Vulnerability: Whatsapp

On May 13 2019, The Guardian reported that WhatsApp has a vulnerability which allows for malicious software to be run on a user's phone. The malicious software can be automatically installed by merely calling a user. Perhaps even more insidious is that the call log on the user's phone is cleared so that no evidence remains of the caller that initiated the attack. WnatsApp has released a version of the software which fixes this bug.

Recommendations

• Update the the latest version of WhatsApp
• Ensure phone antivirus software is up to date with the latest signatures

Details

WhatsApp is encouraging users to update to the latest application version due to a flaw in their software. Namely, a vulnerability was discovered which allowed a malicious user to inject malware onto a call recipient's device. Perhaps most alarmingly, the user is not required to answer the call to be infected and once infected, the malware gets rid of the incoming call logs, making it difficult to tell if a user has been targeted. WhatsApp has corrected the issue and released an update version of their application.

The organization that created the software, the NSO Group claims that their software, Pegasus is incapable of causing harm on its own and requires an attack vector to target a given user. Furthermore, they claim that they only sell to state intelligence agencies. However, given the attack surface and potential for exploitation, WhatsApp has briefed human rights organizations about the potential for abuse.

Vulnerability: Remote Desktop

On May 14 2019, Microsoft announced a fix for Remote Desktop which patched a critical security vulnerability (CVE-2019-0708). This vulnerability allows the attacker to execute arbitrary code remotely, without authenticating. Microsoft is releasing the patch prior to seeing any exploits in the wild in an effort to prevent the vulnerability being used as an attack vector for a worm or other malware. Microsoft is encouraging administrators to patch all systems as soon as possible.

Recommendations

• Update affected versions of Windows with the latest patch Windows 7, Windows 2008 R2, Windows 2008 and Windows 2003 and Windows XP

Details

Microsoft has released a patch for currently supported and formerly supported versions of Windows which fixes a critical vulnerability in the Remote Desktop service. In CVE-2019-0708, they detail that the Remote Desktop service is vulnerable to a remote code execution vulnerability. Vulnerable systems still being supported include Windows 7, Windows Server 2008 R2, and Windows Server 2008, however, Microsoft is releasing the patch for systems no longer supported like Windows 2003 and Windows XP. The vulnerability takes place before a user authenticates and does not require the attacker to be logged in to exploit the vulnerability. Due to the ability to infect a system without authentication, Microsoft is concerned about the potential for this vulnerability to be used to create worm. While Microsoft has not seen any instances in the wild that exploit this vulnerability, they released a patch preemptively and encouraging administrators to patch systems as soon as possible.

Cybercriminal Group behind GozNym Arrested by Europol and Partners

On 16 May 2019, a press conference held by Europol confirmed the dismantling of a major cybercrime network behind the GozNym banking malware. The press release stated that the malware attempted to steal an estimated $100 Million from more than 41,000 victims, primarily businesses and their associated financial organizations. The operation conducted physical searches in Bulgaria, Georgia, Moldova and Ukraine, and prosecutions were issued in Georgia, Moldova, Ukraine and the US.

Recommendations

• Enable the Cyber Attack Chatter rule and configure it to listen for GozNym chatter, especially if operations have moved or new indicators emerge from the research community

Details

The GozNym malware has been in the news for a number of years. Google trends shows a large spike in searches for GozNym in March 2016. Victims were infected by the malware to capture banking login credentials, which were then used by the criminal network to pilfer accounts and launder the money through U.S. and foreign bank accounts. A number of specialized cybercrime tactics were involved in the operation, whether it was bulletproof hosts, mules, crypters, spammers, developers or even tech support, the scale of GozNym shows what a sophisticated group of cybercriminals can accomplish in just a few short years.

Vulnerability: Intel Processors

On May 14 2019, HackerNews announced that academic researchers released the newest class of speculative execution side-channel attacks against Intel chips. The new class of vulnerability affects nearly all processors since 2011. Former side-channel attacks against speculative execution only potentially leaked data within CPU caches. However, the new attack can leak arbitrary data from internal CPU buffers, which can potentially leak arbitrary data. Some vendors have released patches to combat this vulnerability and more are expected imminently. No in-the-wild variants of this attack have been found to date.

Recommendations

• A tool has been released for Windows and Linux to test a system for speculative execution attacks
• Updates have been released for macOS, Windows, ChromeOS, and Linux
• Intel has released patches for some of its hardware, but others will have to wait until motherboard vendors release updates
• Continue to install relevant operating system updates and patches because various vendors responsible for patching this vulnerability will respond at different rates

Details

Researchers announced a new speculative execution attack against Intel processors. Speculative execution attacks rely on the fact that modern processors use speculative execution to determine if certain code paths are likely to be taken or not. When a processor speculatively executes a branch instruction, it may cross certain privileged barriers and cause the CPU's cache to speculatively load the target of that branch. When this happens, critical data that should only be available to a privileged processor can be potentially leaked by comparing the length of time it takes to do a load which was speculatively executed versus a load in the cache line that was not preemptively loaded. Using statistical sampling methods and enough time, arbitrary data can be leaked from the cache line.

This new class of attack can not only read cache lines but can sample internal CPU buffers for in flight data, which can potentially leak arbitrary data, given enough time on the end system. The CVEs associated with these attacks are: Fallout (CVE-2018-12126), Zombieload/RIDL (CVE-2018-12130), Microarchitectural Load Port Data Sampling (CVE-2018-12127), and this advisory, CVE-2019-11091 (Microarchitectural Data Sampling Uncacheable Memory, a RIDL variant).The researchers demonstrated a proof-of-concept attack that can break Kernel Address Space Layout Randomization as well as leak sensitive kernel data. However, these attacks are in their infancy and no in-the-wild variants have been discovered so far. Patches for this exploit flush caches and in flight buffers if a context switch to privileged code occurs from unprivileged code.