Threat Intelligence Bulletin: 10/16/2020 - 10/22/2020

Breaking News: 2020-10-16 - 2020-10-22

Critical Magento Holes Open Online Shops to Code Execution

Adobe has disclosed two critical flaws, six important-rated errors, and one moderate-severity vulnerability plaguing both Magento Commerce and Magento Open Source. Two critical flaws tracked as CVE-2020-24407 and CVE-2020-24400 in Magento – Adobe’s e-commerce platform that is commonly targeted by attackers like the Magecart threat group could enable arbitrary code execution on affected systems. The first critical vulnerability(CVE-2020-24407) allows for arbitrary code execution. The issue stems from the application not validating full filenames. This could enable an attacker to bypass the validation and upload a malicious file. The other critical flaw(CVE-2020-24400) is an SQL injection vulnerability wherein it allows an attacker to interfere with the queries that an application makes to its database. An attacker without authentication but also with administrative privileges could exploit this bug in order to gain arbitrary read or write access to a database. Adobe has issued patches in Magento Commerce and Magento Open Source versions 2.4.1 and 2.3.6 and recommends users update their installation to the newest version.

See the full report here: https://threatpost.com/critical-magento-holes-online-shops-code-execution/160181/

Broadvoice Leak Exposes 350M Records, Personal Voicemail Transcripts

Broadvoice, a well-known VoIP provider that serves small- and medium-sized businesses, has leaked more than 350 million customer records related to the company’s “b-hive” cloud-based communications suite. According to researchers at Comparitech, Broadvoice left an Elasticsearch database cluster open to the internet, accessible to anyone, with no authentication required. The misconfigured cluster included ten separate collections of data related to b-hive. The largest collection (275 million records) included a full caller name, caller ID, phone number, and city and state. Meanwhile, a collection entitled “people-production” contained account ID numbers for Broadvoice’s customers. One of these included 2 million voicemail records, with more than 200,000 transcripts. Many of the transcripts contained personal details such as full name, phone number, and date of birth, as well as some sensitive information. Other voicemails left for financial-service companies included details about mortgages and other loans. The researchers discovered the collections on Oct. 1, 2020, and soon after which Broadvoice secured the database.

See the full report here: https://threatpost.com/broadvoice-leaks-350m-records-voicemail-transcripts/160158/

Iranian state hacker group linked to ransomware deployments

Security researchers from ClearSky and Profero found clues linking recent attacks with the Thanos ransomware to a group of Iranian state-sponsored hackers, MuddyWater. The intrusions follow similar patterns, with two tactics recorded. MuddyWater is known to use phishing emails with malicious documents that, when opened, would download and install malware. In the second scenario, the hacking group would scan the internet for unpatched Microsoft Exchange email servers, exploit the CVE-2020-0688 vulnerability, install a web shell on the server, and then download and install the malware seen before. The malware is tracked by the name PowGoop, which is a PowerShell-based script used to download Thanos ransomware. Researchers believe that the hacker group would have tried to install the Thanos ransomware as a means to hide their attacks and destroy evidence of intrusions by encrypting files on hacked networks.

See the full report here: https://www.zdnet.com/article/iranian-state-hacker-group-linked-to-ransomware-deployments/

800,000 SonicWall VPNs vulnerable to new remote code execution bug

Tripwire VERT security team has discovered a vulnerability in a component of SonicOS that handles custom protocols. This component is exposed on the WAN (public internet) interface, meaning any attacker can exploit it, as long as they're aware of the device's IP address. SonicWall Network Security Appliance (NSA) runs on SonicOS operating system, used as firewalls and SSL VPN portals to filter, control, and allow employees to access internal and private networks. The flaw tracked as CVE-2020-5135 is considered as critical and rated 9.4 out of 10. The bug can result in denial of service and code execution on vulnerable devices. Almost 800,000 internet-accessible SonicWall VPN appliances are unpatched. The company has released patches to address the vulnerability.

