Publications

AUSCERT Week in Review for 5th April 2019 Greetings, This week, MISP released an update to patch a CVE in itself and China managed to top the cake by leaving over 590 million resumes sitting in an open-database. Here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: NIST cybersecurity resources for smaller businessesDate Published: 4 April 2019Author:  Lysa Myers     Excerpt: “There are a lot of challenges to being a small-business owner, including safely managing technology. Every risk can have an outsized effect on your ability to stay in business. And resources for protecting your business are often geared towards much larger organizations. The National Institute of Standards and Technology (NIST) aims to change that, with the release of their Small Business Cybersecurity Corner.”—– SamSam outbreak led to FBI restructuring, top official saysDate Published: 4 April 2019Author: Sean LyngaasExcerpt: “The notorious SamSam ransomware — which extracted over $6 million in payments from more than 200 victim organizations — forced the FBI to adjust its model for handling cyberattack investigations, a senior bureau official said Thursday.Nearly all 56 of the FBI’s field offices responded to SamSam incidents — an inefficient way of keeping up with the malware, said Tonya Ugoretz, deputy assistant director of the FBI’s Cyber Division.”—– Chinese companies have leaked over 590 million resumes via open databasesDate Published: April 4 2019Author: Catalin Cimpanu Excerpt: “Chinese companies have leaked a whopping 590 million resumes in the first three months of the year, ZDNet has learned from multiple security researchers.Most of the resume leaks have occurred because of poorly secured MongoDB databases and ElasticSearch servers that have been left exposed online without a password, or have ended up online following unexpected firewall errors.”—– 540 Mllion Facebook Records Leaked by Public Amazon S3 BucketsDate Published: 3 April 2019Author: Sergiu GatlanExcerpt: “More than 540 million records of Facebook users were exposed by publicly accessible Amazon S3 buckets used by two third-party apps to store user data such as plain text app passwords, account names, user IDs, interests, relationship status, and more.As discovered by the UpGuard Cyber Risk team, Mexico-based media company Cultura Colectiva stored the records of roughly 540 million of its users within a 146 GB database called “cc-datalake,” stored in a misconfigured Amazon S3 bucket which gave anyone download permissions.”—– Hacker group has been hijacking DNS traffic on D-Link routers for three monthsDate Published: April 4 2019Author: Catalin Cimpanu Excerpt: “For the past three months, a cybercrime group has been hacking into home routers –mostly D-Link models– to change DNS server settings and hijack traffic meant for legitimate sites and redirect it to malicious clones. The attackers operate by using well-known exploits in router firmware to hack into vulnerable devices and make silent changes to the router’s DNS configuration, changes that most users won’t ever notice.”—– Here are this week’s noteworthy security bulletins: 1) ESB-2019.1082 – [Linux] MISP: Cross-site scripting – Remote with user interaction       A new version of MISP (2.4.105) has been released to fix a cross-site scripting vulnerability (CVE-2019-10254) in addition to some minor improvements and fixes. 2) ESB-2019.1148 – [Win][UNIX/Linux] Jenkins plugins: Multiple vulnerabilities       72 CVE’s published for various different Jenkins plugins. 3) ESB-2019.1139 – [Win][UNIX/Linux] drupal7: Multiple vulnerabilities       A Drupal7 update to resolve an access bypass vulnerability.    Stay safe, stay patched and have a great weekend, Rameez Agnew

AUSCERT Week in Review for 29th March 2019 Greetings, Another eventful week in information security!  Apart from plenty of vulnerabilities disclosed and patched, we have seen much media discussion regarding the intersection of IT, foreign powers, social media companies and politics. In case you were not aware, there is a “World Backup Day”, and it is this Sunday, the day before April fool’s day! The site http://www.worldbackupday.com/en/ has some interesting stats regarding backups and some arguments as to why we should backup our important data. We have also published a short blog about backups here. Finally, another reminder regarding the upcoming AUSCERT conference.  There is just over 2 weeks left to register for the Early Bird prices.  For further details, please visit:  https://conference.auscert.org.au As for news, here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: Title:  US Congress proposes comprehensive federal data privacy legislation—finally Date:  March 28, 2019 Author:  David Ruiz Excerpt: “The United States might be the only country of its size – both in economy and population – to lack a comprehensive data privacy law protecting its citizens’ online lives. That could change this year. Never-ending cybersecurity breaches, recently-enacted international privacy laws, public outrage, and crisis after crisis from the world’s largest social media company have pushed US Senators and Representatives into rarely-charted territory: regulation.” — Title:  Commando VM: The First of Its Kind Windows Offensive Distribution Date:  March 28, 2019 Author:  Jacob Barteaux, Blaine Stancill, Nhan Huynh Excerpt: “For penetration testers looking for a stable and supported Linux testing platform, the industry agrees that Kali is the go-to platform. However, if you’d prefer to use Windows as an operating system, you may have noticed that a worthy platform didn’t exist. As security researchers, every one of us has probably spent hours customizing a Windows working environment at least once and we all use the same tools, utilities, and techniques during customer engagements. Therefore, maintaining a custom environment while keeping all our tool sets up-to-date can be a monotonous chore for all. Recognizing that, we have created a Windows distribution focused on supporting penetration testers and red teamers.” — Title:  Norsk Hydro ransomware incident losses reach $40 million after one week Date:  March 26, 2019 Author:  Catalin Cimpanu Excerpt:  “A week after suffering a crippling ransomware infection, Norwegian aluminum producer Norsk Hydro estimates that total losses from the incident have already reached $40 million. […] It now remains to be seen how much of the $40 million losses will be covered by Norsk Hydro’s cyber-insurance policy. Most cyber-insurance policies don’t necessarily cover revenue losses caused by loss of business capabilities. Instead, most cover costs directly generated by the cyber-incident, such as IT consulting, incident response costs, and replacing computers and software.” — Title: Tesla car hacked at Pwn2Own contest Date: March 23, 2019 Author:Catalin Cimpanu Excerpt: “A team of security researchers has hacked a Tesla Model 3 car on the last day of the Pwn2Own 2019 hacking contest that was held this week in Vancouver, Canada.  