The YubiKey 5, the most widely used hardware token for two-factor authentication based on the FIDO standard, contains a cryptographic flaw that makes the finger-size device vulnerable to cloning when an attacker gains temporary physical access to it, researchers said Tuesday.

The cryptographic flaw, known as a side channel, resides in a small microcontroller used in a large number of other authentication devices, including smartcards used in banking, electronic passports, and the accessing of secure areas. While the researchers have confirmed all YubiKey 5 series models can be cloned, they haven’t tested other devices using the microcontroller, such as the SLE78 made by Infineon and successor microcontrollers known as the Infineon Optiga Trust M and the Infineon Optiga TPM. The researchers suspect that any device using any of these three microcontrollers and the Infineon cryptographic library contains the same vulnerability.

Patching not possible

YubiKey-maker Yubico issued an advisory in coordination with a detailed disclosure report from NinjaLab, the security firm that reverse-engineered the YubiKey 5 series and devised the cloning attack. All YubiKeys running firmware prior to version 5.7—which was released in May and replaces the Infineon cryptolibrary with a custom one—are vulnerable. Updating key firmware on the YubiKey isn’t possible. That leaves all affected YubiKeys permanently vulnerable.

“An attacker could exploit this issue as part of a sophisticated and targeted attack to recover affected private keys,” the advisory confirmed. “The attacker would need physical possession of the YubiKey, Security Key, or YubiHSM, knowledge of the accounts they want to target and specialized equipment to perform the necessary attack. Depending on the use case, the attacker may also require additional knowledge including username, PIN, account password, or authentication key.”

Side channels are the result of clues left in physical manifestations such as electromagnetic emanations, data caches, or the time required to complete a task that leaks cryptographic secrets. In this case, the side channel is the amount of time taken during a mathematical calculation known as a modular inversion. The Infineon cryptolibrary failed to implement a common side-channel defense known as constant time as it performs modular inversion operations involving the Elliptic Curve Digital Signature Algorithm. Constant time ensures the time sensitive cryptographic operations execute is uniform rather than variable depending on the specific keys.

More precisely, the side channel is located in the Infineon implementation of the Extended Euclidean Algorithm, a method for, among other things, computing the modular inverse. By using an oscilloscope to measure the electromagnetic radiation while the token is authenticating itself, the researchers can detect tiny execution time differences that reveal a token’s ephemeral ECDSA key, also known as a nonce. Further analysis allows the researchers to extract the secret ECDSA key that underpins the entire security of the token.

In Tuesday’s report, NinjaLab co-founder Thomas Roche wrote:

In the present work, NinjaLab unveils a new side-channel vulnerability in the ECDSA implementation of Infineon 9 on any security microcontroller family of the manufacturer.This vulnerability lies in the ECDSA ephemeral key (or nonce) modular inversion, and, more precisely, in the Infineon implementation of the Extended Euclidean Algorithm (EEA for short). To our knowledge, this is the first time an implementation of the EEA is shown to be vulnerable to side-channel analysis (contrarily to the EEA binary version). The exploitation of this vulnerability is demonstrated through realistic experiments and we show that an adversary only needs to have access to the device for a few minutes. The offline phase took us about 24 hours; with more engineering work in the attack development, it would take less than one hour.

After a long phase of understanding Infineon implementation through side-channel analysis on a Feitian 10 open JavaCard smartcard, the attack is tested on a YubiKey 5Ci, a FIDO hardware token from Yubico. All YubiKey 5 Series (before the firmware update 5.7 11 of May 6th, 2024) are affected by the attack. In fact all products relying on the ECDSA of Infineon cryptographic library running on an Infineon security microcontroller are affected by the attack. We estimate that the vulnerability exists for more than 14 years in Infineon top secure chips. These chips and the vulnerable part of the cryptographic library went through about 80 CC certification evaluations of level AVA VAN 4 (for TPMs) or AVA VAN 5 (for the others) from 2010 to 2024 (and a bit less than 30 certificate maintenances).

https://arstechnica.com/?p=2046777

Research from the GuidePoint Research and Intelligence Team highlights a sophisticated, ongoing phishing campaign that has targeted over 130 organizations. This campaign targets employees by mimicking the VPN providers their organizations use, registering domain names that are similar to the legitimate domain names. 