See the full report here: https://www.zdnet.com/article/800000-sonicwall-vpns-vulnerable-to-new-remote-code-execution-bug/

New Emotet attacks use fake Windows Update lures

Emotet botnet has resurfaced with a new document lure. The recent Emotet campaigns use the file attachments with a message to update Windows service by clicking the "Enable Editing" button. According to an update from the Cryptolaemus group, these Emotet lures have been spammed in massive numbers to users located all over the world. The boobytrapped documents are being sent from emails with spoofed identities, appearing to come from acquaintances and business partners. Furthermore, Emotet uses a technique called conversation hijacking, through which it steals email threads from infected hosts, inserts itself in the thread with a reply spoofing one of the participants, and adding the boobytrapped Office documents as attachments. It is recommended that users who work with emails regularly should be made aware of the danger of enabling macros inside documents.

See the full report here: https://www.zdnet.com/article/new-emotet-attacks-use-fake-windows-update-lures/

Microsoft now lets you disable insecure JScript in Internet Explorer

Microsoft says that customers can now disable JScript (Jscript[.]dll) execution in Internet Explorer 11 after installing the Windows October 2020 monthly security updates. JScript is a legacy Microsoft implementation of the ECMAScript language specification in the form of an Active Scripting engine. This update allows IT admins to provide their users with a more secure browsing experience across enterprise environments. After applying the settings, Internet Explorer will not run JScript from websites that use Internet Explorer’s legacy document modes (Internet Explorer 9 and earlier versions) and which are in the Internet Zone or Restricted Sites Zone.

See the full report here: https://www.bleepingcomputer.com/news/security/microsoft-now-lets-you-disable-insecure-jscript-in-internet-explorer/

Card details for 3 million Dickey's customers posted on carding forum

The card details of more than three million customers of Dickey's Barbecue Pit, the largest barbecue restaurant chain in the US, have been posted on a carding and fraud marketplace known as Joker's Stash. The leaked data discovered by the company with the name "Blazingsun", is being sold for a median price of $17 per card. According to Gemini Advisory, hackers have compromised 156 Dickey's restaurants located across 30 states, with the highest exposure being in California and Arizona. The card data appears to have been collected between July 2019 and August 2020 by compromising the in-store Point-of-Sale (POS).

See the full report here: https://www.zdnet.com/article/card-details-for-3-million-dickeys-customers-posted-on-carding-forum/

Biden Campaign Staffers Targeted in Cyberattack Leveraging Antivirus Lure, Dropbox Ploy

Google’s Threat Analysis Group has published a detailed report on targeted credential phishing and malware attacks on the staff of Joe Biden’s presidential campaign. Hackers sent Joe Biden’s presidential campaign staffers malicious emails that impersonated anti-virus software company McAfee and used a mix of legitimate services to avoid detection. The emails were an attempt to steal staffers’ credentials and infect them with malware. The malware was a Python-based implant, hosted on Github, which used Dropbox for command and control (C2). Once downloaded, the malware would allow the attacker to upload and download files and execute arbitrary commands. Google attributed the attack on Biden’s campaign staff to APT 31 (also known as Zirconium). According to reports, this threat actor is tied to the Chinese government.

See the full report here: https://threatpost.com/biden-campaign-staffers-targeted-in-cyberattack-leveraging-anti-virus-lure-dropbox-ploy/160234/

UK urges orgs to patch severe CVE-2020-16952 SharePoint RCE bug - BleepingComputer

The U.K. National Cyber Security Centre (NCSC) today issued an alert highlighting the risks behind the recently addressed CVE-2020-16952 remote code execution (RCE) vulnerability in Microsoft SharePoint Server. The vulnerability allows attackers to remotely execute code following successful exploitation in the context of the local Administrator. It poses higher risk for multi-tenant environments i.e., multiple organizations using the same SharePoint and/or Active Directory environment. A proof-of-concept exploit is also publicly available. To defend against attacks designed to exploit this vulnerability, IT admins are advised to apply the October 2020 SharePoint security updates.