Team Fluoroacetate –made up of Amat Cama and Richard Zhu– hacked the Tesla car via its browser. They used a JIT bug in the browser renderer process to execute code on the car’s firmware and show a message on its entertainment system. As per contest rules announced last fall, the duo now gets to keep the car. Besides keeping the car, they also received a $35,000 reward.” — Here are some of this week’s noteworthy security bulletins (in no particular order): ESB-2019.1047 – [RedHat] libssh2: Execute arbitrary code/commands – Remote with user interaction SSH client-side arbitary code execution. ESB-2019.1026 – [Cisco] Cisco IOS: Multiple vulnerabilities Confidential data disclosure, arbitary code execution and root compromise for Cisco IOS. ESB-2019.0997 – [RedHat] Red Hat Ansible Tower: Multiple vulnerabilities Significant vulnerabilities for this popular configuration management tool. ESB-2019.0991 – [Apple iOS] iOS: Multiple vulnerabilities A user’s video may not be paused in a FaceTime call if they exit the FaceTime app while the call is ringing” Stay safe, stay patched and have a good weekend! Marcus

Don't be an April Fool – back up your files! This Sunday the 31st of March marks World Backup Day [1]. Why backup? Backups are crucial for ensuring the integrity of your files in any unexpected event.  If you aren’t already convinced on the utility of backups, or if they aren’t at the top of the priority list, here’s a handy list to change your mind (or to convince the boss it’s important!) – Disaster recovery: from flood and fire to dead hard drives and the accidental rm -rf– Forensics and auditing: to find out when something changed or when a machine is compromised– Ransomware recovery: so we don’t have to negotiate with scammers– Device theft or loss: hardware is replaceable, the data should be too– Minimising down time: in the event of data loss, you want the business back up and running as soon as possible Snapshots can help with some of these things, but snapshots aren’t backups, so having both is important. Storing your Backups Securing your backups is important to ensure the integrity and confidentiality of your data.  Keep your backups on servers you trust, and have at least one copy offsite, in the case of a natural disaster.  Duplicity or Duply [2] are powerful tools which can gpg-encrypt your backups to send to an Amazon S3 bucket or elsewhere.  Popular cloud services include Backblaze [3], or Time Machine for Mac [4].   Testing your Backups If you already have backups, which fingers crossed we all do, take this event as an opportunity to test them.  Try to include data recovery testing with your regular maintenance or patch cycle – just because they worked once, doesn’t mean they always will. The worst time to test your backups is when your data is gone, the best time is right now! Charelle   [1] http://www.worldbackupday.com/en/[2] https://duply.net/[3] https://www.backblaze.com/[4] https://support.apple.com/en-us/HT201250

AUSCERT Week in Review for 22nd March 2019 AUSCERT Week in Review22 March 2019 Greetings, Have you registered for the AUSCERT conference? There’s only 3 weeks until our Early Bird closing date – registrations and program details can be found on: https://conference.auscert.org.au Speaking of events, just yesterday we jointly hosted a public lecture from Major General Marcus Thompson AM, Deputy Chief Information Warfare Division (IWD) with the Australian Defence Force.  There were over 200 attendees, and the presentation was followed by a panel which attracted a lot of audience participation with a range of perspectives. https://wordpress-admin.auscert.org.au/events/2019-03-21-cyber-warfare-hear-major-general-marcus-thompson Did you catch us at BSides Canberra last weekend?  If not, you have another opportunity – our very own Mike Holm and Anthony Vaccaro will be presenting at BrisSEC next Friday.  Be sure to come up and say ‘hello’ to them afterwards!  Here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: Christchurch tragedy-related scams and attacksDate Published: 18 March 2019URL: https://www.cert.govt.nz/businesses-and-individuals/recent-threats/christchurch-tragedy-related-scams-and-attacks/Author: CERT NZ “CERT NZ has received reports of different opportunistic online scams and attacks in the wake of the tragic events in Christchurch last week. This includes online donation fraud, malicious video files, defacement of NZ websites, and website disruption.”—– Spam Warns about Boeing 737 Max Crashes While Pushing MalwareDate Published: 16 March 2019URL: https://www.bleepingcomputer.com/news/security/spam-warns-about-boeing-737-max-crashes-while-pushing-malware/Author: Lawrence Abrams “A new malspam campaign is underway that is trying to utilize the tragic Boeing 737 Max crashes as a way to spread malware on a recipient’s computer. These spam emails pretend to be leaked documents about imminent crashes that the sender states should be reviewed and shared with loved ones to warn them.”—– The Government wants to free up your bank data. Here’s what that means for youDate Published: 20 March 2019URL: https://www.abc.net.au/news/science/2019-03-20/consumer-data-right-bank-transactions-privacy/10898060Author: Ariel Bogle “The Consumer Data Right (CDR), which begins to come online mid-year, aims to give Australians more agency to access and control parts of their personal information.The government calls it a “game changer”, but critics fear that without careful consideration, it could have serious privacy implications, among other concerns.”—– Fake CIA emails requesting Bitcoin payment or arrestDate Published: 20 March 2019URL: https://www.staysmartonline.gov.au/alert-service/fake-cia-emails-requesting-bitcoin-payment-or-arrestAuthor: Stay Smart Online “The Australian Cyber Security Centre (ACSC) is aware of malicious emails claiming to be from the Central Intelligence Agency (CIA) being received by Australians.The emails state that the recipient’s personal details, addresses, contact information and information relating to their relatives are contained in a case file about the distribution and storage of pornographic electronic materials involving underage children.The emails advise that arrests are scheduled and that a payment of $10,000 USD in Bitcoin will prevent further action or contact.”