ZeroFox Daily Intelligence Brief - April 25, 2023

ZeroFox Daily Intelligence Brief - April 25, 2023

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Please find today’s daily roundup with recommendations that aim to give you and your clients an advantage over the adversary.

Key Findings

• Schneider Electric Warns of Critical Flaws in its APC UPS Software
• Black Basta Gang Leaks Personal Information from YellowPages Data
• Intel CPUs Vulnerable to New Transient Execution Side-channel Attack

Schneider Electric Warns of Critical Flaws in its APC UPS Software

Schneider Electric has warned that vulnerabilities exist in software associated with its identified Uninterruptible Power Supply (UPS) devices, which are widely used within both the consumer and corporate markets. UPS devices ensure seamless operation amidst power fluctuations and outages and safeguard data centers, server farms, and smaller network infrastructures. Schneider’s APC's Easy UPS Online Monitoring Software is susceptible to unauthenticated arbitrary remote code execution, escalation of privileges, and authentication bypass, which could lead to execution of malicious web code or loss of device functionality. The vulnerabilities identified (CVE-2023-29411, CVE-2023-29412, and CVE-2023-29413) impact all Windows versions, including 10 and 11, and Windows Server 2016, 2019, and 2022.

Recommendations:

• Users of APC Easy UPS Online Monitoring Software v2.5-GA-01-22320 and earlier and Schneider Electric Easy UPS Online Monitoring Software v2.5-GA-01-22320 and earlier should update to V2.5-GS-01-23036 or later to address these vulnerabilities.
• Use industry cybersecurity best practices such as isolating control and safety system networks from business networks, installing physical controls, minimizing network exposure, and using secure methods such as VPNs for remote access.
• Apply mitigations for Windows 11 and Windows Server 2016, 2019, and 2022 until the remediation plan is established by upgrading to PowerChute Serial Shutdown (PCSS) software.

Black Basta Gang Leaks Personal Information from YellowPages Data

Canadian directory publisher Yellow Pages Group has suffered a data breach after being targeted by the Black Basta ransomware and extortion group. The hacker has leaked sensitive documents exposing the personal information of Yellow Pages’ employees and business customers that includes scans of passports and driver's licenses, tax documents exposing Social Insurance Numbers, sales and purchase agreements, accounts receivable spreadsheets, and budget and debt forecasts. The cyberattack occurred around March 15, 2023, based on the dates present on a few leaked documents. YellowPages has notified impacted individuals and also reported the incident to all appropriate privacy regulatory authorities. Founded in 1908, Yellow Pages Group owns and operates YP[.]ca and Yellowpages[.]ca, along with the Canada411 online service.

Recommendations:

• Victims of the data leak should stay alert for potential phishing emails, fraudulent calls, or other communications urging users to click on links and open files or that seek personal information, as these could be follow-on attacks using the breached information.
• Victims should consider using data-protection services, such as those provided by ZeroFox’s IDX, to alert them of any misuse of their personal information following the data leak.

Intel CPUs Vulnerable to New Transient Execution Side-channel Attack

Researchers at Tsinghua University, University of Maryland, and BUPT have discovered a new side-channel attack that allows data leakage through the EFLAGS register. Unlike many other attacks, this exploit leverages a flaw in transient execution, extracting secret data from user memory space through timing analysis. The attack works as a side channel to Meltdown, a security flaw discovered in 2018. Meltdown allows attackers to access secrets stored in kernel memory, such as passwords and encryption keys, through a performance optimization feature called "speculative execution." The new attack exploits the change in the EFLAGS register during transient execution, affecting the timing of JCC instructions. The researchers note that this timing attack is not as reliable as cache-state, side-channel methods and propose non-trivial mitigations.

Recommendations:

• Keep systems updated with the latest software patches, microcode updates, and hardware redesigns to mitigate Meltdown and other vulnerabilities.
• Implement non-trivial mitigations such as changing the JCC instruction or rewriting the EFLAGS after transient execution.
• Use a multi-layered approach to security, including technical solutions, user education and awareness of cybersecurity risks and best practices.