See the full report here: https://www.bleepingcomputer.com/news/security/uk-urges-orgs-to-patch-severe-cve-2020-16952-sharepoint-rce-bug/

Juniper fixes tens of flaws affecting the Junos OS

Juniper Networks has addressed tens of vulnerabilities, including serious issues that can be exploited to take control of vulnerable systems. Out of these, the critical vulnerabilities affect the Security Assertion Markup Language (SAML) authentication, which could be exploited by a remote attacker to bypass SAML authentication. Juniper has also fixed a critical remote code execution vulnerability in the Telnet server tracked as CVE-2020-10188. Juniper Networks has released security updates to address vulnerabilities affecting multiple products. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has also urged organizations to apply the security updates released by the vendor.

See the full report here: https://securityaffairs.co/wordpress/109595/security/juniper-junos-os-flaws.html?utm_source=rss&utm_medium=rss&utm_campaign=juniper-junos-os-flaws

Nation-state actor hit Google with the largest DDoS attack - BleepingComputer

In an overview of distributed denial-of-service (DDoS) trends targeting its network links, Google revealed that in 2017 a nation-state actor used massive firepower that amounted to more than 2.54 terabits per second. The attack occurred in September 2017 and used 180,000 exposed CLDAP, DNS, and SMTP servers to amplify responses directed at Google. The actor targeted thousands of Google IP addresses at the same time and used several attack methods in a campaign that span across multiple months. Google did not attribute the attack to a particular actor but said that the bad UDP packets hurled at its systems came from devices using several Chinese internet service providers.

See the full report here: https://www.bleepingcomputer.com/news/security/nation-state-actor-hit-google-with-the-largest-ddos-attack/

Microsoft releases emergency security updates for Windows and Visual Studio

Microsoft has published two out-of-band security updates to address security issues in the Windows Codecs library and the Visual Studio Code application. The first bug is tracked as CVE-2020-17022, wherein an attacker can craft malicious images that, when processed by an app running on top of Windows, could execute code on an unpatched Windows OS. Microsoft said that an update for this library would be automatically installed on user systems via the Microsoft Store. The second bug is tracked as CVE-2020-17023, where an attacker can craft malicious package[.]json files that, when loaded in Visual Studio Code, can execute malicious code. Users are advised to apply the fixes to mitigate the vulnerabilities.

See the full report here: https://www.zdnet.com/article/microsoft-releases-emergency-security-updates-for-windows-and-visual-studio/

NPM nukes NodeJS malware opening Windows, Linux reverse shells - BleepingComputer

NPM has removed multiple packages hosted on its repository this week that established connection to remote servers and exfiltrated user data. The 4 packages namely, 'plutov-slack-client', 'nodetest199', 'nodetest1010', and 'npmpubman' had collected over 1,000 total downloads for the last few months up until being removed by NPM yesterday. The first three packages share identical code that is capable of running on both Windows and Unix-based systems. After the packages are installed, the code establishes a reverse shell to the attacker's server, allowing the attacker to obtain remote access to the compromised machine. The last package on the list has a different code structure and purpose. It collects user data from the environment variables and uploads this information to a remote host. Environment information can reveal sensitive information about a developer's environment, such as the PATH variable, database server, ports, API keys, etc. NPM has shut down the different NPM author accounts associated with those four packages.

See the full report here: https://www.bleepingcomputer.com/news/security/npm-nukes-nodejs-malware-opening-windows-linux-reverse-shells/

Waze Vulnerability Allowed Hackers to Track Users, Figure Out Who They Are - autoevolution

Waze, a GPS navigation software app owned by Google, is vulnerable to a security flaw that could allow the crooks to track a random driver on the map and view their location. A security researcher could request the Waze API to display the coordinates for both his location and for other nearby drivers. When inspecting the data returned by the API, the identification numbers (ID) associated with the icons were also included. These IDs did not change over time. The researcher was also able to convert the user ID to username, using the event reporting system in Waze. Once the username of a Wazer is determined, hackers can scan public profiles and social media to determine the identity of a user and use the same in malicious activities. The vulnerability has been patched.