—– Facebook Stored Hundreds of Millions of User Passwords in Plain Text for YearsDate Published: 21 March 2019URL: https://krebsonsecurity.com/2019/03/facebook-stored-hundreds-of-millions-of-user-passwords-in-plain-text-for-years/Author: Brian Krebs “Facebook is probing a series of security failures in which employees built applications that logged unencrypted password data for Facebook users and stored it in plain text on internal company servers. “—– Here are this week’s noteworthy security bulletins: ESB-2019.0880 – ESB-2019.0885 [Win][UNIX/Linux] Moodle: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/ESB-2019.0880Multiple serious vulnerabilities have been patched in Moodle, so we recommend upgrading as soon as convienient. ASB-2019.0082 – [Win][UNIX/Linux] Mozilla Firefox: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/ASB-2019.0082Several vulnerabilities have been identified in Mozilla Firefox prior to version 66.0 [1], and Firefox ESR prior to version 60.6. Updates are available through most package managers. ESB-2019.0920 – [Win][UNIX/Linux] Drupal modules: Execute arbitrary code/commands – Remote/unauthenticatedhttps://portal.auscert.org.au/bulletins/ESB-2019.0920Three Drupal modules have been patched for remote code execution and cross site scripting. ESB-2019.0915 – [Appliance] Cisco IP Phone 7800 and 8800 Series: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/ESB-2019.0915Vulnerabilities in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 7800 Series and Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code. ESB-2019.0950 – Medtronic Conexus telemetry: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/ESB-2019.0950Successful exploitation of these vulnerabilities may allow an attacker with adjacent short-range access to one of the affected products to interfere with, generate, modify, or intercept the radio frequency (RF) communication of the Medtronic proprietary Conexus telemetry system, potentially impacting product functionality and/or allowing access to transmitted sensitive data.—- Stay safe, stay patched and have a good weekend! Charelle

AUSCERT Week in Review for 8th March 2019 AUSCERT Week in Review08 March 2019 Greetings, This has been an action packed week and with so many variety of events that it is hard to piece this week with one single smooth story on a Friday afternoon.  To name a few of the things that have happened, there are botnets launched and taken down, cryptojacking using vulnerable installation utilities, zero-day on a popular browser, a new analysis tool being released, another “can’t-fix-quick” vulnerability from a popular CPU manufacturer, a SIEM solution that can be potentially crashed from afar, and the list continues to be nothing short of amazing, bewildering and Friday comes as a cliffhanger for the next week’s events.Have a good rest this weekend as next week could turn out even more exciting. As for news, here’s a summary (including excerpts) of some of the moreinteresting stories we’ve seen this week: ——-  Title:  Serious Chrome zero-day – Google says update “right this minute”Date:  March 6th 2019Author: Paul DucklinURL: https://nakedsecurity.sophos.com/2019/03/06/serious-chrome-zero-day-google-says-update-right-this-minute/ Excerpt:“Precise information about the Chrome CVE-2019-5786 zero-day is hard to come by at the moment – as Google says: ‘Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.’ According to the official release notes, this vulnerability involves a memory mismanagement bug in a part of Chrome called FileReader…it looks as though attackers can take much more general control, allowing them to pull off what’s called Remote Code Execution, or RCE.…Just tricking you into looking at a booby-trapped web page might be enough for crooks to take over your computer remotely.” ——-  Title:  Vulnerable Docker Hosts Actively Abused in Cryptojacking CampaignsDate:  March 4th, 2019Author: Sergiu GatlanURL: https://www.bleepingcomputer.com/news/security/vulnerable-docker-hosts-actively-abused-in-cryptojacking-campaigns/ Excerpt:“Hundreds of vulnerable and exposed Docker hosts are being abused in cryptojacking campaigns after being compromised with the help of exploits designed to take advantage of the CVE-2019-5736 runc vulnerability discovered last month. The CVE-2019-5736 runc flaw triggers a container escape and it allows potential attackers to access the host filesystem upon execution of a malicious container, overwrite the runc binary present on the system, and run arbitrary commands on the container’s host system.” ——-  Title:  All Intel chips open to new Spoiler non-Spectre attack: Don’t expect a quick fixDate:  March 5th 2019Author: Liam TungURL: https://www.zdnet.com/article/all-intel-chips-open-to-new-spoiler-non-spectre-attack-dont-expect-a-quick-fix/ Excerpt:“Researchers have discovered a new flaw affecting all Intel chips due to the way they carry out speculative execution for CPU performance gains.   Like the Spectre and Meltdown attacks revealed in January 2018, Spoiler also abuses speculative execution in Intel chips to leak secrets.” ——-  Title:  WordPress Comprises 90% of Hacked Sites: ReportDate:  March 5th 2019Author: Phil MuncasterURL: https://www.infosecurity-magazine.com/news/wordpress-comprises-90-of-hacked-1-1/ Excerpt:“The GoDaddy-owned security vendor analyzed 18,302 infected websites and over 4.4m cleaned files to compile its latest Hacked Website Trend report. It revealed that WordPress accounted for 90% of hacked websites in 2018, up from 83% in 2018. There was a steep drop before Magento (4.6%) and Joomla (4.3%) in second and third. The latter two had dropped from figures of 6.5% and 13.1% respectively in 2017.” ——-  Title:  NSA puts ‘Ghidra,’ its reverse-engineering tool for malware, in the hands of the publicDate:  March 5th 2019Author: Sean LyngaasURL: https://www.cyberscoop.com/ghidra-nsa-tool-public/ Excerpt:“After years lurking in the shadows, the National Security Agency’s tool for reverse-engineering malware is now out in the open. The software framework has moved from classified status into use by military analysts and contractors in sensitive-but-unclassified settings, and now it’s available to anyone with an internet connection.” ——- Here are this week’s noteworthy security bulletins (in no particular order): 1.    ASB-2019.0066.2 – UPDATED ALERT [Win][Linux][Mac] Google Chrome: Execute arbitrary code/commands – Remote with user interaction https://portal.auscert.org.au/bulletins/76398Exploit in the wild has been reported. 2.    ESB-2018.1689.4 – UPDATED ALERT [Cisco] Cisco Adaptive Security Appliance Web Services: Denial of service – Remote/unauthenticated https://portal.auscert.org.au/bulletins/63666Attempted exploitation of this vulnerability in the wild. 3.    ESB-2019.0696 – [Linux] IBM QRadar SIEM: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/76558..a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash. 4.    ESB-2019.0739 – [Win][Linux][HP-UX][Solaris][AIX] IBM Db2: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/76734could allow an authenticated local attacker to execute arbitrary code on the system as root 5.    ESB-2019.0734 – [Appliance] IBM Lotus Protector for Mail Security: Execute Arbitrary Code/Commands – Remote/Unauthenticated https://portal.auscert.org.au/bulletins/76714would allow the attacker to bypass disabled exec functions Wishing you the best from AUSCERT and hope to see you safe next week,Geoffroy

