device (BYOD) policy has recently raised discussions regarding Bring Your Own Office (BYOO). Perhaps it’s time to splash out on two sweet 27″ monitors for your home office. Lastly, a reminder to both enterprise and consumers that Windows 7 support will end on 14 January 2020, so perhaps new year, new secure you! And if you’re an Apple device user, then definitely check Wired’s article for checking your iOS 13 privacy and security features. vBulletin Zero-Day Exploited for Years, Gets Unofficial PatchDate: 25 SeptemberAuthor: BleepingComputer A zero-day exploit for the vBulletin forum platform was publicly disclosed and quickly used to attack affected versions of the forum software. It turns out, though, that this exploit has been known, utilized, and sold by researchers and attackers for years. Retiring IE11 support for Atlassian cloud, server, and data center productsDate: 23 SeptemberAuthor: AtlassianURL: https://community.atlassian.com/t5/Feedback-Forum-articles/Retiring-IE11-support-for-Atlassian-cloud-server-and-data-center/ba-p/1185312 In 2015 Microsoft released Edge as the browser to supersede Internet Explorer (IE). Since then IE has not received major updates, or added support for many modern web standards. Microsoft recently discouraged the use of Internet Explorer as a default browser, and we’ve also seen a decrease in IE11 usage across our cloud, server, and data center products over time. To allow us to continue to take advantage of modern web standards to deliver improved functionality and the best possible user experience across all of our products, we have decided to end support for IE11. Microsoft releases out-of-band security update to fix IE zero-day & Defender bugDate: 23 SeptemberAuthor: ZDNet Microsoft has released an emergency out-of-band security update today to fix two critical security issues — a zero-day vulnerability in the Internet Explorer scripting engine that has been exploited in the wild, and a Microsoft Defender bug.The updates stand out because Microsoft usually likes to stay the course and only release security updates on the second Tuesday of every month. The company rarely breaks this pattern, and it’s usually only for very important security issues. Hackers looking into injecting card stealing code on routers, rather than websitesDate: 25 SeptemberAuthor: ZDNet Security researchers at IBM have found evidence that hackers have been working on creating malicious scripts they can deploy on commercial-grade “Layer 7” routers to steal payment card details. Why your company needs a BYOO (bring your own office) policyDate: 23 SeptemberAuthor: InsiderPro Remote work is not a trend. It’s there to stay. Insider Pro columnist Mike Elgan explains why it’s time to re-orient your organisation’s thinking around workshifting and BYOO. Just as the reality of consumer devices drove the BYOD policy trend, the reality of remote work demands the systematic thinking and communication of a bring your own office (BYOO) policy. Windows 7 support will end on January 14, 2020Date: Aug 3, 2019Author: Microsoft Microsoft made a commitment to provide 10 years of product support for Windows 7 when it was released on October 22, 2009. When this 10-year period ends, Microsoft will discontinue Windows 7 support so that we can focus our investment on supporting newer technologies and great new experiences. The specific end of support day for Windows 7 will be January 14, 2020. After that, technical assistance and software updates from Windows Update that help protect your PC will no longer be available for the product. The iOS 13 Privacy and Security Features You Should KnowDate: 22 SeptemberAuthor: WIRED Your iPhone just got a major security upgrade. The reputation of iOS security may have taken some dings of late, but it’s still one of the most secure consumer operating systems available. Here are all the ways the latest version keeps you even more protected. Here are some noteworthy bulletins from the week: ESB-2019.3609Adobe ColdFusion patched to resolve two critical and one important vulnerability. ESB-2019.3617Cisco IOx multiple vulnerabilities. ESB-2019.3616Cisco IOS XR root compromise vulnerability. ESB-2019.3648Confidential data access vulnerabilities patched in Apple iOS and iPadOS. ESB-2019.3641Apple iOS, macOS and watchOS were all patched due to an out-of-bounds readwith significant implications. As always, stay safe, stay patched, and make it a good weekend!Colin

AUSCERT Week in Review for 6th September 2019 Greetings, Ask yourself this question. “Should I always believe what you see (or hear)?” As the week comes to a close, here are some articles that may help ease you into the weekend. Privacy concerns mount over Chinese face-swap app Zao Date published: 03/09/2019  Author: Mark Wycislik-Wilson Excerpt: “Zao — a Chinese face-swapping app with the potential to be used to create deepfakes — went viral over the weekend, shooting to the top of the App Store download charts. But concerns have been raised not only over the potential for the app to be abused, but also over its privacy policies. Of particular concern are clauses which grant the developers “free, irrevocable, permanent, transferable, and relicense-able” rights over users’ photos. Zao responded by tweaking its privacy policy, but complaints are still flooding in.” Nemty Ransomware Gets Distribution from RIG Exploit Kit Date published: 03/09/2019 Author: Ionut Ilascu Excerpt: “BleepingComputer saw that the post-encryption ransom demand was around $1,000 in bitcoin. Unfortunately, there is no free decryption tool available at the moment and the malware makes sure to remove the file shadows created by Windows. Security researcher Mol69 noticed that the file-encrypting malware is now a payload in malvertising campaigns from RIG exploit kit (EK). The malware used the .nemty extension for the encrypted files but the variant observed by Mol69 adds ‘._NEMTY_Lct5F3C_’ at the end of the processed files.” Scammer Successfully Deepfaked CEO’s Voice To Fool Underling Into Transferring $243,000 Date published: 03/09/2019 Author: Jennings Brown Excerpt: “The CEO of an energy firm based in the UK thought