See the full report here: https://www.autoevolution.com/news/waze-vulnerability-allowed-hackers-to-track-users-figure-out-who-they-are-150276.html

British Airways fined £20m for Magecart hack that exposed 400k folks' credit card details to crooks

The Information Commissioner’s Office has fined British Airways with approximately £20 million for its 2018 Magecart hack. British Airways’ internal payments systems were accessed by malicious parties in June 2018, impacting credit and debit card details of nearly 380,000 individuals. The airline had been saving credit card details in plain text since 2015. According to ICO, the logging and storing of these card details (including, in most cases, CVV numbers) was not an intended design feature of BA’s systems, as it was a testing feature that was only intended to operate when the systems were not live, but which was left activated when the systems went live. However, those logs were stored for three months. From there, the attackers discovered source code for the BA website and planted a card skimmer on the payments page used by the general public.

See the full report here: https://go.theregister.com/feed/www.theregister.com/2020/10/16/british_airways_ico_fine_20m/

Hackers now abuse BaseCamp for free malware hosting - BleepingComputer

Basecamp, a web-based project management solution that allows people to collaborate, chat with each other, create documents, and share files, is being abused by hackers in a new phishing campaign aiming to distribute malware or steal user login credentials. Threat actors leverage Basecamp's free license that allows users to get free hosting using which the users can distribute any type of file they want. Security researchers have found that threat actors are distributing BazarLoader, a stealthy backdoor Trojan from the TrickBot gang, executables using public Basecamp download links. Once installed, BazarLoader will deploy Cobalt Strike beacons that allow threat actors to access the network and ultimately deploy the Ryuk ransomware.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-now-abuse-basecamp-for-free-malware-hosting/

BlackBerry Uncovers Massive Hack-For-Hire Group Targeting Governments, Businesses and NGOs - HSToday

According to the security researchers at BlackBerry, a hack-for-hire group dubbed "Bahamut" is renting out its espionage and disinformation services to the highest bidder to target nonprofit organizations and diplomats across the Middle East and southern Asia. Bahamut, which has been active for several years, is known to security researchers by various names, including EHDevel, WindShift, Urpage, and The White Company. The researchers identified several fake news websites the Bahamut group created to push disinformation content. They also discovered a phishing infrastructure and malicious apps installed in the official Google Play and Apple App stores used to target specific victims and organizations. Google has removed all the malicious apps mentioned in the BlackBerry report from its app store. Apple confirmed that two of the seven apps were no longer available in its app store. But because the BlackBerry report did not provide enough information on the remaining apps, Apple is still determining if they are malicious.

See the full report here: https://www.hstoday.us/industry/blackberry-uncovers-massive-hack-for-hire-group-targeting-governments-businesses-and-ngos/

Kleenheat customer names and addresses exposed in system breach - ZDNet

Kleenheat, an Australian gas producer, retailer, and distributor based in Perth, has reported a data breach that may have exposed information such as name and address. Kleenheat believes the breach occurred in 2014 on a third-party system and was recently identified by the company during a routine data security check. The breach may have exposed customers' names, residential addresses, and email addresses. The company assured that phone numbers, dates of birth, or bank, credit cards, and account details were not breached. The company stated that no evidence of misuse of potentially leaked data was found. However, Kleenheat has notified the impacted customers and has taken measures to secure the information.

See the full report here: https://www.zdnet.com/article/kleenheat-customer-names-and-addresses-exposed-in-system-breach/

Haldiram's servers get hit by ransomware attack, hackers demand $750,000 - India TV News

Haldiram, a popular Indian food giant, has fallen victim to a ransomware attack. According to reports, the cyberattack took place on October 12 and 13, during which the hackers may have stolen entire or substantial data of the company. The company's servers were impacted during the cyberattack preventing its officials from interacting with their files, data, applications, and systems. The hackers are demanding a ransom of USD 750,000 in return for a decryption key. The company is investigating the issue to understand the nature and scope of the ransomware attack.