AUSCERT Week in Review for 15th March 2019 AUSCERT Week in Review15 March 2019 Greetings, Well this week has been interesting.  Watch out which games you play as they could be backdoored from way up the supply chain. Exaggerating a bit on the controls over USBs, you could start either tethering them to your personnel or consider thermite upon their removal of circulation. But things does not stop there. At work, this patch-cycle-week, plenty of systems had to be updated to avoid being abused.  Also, Monero mining was thought to slow down but with the incorporation in to malicious code with worm-like behaviour, mining will move into a new gear. Had enough and have the thought of applying for a job else where? Bad luck, as databases overseas also get compromised.So we all need you to rest for the weekend, recuperate, cause it will have to be all-hands-on-deck next week. As for news, here’s a summary (including excerpts) of some of the moreinteresting stories we’ve seen this week: ——-  Title: Game Development Companies Backdoored in Supply-Chain AttacksURL: https://www.bleepingcomputer.com/news/security/game-development-companies-backdoored-in-supply-chain-attacks/Author : Sergiu GatlanDate: 11th March 2019 Excerpt:“Two popular games and a gaming platform developed by Asian companies were compromised following a series of successful supply-chain attacks which allowed the attackers to include a malicious payload designed to provide them with a backdoor. The malware used in the supply chain attacks is designed to check the region of the compromised machines before dropping the payload and, if it’s a Chinese or a Russian computer, it will automatically stop the infection process hinting at the fact that the cybercriminals behind this supply chain attack have a very specific list of victims they need to target.” ——-  Title: CVE-2019-0797 Windows Zero-Day exploited by FruityArmor and SandCat APT GroupsURL: https://securityaffairs.co/wordpress/82345/apt/cve-2019-0797-fruitarmor-sandcat.htmlAuthor : Pierluigi PaganiniDate: 13th March 2019 Excerpt:“One of the flaws, tracked as CVE-2019-0808, was disclosed by Google’s Threat Analysis Group after it has observed targeted attacks exploiting the issue alongside a recently addressed flaw in Chrome flaw (CVE-2019-5786). The second zero-day, tracked as CVE-2019-0797, was reported to Microsoft by experts at Kaspersky Lab, which states the issue has been exploited by several threat actors, including FruityArmor and SandCat APT groups.” ——-  Title: What do sexy selfies, search warrants, tax files have in common? They’ve all been found on resold USB sticksURL: https://www.theregister.co.uk/2019/03/14/usb_recoverable_data/Author : Thomas ClaburnDate: 14th March 2019 Excerpt:“You do know just dragging stuff to the delete folder doesn’t wipe stuff, right? Apparently not.About two-thirds of USB memory sticks bought secondhand in the US and UK have recoverable and sometimes sensitive data, and in one-fifth of the devices studied, the past owner could be identified.” ——-  Title: Unsecured Database Exposed 33 Million Job Profiles in ChinaURL: https://www.bleepingcomputer.com/news/security/unsecured-database-exposed-33-million-job-profiles-in-china/Author : Lawrence AbramsDate: 14th March 2019 Excerpt:“A large database with approximately 33 million profiles for people seeking jobs in China has been fully accessible and unprotected online. This information included sensitive information that could have been used for scammers and identity theft. The database was discovered by Sanyam Jain, a security researcher and member of GDI.Foundation, who found the database using the Shodan search engine.” ——-  Title: Malware Spreads As a Worm, Uses Cryptojacking Module to Mine for MoneroURL: https://www.bleepingcomputer.com/news/security/malware-spreads-as-a-worm-uses-cryptojacking-module-to-mine-for-monero/Author : Sergiu GatlanDate: 12th March 2019 Excerpt:“A modular malware with worm capabilities exploits known vulnerabilities in servers running ElasticSearch, Hadoop, Redis, Spring, Weblogic, ThinkPHP, and SqlServer to spread from one server to another and mine for Monero cryptocurrency. Systemctl.exe, the worm module of the malware named PsMiner by the 360 Total Security researchers, is a Windows binary written in the Go language which bundles all the exploit modules used to hack into vulnerable servers it can find on the Internet.” ——- Here are this week’s noteworthy security bulletins (in no particular order): 1.    ESB-2019.0834 – [Appliance] Power 9 Systems: Root compromise – Existing accounthttps://portal.auscert.org.au/bulletins/77154“…could allow the host full access to BMC memory and flash… 2.    ESB-2019.0782 – [Linux][HP-UX][Solaris][AIX] IBM MQ: Execute arbitrary code/commands – Existing account https://portal.auscert.org.au/bulletins/76906“..a local user to inject code that could be executed with root privileges..” 3.    ESB-2019.0806 – [Win][Linux][HP-UX][Solaris][AIX] IBM Db2: Increased privileges – Existing accounthttps://portal.auscert.org.au/bulletins/77042“…potentially giving low privilege user full access to root…” 4.     ASB-2019.0077 – [Win] Microsoft Windows: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/76950“CVE-2019-0797   Elevation of Privilege   Important” Wishing you the best from AUSCERT and hope to see you safe next week,Geoffroy

AUSCERT Week in Review for 1st March 2019 AUSCERT Week in Review01 March 2019 Greetings, This week was marked by solution providers running-for-the-hills with runc as more can be done with the call than what was documented.  The vulnerability is being patched and the solutions are being rolled out. Also the final days of Coin-Hive are able to be counted on two hands. The reason for the shutdown is that the business model “isn’t economically viable anymore.”.  Somehow a permutation of it, with a different currency-algorithm pair, coupled with the fact that new APIs in browsers may continue to trudge on through even after the browser is closed, a new service is bound to emerge. This type of service, may be taking a break, but mining on other’s computers is bound to come back. After all, that’s where the money is these days.    