Security leaders weigh in 

Patrick Harr, CEO at SlashNext Email Security+:

“Unfortunately, we continue to see creative attacks like these that prey on unsuspecting users. Using typosquatting domains (those that are very similar to the actual real VPN domain) is not a new tactic. What is more creative is the use of messaging channels outside of email. SMS is now the second most attacked vector and mobile phones have minimal to no protection, hence why threat actors are creatively attacking them with greater volume.  

“Training is no longer effective against these attacks alone. That’s why it’s imperative that organizations must employ AI-based anti-phishing in SMS and other messaging apps locally on the phone to pre-emptively thwart these attacks before they compromise employees.”

John Bambenek, President at Bambenek Consulting:

“The technique of phishing users by using third-party brands is not new, however, the use of VPNs is novel and much more dangerous. This allows the attacker to get unencrypted data by placing themselves as a trusted intermediary, especially if they can get a malicious CA installed on the device. It is explicitly targeting a weak link, BYOD and employees individual devices, knowing full well that enterprise tools won’t detect this.”

https://www.securitymagazine.com/articles/100998-security-leaders-discuss-a-sophisticated-ongoing-phishing-campaign

Young Consulting announced a data breach affecting Blue Shield of California subscribers in late August 2024.

Young Consulting revealed that an unauthorized actor gained access to its computer network in April 2024 and downloaded copies of certain files. Young Consulting determined that this data belonged to Blue Shield of California subscribers.

Young Consulting has informed Blue Shield of California subscribers that the following private information may have been stolen in the breach: names, Social Security numbers, dates of birth, and insurance claim information.

https://www.securitymagazine.com/articles/100999-young-consulting-and-blue-shield-of-california-announce-data-breach

Set 03, 2024 Marina Londei Approfondimenti, News, RSS, Tecnologia, Tecnologia 0

---

Le identità digitali si moltiplicano e con esse anche le preoccupazioni legate alla privacy, persino per chi non c’è più: secondo lo studio di Kaspersky “Entusiasmo, superstizione e grande insicurezza – Come gli utenti di tutto il mondo si confrontano con l’universo digitale“, il 55% degli utenti italiani ritiene che l’eredità digitale dei defunti sia particolarmente vulnerabile al furto. Il motivo, secondo gli intervistati, è che non c’è nessuno che monitori le informazioni pubblicate online.

Sempre riguardo le persone decedute, il 28% degli intervistati considera accettabile ricreare l’identità digitale di un defunto tramite foto, video e altri ricordi, mentre il 45% si dice contrario.

Il 68% degli italiani ritiene comunque che vedere immagini o storie di persone decedute possa turbare chi era vicino a loro, mentre il 29% pensa che non ci sia un limite di tempo per raccogliere tutti i media pubblicati online riguardo una persona specifica.

Tornando alla preoccupazione per la privacy dei defunti, il 66% degli intervistati è concorde sulla necessità di controllare la presenza digitale dopo la morte includendo nel proprio testamento che cosa fare dei propri dati online e degli account social.

“Il problema della gestione della propria presenza digitale è spesso trascurato nelle attività online quotidiane. Tuttavia, i risultati del sondaggio sottolineano un punto critico: un numero significativo di intervistati è consapevole del fatto che le identità rubate possono causare immensi problemi personali agli utenti o ai loro cari” ha commentato Anna Larkina, Web Content Analysis Expert di Kaspersky. “Alla luce di questi rischi, è prudente adottare misure proattive per migliorare la privacy e salvaguardare le identità digitali. Così facendo, gli utenti possono assicurarsi che la loro presenza online rimanga sicura e rispettabile, in ogni caso“.

Per proteggere adeguatamente la propria identità digitale, Kaspersky consiglia di usare soluzioni di sicurezza per monitorare quali dati personali vengono elaborati dalle applicazioni, limitandone il più possibile la raccolta, e tenere sempre aggiornati il sistema operativo, il browser e qualsiasi software di sicurezza in uso.