he was following his boss’s urgent orders in March when he transferred funds to a third-party. But the request actually came from the AI-assisted voice of a fraudster.” Threat Actor behind Astaroth is now using Cloudflare Workers to bypass your Security Solutions. Date published: 01/09/2019 Author: Marcel Afrahim Excerpt: “You might have seen the recently published report about a widespread fileless campaign called Astaroth by Microsoft Research Team that completely “lived off the land”: it only ran system tools throughout a complex attack chain. If you haven’t, you SHOULD definitely read the details of the research article done by the Microsoft team here. Following the report, the group behind the Astaroth attack campaign changed tactics and they ran a similar campaign again earlier in august with few changes, notably use of Cloudflare Workers. In this article I will try to show highlight the changes and show a clear chain of attack from the delivery till infection, something Microsoft research article failed to do.”   Here are this week’s noteworthy-ish security bulletins: 1) Firefox and Firefox ESR: Multiple vulnerabilities https://portal.auscert.org.au/bulletins/ASB-2019.0252/ Mozilla released updates for Firefox and Firefox ESR that addressed a large number of vulnerabilties, the most severe being a remote code execution vulnerability stemming from poor sanitization of logging related command line parameters. Luckily, this issue only affects Windows and not many people use that! 2) Cisco Small Business RV160, 260, and 340 Series VPN Routers: Root compromise – Existing account https://portal.auscert.org.au/bulletins/ESB-2019.3369/ A number of Cisco small business VPN routers have been identified as being affected by a number of vulnerabilities. The most important of these deal with hardcoded password hashes stored for the root user stored in the firmware and the ability to view undocumented user accounts, which includes the “root” account! If you own any of these, please read the bulletin and update! 3) Cisco Identity Services Engine: Cross-site scripting – Remote with user interaction https://portal.auscert.org.au/bulletins/ESB-2019.3364/ More from Cisco! Cisco fixed a reflected XSS vulnerability in web-based management interface of its ISE product. 4) Cisco Content Security Management Appliance – Access confidential data –Existing account https://portal.auscert.org.au/bulletins/ESB-2019.3362/ Just one more Cisco bulletin. Cisco released a fix for an information disclosure vulnerability in its CCSM appliance, which originates from a role permissions implementation error allowing unauthorised access to other users spam folders, for example. Stay safe, stay patched, keep your eyes peeled and have a great weekend free of paranoia!  Nick

AUSCERT Week in Review for 13th September 2019 Greetings, This week has been a busy one with Microsoft patch Tuesday, a serious Exim vulnerability being actively exploited and other potentially life threatening medical equipment vulnerabilities being exposed. All in all, just another day at the office! As the week comes to a close, here are some articles that may help ease you into the weekend. ThreatList: Amidst Data Breaches, Account Creation Fraud Soars in 2019 Date published: 10/09/2019  Author: Tara Seals Excerpt: “The first half of 2019 saw a 13 percent increase in fraudulent activity compared to the previous six months, with a spike in June representing the highest-volume bot attack that’s been recorded since 2016, according to an analysis from LexisNexis. The firm’s report, with data gleaned from 277 million human-initiated attacks across its Digital Identity Network, shows that bot attacks focused on new account creations are on the rise, bent on building fake online identities across diverse sectors. This type of attack is the only criminal “use case” that saw growth in the study period. The June attack targeted a virtual gift-card provider, with a bot trying to set up accounts using different email addresses. LexisNexis found that the attack originated in the U.S., but the browser language was set to Russian.” Weakness in Intel chips lets researchers steal encrypted SSH keystrokes Date published: 11/09/2019 Author: Dan Goodin Excerpt: “The researchers have named their attack NetCAT, short for Network Cache ATtack. Their research is prompting an advisory for Intel that effectively recommends turning off either DDIO or RDMA in untrusted networks. The researchers say future attacks may be able to steal other types of data, possibly even when RDMA isn’t enabled. They are also advising hardware makers do a better job of securing microarchitectural enhancements before putting them into billions of real-world servers. “While NetCAT is powerful even with only minimal assumptions, we believe that we have merely scratched the surface of possibilities for network-based cache attacks, and we expect similar attacks based on NetCAT in the future,” the researchers, from the Vrije Universiteit Amsterdam and ETH Zurich, wrote in a paper published on Tuesday. “We hope that our efforts caution processor vendors against exposing microarchitectural elements to peripherals without a thorough security design to prevent abuse.”” Fake PayPal Site Spreads Nemty Ransomware Date published: 08/09/2019 Author: Ionut Ilascu Excerpt: “The automated analysis showed that it took about seven minutes for the ransomware to encrypt the files on the victim host. However, this may differ from one system to another. Fortunately, the malicious executable is detected by most popular antivirus products on the market. A scan on VirusTotal shows that it is detected by 36 out of 68 antivirus engine.” Threats to macOS users Date published: 11/09/2019 Authors: Mikhail Kuzin, Tatyana Shcherbakova, Tatyana Sidorina, Vitaly Kamluk Excerpt: “The belief that there are no threats for the macOS operating system (or at least no serious threats) has been bandied about for decades. The owners of MacBooks and iMacs are only rivaled by Linux users in terms of the level of confidence in their own security, and we must admit that they are right to a certain degree: compared to