As for news, here’s a summary (including excerpts) of some of the moreinteresting stories we’ve seen this week: ——- Title:  Cisco Fixes Critical RCE Vulnerability in RV110W, RV130W, and RV215W RoutersURL: https://www.bleepingcomputer.com/news/security/cisco-fixes-critical-rce-vulnerability-in-rv110w-rv130w-and-rv215w-routers/Date:  28th February 2019 Author: Sergiu Gatlan Excerpt:“Cisco fixed a critical remote code execution vulnerability present in the web-based management interface of the RV110W Wireless-N VPN Firewall, RV130W Wireless-N Multifunction VPN Router, and RV215W Wireless-N VPN Router devices. Cisco’s security advisory rates the vulnerability currently tracked under CVE-2019-1663 as critical and assigns it a 9.8 base score based on the Common Vulnerability Scoring System (CVSS) 3.0 given that it could allow potential unauthenticated attackers to remotely execute arbitrary code on any of the three vulnerable routers.” ——- Title:  Coinhive to Mine Its Last Monero in March  URL: https://threatpost.com/coinhive-monero-shutdown/142290/Date:   28th February 2019Author: Tara Seals Excerpt:“It seems like a good model on the surface, but in the notice on its website, posted on Tuesday, Coinhive management said that a 50 percent drop in the hash rate after the latest Monero fork “hit us hard.” The hash rate refers to the speed at which a mining operation is completed – i.e., how long it takes to uncover one block of currency.” ——- Title: Drupal RCE Flaw Exploited in Attacks Days After PatchURL: https://www.securityweek.com/drupal-rce-flaw-exploited-attacks-days-after-patchDate:  26th February 2019Author: Eduard Kovac Excerpt:“A vulnerability patched recently in the Drupal content management system (CMS) has been exploited in the wild to deliver cryptocurrency miners and other payloads. The attacks started just three days after a fix was released.…The patches released on February 20 were quickly analyzed and technical details and proof-of-concept (PoC) code were released roughly two days later.” ——- Title: Malspam Exploits WinRAR ACE Vulnerability to Install a Backdoor  URL: https://www.bleepingcomputer.com/news/security/malspam-exploits-winrar-ace-vulnerability-to-install-a-backdoor/Date:  25th February 2019 Author: Lawrence Abrams Excerpt:“Researchers have discovered a malspam campaign that is distributing a a malicious RAR archive that may be the first one to exploit the newly discovered WinRAR ACE vulnerability to install malware on a computer. Last week, Checkpoint disclosed a 19 year old vulnerability in the WinRAR UNACEV2.DLL library that allows a specially crafted ACE archive to extract a file to the Window Startup folder when it is extracted. This allows the executable to gain persistence and launch automatically when the user next logs in to Windows.” ——- Title: New browser attack lets hackers run bad code even after users leave a web page URL: https://www.zdnet.com/article/new-browser-attack-lets-hackers-run-bad-code-even-after-users-leave-a-web-page/Date:  25th February 2019Author:  Catalin Cimpanu Excerpt:“Academics from Greece have devised a new browser-based attack that can allow hackers to run malicious code inside users’ browsers even after users have closed or navigated away from the web page on which they got infected.…This is possible because modern web browsers now support a new API called Service Workers. This mechanism allows a website to isolate operations that rendering a page’s user interface from operations that handle intense computational tasks so that the web page UI doesn’t freeze when processing large quantities of data.“ ——- Here are this week’s noteworthy security bulletins (in no particular order): 1.    ESB-2019.0621 – [Win] Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools: Administrator compromise – Existing account https://portal.auscert.org.au/bulletins/76234“An exploit could allow the attacker to run arbitrary commands with SYSTEM user privileges.” 2.    ESB-2019.0625 – [RedHat] Red Hat Ansible Engine: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/76258“path traversal vulnerability which allows copying and overwriting files…” 3.    ESB-2019.0622 – [Appliance] Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router: Execute arbitrary code/commands – Remote/unauthenticatedhttps://portal.auscert.org.au/bulletins/76242“could allow an unauthenticated, remote attacker to execute arbitrary code…” 4.    ESB-2019.0597 – [Appliance] Moxa IKS and Moxa EDS: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/76138“The devices use plaintext transmission of sensitive data, which may allow an attacker to capture sensitive data such as an administrative password.” 5.    ESB-2019.0559 – [SUSE] kernel-firmware: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/75986“..in Bluetooth where the elliptic curve parameters were not sufficiently validated during Diffie-Hellman key exchange.” Wishing you the best from AUSCERT and hope to see you safe next week,Geoffroy

AUSCERT Week in Review for 22nd February 2019 Greetings, This week, North Korea decides to poke the bear which handed them nukes and Adobe patches a patch. Here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: Title: North Korean APT Lazarus Targets Russian Entities with KEYMARBLE BackdoorDate Published: February 19, 2019Author: Sergiu Gatlan Excerpt: “Bluenoroff, a subdivision of the North Korean sponsored APT group Lazarus, recently switched its sights to Russian entities as unveiled by a newly discovered campaign which uses malicious Office documents specifically crafted to target Russian organizations.This is especially interesting considering that Lazarus (also known as HIDDEN COBRA, Guardians of Peace, ZINC, and NICKEL ACADEMY) which became active during 2009 traditionally targeted only entities from countries that oppose the North Korean regime.”—– Title: Almost Half A Million Delhi Citizens’ Personal Data Exposed OnlineDate Published: February 21 2019 Author: Mohit Kumar Excerpt: February 21 2019 “A security researcher has identified an unsecured server that was leaking detailed personal details of nearly half a million Indian citizens… thanks to another MongoDB database instance that company left unprotected on the Internet accessible to anyone without password.In a report shared with The Hacker News, Bob Diachenko disclosed that two days ago he found a 4.1 GB-sized highly sensitive database online, named “GNCTD,” containing information collected on 458, 388 individuals located in Delhi, including their Aadhaar numbers and voter ID numbers.”—– Title: Microsoft Edge lets Facebook run Flash code behind users’ backsDate Published: February 20, 2019Author: Catalin Cimpanu Excerpt: “Microsoft’s Edge browser contains a secret whitelist that lets Facebook run Adobe Flash code behind users’ backs.The whitelist allows Facebook Flash content to bypass Edge security features such as the click-to-play policy that normally prevents websites from running Flash code without user approval beforehand. Prior to February 2019, the secret Flash whitelist contained 58 entries, including domains and subdomains for Microsoft”s main site, the MSN portal, music streaming service Deezer, Yahoo, and Chinese social network QQ, just to name the biggest names on the list.Microsoft trimmed down the list to two Facebook domains earlier this month after a Google security researcher discovered several security flaws in Edge”s secret Flash whitelist mechanism.”