---

---

---

https://www.securityinfo.it/2024/09/03/gli-italiani-si-preoccupano-delleredita-digitale-dei-defunti/?utm_source=rss&utm_medium=rss&utm_campaign=gli-italiani-si-preoccupano-delleredita-digitale-dei-defunti

The BlackByte ransomware group typically utilizes tactics, techniques and procedures (TTPs) that leverage vulnerable drivers to evade security measures to deploy a self-spreading ransomware encryptor. However, recent investigations by Talos IR reveal that BlackByte is deploying techniques that vary from its typical methods. BlackByte was observed exploiting a vulnerability in VMware ESXi (CVE-2024-37085), allowing for an authentication bypass.

Darren Guccione, CEO and Co-Founder at Keeper Security, comments, “The exploitation of CVE-2024-37085 represents an aggressive approach by BlackByte. It demonstrates a shift toward quickly iterating and updating tooling to capitalize on vulnerabilities at speed, before organizations are able to bolster their defenses. As ransomware groups like BlackByte continue to evolve their TTPs, organizations must invest in adaptive security measures that can keep up with the ever-evolving threat environment.

“The exploitation of vulnerabilities in ESXi by BlackByte and similar threat actors indicates a focused effort to compromise the core infrastructure of enterprise networks. Given that ESXi servers often host multiple virtual machines, a single successful attack can cause widespread disruption, making them a prime target for ransomware groups. BlackByte’s evolution to using advanced programming languages like C/C++ in their latest encryptor, BlackByteNT, reflects their intent to make their malware more resistant to detection and analysis with sophisticated anti-analysis and anti-debugging techniques.”

Why did BlackByte change tactics? 

Heath Renfrow, Co-founder of Fenix24, offers the following suggestion for why BlackByte may have adjusted its methods, saying, “The reason for this pivot is most likely due to the effectiveness and the number of systems still tied into Active Directory (AD), either directly or through vCenter. Gaining this level of access provides a one-stop shop where attackers can deploy their ransomware or move laterally to other hypervisors.”

Callie Guenther, Senior Manager, Cyber Threat Research at Critical Start, elaborates, “Traditionally, ransomware groups rely on well-established techniques to gain initial access, escalate privileges, and execute their malicious payloads. However, the exploitation of a new, recently disclosed vulnerability (CVE-2024-37085) in VMware ESXi hypervisors indicates a strategic pivot.

“Previously, BlackByte and similar groups have frequently relied on exploiting known vulnerabilities in widely used software (e.g., ProxyShell vulnerabilities in Microsoft Exchange) or leveraging phishing campaigns and brute-force attacks to gain access. They have used web shells, Cobalt Strike, and credential-stealing tools like Mimikatz to move laterally across networks and escalate privileges within compromised environments. The group has historically used methods such as process hollowing, registry modifications, and manipulation of system components like Volume Shadow Copies to ensure the success of their ransomware execution.

“By exploiting CVE-2024-37085, BlackByte is demonstrating an ability to quickly integrate new vulnerabilities into their toolkit, moving away from purely relying on older, well-known techniques. This shift shows that they are willing to adopt cutting-edge methods to improve the effectiveness of their attacks. VMware ESXi hypervisors are critical in many enterprise environments, often hosting multiple virtual machines that run vital business applications. Targeting such infrastructure allows the attackers to cause significant disruption, increasing the pressure on victims to pay the ransom.”

Why is this significant? 

Guenther explains, “The focus on VMware ESXi hypervisors by groups like BlackByte is particularly concerning because these servers are often central to the IT infrastructure of enterprises. By compromising an ESXi server, attackers can potentially disrupt or gain control over multiple virtual machines running critical services, magnifying the impact of the attack. The adoption of the CVE-2024-37085 vulnerability by BlackByte signals an understanding of the value in targeting these systems, as they offer a high return on investment for the attackers in terms of potential ransom payouts.

“Overall, BlackByte’s ability to adapt and leverage both new vulnerabilities and sophisticated techniques like BYOVD reflects their intent to remain a potent threat in the ransomware landscape. The group’s persistence in attacking ESXi servers highlights the importance of keeping such critical infrastructure updated and secured against the latest threats.”

How can security leaders defend against BlackByte or similar tactics? 