Windows-based systems, there are far fewer threats that target macOS. However, the main reason for this is the number of potential victims: there are many more computers running Windows than those running macOS. However, the situation is changing, since the popularity of the latter platform is growing. Due to this and despite all the efforts that have been taken by the company, the threat landscape for Apple devices is changing, and the amount of malicious and unwanted software is growing. For the purposes of this report we used the statistics from Kaspersky Security Network cloud infrastructure. It stores information about all of the malicious programs and other threats that our macOS product users agreed to anonymously share with us. In fact, all these threats at some point attacked the computers of Kaspersky security solution users, but these attacks were successfully repelled.” COBALT DICKENS Goes Back to School…Again Date published: 11/09/2019 Authors: Secureworks Counter Threat Unit Research Team Excerpt: “For this campaign, the threat actors registered at least 20 new domains targeting over 60 universities in Australia, the United States, the United Kingdom, Canada, Hong Kong, and Switzerland. These domains were registered using the Freenom domain provider, which administers the following free top-level domains (TLDs) unless the domain is considered “special”: .ml .ga .cf .gq .tk   Many of these domains use valid SSL certificates, likely to make the spoofed pages appear authentic. The overwhelming majority of the certificates observed in 2019 were issued by Let’s Encrypt, a nonprofit organization that programmatically issues free certificates. However, past campaigns used certificates issued by the Comodo certificate authority.”   Here are this week’s noteworthy-ish security bulletins: 1) Microsoft Windows: Multiple vulnerabilities https://portal.auscert.org.au/bulletins/ASB-2019.0257/ Microsoft Patch Tuesday (or Wednesday in this part of the world) saw the release of security updates for multiple Microsoft products. These included Edge, Internet Explorer (surprise, surprise), Exchange server, Office, Skype, etc. The update for Windows had a rather small 49 vulnerabilities addressed within it, including multiple remote code execution vulnerabilities and privilege escalation vulnerabilities. 2) UPDATED ALERT exim4: Root compromise – Remote/unauthenticated https://portal.auscert.org.au/bulletins/ESB-2019.3394.2/ This was published, and then, republished as an alert when a malware campaign involving the installation of LILOCKED ransomware in Linux servers by gaining root access on those servers. Chatter from a Russian-language blog indicated exim as a potential vector employed by the malware authors gain root privileges within the target servers. If you want to to learn more, see https://twitter.com/threatbear_co/status/1170876973436022785?s=20 3) Becton, Dickinson and Company Pyxis: Unauthorised access – Existing account https://portal.auscert.org.au/bulletins/ESB-2019.3404/ The weekly roundup just wouldn’t be complete without a medical industry related vulnerability. This particular session fixation vulnerability could allow an attacker who has gained prior access to a lower privileged account within the Pyxis medication management platform, to re-use a higher privileged users Active Directory credentials, thereby increasing his privileges within the platform. At that point, the attacker could view patient data and medication details and potentially alter medication records within the platform. 4) Adobe Flash Player: Execute arbitrary code/commands – Remote with user interaction https://portal.auscert.org.au/bulletins/ASB-2019.0264/ Adobe got a bit of security love from Microsoft as part of its updates. Just two “critical” remote code execution vulnerabilities being addressed this time around. Adobe also released an update fixing a remote code execution vulnerability in its Application Manager software. 5) curl: Multiple vulnerabilities https://portal.auscert.org.au/bulletins/ESB-2019.3472/ Last but not least, everyone’s favourite url retrieval tool, curl, got an update for two remote code execution vulnerabilities which stem from it incorrectly handling memory when performing transfer of TFTP or when using Kerberos over FTP. ..and with that, have a great weekend all!  Nick

AUSCERT Week in Review for 20th September 2019 Greetings, This week’s big headline is the findings of the AFP and ASIC’s investigation into a cybercrime syndicate targeting Australian superannuation accounts. Also, Reuters (normally a relatively credible source) have published a story attributing the Australian parliament hack, albeit without official sources. More after the jump. China blamed for Australian parliament hackDate: 16 SeptemberAuthor: iTnews Australian intelligence determined China was responsible for a cyber-attack on its national parliament and three largest political parties before the general election in May, five people with direct knowledge of the matter told Reuters.The Australian Signals Directorate concluded in March that China’s Ministry of State Security was responsible for the attack, the five people said. Cyber fraud hits superannuation, share accountsDate: 17 SeptemberAuthor: iTnews Millions of dollars have allegedly been stolen from personal superannuation and share trading accounts using hijacked identity credentials that were obtained on the dark net.The Australian Federal Police and on Tuesday revealed the “multi-layered cybercrime activity” after a 12-month investigation into a major fraud and identity theft syndicate with the Australian Securities and Investment Commission. 