Week in review

AUSCERT Week in Review for 22nd June 2018

AUSCERT Week in Review for 22nd June 2018 AUSCERT Week in Review22 June 2018 Greetings, As Friday 22nd June comes to a close, I’d like to bring your attention to an old read from 1996, but a good read titled “Smashing The Stack For Fun And Profit” [1].  Why bring to light this 1996 classic? Well, because it highlights that it is hard to wipe out a class of vulnerability.  Even, 22 years on, and a whole lot of smart people at the problem, with today’s automatic code checking, and secure coding frameworks, classes of vulnerabilities still get through to production.  Also, the time between a fix being available and news of it can be weeks. For example, Firefox was out with a release on the 6th June with [mfsa2018-14] and it seem to only make general news this week on Monday 18th June.  Surely nothing bad could really happen in a couple of weeks.Yes, incidents will happen and a function in an organisation that has its fingers on the pulse of these incidents, that can analyse the depth of the impact can be a worthwhile investment in cyber security.Incidents could be just a wake-up call, with port 8000 being suddenly and unusually requested “en masse”.  Could that function be able to find the relationship of those port requests with the “XiongMai uc-httpd 1.0.0 Buffer Overflow Exploit” and then check if it reached any exposed IoT in the organisation, with the vulnerable code.Sounds simple but the difficulty is in the detail. Just drop the words “Vulnerability Management” around the work place and look for the reaction.  Perhaps, you only need to fine tune your VM SOPs by adding a task of digesting some industry news and perhaps some advisories of the week.  Enjoy.   Here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: ——- Title:  Google Developer Discovers a Critical Bug in Modern Web BrowsersURL:  https://thehackernews.com/2018/06/browser-cross-origin-vulnerability.htmlDate:  20th June 2018 Author: Mohit Kumar Excerpt:“Discovered by Jake Archibald, developer advocate for Google Chrome, the vulnerability resides in the way browsers handle cross-origin requests to video and audio files, which if exploited, could allow remote attackers to even read the content of your Gmail or private Facebook messages.” ——- Title:  Botnets never Die, Satori REFUSES to Fade AwayURL:    http://blog.netlab.360.com/botnets-never-die-satori-refuses-to-fade-away-en/Date:   15th June 2018Author: NetLab Excerpt:“Two days ago, on 2018-06-14, we noticed that an updated Satori botnet began to perform network wide scan looking for uc-httpd 1.0.0 devices. Most likely for the vulnerability of XiongMai uc-httpd 1.0.0 “ ——- Title:  Apple macOS Bug Reveals Cache of Sensitive Data from Encrypted DrivesURL:    https://thehackernews.com/2018/06/apple-macos-quicklook.htmlDate:   18th June 2018Author: Swati Khandelwal Excerpt:“Security researchers are warning of almost a decade old issue with one of the Apple’s macOS feature which was designed for users’ convenience but is potentially exposing the contents of files stored on password-protected encrypted drives.” ——- Title:  SamSam ransomware: controlled distribution for an elusive malware URL:    https://blog.malwarebytes.com/threat-analysis/2018/06/samsam-ransomware-controlled-distribution/Date:   19th June 2018Author: Malwarebytes Labs Excerpt:“SamSam ransomware has been involved in some high profile attacks recently, and remains a somewhat elusive malware. In its time being active, SamSam has gone through a slight evolution, adding more features and alterations into the mix. These changes do not necessarily make the ransomware more dangerous, but they are added to make it just a bit more tricky to detect or track as it is constantly changing.” ——- Title:  All That Port 8000 Traffic This Week! Yeah, That’s Satori Looking for New BotsURL:    https://www.bleepingcomputer.com/news/security/all-that-port-8000-traffic-this-week-yeah-thats-satori-looking-for-new-bots/Date:   15th June 2018Author: Catalin Cimpanu Excerpt:“The PoC code was for a buffer overflow vulnerability (CVE-2018-10088) in XionMai uc-httpd 1.0.0, a lightweight web server package often found embedded inside the firmware of routers and IoT equipment sold by some Chinese vendors.The exploit allows an attacker to send a malformed package via ports 80 or 8000 and execute code on the device, effectively taking it over.” ——- Title:  Firefox fixes critical buffer overflowURL:    https://nakedsecurity.sophos.com/2018/06/18/firefox-fixes-critical-buffer-overflow/Date:   18th June 2018Author: Maria Varmazis Excerpt:“Earlier this month Mozilla announced a security advisory (MFSA2018-14) for its Firefox browser, noting that version 60.0.2 of both Firefox and Firefox Extended Support Release (ESR) as well as the legacy ESR (ESR 52.8.1) now have a fix for a critical-level buffer overflow vulnerability.” ——- Title:  Google’s Newest Feature: Find My HomeURL:    https://www.tripwire.com/state-of-security/vert/googles-newest-feature-find-my-home/#.WyfDEMLoy-g.twitterDate:   18th June 2018Author: Craig Young Excerpt:“Despite all of these efforts to thwart unwanted online tracking, it turns out that our connected gadgets may not only uniquely identify us but, in some cases, they can reveal precise physical locations. In this blog post, I will reveal a new attack against Google Home and Chromecast devices that does exactly that.” ——- Here are this week’s noteworthy security bulletins (in no particular order): 1.    ESB-2018.1810 – ALERT [Cisco] Cisco NX-OS: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/64198CVE-2018-0313 A successful exploit could allow the attacker to execute arbitrary commands with root privileges. 2.    ESB-2018.1809 – ALERT [Cisco] Cisco FXOS and Cisco NX-OS: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/64194CVE-2018-0304 …which could allow the attacker to read sensitive memory content, create a DoS condition, or execute arbitrary code as root. 3.    ESB-2018.1836 – [Win][Linux][IBM i][HP-UX][Solaris][AIX] IBM WebSphere Application Server: Multiple vulnerabilities    https://portal.auscert.org.au/bulletins/64302CVE-2014-0114 …to manipulate the ClassLoader and execute arbitrary code on the system. 4.    ESB-2018.1834 – [Win][UNIX/Linux] phpMyAdmin: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/64294CVE-2018-12581 …attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin. 5.    ESB-2018.1829 – [Win] Delta Industrial Automation COMMGR: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/64274CVE-2018-10594 This may allow remote code execution, cause the application to crash, or result in a denial-of-service condition in the application server. Wishing you the best from AUSCERT and hope to see you safe next week,Geoffroy P.S. Just as an exercise, of the bulletins AUSCERT processed this week, it may be instructive to count how many of them hints at the 1996 technique.

