ZeroFox Daily Intelligence Brief - April 12, 2023

ZeroFox Daily Intelligence Brief - April 12, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Zero-Click Apple Spyware Abuses Calendar Events
• FBI Issues Alerts on “Juice Jacking” and Warns Against Using Charging Phones at Free Charging Stations
• SAP Releases Security Updates to Fix Critical-Severity Vulnerabilities

Zero-Click Apple Spyware Abuses Calendar Events

Israeli spyware distributor QuaDream reportedly used a zero-click exploit (dubbed ENDOFDAYS) to target Apple devices running iOS 14 with Reign spyware. The spyware was discovered on the devices of journalists, politicians, and NGO workers in multiple countries across North America, Central Asia, Southeast Asia, Europe, and the Middle East. QuaDream is believed to have hidden the spyware in iCal files, with a specially crafted calendar invite activating the payload when it was automatically processed by the victim's iOS device. Once active, the spyware could exfiltrate various device data, carrier, and network info; access the iOS keychain; and perform several other intrusive activities. The spyware was also found to contain mechanisms that could clean up traces it left behind.

Recommendations:

• Follow basic cyber hygiene to prevent mobile device compromise. Specific best practices include keeping device operating systems updated, enabling automatic software updates if available, using anti-malware software, and remaining vigilant about suspicious activity and messages.
• Enable Lockdown Mode on iOS devices to reduce the attack surface available to threat actors.

FBI Issues Alerts on “Juice Jacking” and Warns Against Using Charging Phones at Free Charging Stations

The Federal Bureau of Investigation (FBI) has cautioned smartphone users against charging their phones at public charging kiosks as threat actors have devised ways to introduce malware and monitoring software into devices through public USB ports. This type of cybercrime, termed “juice jacking,” involves threat actors using public USB charging ports—such as those at airports, hotels, or shopping centers—to steal data (for example, credit card numbers) or install malware on a user’s device. Security researchers have reported that a malicious charging station can identify the web pages loaded on a phone’s browser in less than 10 seconds, and as little as one minute of charging time may be adequate for compromising a user’s phone.

The Federal Communications Commission had previously issued an advisory on the threat of juice jacking and recommended mitigation measures.

Recommendations:

• People should carry their own charger and USB cord and use an electrical outlet to power up their devices rather than relying on possibly insecure public infrastructure.
• Adopt newer USB technology (such as USB C) or use charging-only cables, which do not allow data extraction. Wireless chargers are even more secure.
• Upon plugging a device into a USB port, if a prompt appears asking users to select "share data" or “charge only,” always select “charge only.”
• Follow ZeroFox Intelligence to remain up to date on emerging threats and security guidelines.

SAP Releases Security Updates to Fix Critical-Severity Vulnerabilities

As part of the April 2023 security updates, SAP has released 24 notes and fixed two critical-severity bugs that affect the SAP Diagnostics Agent and the SAP BusinessObjects Business Intelligence Platform. The significant bugs patched in the batch include CVE-2023-27267, which impacts version 720 of the OSCommand Bridge of SAP Diagnostics Agent and enables an attacker to execute scripts on connected agents and fully compromise the system. CVE-2023-28765 impacts versions 420 and 430 of SAP BusinessObjects Business Intelligence Platform (Promotion Management), allowing an attacker with basic privileges to gain access to the lcmbiar file and decrypt it. Another important fix addresses CVE-2023-29186, which impacts SAP NetWeaver versions 707, 737, 747, and 757 and allows an attacker to upload and overwrite files on the vulnerable SAP server. SAP is the largest enterprise resource planning (ERP) vendor in the world; it has 24 percent of the global market share and 425,000 customers in 180 countries.

Recommendations:

• Affected SAP users should install the latest security updates as soon as possible to guard their systems against attacks exploiting these vulnerabilities.
• Follow ZeroFox Intelligence to remain up to date on the latest software patches and security guidelines.