To protect against these sophisticated attacks, Guccione advises, “Defending against these threats requires regularly hardening and patching ESXi hosts to address vulnerabilities swiftly. Implementing multi-factor authentication for remote access, auditing VPN configurations and closely monitoring privileged access are essential to minimizing the risk of compromise. Additionally, securing authentication protocols, disabling unused vendor accounts and maintaining robust detection capabilities for unauthorized changes are crucial to securing these key systems from the increasingly sophisticated tactics we’re seeing from ransomware groups like BlackByte.”

https://www.securitymagazine.com/articles/100997-vmware-esxi-flaw-leveraged-by-blackbyte-ransomware

A national survey of of K-12 educators highlights the impacts school safety (or a lack thereof) has on staff recruitment and retention as well as student learning. The survey found that 80% of educators worry on a regular basis for their physical safety. Furthermore, only 33% feel as though their school or district prioritizes their safety, and 74% do not feel sufficiently supported by the school or district to manage security incidents. 

The survey shows how teachers feel about security’s impact on recruitment and retention, as 77% believe school security has a significant influence. 57% know an educator who left a job due to feeling unsafe, and 45% have left a job or have considered leaving a job themselves for the same reason. 

In addition to impacting staff, poor security also influences students. 84% of educators believe that school safety directly affects student success, and 83% state that students are concerned about their safety at school. Moreover, 56% report the loss of two or more instructional hours each week to address safety incidents. This is the equivalent of nine or more school days each year. 

https://www.securitymagazine.com/articles/100996-80-of-k-12-educators-regularly-consider-their-safety-at-work

Bot attacks and security concerns were analyzed in a recent report by Kasada. The report found that 98% of organizations attacked by bots in the past year lost revenue as a result. Web scraping (web crawling) is a major threat followed closely by account fraud, with more than one third of IT/IS specialists reporting their organizations experienced over 5% revenue loss as a result of each.

The report found that 67% of technology companies are currently using CDN-based bot detection. 30% say their organization has spent $1,000,000 or more on mitigating bot attacks over the past year. Despite these expenditures, traditional bot mitigation solutions are falling short. Just one in five say that after initial deployment their bot mitigation solution(s) retained effectiveness for more than 12 months. So it’s not surprising that 79% say they are likely to switch bot mitigation providers based on their detection and efficacy.

The report highlights the following trends:

• Leaders are very worried about AI-fueled fraud and automated threats.
• 87% of IT/IS specialists say their executive team is concerned about bot attacks and AI-driven fraud.

Many IT/IS specialists are concerned about AI fueling more complex and more frequent bot attacks. The following AI-driven security threat scenarios are the most concerning:

• Generative AI enabling criminal attackers to pull off complex attacks with more ease.
• Sophisticated bots’ developing the ability to easily bypass CAPTCHAs.
• Increased frequency of advanced attacks that could cause a major disruption to their organization.
• Most IT leaders are worried about CAPTCHA ineffectiveness, yet businesses continue to rely on them.
• More than half (57%) of IT/IS specialists say sophisticated bots developing the ability to easily bypass CAPTCHAs is a major concern.
• Nearly three quarters (73%) of IT/IS specialists say they believe the customer experience on websites would be improved by the elimination of CAPTCHAs.

Web scraping is amongst the most costly automated threats to businesses. Among IT/IS specialists who report that their company experienced a bot attack in the past 12 months:

• 37% report their organization has lost more than 5% of revenue as a result of web scraping.
• 34% report their organization has lost more than 5% of revenue due to account fraud.
• 26% report their organization has lost more than 5% of revenue due to SMS pumping / toll fraud.

https://www.securitymagazine.com/articles/100991-87-of-executives-are-concerned-about-bot-attacks-and-ai-fraud

In early 2024, Microsoft was notified of a vulnerability that could allow for the theft of sensitive user information. This vulnerability, which has now been patched, affected Microsoft 365 Copilot and opened the door for ASCII smuggling. 

Due to the vulnerability, a reliable exploit chain could be fashioned with a string of various attack methods: 

• Induce prompt injection via malicious, concealed content in a document shared through chat,
• Leverage a prompt injection payload to command Microsoft 365 Copilot to find more emails and documents, 
• And deploy ASCII smuggling to cause the target to click on a link, exfiltrating sensitive data to a third-party server. 