400 Million Medical Radiological Images Exposed on the InternetDate: 18 SeptemberAuthor: Bleeping Computer An analysis of medical image storage systems exposed to the public web reveals that almost 600 servers in 52 countries are completely unprotected against unauthorized access.Audited systems were unpatched against thousands of vulnerabilities, more than 500 of them having the highest severity score. A Guide on 5 Common LinkedIn ScamsDate: 19 SeptemberAuthor: Tripwire The fact that scammers haunt Facebook and Twitter is not surprising. Even so, digital criminals don’t stop with just those two platforms. They’re also known to stalk users on LinkedIn where connections carry greater professional gravity.Fortunately, users can stay alert of such activity by familiarizing themselves with the most common types of LinkedIn scams. Here are five ruses, in particular, that should be on their radar. Here are some noteworthy bulletins from the week: 1. ESB-2019.3511 – Norton Password Manager information disclosureUnspecified information disclosure vulnerability in Symantec’s password manager for Android. 2. ESB-2019.3519 – IBus access control vulnerabilityUnintentional keylogger for different users on the same machine. 3. ESB-2019.3541 – Werkzeug cross-container accessThe debugger security PIN was not unique per Docker container. 4. ASB-2019.0268 – Mozilla Thunderbird web view fixesThunderbird’s email view disables scripting, but if the program is used “in browser or browser-like contexts”, it could be abused. Stay safe, stay patched, and have a good weekend!David

AUSCERT: What’s next in 2019? It’s been a month since the wrap up of our annual AUSCERT Cyber Security Conference and we’re now at the start of the second half of 2019. To kick things off for the rest of the year, allow us to recap a few initiatives we’ve accomplished in the industry and goals that our team’s looking forward to achieve in the next six months:  “It’s Dangerous to Go Alone” In honouring the theme from our conference, we have joined forces with the Council of Australasian Directors of Information Technology (CAUDIT) and Australia’s Academic and Research Network (AARNet) to create the Australasian Higher Education Cybersecurity Service (AHECS). Together with CAUDIT and AARNet, we are working together to address the industry’s unique cyber security challenges, with an aim to develop coordinated services that are tailored to the Australasian higher education and research sectors. This AHECS initiative will span across several tertiary institutions to build group strength and a trusted community through engagement, advocacy, and support. In addition to this, we continue to work with the Department of Premier and Cabinet and all of the Victorian Government workforce, one of the largest and most diverse enterprises in Australia – both in delivering our member services as well as providing their team with an in-house training module on the topic of ‘Incident Response Planning’ Both of these examples showcase our commitment for our members to “Empower their People, Capabilities and Capacities” by providing an extension of their workforces and channelling the expertise gained from an AUSCERT membership directly into their business processes.  Training courses with AUSCERT  We are continuing with our training workshop offerings to our members and the wider information security community by providing the following options:  Incident Response PlanningBe equipped with the tools to write a bespoke incident response plan for your organisation  MISPSet-up, configure and integrate Malware Information Sharing Platform into your organisation’s cybersecurity defense strategy  Cyber Security Risk ManagementGain the confidence to perform a risk assessment of cyber security risks and the ability to rate and assess business risks rather than technical vulnerabilities Introduction to Cyber Security for IT professionals Understand information security principles, cyber security as a risk to business objectives; and cultivate an appreciation of the current cyber threat landscape Cost $990 for members $1980 for non-members Customised in-house or group training options At AUSCERT we are also able to develop tailored industry and/or government content with each of our members and clients to ensure that the resulting workshop meets their needs and objectives – P.O.A  To find out more on each of these training courses – let us know what topic(s) you’re interested in, number of people from your organisation and city/state location – please contact us via membership@auscert.org.au  New services: MISP feed (AusISAC) and ADIR Over the past couple of years, AUSCERT has coordinated and run a highly-successful information sharing group for the tertiary education sector, and we are pleased to announce the establishment of an AUSCERT Information Sharing and Analysis Center (AusISAC); now available to general members. Members who join will be given access to our MISP platform, where we share a curated feed of threat intelligence gathered from multiple sources, and our own malware and threat analysis.  Cost of service: $20,000 Sign up now and receive a complimentary half-day remote MISP training session (we will cap these sessions at a maximum of 5 participants in each class!). Please note that members who subscribe to this service cannot use it for commercial purposes.  We have also launched the AUSCERT Daily Intelligence Report (ADIR) service. ADIR is a daily summary of information security news, with a focus on the Australian cyberspace. To sign up, send us an email via membership@auscert.org.au. UQ Cyber Security Initiative  One of the most exciting projects we’ve been lucky to be involved in this year has been our relationship and collaboration with colleagues from UQ’s School of Information Technology and Electrical Engineering through their Cyber Security Initiative. In the next six months or so, our collaboration with this team will continue to evolve in a few different ways:  1 August, public seminar by Professor Corey Schou from Idaho State University   30 September to 4 October, (ISC)2 and CISSP CBK training ‘UQ Cyber Squad’ – allowing students from any field of studies and course level to represent the University at local and international cyber-security competition  Mike Holm AUSCERT Operations Manager   