Learn more

Blogs

Malicious emails via WeTransfer

Malicious emails via WeTransfer AUSCERT has seen direct evidence of malicious emails being sent via WeTransfer, as part of an ongoing campaign affecting Australian organisations. We have summarised our findings and provided advice, which can be found at the end of this post. WeTransfer is a legitimate file-hosting service with a simple business model: users can upload a file, enter a recipient email address, and enter a sender email address. The uploaded file will be sent to the recipient with an explanatory email template, and the sender will also receive an email receipt. However, WeTransfer perform minimal validation on email addresses provided by users, which is a major security hole. By default, users may enter any sender address. The WeTransfer FAQ makes it clear that they allow address spoofing on purpose: “Our ease of use is a core value, that’s why we allow our users to enter any email address they want. This sometimes has the effect you are experiencing, where someone else uses your email address. Most likely even by mistake!” An attacker can enter something like the following: This will send a legitimate-looking file transfer email to both parties, using WeTransfer’s branding and legitimate email headers.     This means that WeTransfer is allowing targeted phishing and malspam emails to be delivered, based on the strength of their own brand. This vulnerability, and others, have been known for months.    When AUSCERT contacted WeTransfer to report this security hole, we received a response, the gist of which was: They’ve blocked the sender and their IP address. They’ve removed the malicious file, so nobody can download it. They consider this kind of abuse a “very rare effect”. They have a “new email verification feature”. Fill out a form and they’ll send a verification token to your email address every time it is used as a sender. They can block a specific email address so it cannot be used to send spam.   This is inadequate, for the following reasons: Verification of the sender should be default, not opt-in. IP address blacklists provide minimal security. It is not the responsibility of an organisation or individual to disallow third-party services from spoofing them.   AUSCERT recommends: All emails sent from WeTransfer should be treated as suspicious. Until mail blacklists begin to block WeTransfer’s emails automatically, flag suspicious emails as junk. Mail administrators should consider looking for recent WeTransfer emails and following up with users. Malicious emails are sent from noreply@wetransfer.com.

Learn more

Week in review

AUSCERT Week in Review for 15th June 2018

AUSCERT Week in Review for 15th June 2018 Greetings, This week demonstrated AI’s potential to assist humanity, as it came out from this month’s Microsoft Patch Tuesday that Cortana would helpfully execute code for you even when the system was locked. All that was required was for the executable to have been indexed, and Cortana was more than happy to run it for you with elevated privileges. The 3rd wave of speculative execution side-channels is upon us, dubbed “LazyFP”, but luckily is not quite as ubiquitous as its predecessors. Patches for some distributions have been released, so please make sure you’re up to date if a fix is available. The EU has passed a motion that would see it phasing out the use of the AV vendor Kaspersky’s products in its institutions. They join the list of governing bodies worried about the company’s susceptibility to Russian influence. For its part, Kaspersky have been an active contributor to several anti-cyber crime initiatives, and have been a frequent collaborator with Interpol. The company has suspended any further collaboration in response. Here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: Meltdown-Like ‘LazyFP’ Vulnerability Impacts Intel CPUsPublished: 14 Jun 2018https://www.securityweek.com/meltdown-lazyfp-vulnerability-impacts-intel-cpus Author: Eduard KovacsExcerpt: “Intel and software vendors have started informing users about a new vulnerability involving side channel speculative execution that could be exploited by malicious actors to obtain sensitive information from the targeted system. Dubbed LazyFP, the security hole is related to the floating point unit (FPU), also known as the math coprocessor. The FPU is used by the operating system when switching between processes – it saves the state of the current process and restores the state of the new process.” —— Locked Win10 PCs can leak sensitive data via CortanaPublished: 14 Jun 2018https://www.itnews.com.au/news/locked-win10-pcs-can-leak-sensitive-data-via-cortana-493692 Author: Juha SaarinenExcerpt: “Researchers from security vendor McAfee have demonstrated a way to use Microsoft’s personal digital assistant Cortana as an attack vector to get into locked Windows 10 PCs.” —— Citation needed: Europe claims Kaspersky wares ‘confirmed as malicious’Published: 13 Jun 2018https://www.theregister.co.uk/2018/06/13/eu_kaspersky_cyber_defence_motion/ Author: Richard SpeedExcerpt: “The wide-ranging non-binding motion is primarily concerned with cyber defence, stating that “the EU and the Member States face an unprecedented threat in the form of politically motivated, state-sponsored cyber attacks”.” —— Here are this week’s noteworthy security bulletins: 1) ESB-2018.1770 – [Linux][RedHat] kernel: Access privileged data – Existing accounthttps://portal.auscert.org.au/bulletins/64030 Red Hat has released patches for the new LazyFP side-channel vulnerability. 2) ESB-2018.1756 – [Win][UNIX/Linux] BIND: Denial of service – Remote/unauthenticatedhttps://portal.auscert.org.au/bulletins/63966 A regression in how BIND handles its configuration could allow recursive queries where they should be denied. This would allow the server to be used for reflective DoS attacks. 3) ESB-2018.1758 – [Win][UNIX/Linux] OpenSSL: Denial of service – Remote with user interactionhttps://portal.auscert.org.au/bulletins/63974 During handshake negotiation, a malicious server could send a large prime to the client, which would leave it scratching its head trying to generate a key and cause a DoS. 4) ESB-2018.1739 – [Win][UNIX/Linux][Debian] perl: Modify arbitrary files – Remote with user interactionhttps://portal.auscert.org.au/bulletins/63874 The Tar archiving module in perl would happily traverse the filesystem as it pleased while extracting, allowing archives to contain such files as ../etc/passwd ../../etc/passwd etc. Stay safe, stay patched and have a good weekend! Tim