See the full report here: https://www.indiatvnews.com/technology/news-haldiram-s-servers-get-hit-by-ransomware-attack-hackers-demand-750-000-657926

Google Chrome and Edge are creating random debug.log log files

A bug in the latest version of Chrome and other Chromium-based browsers results in random debug.log files being generated on users' desktops and other folders. After a recent update to Edge, Chrome, and other Chromium-based browsers, users noticed that the browser creates a "debug[.]log" file with the error "FindFirstFile: The system cannot find the path specified." A lot of users have also reported the problem on Microsoft's community forum and Chromium bug repository. Based on the error, Chrome runs into an issue that loops through files and subdirectories in a folder and logs it as an error. Users facing this issue can resolve it by deleting the contents of the Chromium Crashpad folder.

See the full report here: https://www.bleepingcomputer.com/news/google/google-chrome-and-edge-are-creating-random-debuglog-log-files/

Shenzhen Bourse Apologizes for Trading Glitch - finews.asia

The confirmation of some stock trading on the Shenzhen bourse was delayed due to a trading system fault on Thursday morning, as multiple investors said they had failed to receive timely confirmation from the bourse when placing or canceling transaction orders. The Shenzhen Stock Exchange (SZSE) later admitted the fault, saying it lasted for 32 minutes and offered an apology to the investors. Many investors were not satisfied with the SZSE’s response, referring to losses caused by the trading system’s glitch.

See the full report here: https://www.finews.asia/finance/32962-asia-s-exchange-glitches-three-hits-in-a-quarter

Hackers hijack Telegram, email accounts in SS7 mobile attack

Hackers have exploited the Signaling System 7 (SS7), a set of protocols used to perform telephone calls and text messages, to obtain cryptocurrency via cyber-attack. They gained access to Telegram messenger and email data of high-profile individuals in the cryptocurrency business, took over two-factor authentication login codes, delivered over the short messaging system of the victims' mobile phone provider via the SS7 protocols. According to a local news source, Israel's national intelligence agency (Mossad) and the country's National Cyber Security Authority are investigating the attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/hackers-hijack-telegram-email-accounts-in-ss7-mobile-attack/

FBI warns of newly registered domains spoofing US Census Bureau

The Federal Bureau of Investigation (FBI) has warned about the potential use of spoofed US Census Bureau, a federal government statistical agency that collects statistical data on the US economy and population, domains in future malicious campaigns including phishing and credential theft attacks. The flash alert was published by the FBI Cyber Division in coordination with DHS’Office of Intelligence & Analysis, DHS-CISA, the Department of Commerce, and the Census Bureau. The FBI has observed entities not associated with the US Census Bureau registering numerous domains spoofing the Bureau’s websites, likely for malicious purposes. Although there is no evidence that the fake domains have been used in attacks currently, they could be used in the future by both nation state-backed hacking groups and cyber-criminals to spread malware as part of espionage or financially motivated campaigns targeting individuals and businesses. The FBI has also provided a list of recommended mitigations to protect users from future attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/fbi-warns-of-newly-registered-domains-spoofing-us-census-bureau/

Discord desktop app vulnerability chain triggered remote code execution attacks

The bug bounty hunter, Masato Kinugawa has developed an exploit chain leading to a critical issue in the desktop version of Discord, which left users vulnerable to remote code execution (RCE) attacks. The first security issue was in the Electron open-source framework, tracked as CVE-2020-15174, used in Discord's Electron build that could allow JavaScript code outside of the app to influence internal code leading to RCE. The cross-site scripting (XSS) issue was discovered in the iframe embed feature, allowing the execution of JavaScript on the application. Sketchfab is whitelisted in Discord's content security policy, which may lead to DOM-based XSS. The CVE-2020-15174, when combined with the other two, may allow an attacker to perform an RCE attack by circumventing navigation restrictions and using the iframe XSS bug to access a web page containing the RCE payload. Discord has patched the issue.