—– Title: Adobe Releases Second Patch for Data Leakage Flaw in ReaderDate Published: February 21, 2019 Author:  Eduard Kovacs Excerpt: “The security hole, identified by Alex Infuhr from Cure53, allows a specially crafted PDF document to send SMB requests to the attacker’s server when the file is opened.The vulnerability, similar to CVE-2018-4993, allows a remote attacker to steal a user”s NTLM hash included in an SMB request, and it can be leveraged to alert an attacker when their malicious PDF document has been opened by the targeted user. Adobe released a fix for CVE 2019-7089 with its February 2019 Patch Tuesday updates, but Infuhr quickly discovered that it could be bypassed.”—– Title: Toyota Australia hit by cyber attackDate Published: Feb 21 2019Author: Ry Crozier Excerpt:“Toyota Australia has suffered an ‘attempted cyber attack’ that has taken out its email and other online systems. The carmaker said in a statement that it is still investigating the source of the attack. “The threat is being managed by our IT department who is working closely with international cyber security experts to get systems up and running again,” the company said.”—– Here are this week”s noteworthy security bulletins: 1) ESB-2019.0536 – [Cisco] Cisco Prime Collaboration Assurance: Unauthorised access – Remote/unauthenticated     Prime Collaboration Assurance (PCA) Software could allow an unauthenticated, remote attacker to access the system as a valid user. 2) ESB-2019.0529 – [Win][UNIX/Linux] Drupal: Execute arbitrary code/commands – Remote with user interaction   Allows an unauthenticated, remote attacker to arbitrary code as the webservers current user.  3) ESB-2019.0551 – [Win][Mac] Adobe: Multiple vulnerabilities    Allows a remote attacker to steal a user”s NTLM hash included in an SMB request.   4) ESB-2019.0488.2 – UPDATE [Cisco] Cisco Systems: Root compromise – Existing account   This vulnerability requires user interaction or an existing account. However successful exploitation could allow the attacker to overwrite the host’s runc binary file with a malicious file, escape the container, and execute arbitrary commands with root privileges on the host system. Stay safe, stay patched and have a great weekend, Rameez Agnew

AUSCERT Week in Review for 15th February 2019 Greetings, This week in security, we enjoy the rare sight of sysadmins running to their terminals for Microsoft’s Patch Tuesday and Optus calling their customers “Vladimir” for valentines day. Here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: Title: Optus disables My Account site after users complain of privacy breachDate Published:  February 15, 2019 Author: Corinne Reichert Excerpt: “Optus has confirmed that its My Account website is back up and running after temporarily disabling access following complaints from users that they were seeing the wrong customer information after logging in. According to Optus, it disabled the site “as a precaution”.“Optus is aware some customers reported seeing incorrect information when activating their Prepaid service, and when logging into My Account to pay their bill yesterday,” an Optus spokesperson said on Friday. “The Optus My Account website is now operational, and Optus is working with our third-party vendors to identify the cause of yesterday’s issue.””—– Title: RunC Vulnerability Gives Attackers Root Access on Docker, Kubernetes HostsDate Published: February 11, 2019Author: Sergiu Gatlan Excerpt: “A container breakout security flaw found in the runc container runtime allows malicious containers (with minimal user interaction) to overwrite the host runc binary and gain root-level code execution on the host machine.runc is an open source command line utility designed to spawn and run containers and, at the moment, it is used as the default runtime for containers with Docker, containerd, Podman, and CRI-O.According to Aleksa Sarai, Senior Software Engineer (Containers) SUSE Linux GmbH, one of the runc maintainers:The level of user interaction is being able to run any command (it doesn’t matter if the command is not attacker-controlled) as root within a container in either of these contexts:Creating a new container using an attacker-controlled image.Attaching (docker exec) into an existing container which the attacker had previous write access to.”—– Title: Govt moves to extend encryption-busting powers to anti-corruption agenciesDate Published: Feb 13 2019Author: Justin Hendry Excerpt: “The federal government has revealed planned changes to Australia’s controversial encryption-busting legislation that will give anti-corruption bodies similar powers to other law enforcement agencies.Amendments to the Assistance and Access Act introduced to parliament on Wednesday afternoon propose extending the industry assistance powers to eight additional agencies, including state corruption watchdogs.The Australian Federal Police, Australian Crime Commission and state and territory police forces are the only law enforcement agencies afforded the powers as the Act currently stands.”—– Title: Email provider hack destroys nearly two decades’ worth of dataDate Published: Author: Abrar Al-Heeti Excerpt: “All US data from email provider VFEmail was destroyed by an unknown hacker, deleting nearly two decades’ worth of emails, VFEmail said Tuesday.The email provider, which was founded in 2001, scans each email for viruses and spam before they get to someone’s inbox. If a virus is found, it’s blocked from getting onto VFEmail’s servers.“Yes, @VFEmail is effectively gone,” VFEmail owner Rick Romero said on Twitter. “It will likely not return. I never thought anyone would care about my labor of love so much that they’d want to completely and thoroughly destroy it.””—– Title: It’s now 2019, and your Windows DHCP server can be pwned by a packet, IE and Edge by a webpage, and so onDate Published:  13 Feb 2019 Author: Shaun Nichols Excerpt: “Patch Tuesday Microsoft and Adobe have teamed up to give users and sysadmins plenty of work to do this week.The February edition of Patch Tuesday includes more than 70 CVE-listed vulnerabilities from each vendor – yes, each – as well as a critical security fix from Cisco. You should patch them as soon as it is possible. For Redmond, the February dump covers 77 CVE-listed bugs across Windows, Office, and Edge/IE.Among the most potentially serious was CVE-2019-0626, a remote code execution vulnerability in the Windows Server DHCP component.”—– Here are this week’s noteworthy security bulletins: 1) ASB-2019.0054 – [Win] Windows: Multiple vulnerabilities     Microsoft patches 32 vulnerabilities for windows desktop and windows server. 2) ASB-2019.0055 – [Win][UNIX/Linux] Mozilla Firefox and Firefox ESR: Multiple vulnerabilities      Mozilla patches 3 new vulnerabilities in Firefox/ESR.   3) ESB-2019.0436 – [Linux][Ubuntu] snapd: Root compromise – Existing account     A privilege escalation exploit in Linux, named dirty_sock.   4) ESB-2019.0438 – [Win][Linux][OSX] Adobe Flash Player: Access confidential data – Remote with user interaction     An Adobe Flash Player information disclosure vulnerability affecting Windows, Linux, OSX and Chrome OS. Stay safe, stay patched and have a great weekend, Rameez Agnew