Learn more

Week in review

AUSCERT Week in Review for 8th June 2018

AUSCERT Week in Review for 8th June 2018 Greetings, AUSCERT is back to business as usual after the conference, and so is the security ecosystem. This week delivered the usual suspects in vulnerability reporting – a Flash 0day, updates for both Firefox and Chrome, an Android update, and a slew of Cisco updates. PageUp (a HR SaaS provider) has reported a breach of its systems, likely the largest in scope reported under the new mandatory breach notification laws. The company has as clients various Australian government departments, large Australian businesses across multiple sectors, and parts of the education sector. Clients such as Wesfarmers (Coles, Target, Kmart, amongst others), the Australian Red Cross, and Medibank have made statements that they have suspended access to the service pending further updates and assurances. Since the system is customisable, the data potentially exposed may vary by client. Australia Post has stated that it requested TFNs, bank and superannuation details, and driver licence numbers from successful candidates via the service. Though passwords were salted and hashed, users are recommended to change their passwords. No matter how heat-death-of-the-universe-scale your hashing algorithm’s time complexity is, it’s no match for “Password123”. Here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: Malware hits HR software firm PageUp with possible data compromisehttps://www.zdnet.com/article/malware-hits-hr-software-firm-pageup-with-possible-data-compromise/ Author: Asha McLeanExcerpt: “Australia-based human resources firm PageUp has confirmed it found “unusual” activity on its IT infrastructure last month, which has resulted in the potential compromise of client data.” —— ATO becomes ASD Top 4 complianthttps://www.itnews.com.au/news/ato-becomes-asd-top-4-compliant-492588 Author: Justin HendryExcerpt: “The department reached full compliance with the Australian Signal’s Directorate’s (ASD) ‘top four strategies to mitigate cyber security incidents’ in November last year, after failing a cyber resilience audit only months earlier.” —— Aussie cyber security spend surged last yearhttps://www.arnnet.com.au/article/641899/aussie-security-spend-surged-last-year/ Author: Samira SarrafExcerpt: “A new report by Australia’s Cyber Emergency Response Team (AUSCERT) showed that 58 per cent of organisations in Australia and New Zealand surveyed increased their security spend in 2017 – with respondents’ figures representing a 35 per cent year-on-year increase in security investment.” —— Adobe Patches Zero-Day Flash Flawhttps://krebsonsecurity.com/tag/cve-2018-5002/ Author: Brian KrebsExcerpt: “Adobe has released an emergency update to address a critical security hole in its Flash Player browser plugin that is being actively exploited to deploy malicious software. If you’ve got Flash installed – and if you’re using Google Chrome or a recent version of Microsoft Windows you do – it’s time once again to make sure your copy of Flash is either patched, hobbled or removed.” —— Here are this week’s noteworthy security bulletins: 1) ESB-2018.1706 – ALERT [Win][Linux][Mac] Adobe Flash Player: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/63742 Another week, another Flash 0day. 2) ASB-2018.0126 – [Win][UNIX/Linux] Google Chrome: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/63714 Google has patched an issue in Chrome where the CSP header was handled incorrectly. No technical details yet, but always keep your browser up to date. 3) ESB-2018.1664 – [Debian] Debian 7: Reduced security – Unknown/unspecifiedhttps://portal.auscert.org.au/bulletins/63558 It had a good run, but Debian 7 has reached End of Life. Jessie and Stretch are eagerly awaiting your upgrade. 4) ESB-2018.1702 – [Cisco] Multiple Cisco Products: Denial of service – Remote/unauthenticatedhttps://portal.auscert.org.au/bulletins/63722 Turns out more than a few Cisco products have unbounded log file sizes which can be exploited to DoS the products by consuming all available disk space. Stay safe, stay patched and have a good weekend! Tim

Learn more

Week in review

AUSCERT Week in Review for 1st June 2018

AUSCERT Week in Review for 1st June 2018 Greetings, This slightly belated Week in Review comes on the heels of a big week in the form of the AUSCERT2018 conference! It was that time once again for us to all come together and put names to faces, see some great talks, and hopefully learn some new skills. Big thank-you to everyone who was able to come and join us, but worry not for those who couldn’t, because planning for AUSCERT2019 has already begun! Just remember not to connect to any unsecured WiFi. Here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: AUSCERT and the Award for Information Security ExcellenceDate Published: 01 June 2018https://www.troyhunt.com/auscert-and-the-award-for-information-security-excellence/Author: Troy HuntExcerpt: “Yes, that guy is wearing a cape, it was a Star Wars thing.” —– AUSCERT 2018 – AwardsDate Published: 01 June 2018https://www.cso.com.au/article/641857/auscert-2018-awards/Author: Anthony CaruanaExcerpt: “AUSCERT’s annual awards, sponsored by the SANS Institute, night kicked off in spectacular fashion with fire-breathing commedian/musician Brian Brushwood carrying out his own version of a penetration test when he hammered a nail into his head through is nasal cavity.” —– Python May Let Security Tools See What Operations the Runtime Is PerformingDate Published: 28 May 2018https://www.bleepingcomputer.com/news/security/python-may-let-security-tools-see-what-operations-the-runtime-is-performing/Author: Catalin CimpanuExcerpt: “A new feature proposal for the Python programming language wants to add “transparency” to the runtime and let security and auditing tools view when Python may be running potentially dangerous operations.” —– Ghostery Tries to Comply With GDPR, but Ends Up Violating GDPR in the ProcessDate Published: 28 May 2018https://www.bleepingcomputer.com/news/technology/ghostery-tries-to-comply-with-gdpr-but-ends-up-violating-gdpr-in-the-process/Author: Catalin CimpanuExcerpt: “The company behind Ghostery, a privacy-focused browser and an ad-blocking browser extension, has apologized for a technical error that occurred last Friday when its staff was sending out GDPR-themed notification emails.” —– Here are this week’s noteworthy security bulletins: 1) ASB-2018.0123 – ASB-2018.0123 – [Win][Linux][Mac] Google Chrome: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/63394 Another release of Chrome patches the usual culprits – RCE, XSS, DoS. 2) ESB-2018.1647 – [Linux][RedHat] xmlrpc3: Execute arbitrary code/commands – Remote/unauthenticatedhttps://portal.auscert.org.au/bulletins/63490 Deserialisation leading to RCE. 3) ESB-2018.1626 – [Ubuntu] apport: Root compromise – Existing accounthttps://portal.auscert.org.au/bulletins/63406 Ubuntu’s crash reporting utility could lead to privilege escalation if expectedfiles were missing from /proc Code poorly and you might end up as root! 4) ESB-2018.1625 – [RedHat] Red Hat Enterprise Linux 7.3https://portal.auscert.org.au/bulletins/63402 RHEL 7.3 Extended Update Support is rapidly approaching end of life, and supportwill cease November 30, 2018. 5) ESB-2018.1619 – [Linux] VMware Horizon Client: Root compromise – Existing account SUID strikes again, in the form of a root compromise for Linux hosts with theVMWare Horizon Client installed. Stay safe, stay patched and have a good weekend! Tim