AUSCERT Week in Review for 30th August 2019 Greetings, As they say, out with the old, in with the new. Or should it be “out with the deprecated, in with the supported”?End-of-life is approaching for both Windows 7 and Python 2. But since they also say what goes around, comes around. So whilst “retro” can be considered cool in some circumstances, it cannot be considered so when retro to run with outdated IOS XE so go ahead and pick up your hardened version of the IOS XE software from Cisco today whilst stocks last. Monopoly is one retro game that seems to forever stay young. Community Chest: Drive past Jail and pick up iOS 12.4.1. Winner! As the week draws to a close, many webservers with HTTP/2 vulnerabilities have been patched over the last two weeks since they were reported by a Netflix researcher, so it’s good to hear of patching wins.   In the news this week: Windows 7 end of life: Months from patch cut-off, millions still haven’t upgradedAuthor: ZDNetDate published: 2019-08-28 With just under five months until Microsoft stops issuing free patches for Windows 7, millions of PCs are still relying on it, leaving them exposed to new bugs that will probably never be patched. Microsoft has been nagging Windows 7 users to upgrade to Windows 10 for years now, yet a huge number of consumers and smaller businesses have either resisted those calls or missed them. Cisco Fixes Critical Bug in Virtual Service Container for IOS XEAuthor: BleepingComputerDate published: 2019-08-28 Cisco today published an update for its IOS XE operating system to patch a critical vulnerability that could allow a remote attacker to bypass authentication on devices running an outdated version of virtual service containers. Exploitation is possible if specific conditions are met by simply sending malicious HTTP requests to a target device. If an administrator is into the REST API interface, an adversary can get their ‘token-id’ and run commands with elevated privileges. Time to shed Python 2Author: National Cyber Security Centre (UK)Date published: 2019-08-22 The end of life (EOL) date for Python 2 has been a long time coming, but it’s finally in sight. As of the 1st of January 2020, Python 2 will no longer be supported. There will be no more bug fixes, or security updates, from Python’s core developers. So, if you’re still using 2.x, it’s time to port your code to Python 3. If you continue to use unsupported modules, you are risking the security of your organisation and data, as vulnerabilities will sooner or later appear which nobody is fixing. Cyber security a key focus for Uni foreign interference taskforceAuthor: iTnewsDate published: 2019-08-29 The cyber resilience of Australia’s universities will be a key focus of a new federal government taskforce aimed at addressing foreign interference concerns in the higher education sector. Education minister Dan Tehan announced the creation of the University Foreign Interference Taskforce on Wednesday to assess the level of foreign interference in universities. Noteworthy bulletins this week: 1. Symantec Reporter: Access confidential data The Australian Taxation Office is credited as the source for this advisory. 2. Cisco IOS XE: Execute arbitrary code/commands A CVSSv3 score of 10/10 for a full authentication bypass. 3. h2o web server: Denial of Service – Remote/Unauthenticated The HTTP/2 vulnerabilities from a Netflix researcher have been patched in many webservers in the last fortnight, including h2o. 4. Apple iOS, macOS and tvOS: Root compromise – Existing Account Regression of a bugfix for a vulnerability used in jailbreaks in iOS 12.4 led to the hasty release of 12.4.1 with the jailbreak patched out. Reward yourself tonight or this weekend by putting up your feet, catching your favourite retro or modern show, or if books are more your thing, pick a good one. Stay safe, stay patched and have a great weekend!Colin

AUSCERT Week in Review for 2nd August 2019 Greetings, This week we’ve seen a few noteworthy stories in the Information Security world. Over in the USA, the Capital One banking corporation suffered from a massive data breach, as millions of customers’ data were downloaded from an AWS S3 bucket with inappropriate permissions. In their notification, Capital One were quick to point out that “No bank account numbers or Social Security numbers were compromised, other than […] About 140,000 Social Security numbers […] About 80,000 linked bank account numbers”. Several Information Security pundits were quick to point out the audacity and dishonesty of this statement. AUSCERT recommends, and has always recommended, clarity and honesty when communicating data breaches. In other news, the Equifax credit reporting firm reached a settlement with the Federal Trade Commission last week, and any victims of the 2017 Equifax data breach can apply for reimbursement for any costs or losses incurred resulting from the breach, including the costs of applying for credit monitoring. Affected people may also make a claim for a cash settlement, which has been set at US$127 per person. Some might say this is small compensation for having your financial information leaked online, and I would agree with them. Closer to home, the AUSCERT office appears to be experiencing virus attacks of a more traditional nature – more than half of our staff have called in sick over this week. We hope you’re staying healthy by sanitising your inputs (air!), installing the latest (vitamin) updates, and quarantining any infected machines (family members) in an isolated environment! Here are some of the week’s noteworthy security stories (in no particular order): Title: Apple iMessage Flaw Lets Remote Attackers Read Files on iPhonesAuthor: Sergiu GatlanDate: July 29, 2019 Excerpt: “An iMessage vulnerability patched by Apple as part of the 12.4 iOS updateallows potential attackers to read contents of files stored on iOS devicesremotely with no user interaction, as user mobile with no sandbox.” —- Title: Capital One Says Breach Hit 100 Million Individuals in U.S.Author:  Christian Berthelsen, Matt Day, and William TurtonDate: July 30, 2019 Excerpt: “Capital One Financial Corp. said data from about 100 million people inthe U.S. was illegally accessed after prosecutors accused a Seattle womanidentified by Amazon.com Inc. as one of its former cloud service employeesof breaking into the bank’s server. While the complaint doesn’t identify the cloud provider that stored theallegedly stolen