AUSCERT Week in Review for 8th February 2019 Greetings, This week Apple patched the high-profile FaceTime vulnerability that made the news from last week, and a researcher goes public with a Mac OS key-chain vulnerability that allows a user access to its plaintext credentials without restriction. One in, one out for news-worthy Apple vulnerabilities. To dramatically cap off this week, the Australian Parliament was subject to a cyber attack, the extent of which is still being investigated. Here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: China link possible in cyber attack on Australian Parliament computer system, ABC understands08 February 2019Author: Stephanie Borys Excerpt: “Australia’s security agencies are investigating a cyber breach of the Federal Parliament’s computer network that the ABC understands is likely the result of a foreign government attack. The agencies are looking into whether China is behind the incident. In a statement, Federal Parliament’s presiding officers said authorities were yet to detect any evidence data had been stolen in the breach.” —— Apple puts bullet through ‘Do Not Track’, FaceTime snooping bug and iOS vulnerabilities07 February 2019Author: Thomas Claburn Excerpt: “Today, Apple also emitted security fixes for iOS 12.1.4. This fixes the FaceTime eavesdropping bug (CVE-2019-6223) found by 14-year-old Grant Thompson of Catalina Foothills High School and Daven Morris of Arlington, Texas. We understand the teen and his family will get some compensation from Apple, which will also pay toward his education. The OS update also fixes two elevation-of-privilege holes (CVE-2019-7286 in Foundation, CVE-2019-7286 in IOKit), and a vague problem with Live Photos in FaceTime (CVE-2019-7288). Meanwhile, FaceTime has been fixed in macOS, too.” —— Researcher reveals huge Mac password flaw to protest Apple bug bounty06 February 2019Author: Jeremy Horwitz Excerpt: “Apple’s operating systems have recently had more than their fair share of serious security issues, and the latest problem will be enough to rattle millions of Mac users. Previously credible researcher Linuz Henze has revealed an exploit that in one button press can reveal the passwords in a Mac’s keychain. Keychain is where macOS stores most of the passwords used on the machine, ranging from iMessage private encryption keys to certificates, secured notes, Wi-Fi, and other Apple hardware passwords, app passwords, and web passwords. A pre-installed app called Keychain Access enables users to view the entire list of stored items, unlocking each one individually by repeatedly entering the system password, but Henze’s KeySteal exploit grabs everything with a single press of a “Show me your secrets” button.” —— Here are this week’s noteworthy security bulletins: 1) ESB-2019.0388 – [Apple iOS] iOS: Multiple vulnerabilities Apple has released its patch for the FaceTime group chat, alongside two elevation of privilege vulnerabilities. 2) ASB-2019.0046 – [Android] Android: Multiple vulnerabilities Android’s February update is out, with all the usual suspects getting fixes (RCE, EoP, DoS). 3) ESB-2019.0305 – [Win][UNIX/Linux][Debian] libreoffice: Execute arbitrary code/commands – Remote with user interaction Libreoffice documents would happily execute any Python script (and arguments!) in a document-supplied directory. Stay safe, stay patched and have a good weekend! Tim

AUSCERT Week in Review for 1st February 2019 Greetings, This week featured some very high-profile vulnerabilities, tech companies abusing each others’ trust, and a great upheaval in name-resolution – leaving unorthodox DNS servers out in the cold. A pass-the-hash vulnerability in Exchange was made public, which allows any user with a mailbox to elevate themselves to the Exchange user, which unsurprisingly, often runs with Domain Admin privileges. Microsoft have not released a patch, but mitigations are available. Apple was forced to suspend group chat functionality in FaceTime, after a teenager discovered its espionage potential. Calling a contact via FaceTime, and then adding yourself as an additional contact to the group would hot-mic the unsuspecting victim, before they had answered the call. Rather than let this capability fall into the hands of pranksters and nation states, Apple wisely disabled the function until a patch is ready. Apple was also forced to suspend Facebook and Google’s enterprise certificates, causing chaos internally as non-public applications (and development versions of their public app suites) would now refuse to run on iOS. This was a result of the companies using the intra-company certificate to bypass Apple’s privacy requirements on the app store, having created data-harvesting apps that lured users in with the promise of gift-cards. Apple has since worked to reinstate certificates for the companies, presumably satisfied that it had made its point. (On or around) February 1st is DNS Flag Day, and authoritative DNS servers that stray from the RFCs and fail to implement the EDNS extension will find themselves receiving the cold-shoulder from upstream servers. If you run such a non-compliant server after Flag Day, then your services had better have memorable IP addresses. Here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: Cyber Alert: DNS Flag DayJanuary 30 2019Author: Center for Internet SecurityExcerpt: “On Friday, February 1, 2019, major Domain Name Systems (DNS) software and service providers will remove DNS workarounds that allow users to bypass the Extension Mechanisms Protocol for DNS (EDNS). EDNS is a set of extension mechanisms to expand the size of the DNS message as it goes through its query, which allows more information to be included in the communication between each host in the DNS resolution process. On Friday, several DNS resolver operators, including PowerDNS, Internet System Consortium, and Google, will release updates that implement stricter EDNS handling. This update will speed up the DNS process by forcing everyone to implement the EDNS protocol. Furthermore, the update will simplify the deployment of new features in the future. Consequently, if the update is not implemented on DNS servers, there will be no DNS response to any recursive servers’ request.” —— Severe vulnerability in Apple FaceTime found by Fortnite playerJanuary 30 2019Author: Charlie OsborneExcerpt: “Before the so-called Apple “Facepalm” bug hit the headlines, the mother of a 14-year-old boy from Arizona had been trying to warn the tech giant about the vulnerability for over a week. A FaceTime call made on 19 January