See the full report here: https://www.zdnet.com/article/discord-desktop-app-vulnerable-to-remote-code-execution-bug/

ThunderX Ransomware rebrands as Ranzy Locker, adds data leak site - BleepingComputer

ThunderX, a ransomware operation launched in August 2020, has rebranded itself to Ranzy Locker and launched a data leak site "Ranzy Leak," where they shame victims who do not pay the ransom. The weaknesses found in ThunderX ransomware allowed a free release of the decryptor. The ransomware operators quickly fixed their bugs and released a new version of the ransomware. According to the researchers, when launched, Ranzy Locker first clears Shadow Volume Copies so that victims can't use it to recover encrypted files. When encrypting files, ransomware uses the Windows Restart Manager API to terminate processes or Windows services that keep a file open and prevent it from being encrypted. For each encrypted file, the ransomware appends the new .ranzy extension to the file's name and creates a ransom note named 'readme.txt' that includes contact and ransom information. However, according to BleepingComputer, the Ako ransomware operators stated ThunderX is part of their operation and that they have rebranded to Ranzy Locker.

See the full report here: https://www.bleepingcomputer.com/news/security/thunderx-ransomware-rebrands-as-ranzy-locker-adds-data-leak-site/

Office 365 OAuth Attack Targets Coinbase Users

In a new phishing campaign, attackers are targeting Microsoft Office 365 users with Coinbase-themed lures in an attempt to take control of their inboxes via OAuth. The phishing email purports to come from Coinbase, a platform allowing users to buy and sell cryptocurrency like Bitcoin, asking users to download updated Terms of Service via an OAuth consent app. Upon clicking the link in the phishing email to review the new Terms of Service, users are taken to a legitimate Office 365 login page where they are presented with the OAuth consent request for read-and-write access to their mailboxes, emails, profiles, and other information. Once access is granted, the users unknowingly give attackers full access to their email. Microsoft recommends users to investigate any OAuth apps by using the abilities and information provided in the Cloud App Security portal to filter out apps with a low chance of being risky and focus on the suspicious apps.

See the full report here: https://threatpost.com/office-365-oauth-attack-coinbase/160337/

Adobe fixes 18 critical bugs affecting its Windows, macOS apps

Adobe has released security updates to address nearly 20 vulnerabilities that could allow arbitrary code execution in devices running vulnerable software versions. Adobe has fixed 20 security vulnerabilities in Adobe Creative Cloud Desktop Application, Adobe InDesign, Adobe Media Encoder, Adobe Premiere Pro, Adobe Photoshop, Adobe After Effects, Adobe Animate, Adobe Dreamweaver, Adobe Illustrator, and Marketo. Among the 20 flaws, 18 of them rated as critical severity flaws, and two marked important. Adobe urges all customers to update to the fixed versions of the vulnerable products as soon as possible to block future attacks that could emanate from unpatched installations.

See the full report here: https://www.bleepingcomputer.com/news/security/adobe-fixes-18-critical-bugs-affecting-its-windows-macos-apps/

Barnes & Noble hit by Egregor ransomware, strange data leaked

U.S. Bookstore giant Barnes & Noble disclosed that they suffered a cyberattack on October 10th, 2020, after users began complaining that they could no longer access their library of purchased eBooks and magazine subscriptions. The attackers gained access to the corporate network of the company and compromised customers' email addresses, billing addresses, shipping addresses, and purchase history. The company stated that no payment details have been exposed. After discovering the attack, Barnes and Noble shut down their network to prevent the attack's further spread. The Egregor ransomware gang claims to be responsible for the attack. To support their claims, the ransomware gain has posted the leaked data containing two Windows Registry hives exported from Barnes & Noble's Windows servers during the attack.

