Breach Disclosure: ShareThis

In February 2019, The Register reported on a trove of information dumps being sold on the dark web. This collection contained details from approximately 16 sources, one of them being ShareThis, a social bookmarking and sharing tool. The ShareThis breach specifically contained 41 million rows of email addresses, usernames, dates of birth and password hashes. The ShareThis breach, along with others in the Register report, has been made available to the general public, while other dumps have yet to be disclosed.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

ShareThis is number 5 out of the 16 breaches from The Register report that have been disclosed to the public. This disclosed breach contained 41 million rows of email addresses, usernames, dates of birth and password hashes. In the company's notice of the breach, they reported that they were informed on February 11 2019 and believe the incident occurred in or prior to July 2018. The company deactivated ShareThis accounts associated with this breach and are engaged with incident response and forensic experts to evaluate the full impact of the breach.

Research: NSA Releases GHIDRA - A Free Reverse Engineering Tool

The National Security Agency (NSA) released their home-grown software reverse engineering tool at RSA this week. The NSA claims this tool has been used internally for years to reverse engineer malware and find security bugs in software. Robert Joyce, the adviser who released this tool at RSA, said that GHIDRA contains “...all the features expected in high-end commercial tool”. Although Joyce claims GHIDRA contains no backdoors, there was a report by security researcher HackerFantastic of an exposed debugging port listening on all interfaces that allows arbitrary remote code execution.

Recommendations

• GHIDRA maintainers and other researchers claim that the exposed debugger port is intended for team access, a feature in GHIDRA. Be weary of using GHIDRA in environments where this exposed port can be exploited by attackers

Details

In a tweet by HackerFantastic, the researcher points out JDWP in debug mode is listening on port 18001 via all interfaces when GHIDRA is opened. The Java Debug Wire Protocol (JDWP) is useful for debugging Java applications and has been historically written about by pentesters as a useful way to obtain remote code execution on a machine running the service. The associated Github issue contains a reference to HackerFantastic’s tweet with some proposed fixes on launching GHIDRA on a local interface.

Vulnerability: New Chrome Zero-Day Actively Exploited in the Wild

Google’s Threat Analysis Group discovered and disclosed a high severity vulnerability last month that allowed remote code execution on Chrome browsers. The Chrome security team did not release much detail about the vulnerability but did disclose it is a Use-After-Free vulnerability in one of the core components of Chrome. This vulnerability affects Chrome browsers across Windows, Mac and Linux environments. The update was released on Friday, 1 March, along with a warning that the team has received reports of the vulnerability being exploited in the wild.

Recommendations

• Update Google Chrome to the latest stable release on all devices
• If on 32-bit Windows 7, upgrade to Windows 10 as Windows 7 has been actively exploited the most
• Monitor CVE-2019-5786 chatter on ZeroFOX for PoC disclosures

Details

The exploit was found by Clement Lecigne of Google’s Threat Analysis group. Google is withholding information about the bug until a majority of its users update to versions of Chrome that resolve this issue. The Use-After-Free was found in the FileReader component, which is present in all major operating system versions of Chrome. The stable channel update page for Chrome Desktop was updated on 5 March 2019 to add the reporter and exploit in the wild information. On 7 March, Google released an additional announcement with some clarifying information on the exploit. They have observed active exploitation against 32-bit Windows 7 systems, and protections in Windows 10 have mitigated the vulnerability.