Learn more

Week in review

AUSCERT Week in Review for 25th May 2018

AUSCERT Week in Review for 25th May 2018 AUSCERT Week in Review25 May 2018 Greetings, Happy GDPR compliance deadline day!  I’m sure you’ve been receiving many privacy policy update emails this week.  Also this week we saw CVE-2018-3639 and CVE-2018-3640 announced, aka Spectre and Meltdown variants 3A and 4.  While they are hardware-level vulnerabilities which affect various processors from AMD, ARM, IBM POWER8, and  POWER9, and Intel, it’s still important to apply the latest microcode updates and software patches. With Microsoft’s $250,000 bounty, and more researchers looking at speculative execution vulnerabilities, it will be interesting to see how many more are discovered this year. AUSCERT has generated a new PGP/GPG Key to use for signing and receiving encrypted data, and this key comes into effect today. For more details: https://wordpress-admin.auscert.org.au/render.html?it=1967 Here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: Alert (TA18-141A) Side-Channel Vulnerability Variants 3a and 4Date Published: 21 May 2018https://www.us-cert.gov/ncas/alerts/TA18-141AAuthor: US-CERTExcerpt: “On May 21, 2018, new variants of the side-channel central processing unit (CPU) hardware vulnerabilities known as Spectre and Meltdown were publicly disclosed. These variants–known as 3A and 4–can allow an attacker to obtain access to sensitive information on affected systems.” —– Server? What server? Site forgotten for 12 years attracts hacks, finesDate Published:  22 May 2018https://nakedsecurity.sophos.com/2018/05/22/server-what-server-site-forgotten-for-12-years-attracts-hacks-fines/Author: John E DunnExcerpt: “A web server set up by an enterprising student for a conference in 2004 and then forgotten about has left the University of Greenwich nursing a ?120,000 ($160,000) fine from Britain’s Information Commissioner (ICO).” —– Here’s Amazon’s explanation for the Alexa eavesdropping scandalDate Published:  24 May 2018https://www.recode.net/2018/5/24/17391480/amazon-alexa-woman-secret-recording-echo-explanationAuthor: Jason Del ReyExcerpt:  “Asked for more details, Amazon provided Recode with the following explanation: “Echo woke up due to a word in background conversation sounding like “Alexa.” Then, the subsequent conversation was heard as a “send message” request. At which point, Alexa said out loud “To whom?” At which point, the background conversation was interpreted as a name in the customers contact list. Alexa then asked out loud, “[contact name], right?” Alexa then interpreted background conversation as “right”. As unlikely as this string of events is, we are evaluating options to make this case even less likely.” —– Chrome to remove ‘secure’ and padlock icon for HTTPSDate Published: 18 May 2018https://www.itnews.com.au/news/chrome-to-remove-secure-and-padlock-icon-for-https-491217Author: Juha SaarinenExcerpt: “Google will treat Transport Layer Security encrypted pages as the default soon with no indications shown, and call out unencoded HTTP web content as unsafe.” —– ASADA latest to access smartphone-hacking tool raising fresh privacy concernsDate Published: 23 May 2018http://www.abc.net.au/news/science/2018-05-23/asada-access-cellebrite-smartphone-hacking-technology/9786106Author: Ariel BogleExcerpt: “Critics flagged concerns about potential misuse of the technology, after Fairfax Media reported in 2017 that Centrelink, the Australian Taxation Office and the Australian Securities and Investment Commission have also deployed it. The use of such tools typically requires a warrant.” —– Here are this week’s noteworthy security bulletins: 1) ASB-2018.0122 – [Win][UNIX/Linux] Joomla!: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/63206 An XSS vulnerability has been identified in Joomla! in versions prior through 3.8.7 2) ASB-2018.0121 – ALERT [Win][UNIX/Linux][Virtual][Mobile] CPU Microcode: Access privileged data – Existing accounthttps://portal.auscert.org.au/bulletins/63066 Two new speculative execution side-channel vulnerabilities announced. 3) ESB-2018.1547 – [Win][UNIX/Linux] Zookeeper: Provide misleading information – Remote/unauthenticatedhttps://portal.auscert.org.au/bulletins/63082 No authentication/authorization is enforced when a server attempts to join a quorum. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader. 4) ESB-2018.1543 – [Debian] Debian 8: Deprecationhttps://portal.auscert.org.au/bulletins/63062 This is an advance notice that regular security support for Debian GNU/Linux 8 (code name “jessie”) will be terminated on the 17th of June. 5) ASB-2018.0119 – [Win][UNIX/Linux] Mozilla Thunderbird: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/63034 Multiple security vulnerabilities have been identified in Mozilla Thunderbird prior to version 52.8. Stay safe, stay patched and have a good weekend! Charelle