As a result of such an attack, sensitive information in emails (including multi-factor authentication codes) could be given to a server controlled by the malicious actor. 

Security leaders weigh in 

Stephen Kowski, Field CTO at SlashNext Email Security+:

“This ASCII smuggling technique highlights the evolving sophistication of AI-enabled attacks, where seemingly innocuous content can conceal malicious payloads capable of exfiltrating sensitive data. To protect against such threats, organizations should implement advanced threat detection systems that can analyze content across multiple communication channels, including email, chat and collaboration platforms. These solutions should leverage AI and machine learning to identify subtle anomalies and hidden malicious patterns that traditional security measures might miss. Additionally, continuous employee education on emerging threats and the implementation of strict access controls and data loss prevention measures are crucial in mitigating the risks posed by these innovative attack vectors.”

Jason Soroko, Senior Fellow at Sectigo: 

“The ASCII smuggling flaw in Microsoft 365 Copilot is a novel vulnerability that allows attackers to hide malicious code within seemingly harmless text using special Unicode characters. These characters resemble ASCII but are invisible in the user interface, allowing the attacker to embed hidden data within clickable hyperlinks. When a user interacts with these links, the hidden data can be exfiltrated to a third-party server, potentially compromising sensitive information, such as MFA one time password codes.

“The attack works by stringing together multiple methods: First, a prompt injection is triggered by sharing a malicious document in a chat. Then, Copilot is manipulated to search for more sensitive data, and finally, ASCII smuggling is used to trick the user into clicking on an exfiltration link.

“To mitigate this risk, users should ensure their Microsoft 365 software is updated, as Microsoft has patched the vulnerability. Additionally, they should exercise caution when interacting with links in documents and emails, especially those received from unknown or untrusted sources. Regular monitoring of AI tools like Copilot for unusual behavior is also essential to catch and respond to any suspicious activity quickly

“What needs to be reported on more often is the tactic of prompt injections.  A prompt injection is a type of attack where an attacker manipulates an AI system, such as a large language model, by crafting specific inputs (or “prompts”) that cause the AI to perform unintended actions. In the context of AI-driven tools like Microsoft 365 Copilot, a prompt injection can involve embedding malicious instructions within a document or message. When the AI processes these inputs, it mistakenly interprets them as legitimate commands, leading to actions like retrieving sensitive information, altering responses, or even exfiltrating data.

“The essence of a prompt injection attack is that it takes advantage of the AI’s ability to interpret and act on natural language inputs, causing it to carry out operations that the user or system owner did not intend. This can be particularly dangerous when the AI has access to sensitive data or controls within a system.”

https://www.securitymagazine.com/articles/100995-microsoft-vulnerability-that-could-enable-data-theft-is-now-patched

Set 02, 2024 Stefano Silvestri Attacchi, Malware, Minacce, News, Phishing, Tecnologia, Vulnerabilità 0

---

Il CERT-AGID ha condotto un’analisi approfondita delle minacce informatiche in Italia nell’ultima settimana, identificando 47 campagne malevole, di cui 27 specificamente mirate a obiettivi italiani. L’agenzia ha fornito 438 indicatori di compromissione (IoC) agli enti accreditati.

I temi più rilevanti della settimana

Questa settimana sono stati identificati 20 temi sfruttati per veicolare campagne malevole in Italia. Tra i più rilevanti troviamo innanzitutto il tema “Delivery“, utilizzato per campagne di phishing italiane, mirate ad Aruba, e per campagne generiche che hanno colpito Wix e altri servizi di web hosting.

Il tema “Undelivered” è stato sfruttato per campagne di phishing ai danni di Poste Italiane e per veicolare phishing webmail generici. Il tema “Documenti” è stato impiegato in campagne di phishing webmail e per la diffusione dei malware AsyncRat e Vip Keylogger.

“Pagamenti” è stato usato in campagne di phishing contro SiteGround e per distribuire il malware Snake Keylogger. Infine, il tema “Erogazioni” è stato utilizzato in campagne di phishing italiane contro l’INPS e l’Agenzia delle Entrate. Altri temi sono stati sfruttati per diffondere varie campagne di malware e phishing.