See the full report here: https://www.bleepingcomputer.com/news/security/barnes-and-noble-hit-by-egregor-ransomware-strange-data-leaked/

Google removes two Chrome ad blockers caught collecting user data

Nano Adblocker and Nano Defender have been removed from the official Chrome Web Store and disabled in users' Chrome browsers after the two were caught collecting user data. The two extensions had been around for more than a year and each had more than 50,000 and 200,000 installs, respectively, at the time they were taken down. The data collection code was added at the start of this month after the original author sold the two extensions to a team of Turkish developers. The malicious code was exposed to collect information about users' IP address, Country, OS details, Website URLs, Timestamps for web requests, HTTP methods, Size of HTTP responses, HTTP status codes, Time spent on each web page, and Other URLs clicked on a web page. In addition, the two Turkish developers also never modified the two extensions' author fields, leaving the original author's name in place.

See the full report here: https://www.zdnet.com/article/google-removes-two-chrome-ad-blockers-caught-collecting-user-data/

Cisco warns of attacks targeting high severity router vulnerability

Cisco today warned of attacks actively targeting the CVE-2020-3118 high severity vulnerability found to affect multiple carrier-grade routers that run the company's Cisco IOS XR Software. The IOS XR Network OS is deployed on several Cisco router platforms, including NCS 540 & 560, NCS 5500, 8000, and ASR 9000 series routers. Attackers could exploit the vulnerability by sending a malicious Cisco Discovery Protocol packet to devices running a vulnerable IOS XR version. Successful exploitation could enable the attackers to trigger a stack overflow that could lead to arbitrary code execution with administrative privileges on the targeted device. Cisco recommends that customers upgrade to a fixed Cisco IOS XR Software release to remediate this vulnerability.

See the full report here: https://www.bleepingcomputer.com/news/security/cisco-warns-of-attacks-targeting-high-severity-router-vulnerability/

Bug bounty reporter cashes out on someone else's exploit - BleepingComputer

Security professional Guido Vranken alleged that a vulnerability reported to Monero's bug bounty program run by HackerOne was a verbatim copy of his previously discovered exploit tracked as CVE-2019-6250 that he had found in the libzmq 4.1 series and reported to the developers in January 2019. The disclosure on HackerOne comes July 2019 and has exact wording as Vranken's January 2019 report. On taking a closer look, the Monero team had determined that the 4.1 series is not affected by CVE-2019-6250 but is affected by CVE-2019-13132 and therefore rewarded Melo, who discovered the security flaw.

See the full report here: https://www.bleepingcomputer.com/news/security/bug-bounty-reporter-cashes-out-on-someone-elses-exploit/

Google releases Chrome security update to patch actively exploited zero-day

Google has released Chrome version 86.0.4240.111 to deploy security fixes, including a patch for an actively exploited zero-day vulnerability. The zero-day tracked as CVE-2020-15999 is a memory corruption bug in the FreeType font rendering library included with standard Chrome distributions. Researches from Project Zero discovered a threat actor abusing this FreeType bug to mount attacks against Chrome users. A patch for this bug is included in the FreeType 2.10.4 release. However, other app vendors using the affected library are advised to update their software. The technical details for this actively exploited zero-day vulnerability have not been made public. Since the patch for this zero-day is visible in the source code of FreeType, an open-source project, it's expected that threat actors will be able to reverse-engineer the zero-day and come up with their own exploits. Windows, Mac, and Linux chrome desktop users are requested to upgrade to the latest release.

See the full report here: https://www.zdnet.com/article/google-releases-chrome-security-update-to-patch-actively-exploited-zero-day/

Cisco Warns of Severe DoS Flaws in Network Security Software

Cisco has disclosed several high-severity vulnerabilities across its lineup of network-security products. The most severe flaws can be exploited by an unauthenticated, remote attacker to launch malicious attacks from denial of service (DoS) to cross-site request forgery (CSRF). The vulnerabilities exist in Cisco’s Firepower Threat Defense (FTD) software, which is part of its suite of network-security and traffic-management products, and it's Adaptive Security Appliance (ASA) software, the operating system for its family of ASA corporate network-security devices. The most severe of these flaws include a vulnerability in Cisco Firepower Chassis Manager (FCM), which exists in the Firepower Extensible Operating System (FXOS) and provides management capabilities. The flaw tracked as CVE-2020-3456 scored 8.8 out of 10 on the CVSS scale, and stems from insufficient CSRF protections in the FCM interface. Users are recommended to upgrade to the latest versions at the earliest.