Learn more

Week in review

AUSCERT Week in Review for 18th May 2018

AUSCERT Week in Review for 18th May 2018 Greetings, We’ve seen a spate of bulletins this week following Twitter’s revelation that they were accidentally logging some passwords in clear-text, indicating that some products have also exposed sensitive data. NSW Family Planning has suffered a ransomware attack, leading to concerns that personal data may have been exposed. In other news, the AUSCERT 2018 conference is almost upon us!We look forward to seeing some of you there from Tuesday the 29th of May. In the news this week: ——————————————————————————– Family Planning NSW ransomware attack sees personal information of 8000 people at risk URL: https://www.healthcareit.com.au/article/family-planning-nsw-ransomware-attack-sees-personal-information-8000-people-risk-0 Author: Lynne Minion Excerpt: A ransomware attack on Family Planning NSW two weeks ago has potentially exposed the personal information of up to 8000 people, including women who sought information on abortions and contraception, but the reproductive and sexual health organisation claims medical records were never under threat. … In the attack on ANZAC Day, the hackers demanded a $15,000 ransom be paid in bitcoin. ——————————————————————————– Shadowy Hackers Accidentally Reveal Two Zero-Days to Security Researchers Date published: 15-05-2018 URL: https://www.bleepingcomputer.com/news/security/shadowy-hackers-accidentally-reveal-two-zero-days-to-security-researchers/ Author: Catalin Cimpanu Excerpt: An unidentified hacker group appears to have accidentally exposed two fully-working zero-days when they’ve uploaded a weaponized PDF file to a public malware scanning engine. The zero-days were spotted by security researchers from Slovak antivirus vendor ESET, who reported the issues to Adobe and Microsoft, which in turn, had them patched within two months. [These vulnerabilities have been patched in the last week.] ——————————————————————————– ‘Efail’ vulnerability lies in apps, not PGP and GnuPG Date published: 15-05-2018 Author: Juha Saarinen URL: https://www.itnews.com.au/news/efail-vulnerability-lies-in-apps-not-pgp-and-gnupg-490961 Excerpt: A security scare said to affect the popular Pretty Good Privacy (PGP) and Gnu Privacy Guard (GnuPG) protocols used to encrypt email messages is in fact caused by bugs in older mail apps. The issue arose after researchers from three German universities claimed to have devised an attack the called Efail, which they said would allow the decryption of current and past emails scrambled with PGP or GnuPG and exfiltration of the decoded content. But maintainers of the open source GnuPG set of encryption tools quickly issued a statement on Efail, pointing out that the issue affects older email applications and not the protocol itself. ——————————————————————————– WordPress releases GDPR features URL: https://wordpress.org/news/2018/05/wordpress-4-9-6-privacy-and-maintenance-release/ Author: Allen Snook Excerpt: It’s important to understand that while the GDPR is a European regulation, its requirements apply to all sites and online businesses that collect, store, and process personal data about EU residents no matter where the business is located. … We’re committed to supporting site owners around the world in their work to comply with this important law. As part of that effort, we’ve added a number of new privacy features in this release. ——————————————————————————– And lastly, here are this week’s most noteworthy security bulletins: ESB-2018.1526 – [RedHat] sensu: Access privileged data – Existing account https://portal.auscert.org.au/bulletins/62978 Sensitive data, including passwords, was logged in clear-text. ——————————————————————————– ESB-2018.1468 – [Win][UNIX/Linux] IBM MQ Managed File Transfer: Access privileged data – Existing account https://portal.auscert.org.au/bulletins/62738 Passwords were logged in clear-text. ——————————————————————————– ESB-2018.1489 – [RedHat] ovirt-ansible-roles: Access privileged data – Existing account https://portal.auscert.org.au/bulletins/62822 Passwords were logged in clear-text. ——————————————————————————– ESB-2018.1506 – [Win][Mac] Adobe Acrobat & Reader: Multiple vulnerabilities https://portal.auscert.org.au/bulletins/62898 Multiple vulnerabilities when handling malicious PDF files could lead to execution of arbitrary code or data leakage. ——————————————————————————– ASB-2018.0106.2 – UPDATE [Win][Mac] Microsoft Office products: Multiple vulnerabilities https://portal.auscert.org.au/bulletins/62450 Multiple vulnerabilities in Microsoft Office when handling malicious files could lead to execution of arbitrary code. ——————————————————————————– ESB-2018.1419 – [Win][Linux][Mac] Adobe Flash Player: Execute arbitrary code/commands – Remote with user interaction https://portal.auscert.org.au/bulletins/62514 Flash also executes arbitrary code. ——————————————————————————– Stay safe, stay patched and have a great weekend.David

Learn more

Week in review

AUSCERT Week in Review for 11th May 2018

AUSCERT Week in Review for 11th May 2018 Greetings, Another week, another drink from the firehose of information security. Microsoft’s patch Tuesday was largely uneventful, but Chrome, Firefox and Safari have all received significant security updates. DLA Piper have published some discussion of the major NotPetya ransomware attack they endured. The AUSCERT conference is in three weeks – we look forward to seeing some of you there! This week in cybersecurity: ——————————————————————————- DLA Piper paid 15,000 hours of IT overtime after NotPetya attackhttps://www.itnews.com.au/news/dla-piper-paid-15000-hours-of-it-overtime-after-notpetya-attack-490495Date: May 8 2018Author: Ry Crozier Excerpt: Law firm DLA Piper has revealed its IT team put in 15,000 hours of paid overtime to recover from the NotPetya malware infection. The company was also forced to wipe its entire Windows environment and “start afresh” after the first two weeks showed nothing in the existing environment was “salvageable”. ——————————————————————————- Misinterpretation of Intel docs is the root cause for the CVE-2018-8897 flaw in Hypervisors and OSshttps://securityaffairs.co/wordpress/72323/hacking/cve-2018-8897-misinterpretation-intel-docs.htmlDate: May 10 2018Author: Pierluigi Paganini Excerpt: The CERT/CC published a security advisory to warn of the CVE-2018-8897 flaw that impact the Linux kernel and software developed by major tech firms including Apple, the DragonFly BSD Project, Red Hat, the FreeBSD Project, Microsoft, SUSE Linux, Canonical, VMware, and the Xen Project (CERT/CC published the complete list of companies whose products may be impacted). … Experts explained that in the case of Linux, the flaw can trigger a denial-of-service (DoS) condition or cause the crash of the kernel. According to Microsoft, an attacker can exploit the security flaw on Windows for privilege escalation. ——————————————————————————- baseStriker: Office 365 attack https://www.avanan.com/resources/basestriker-vulnerability-office-365Date: May 8 2018Author: Yoav Nathaniel Excerpt: In this example, Office 365 only performs the lookup on the base domain, ignoring the relative URL in the rest of the body. Because only part of the URL is tested, it mistakenly appears to not exist in the malicious URL database and the email is let through. Furthermore, Safelinks does not replace the malicious link, and the user get the original malicious link, can click it to get right to the phishing page.  ——————————————————————————- Drupal Sites Fall Victims to Cryptojacking Campaigns https://www.bleepingcomputer.com/news/security/drupal-sites-fall-victims-to-cryptojacking-campaigns/Date: May 8 2018Author: Catalin Cimpanu Excerpt: Their efforts and expectations were fully rewarded, as the two vulnerabilities —CVE-2018-7600 and CVE-2018-7602— left over one million websites vulnerable to hacks if they didn’t receive immediate updates. Some webmasters updated their sites, but many didn’t, and those websites quickly fell victims to backdoors and coinminers shortly after the publication of proof-of-concept attack code. ——————————————————————————- And lastly, here are this week’s most noteworthy security bulletins:   1. Adobe Flash Player update https://portal.auscert.org.au/bulletins/62514 Another remote code execution vulnerability if users run malicious content.   2. MOV/POP SS crash https://portal.auscert.org.au/bulletins/62466 A user running unprivileged code can crash the Linux kernel, and probably the Windows kernel, owing to a long-running misunderstanding of how certain CPU instructions work.   3. WebKit RCE from web content https://portal.auscert.org.au/bulletins/62398 WebKit and its Linux port WebKitGTK+ contained memory corruption bugs which could lead to remote code execution from a web browser.   4. Firefox vulnerabilities https://portal.auscert.org.au/bulletins/62570 Continuing the theme of RCEs from web browsers, more memory corruption issues were addressed in Firefox and Firefox Extended Support Release.   Stay safe, stay patched and have a good weekend. David