data, the charging papers mention information stored inS3, a reference to Simple Storage Service, Amazon Web Services’ populardata storage software.” —- Title: 200 million devices–some mission-critical–vulnerable to remote takeoverAuthor: Dan GoodinDate: July 30, 2019 Excerpt: “…Researchers with security firm Armis identified 11 vulnerabilities invarious versions of VxWorks, a slimmed-down operating system that runs onmore than 2 billion devices worldwide. Billed collectively as Urgent 11, the vulnerabilities consist of six remotecode flaws and five less-severe issues… None of the vulnerabilitiesaffects the most recent version of VxWorks–which was released lastweek–or any of the certified versions of the OS, including VxWorks 653or VxWorks Cert Edition.” —- Here are some of this week’s noteworthy security bulletins (in no particularorder): 1. ASB-2019.0226 – [Win][Linux] GitLab: Multiple vulnerabilities 2. ASB-2019.0224 – ALERT [Appliance] VxWorks: Multiple vulnerabilities 3. ESB-2019.2872 – [Win][UNIX/Linux][Ubuntu] Subversion: Denial of service – Remote/unauthenticated Stay safe, stay patched, and have a good weekend. Anthony

AUSCERT Week in Review for 23rd August 2019 Greetings,“Buy the rumor, sell the news”.  Looks like media has gotten hold on to the fact that phisher’s are trying the best they can to add legitimacy of their phish sites any way they can. This instance is by using services that, when conducting a WHOIS, returns signs that the site “belongs” to the service being phished, trying to reduce the likelyhood of it being detected. Well, we have seen various versions of this tactic, for a while now, landing in AUSCERT triage.  It did provide for a change, but they get processed none-the-less. Although phishers are changing tactics, one thing does not change, users need to be aware when clicking links in emails.   As for news, here’s a summary (including excerpts) of some of the moreinteresting stories we’ve seen this week: ——- Phishing Attacks Scrape Branded Microsoft 365 Login PagesAuthor: Sergiu GatlanDate: August 21st, 2019 Excerpt: “An unusual new phishing campaign is probing email inboxes via attacks using the targets’ company-branded Microsoft 365 tenant login pages to add more legitimacy to the scam.  The attackers are also using Microsoft’s Azure Blob Storage and Microsoft Azure Web Sites cloud storage solutions to host their phishing landing pages, a common tactic used by phishers to trick their targets into thinking that they’re seeing an official Microsoft login page.  Using Azure Blob Storage object storage solution to host their phishing pages allows them to take advantage of the fact that they will automatically get signed with an SSL certificate from Microsoft.” ——- npm Pulls Malicious Package that Stole Login PasswordsAuthor: Ionut IlascuDate: August 21st, 2019 Excerpt: “A malicious package was removed today from the npm repository after it was discovered that it stole login information from the computers it was installed on.  The npm repository is a popular online database for open-source packages that are often used as dependencies in Node.js projects. Critical severity. Earlier today, npm pulled the package ‘bb-builder’ from the repository, marking it as malicious and having critical severity.” ——- Identifying Evasive Threats Hiding Inside the NetworkAuthor: Matt LockDate: August 22nd, 2019 Excerpt:“There is no greater security risk to an organization than a threat actor that knows how to operate under the radar.  Malicious insiders and external cybercriminals are getting savvier. They are better at blending in without tripping any alerts. They skip over tools and techniques that trigger standard security systems. How can a company tell them apart from the noise created by legitimate logins to the network that day?  The answer lies in context. It is not enough to monitor and log activity throughout the network – organizations need to be able to combine multiple sources of data to spot the subtle signs of a stealthy attacker at work.” ——- The Cost of Dealing With a Cybersecurity Attack in These 4 IndustriesAuthor: Pierluigi PaganiniDate: August 21st, 2019 Excerpt:“A cybersecurity issue can cause unexpected costs in several different areas. In addition to the monetary costs associated with things like lost productivity and improving network security to reduce the likelihood of future incidents, affected companies have to deal with the costs tied to reduced customer trust and damaged reputations.  It’s not always easy or straightforward to pinpoint the overall costs of recovering from a cyberattack. The totals also vary by industry. However, here’s some research that illuminates the various financial impacts for these four sectors. 1. Health Care, 2. Retail, 3. Manufacturing, 4. Finance.” ——- Update Now! Microsoft Patches Its Android RDP App to Fix FlawAuthor: John E DunnDate: August 22nd, 2019 Excerpt: “Microsoft has added its Android Remote Desktop Protocol (RDP) app to the list of client software that needs updating to fix a security flaw first made public as part of July’s Patch Tuesday.  The flaw, tracked as CVE-2019-1108, was described as an information disclosure issue that could allow an attacker “to connect remotely to an affected system and run a specially crafted application.”  Although the rating made it sound less urgent, attackers are known to be very interested in RDP weaknesses, hence Microsoft’s caution that that exploitation was “more likely.” The fix? To apply the relevant patch for the Windows version in question (KB4507453 in the case of Windows 10 64-bit version 1903).” ——- Here are this week’s noteworthy security bulletins (in no particular order): 1. ESB-2019.3212 – [Cisco] Cisco Systems & Cisco UCS Direct: Multiple vulnerabilities“CVE-2019-1936 …authenticated, remote attacker to execute arbitrary commands on the underlying Linux shell as the root user” 2. ESB-2019.3208 – [Appliance] IBM Netezza Host Management: Multiple vulnerabilities“CVE-2019-10161 …obtain arbitrary file information, cause a denial of service or execute arbitrary programs withroot privileges.” 3. ESB-2019.3210 – [Win][Linux][AIX] IBM InfoSphere Optim High Performance Unload: Root Compromise – Existing Account“CVE-2019-4447 …low privilege user full access to root…” 4. ESB-2019.3190 – [UNIX/Linux][Ubuntu] Zstandard: Multiple vulnerabilities“CVE-2019-11922 …execute arbitrary code if it received specially crafted input…” 5. ESB-2019.3189 – [Ubuntu] OpenJPEG: Multiple vulnerabilities“CVE-2017-17480 Certain PGX files could possibly cause a denial of service or possibly remote code execution.” Wishing you the best from AUSCERT and hope to see you safe next week,Geoffroy