by Michele Thompson’s son, as reported by sister site CNET, began the chain of events. The teenager added a friend to the group conversation and despite the fact that the friend had not yet picked up the phone, he was able to listen in to conversations taking place in the iPhone’s environment.” —— Furious Apple revokes Facebook’s enty app cert after Zuck’s crew abused it to slurp private dataJanuary 30 2019Author: Kieren McCarthyExcerpt: “The enterprise cert allows Facebook to sign iOS applications so they can be installed for internal use only, without having to go through the official App Store. It’s useful for intranet applications and in-house software development work. Facebook, though, used the certificate to sign a market research iPhone application that folks could install it on their devices. The app was previously kicked out of the official App Store for breaking Apple’s rules on privacy: Facebook had to use the cert to skirt Cupertino’s ban.” —— Microsoft Exchange vulnerable to ‘PrivExchange’ zero-dayJanuary 29 2019Author: Catalin CimpanuExcerpt: “Microsoft Exchange 2013 and newer are vulnerable to a zero-day named “PrivExchange” that allows a remote attacker with just the credentials of a single lowly Exchange mailbox user to gain Domain Controller admin privileges with the help of a simple Python tool. … According to the researcher, the zero-day isn’t one single flaw, but a combination of three (default) settings and mechanisms that an attacker can abuse to escalate his access from a hacked email account to the admin of the company’s internal domain controller (a server that handles security authentication requests within a Windows domain).” —— Here are this week’s noteworthy security bulletins: 1) ESB-2019.0285 – ALERT [Win] Microsoft Exchange Server: Increased privileges – Existing account Exchange pass-the-hash vulnerability, often leading to Domain Admin. 2) ASB-2019.0042 – [Win][UNIX/Linux] Mozilla Firefox: Multiple vulnerabilities Your usual suite of vulnerabilities for a browser update – RCE, DoS, increased privileges etc. 3) ASB-2019.0044 – [Win][UNIX/Linux] Google Chrome: Multiple vulnerabilities Not to be outdone, Chrome has also fixed your usual culprits in its latest release. Stay safe, stay patched and have a good weekend! Tim

Password Reuse and Data Breaches Everyone knows the story of registering for a website we only ever intend to use once, where we lazily re-used a password. Fast forward 15 years later, you find out that website’s password database was storing everything in plain text, someone bad got a hold of it and you never knew. It’s a surprisingly common story and there is a stigma of shame around talking about personal password hygiene. One thing we can all do is tell the people we are close to that it’s never too late to start improving, recommended password managers and good multi-factor solutions to get the ball rolling for them.  Password reuse is hard to get out in the open as it is a very private issue. Luckily, there is now a solution. Troy Hunt has teamed up with Cloudflare to provide a free API that allows passwords to be checked against known passwords that have been seen in reported breaches. Steer people in the direction of Troy Hunt’s Have I Been Pwned website and it may give them the wake up call they need, when a big scary red box flashes up on the screen letting them know that their data may not be safe.   What can we do then on an organisational level? The personal touch of reaching out to people directly doesn’t scale well and can often come across as intimidating when coming from “the security team”. The experience of setting a password is a very private one and the strong password guidelines need to make their way into this personal experience. We have been asking users to set things like reasonable password lengths and complexities through web frameworks for a long time now. The instant responsiveness of this has been training everyone that password length and complexity matter, but what about reuse? Troy teamed up with Cloudflare to deliver a free API endpoint to check if a password has shown up in reported data breaches last year. What this means for organisations is that on your password reset page or even login page you can query this API endpoint every time you type in a password so see if it has shown up in a breach before.   Doesn’t that mean Troy now has my new password? Nope! The API has been designed so that only the prefix of the hash of your password is sent to the API endpoint and you get back all hashes that match that prefix, you then check to see if your hash matches any of the returned results. Hashes are designed for obfuscation so sending through the first five characters of your hash doesn’t reveal your password. Passwords that will have the same first five characters will have no relevance to one another. For example the first five characters in the hash for “alexguo029” is “21bd1”, while the first five characters in the hash for “lauragpe” is also “21bd1”. Therefore if an attacker was able to capture the data sent to the API they will not be able to gather any sensitive information. Read more about the technical details in Troy’s blog.   Can I easily implement it on my infrastructure? Yes! We can query this API in client-side code without ripping apart any of our current systems. Client-side code works for this as it’s more of a user education exercise than another security layer. Check out some implementations on GitHub like passprotect-js to see just how easy it is. There is a great demo video and example code showing how the prefix of the password hash is generated and sent to the API and instantly gives the user feedback showing the tangible evidence that the password is not safe to use.  This is an easy win and with the recent password collection dumps it is more valuable then it has ever been. Run it in a development environment today as a proof of concept. To lead by example this is a demo I ran up on the AUSCERT website just this morning using passprotect-js.     What do I do about the latest breach? We can’t eliminate password reuse for our user-base. Password rotation policies feel like a natural solution to this however NIST warns of aggressive password rotation lowers the overall password strength due to user fatigue. Check out if your organisation shows up in a breach. Hopefully the passwords are not reused but you should still encourage resets where possible especially for users which could be high value targets.   Use MFA! Human brains will never be great at password based authentication, that is why we need to supplement it with another factor. This takes the urgency out of password breaches with respect to password reuse in your organisation because of the second line of defence. We use one time password based MFA on the AUSCERT website and hope to extend it to our other services in the future.