Learn more

Week in review

AUSCERT Week in Review for 4th May 2018

AUSCERT Week in Review for 4th May 2018 AUSCERT Week in Review04 May 2018 Greetings, Happy Friday all.Plenty of patches and some interesting security stories again this week. Here’s a summary (including excerpts) of some of the more interestingstories we’ve seen this week: Title: Twitter to All Users: Change Your Password Now!Date Published: 03-05-2018URL: https://krebsonsecurity.com/2018/05/twitter-to-all-users-change-your-password-now/Author: Brian KrebsExcerpt:“Twitter just asked all 300+ million users to reset their passwords, citingthe exposure of user passwords via a bug that stored passwords in plain text” —– Title: Somebody Tried to Hide a Backdoor in a Popular JavaScript npm PackageDate Published: 03-05-2018URL: https://www.bleepingcomputer.com/news/security/somebody-tried-to-hide-a-backdoor-in-a-popular-javascript-npm-package/Author: Catalin CimpanuExcerpt:“The Node Package Manager (npm) team avoided a disaster today when itdiscovered and blocked the distribution of a cleverly hidden backdoormechanism” —– Title: Australia’s Biggest Bank Loses 20 Million Customer RecordsDate Published: 03-05-2018URL: https://www.securityweek.com/australias-biggest-bank-loses-20-million-customer-recordsAuthor: AFPExcerpt:“Australia’s troubled Commonwealth Bank admitted Thursday it had lostfinancial records for almost 20 million customers in a major securityblunder — but insisted there was no need to worry.” —– Title: DDoS Attacks Go Down 60% Across Europe Following WebStresser’s TakedownDate Published: 02-05-2018URL: https://www.bleepingcomputer.com/news/security/ddos-attacks-go-down-60-percent-across-europe-following-webstressers-takedown/Author: Catalin CimpanuExcerpt:“Link11, a DDoS mitigation firm, says that DDoS attacks fell 60% acrossEurope following the takedown of WebStresser, the largest DDoS-for-hireportal on the market.” —– Title: Fancy Bear abuses LoJack security software in targeted attacksDate Published: 03-05-2018URL: https://securityaffairs.co/wordpress/72072/apt/fancy-bear-abuses-lojack.htmlAuthor: Pierluigi PaganiniExcerpt:“Recently, several LoJack agents were found to be connecting to serversthat are believed to be controlled by the notorious Russia-linked FancyBear APT group” —– Here are this week’s noteworthy security bulletins: 1) ESB-2018.1312 – ALERT [RedHat] Red Hat: Root compromise – Existing account https://portal.auscert.org.au/bulletins/62054 Red Hat released updates for Openshift Container Platforms versions 3.1,3.2 … 3.9 which had root compromise vulnerabilities.   2) ESB-2018.1381 – [Win] Philips Brilliance Computed Tomography (CT)System: Multiple vulnerabilities https://portal.auscert.org.au/bulletins/62326 From the ICS-CERT’s advisory: “Successful exploitation of thesevulnerabilities may allow an attacker to attain elevated privilegesand access unauthorized system resources, including access to executesoftware or to view/update files including patient health information(PHI), directories, or system configuration.”   3) ESB-2018.1294 – [Mac] Safari: Execute arbitrary code/commands – Remotewith user interaction https://portal.auscert.org.au/bulletins/61978 Vulnerabilities in Webkit affected Safari in various Apple products.   4) ESB-2018.1363 – [Win][UNIX/Linux][Debian] jackson-databind: Executearbitrary code/commands – Remote/unauthenticated https://portal.auscert.org.au/bulletins/62258 Jackson-databind is a widely used Java library for parsing JSON and othedata formats, so this issue could have ramifications on many products andoperating systems.   5) ESB-2018.1337 – [Linux] IBM QRadar SIEM: Multiple vulnerabilities https://portal.auscert.org.au/bulletins/62154 One of many IBM bulletins relating to Java vulnerabilities.   Stay safe, stay patched and have a good weekend! Marcus  