AUSCERT Week in Review for 16th August 2019 Greetings, Windows’ Remote Desktop Services is in the spotlight this week, with two separate announcements. Firstly, the ACSC issued a warning on Monday night that May’s “BlueKeep” vulnerability was being exploited in the wild. Then, Microsoft warned on Patch Tuesday (or Wednesday for us antipodeans) that it had found two more similar vulnerabilities, with patches available immediately. In other news, F-Secure have written up a novel injection attack. While injection attacks are famously seen in carelessly-written SQL and shell scripts, this week brought a blog post documenting how vendor F5’s own example configuration code often contained vulnerable Tcl. While F5 released an advisory in May to this effect, F-Secure’s post brings greater notoriety to the issue. While scripting languages are on your mind, consider ShellCheck. Yours truly will always recommend an extra pair of eyes on any shell scripts being written. ASD upgrades BlueKeep Win. RDP warning, 50K Aust. devices at riskAuthor: iTnewsDate published: 2019-08-13 The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) has issued a late evening warning to business and government that a recently revealed legacy Windows exploit has jumped ‘research’ quarantine and is expected to start fanging victims imminently. New Bluetooth KNOB Flaw Lets Attackers Manipulate TrafficAuthor: BleepingComputerDate published: 2019-08-13 A new Bluetooth vulnerability named “KNOB” has been disclosed that allows attackers to more easily brute-force the encryption key used during pairing to monitor or manipulate the data transferred between two paired devices. ‘Cyber paramedics’ keep Vic agencies safeAuthor: Government NewsDate published: 2019-08-12 When David Cullen took up the job of Principal Advisor of Cyber Incidents and Emergency Management at the Victorian Department of Premier and Cabinet a year ago he was told there had been just 13 cyber-attacks in the history of the organisation.“I scratched my head and thought, ‘what a ripping job I’ve landed in’,” he told delegates at a Technology in Government conference in Canberra last week.He soon found out those 13 attacks weren’t “even close to the tip of the iceberg”.After conducting a whole of government survey it became apparent that hackers were attempting to breach government systems every 45 seconds and that nine in 10 Victorian government organisations had experienced a cyber incident. WordPress team working on daring plan to forcibly update old websitesAuthor: ZDNetDate published: 2019-08-08 The developers behind the WordPress open-source content management system (CMS) are working on a plan to forcibly auto-update older versions of the CMS to more recent releases.The goal of this plan is to improve the security of the WordPress ecosystem, and the internet as a whole, since WordPress installations account for more than 34% of all internet websites. Hidden Injection Flaws Found in BIG-IP Load BalancersAuthor: SecurityWeekDate published: 2019-08-09 The issue cannot be patched. “This is not a vulnerability in Tcl, or F5 products, but rather an issue relating to coding practices used when writing Tcl code,” explained F5 in its advisory. The effect, however, could give an attacker access to the load balancer and its hosting device, the ability to read passing traffic (including user credentials), and the potential to use this as a beachhead for gaining access to the internal network. The inability to patch the problem and the difficulty for companies to know whether their own code exposes the problem, prompted the flaw finder, F-Secure’s senior security consultant Christoffer Jerkeby, to publish a paper on his findings. ShellCheck This free tool is available online and as a binary, and scours your shell scripts for common mistakes. It’s also available as a plug-in for your favourite editor. This week’s noteworthy bulletins: 1. ESB-2019.3059 – [Appliance] FortiOSJavaScript files used in the appliance’s web UI would reveal OS version information even to unauthenticated users. 2. ASB-2019.0238 – [Windows] Microsoft Windows (login wall)Microsoft’s Patch Tuesday included two “wormable” RCEs in Remote Desktop Services, similar to the BlueKeep bug patched in May.Two more RCEs were also patched in the Windows DHCP client. 3. ESB-2019.3092 – [Windows] [macOS] Adobe Acrobat and ReaderOpening a crafted file could execute arbitrary code. A good reminder not to open suspicious files. 4. ESB-2019.3116 – [Windows] [UNIX/Linux] nginxMultiple DoS vulnerabilities were found in HTTP/2 servers by a researcher at Netflix.Nginx happens to be the first to release a fix. Stay safe, stay patched, try out ShellCheck, and have a great weekend!David