See the full report here: https://threatpost.com/cisco-dos-flaws-network-security-software/160414/

New Windows RAT can be controlled via a Telegram channel

Security researchers have discovered a new remote access trojan (RAT) named T-RAT that being advertised on Russian-speaking underground hacking forums. The malware is available for only $45 that comes with a control-by-Telegram capability. The RAT's Telegram channel supports 98 commands. The commands allow the RAT owner to retrieve browser passwords and cookies, navigate the victim's filesystem and search for sensitive data, deploy a keylogger, record audio via the microphone, take screenshots of the victim's desktop, take pictures via webcam, and retrieve clipboard contents. Furthermore, T-RAT owners can also deploy a clipboard hijacking mechanism that replaces strings that look like cryptocurrency and digital currency addresses with alternatives, allowing the attacker to hijack transactions for payment solutions. The RAT can also run terminal commands (CMD and PowerShell), block access to certain websites, kill processes, and even disable the taskbar and the task manager.

See the full report here: https://www.zdnet.com/article/new-windows-rat-can-be-controlled-via-a-telegram-channel/

Google Chrome now blocks site notifications with abusive content

Starting with Chrome 86, Google is automatically hiding website notification spam on sites showing a pattern of sending abusive notification content to visitors. The "quiet notification permission UI" used to hide the web alert spam from users was introduced in Chrome 80 and improved in Chrome 84. Chrome 86 focuses on precise notification content and block interaction with the sites with a history of sending alert spam with abusive content that delivers malware or helps harvest user credentials. Google’s web crawling service will subscribe to push notifications if push permissions are requested to detect websites misusing notifications to spam their visitors with abusive content. The automated Chrome crawlers will then use Google's Safe Browsing blacklist service to evaluate received notifications, automatically flagging all sites abusing them for malicious purposes to enforce notification blocking by toggling on the quieter notification permission UI. Violators will then be sent a notice through the website’s Search Console and email with a 30-days period to address the issues prior to the start of enforcement.

See the full report here: https://www.bleepingcomputer.com/news/security/google-chrome-now-blocks-site-notifications-with-abusive-content/

WordPress deploys forced security update for dangerous bug in popular plugin

The Loginizer WordPress plugin, which provides security enhancements for the WordPress login page, was found to be affected by an unauthenticated SQL Injection vulnerability. The vulnerability resides in Loginizer’s brute force protection functionality, which is enabled by default for all sites where Loginizer is installed. When a user attempts to log in with an unknown username, the attempt is logged in the backend database where the username and other parameters are not sanitized before being placed within the SQL query, allowing remote attackers to run code against the WordPress database. Researchers released a simple proof-of-concept script to explain the attack. More than one million WordPress sites were running a vulnerable version of the Loginizer plugin. Users are advised to update to Loginizer version 1.6.4 to fix this vulnerability.

See the full report here: https://www.zdnet.com/article/wordpress-deploys-forced-security-update-for-dangerous-bug-in-popular-plugin/

QNAP warns of Windows Zerologon flaw affecting some NAS devices - BleepingComputer

Network-attached storage device maker QNAP has warned customers that some NAS storage devices running vulnerable versions of the QTS operating system are exposed to attacks attempting to exploit the critical Windows ZeroLogon (CVE-2020-1472) vulnerability. If exploited, this elevation of privilege vulnerability allows remote attackers to bypass security measures via a compromised QTS device on the network. While NAS devices aren't commonly used as a Windows domain controller, some organizations might want to use this feature to allow IT admins to use some NAS models to manage user accounts, authentication, and enforce domain security. The company 'strongly' recommends QNAP customers to update the QTS operating system on their NAS devices together with all installed apps to defend against Zerologon attacks.

See the full report here: https://www.bleepingcomputer.com/news/security/qnap-warns-of-windows-zerologon-flaw-affecting-some-nas-devices/