Learn more

Week in review

AUSCERT Week in Review for 27th April 2018

AUSCERT Week in Review for 27th April 2018 AUSCERT Week in Review27 April 2018 Greetings, We have reached the end of another week, so I hope that you can all havean enjoyable and relaxing weekend.As always, there were numerous security vulnerabilities reported andfixes released.Of particular note (especially to us in the Education sector) were thedrupal issues (https://www.drupal.org/sa-core-2018-004). Here’s a summary (including excerpts) of some of the more interestingstories we’ve seen this week: Title: Hackers Don’t Give Site Owners Time to Patch, Start Exploiting New Drupal Flaw Within HoursDate Published: 25/04/2018URL:  https://www.bleepingcomputer.com/news/security/hackers-dont-give-site-owners-time-to-patch-start-exploiting-new-drupal-flaw-within-hours/Author: Catalin CimpanuExcerpt: “Five hours after the Drupal team published a security updatefor the Drupal CMS, hackers have found a way to weaponize the patchedvulnerability, and are actively exploiting it in the wild.”—– Title: Australia joins NATO Cyber Defence CentreDate Published: 24/04/2018URL: https://www.itnews.com.au/news/australia-joins-nato-cyber-defence-centre-489536Author: Juha SaarinenExcerpt: “Australia will take part in the North Atlantic TreatyOrganisation’s cyber warfare centre in Tallinn, Estonia, in order to practicehow to defend critical infrastructure against attacks from hostile nations.”—– Title: Hotel, motel, Holiday Inn? Doesn’t matter – they may need toupdate their room key softwareDate Published: 25/04/2018URL: https://www.theregister.co.uk/2018/04/25/hotel_room_key_security_flaw/Author: Kat HallExcerpt: “Infosec outfit F-Secure has uncovered security vulnerabilitiesin hotel keycard systems that can be exploited by miscreants to break intorooms across the globe.”—– Title: Researchers Hacked Amazon’s Alexa to Spy On Users, AgainDate Published: 25/04/2018URL: https://threatpost.com/researchers-hacked-amazons-alexa-to-spy-on-users-again/131401/Author: Lindsey O’DonnellExcerpt: “A malicious proof-of-concept Amazon Echo Skill shows how attackerscan abuse the Alexa virtual assistant to eavesdrop on consumers with smartdevices – and automatically transcribe every word said.”—– Title: Ransomware Hits HPE iLO Remote Management InterfacesDate Published: 25/04/2018URL: https://www.bleepingcomputer.com/news/security/ransomware-hits-hpe-ilo-remote-management-interfaces/Author: Lawrence AbramsExcerpt: “Attackers are targeting Internet accessible HPE iLO 4 remotemanagement interfaces, supposedly encrypting the hard drives, and thendemanding Bitcoins to get access to the data again.”—– Here are this week’s noteworthy security bulletins: 1) ESB-2018.1279.2 – UPDATED ALERT [Win][UNIX/Linux] Drupal core: Executearbitrary code/commands – Existing accounthttps://portal.auscert.org.au/bulletins/61918 As expected, this vulnerability was being exploited in the wild withinhours of release so needed quick remediation. 2) ESB-2018.1285 – [Apple iOS] iOS: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/61942 Included some RCE vulnerabilities. 3) ESB-2018.1281 – [RedHat] kernel: Root compromise – Existing accounthttps://portal.auscert.org.au/bulletins/61922 Another linux kernel root compromise 4) ESB-2018.1257 – [RedHat] patch: Execute arbitrary code/commands –Remote with user interactionhttps://portal.auscert.org.au/bulletins/61830 “Malicious patch files cause ed to execute arbitrary commands” 5) ESB-2018.1252 – [RedHat] java-1.8.0-oracle: Multiple vulnerabilitieshttps://portal.auscert.org.au/bulletins/61810 There were also numerous fixes released for java 1.6, 1.7 and 1.8 inRHEL-based systems Stay safe, stay patched and have a good weekend! Marcus.  

Learn more

Week in review

AUSCERT Week in Review for 20th April 2018

AUSCERT Week in Review for 20th April 2018 Greetings,   Right off the back of Microsoft’s patch Tuesday and Red Hat’s RHEL 7.5 updates, this week we have Oracle’s quarterly Critical Patch Updates and a slew of Cisco Advisories and Alerts – phew!   Bonus: A short video from CrikeyCon 2018 (a community-run information security conference in Brisbane) https://www.youtube.com/watch?v=VeOM-FxXOzY Here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: Title: Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices Date Published: Mon, 16th April 2018 Author: US-CERT Excerpt: “Since 2015, the U.S. Government received information from multiple sources—including private and public sector cybersecurity research organizations and allies—that cyber actors are exploiting large numbers of enterprise-class and SOHO/residential routers and switches worldwide. The U.S. Government assesses that cyber actors supported by the Russian government carried out this worldwide campaign. These operations enable espionage and intellectual property theft that supports the Russian Federation’s national security and economic goals.” —– Title: Why is the kernel community replacing iptables with BPF? Date Published: Tue, 17th April 2018 Author: Thomas Graf Excerpt: “Facebook has presented exciting work on BPF/XDP based load-balancing to replace IPVS that also includes DDoS mitigation logic. While IPVS is a tempting next step compared to iptables, Facebook is already migrating away from IPVS to BPF after seeing roughly a 10x improvement in performance.” —– Title: FDA Wants Medical Devices to Have Mandatory Built-In Update Mechanisms Date Published: Thur, 19th April 2018 Author: Catalin Cimpanu Excerpt: “An FDA document released this week reveals several of the FDA’s plans, including the desire to force device makers to include mandatory update systems inside products for the purpose of delivering critical security patches.” “In addition, the FDA also plans to force device makers to create a document called “Software Bill of Materials” that will be provided for each medical device and will include software-related details for each product.” —–  Title: Microsoft Debuts Azure Sphere for IoT Security From Chip to Cloud Date Published: Mon, 16th April 2018Author: Rob Marvin Excerpt: “Smith said Microsoft is making the Azure Sphere Security Service compatible not only with Azure, but with other cloud infrastructure providers such as Amazon Web Services (AWS), Google Cloud, IBM, Oracle, and others. The company is doing this for the same reason it’s releasing a Linux-based OS: making sure billions of IoT devices are secure.” —–   Here are this week’s noteworthy security bulletins:   1) ESB-2018.1182 – [Appliance] Abbott Laboratories Defibrillator: Multiple vulnerabilities Abbott has produced firmware updates to help mitigate identified vulnerabilities in their eligible ICDs and CRT-Ds that utilize radio frequency (RF) communications. A third-party security research firm has verified the new firmware updates mitigate the identified vulnerabilities.   2) ESB-2018.1232 – [Win][UNIX/Linux] Drupal core: Cross-site scripting – Remote with user interaction   CKEditor, a third-party JavaScript library included in Drupal core, has fixed a cross-site scripting (XSS) vulnerability. 3) ESB-2018.1229 – [SUSE] Linux kernel: Multiple vulnerabilities The SUSE Linux Enterprise 12 SP3 Realtime kernel was updated to 4.4.120 to receive various security and bugfixes.   4) ASB-2018.0077 – [Win][UNIX/Linux] Oracle Database Server: Multiple vulnerabilities Difficult to exploit vulnerability allows low privileged attacker having Create Session, Create Procedure privilege with network access via multiple protocols to compromise Java VM.  While the vulnerability is in Java VM, attacks may significantly impact additional products. 5) ESB-2018.1142 – [Win][UNIX/Linux][BSD][Debian] perl: Execute arbitrary code/commands – Remote with user interaction GwanYeong Kim reported that ‘pack()’ could cause a heap buffer write overflow with a large item count. Stay safe, stay patched and have a good weekend!   Charelle.