AUSCERT Week in Review for 9th August 2019 Greetings, Two sagas continue this week, and neither one is Star Wars. The Spectre family tree has gained a new member called SWAPGS. It was announced at Black Hat and allows access to protected data in the CPU cache. Another two vulnerabilities have also been added to the Dragonblood family, affecting the cutting-edge WPA 3 WiFi standard. A million-dollar email should serve as a reminder to your staff to always consider whether BCC is a better tool for mass-mail than CC. ——————————————————————————– SWAPGS Vulnerability in Modern CPUs Fixed in Windows, Linux, ChromeOSAuthor: BleepingComputerDate published: 06/08/2019 At BlackHat today, Bitdefender disclosed a new variant of the Spectre 1 speculative execution side channel vulnerabilities that could allow a malicious program to access and read the contents of privileged memory in an operating system.This SWAPGS vulnerability allows local programs, like malware, to read data from memory that is should normally not have access to, such as the Windows or Linux kernel memory.During the July 2019 Patch Tuesday security updates, Microsoft secretly patched the new SWAPGS speculative vulnerability using software mitigations.  [Red Hat and Google have also released advisories and patches.] App that patients use to book GP appointments now facing millions in fines for selling health dataAuthor: ABC NewsDate published: 07/08/2019 Australia’s biggest medical appointment booking app HealthEngine is facing multi-million-dollar penalties after an ABC investigation exposed its practice of funnelling users’ personal health information to law firms. The Australian Competition and Consumer Commission has launched legal action against the Perth-based company in the Federal Court, accusing it of misleading and deceptive conduct. HealthEngine is facing a fine of $1.1 million for each breach of the law, but the ACCC has yet to determine how many breaches it will allege. New Dragonblood vulnerabilities found in WiFi WPA3 standardAuthor: ZDNetDate published: 03/08/2019 Earlier this year in April, two security researchers disclosed details about five vulnerabilities (collectively known as Dragonblood) in the WiFi Alliance’s recently launched WPA3 WiFi security and authentication standard. Yesterday, the same security researchers disclosed two new additional bugs impacting the same standard. The two researchers — Mathy Vanhoef and Eyal Ronen — found these two new bugs in the security recommendations the WiFi Alliance created for equipment vendors in order to mitigate the initial Dragonblood attacks. When ‘CC’ should have been ‘BCC’: How an email gaffe cost one Australiancompany dearlyAuthor: The AgeDate published: 02/08/2019 It started as a simple oversight, but quickly ended as a six-figure mistake. At the heart of the tale is a global real estate company, where one marketing email sent by an employee to just 300 customers exposed a major gap in the firm’s cyber security governance.The problem began when the employee mistakenly pasted 300 email addresses in the “carbon copy” or “CC” email field, instead of the “blind copy” or “BCC” field, a technological misstep familiar to almost anyone using email in 2019. ——————————————————————————– This week’s noteworthy bulletins: 1. [ALERT] Cisco Enterprise NFV Infrastructure Software: Multiple vulnerabilitiesAuthentication bypass and command injection attacks leading to anunauthenticated administrator compromise. 2.  keycloak-httpd-client-install: Multiple vulnerabilitiesInstall scripts can have significant vulnerabilities too! This one usedinsecure temp files to enable privilege escalation. 3. LibreOffice: Execute arbitrary code/commands – Remote with user interactionNooo don’t open that file! 4. IBM Business Automation Workflow: Access confidential data – Remote/unauthenticated“Reverse tabnabbing” is a little-seen web vulnerability. Stay safe, stay patched and have a great weekend!David

AUSCERT Week in Review for 26th July 2019 AUSCERT Week in Review26 July 2019 Greetings, Concerns continue about development of exploits for the Windows RDP vulnerability (BlueKeep) which has the potential to become a self replicating worm. This week more information become available which closes the gap towards successful exploitation of this vulnerability. For more info see: https://www.theregister.co.uk/2019/07/24/bluekeep_code_release/ If you still haven’t patched this yet note the time to successful exploitation with remote code execution is drawing ever closer! This week also saw a warning from the ACSC about a class of scams being called “freight forwarding scams”. A number of AUSCERT members have been hit by this and ACSC note some businesses have closed due to the losses. See: https://www.cyber.gov.au/news/business-email-compromise-freight-forwarding-scam Here are some of the week’s noteworthy security stories (in no particular order): Australia’s Consumer Data Right to finally make its way through ParliamentAuthor: Asha BarbaschowDate: 2019-07-23 Excerpt: “The federal government this week plans to introduce legislation ithas touted as opening up competition between banks, utilities, andtelecommunications providers, as well as allowing consumers to easilyswitch between providers. The Consumer Data Right (CDR) — through the passage of the Treasury LawsAmendment (Consumer Data Right) Bill — will allow individuals to “own”their data by granting them open access to their banking, energy, phone,and internet transactions, in addition to gaining the right to controlwho can have it and who can use it.” Law Council wants warrants and crime threshold for metadata retention schemeAuthor: Chris DuckettDate: 2019-07-23 Excerpt: “The Law Council of Australia has called for the introduction of warrantswhen the nation’s enforcement agencies seek to access metadata stored inthe data retention systems of Australia’s telcos. Currently, enforcement agencies have access to two years’ worth of customers’call records, location information, IP addresses, billing information,and other data stored by carriers without the need for a warrant.” BEC Scammers Trick Employees Into Giving Away Customer InfoAuthor: Sergiu GatlanDate: 2019-07-23 Excerpt: “Business email compromise (BEC) scammers are now targeting a company’scustomers using a new indirect attack method designed to collectinformation on future scam targets by asking for aging reports fromcollections personnel.”   Hundreds of Australians have been fleeced over bogus tax debtsAuthor: Sian Johnson, et alDate: 2019-07-24 Excerpt: “Ms Wilson is one of hundreds of Australians taken in by dodgy phone callsdemanding payment for bogus tax debts, with a record number of more than800 Australians fleeced of a total of $3 million in 2018 alone.” Microsoft to Improve Office 365 Malicious Email AnalysisAuthor: Sergiu GatlanDate: 2019-07-24 Excerpt: “Microsoft is currently in the process of developing significantly bettermanual threat hunting features for the Office 365 Threat Explorer, to berolled out to all environments during August.”