Learn more

Week in review

AUSCERT Week in Review for 13th April 2018

AUSCERT Week in Review for 13th April 2018 Greetings, Happy Friday the 13th all! Well, Cisco’s Smart Install protocol vulnerability that potentially leads to Remote denial of service and code execution attacks, now has a publicly available exploit. So get fixing it! AUSCERT members exposed to this vulnerability will receive MSINs addressing the issue.  Microsoft had 5 security updates addressing it’s browsers, Windows OS and Office products. None had known publicly available exploits at the time. Then, there’s the lighter side of things, like PUBG ransomware (PUBG doesn’t stand for pub games unfortunately). It requires victims to play Player Unknown’s Battleground for 1 hour to decrypt it, but wait, there’s more! Read on. Here’s a summary (including excerpts) of some of the more interesting stories we’ve seen this week: Title: Researchers discovered several flaws that expose electrical substations to hack Date Published: 12/04/2018 Author: Pierluigi Paganini, Security Affairs Excerpt: “By exploiting these vulnerabilities, an attacker is able to change the configuration of power-system protection relay which can lead to disruption of the power equipment protection function (and potentially to an accident) or customer curtailment.”   The most severe vulnerability (rated high severity), tracked as CVE-2018-4840 can be exploited by a remote and unauthenticated attacker to modify the device’s configuration and overwrite access passwords.   “The device engineering mechanism allows an unauthenticated remote user to upload a modified device configuration overwriting access authorization passwords. ” reads the security advisory published by Siemens.   The second flaw, tracked as CVE-2018-4839, is a medium severity issue that could be exploited by a local or network attacker to recover the access authorization password by intercepting network traffic or obtaining data from the targeted device. Once the attacker has obtained the password he can use it to gain complete access to a device.” —– Title: Health holds crown as the most breached sector in Australia Date Published: 11/04/2018 Author: Asha McLean, ZDNet Excerpt: “The Quarterly Statistics Report: January 2018-March 2018 revealed that health service providers accounted for 15 breaches; legal, accounting, and management services suffered 10; finance, including superannuation, reported eight breaches; education suffered six; and charities four.   The NDB scheme requires agencies and organisations in Australia that are covered by the Privacy Act 1988 to notify individuals whose personal information is involved in a data breach that is likely to result in “serious harm” as soon as practicable after becoming aware of a breach.   According to the OAIC report [PDF], 73 percent of eligible data breaches reported involved the personal information of less than 100 individuals, with just over half of the notifications involving the personal information of between one and nine individuals.” —– Title: Barracuda Threat Spotlight: New URL File Outbreak Could be a Ransomware Attempt Date Published: 10/04/2018 Author: Jonathan Tanner, Barracuda Excerpt: “Multiple downloaders, malicious apps that download further malicious apps to infected devices, have made it onto the Google Play Store. The downloaders are capable of downloading further apps that pose as system apps, some of which are capable of stealing Facebook login credentials. To do so, the malicious apps use social engineering tactics to trick victims into giving them up.” —– Title: PUBG Ransomware Decrypts Your Files If You Play PlayerUnknown’s Battlegrounds Date Published: 09/04/2018 Author: Lawrence Abrams, Bleeping Computer Excerpt: “Once a user plays the game and the process is detected, the ransomware will automatically decrypt the victim’s files.  This ransomware is not too advanced as it only looks for the process name and does not check for other information to confirm that the game is actually being played. That means you can simply run any executable called TslGame.exe and it will decrypt the files. This is not the first time a joke ransomware has been created that requires you to play a game before files will be encrypted. In 2017, MalwareHunterTeam also found RensenWare, which required you to play the TH12 Game and score .2 billion points in order to get recover your files.” —- Title: Major uptick in mobile phishing URL click rate Date Published: 10/04/2018 Author: HelpNet Security Excerpt: “Phishing attacks are particularly effective on mobile devices because hidden email headers and URLs make it easy to spoof email addresses and websites while new vectors, including SMS and messaging apps, enable attackers to make their campaigns personal. “It’s critical for enterprises to realize that when it comes to mobile devices, email is not the only phishing attack vector,” said Cockerill. “Attackers now take advantage of SMS, as well as some of today’s most popular and highly used social media apps and messaging platforms, such as WhatsApp, Facebook Messenger, and Instagram, as a means of phishing. Security professionals who overlook these new routes of attack put their organizations at risk.”” Here are this week’s noteworthy security bulletins: 1) ESB-2018.1122 – [Cisco] Cisco IOS and IOS XE: Multiple vulnerabilities Leading the way is this advisory from Cisco addressing multiple vulnerabilities in its Smart Install Client and related protocol that can be exploited to result in Remote code execution or denial of service. An exploit is publicly available. Immediate patching is highly advised. 2) ESB-2018.1080 – [Win][Linux][OSX] Adobe Flash Player: Multiple vulnerabilities More code execution vulnerabilities fixed in Adobe Flash Player. 3) ASB-2018.0075.2 – UPDATE [Win] Microsoft Windows: Multiple vulnerabilities This update for Microsoft Windows addressed a number of vulnerabilities including a two-year old privilege escalation vulnerability that affects Windows 10 as well. Stay safe, stay patched, stay cool and have a good weekend! Nicholas

Learn more