Tra gli eventi di particolare interesse si segnala una campagna di phishing che ha colpito l’Agenzia delle Entrate, mirata a sottrarre le credenziali bancarie delle vittime. L’email, simulando un rimborso, invita il destinatario a compilare un modulo per completare l’erogazione.

Inoltre, sono emerse nuove campagne di smishing dell’INPS, finalizzate alla raccolta di dati personali come carta d’identità, codice fiscale, patente, IBAN e busta paga. Maggiori dettagli e Indicatori di Compromissione (IoC) sono disponibili sul canale Telegram del CERT-AGID.

Malware della settimana

Durante la settimana sono state individuate sette famiglie di malware che hanno colpito l’Italia, con alcune campagne particolarmente rilevanti.

AgentTesla ha dato origine a due campagne, una italiana e una generica, entrambe a tema “Pagamenti”, diffuse tramite email contenenti allegati EXE e RAR. Cryptbot è stato scoperto in una campagna generica a tema “Adobe”, veicolata tramite email con allegato EXE.

SnakeKeylogger è stato rilevato in una campagna italiana, anch’essa a tema “Pagamenti”, diffusa tramite email con allegati EXE. VipKeylogger ha interessato una campagna italiana a tema “Documenti”, distribuita tramite email con allegati SCR e ZIP.

Guloader è stato individuato in una campagna italiana a tema “Preventivo”, diffusa tramite email contenente un allegato VBS. Clearfake ha visto una campagna italiana che sfrutta il tema “Cryptovalute”, con eseguibili diffusi attraverso domini italiani compromessi.

Infine, AsyncRat è stato rilevato in una campagna generica a tema “Documenti”, diffusa tramite email con allegato JS.

Phishing della settimana

Nell’ultima settimana, il panorama delle minacce informatiche ha visto un’intensa attività di phishing che ha coinvolto 13 marchi diversi. Tra le numerose campagne osservate, tre in particolare hanno dominato lo scenario per la loro frequenza e intensità.

I servizi Webmail sono emersi come uno degli obiettivi principali, probabilmente per la loro capacità di fungere da “finestra” su una moltitudine di informazioni personali e professionali.

Parallelamente, Aruba è stato ripetutamente preso di mira, sottolineando l’appetibilità delle credenziali legate ai servizi di hosting per i malintenzionati. Non da meno, l’INPS ha registrato un numero significativo di attacchi, riflettendo il valore percepito dei dati personali e finanziari gestiti dall’ente previdenziale italiano.

Formati e canali di diffusione

L’analisi delle campagne malevole della settimana ha messo in luce un panorama meno variegato di altre settimane in termini di tipologie di file dannosi e metodi di diffusione. Sono state infatti individuate “solo” cinque diverse estensioni di file utilizzate dai cybercriminali.

I file eseguibili (EXE) sono risultati i più comuni, essendo stati impiegati in quattro diverse occasioni. Le altre estensioni, ciascuna rilevata una sola volta, includono ZIP, SCR, RAR, JAR e VBS, evidenziando così la capacità dei malintenzionati di variare le loro tattiche per aggirare i sistemi di sicurezza.

Per quanto riguarda i metodi di diffusione, le email si sono confermate il canale preferito dagli attaccanti, con 44 campagne distinte che hanno sfruttato questo mezzo. In misura minore, ma comunque rilevante, gli SMS sono stati utilizzati in due occasioni, probabilmente nell’ambito di campagne di smishing mirate. Infine, si è registrato un unico caso in cui è stata impiegata la Posta Elettronica Certificata (PEC).

---

---

---

https://www.securityinfo.it/2024/09/02/cert-agid-24-30-agosto-agenzia-delle-entrate-e-inps-sotto-attacco/?utm_source=rss&utm_medium=rss&utm_campaign=cert-agid-24-30-agosto-agenzia-delle-entrate-e-inps-sotto-attacco

In 2024, the software supply chain has faced attacks at a minimum rate of one every two days. Research from Cyble shows that while software supply chain attacks are increasing across the globe, the United States was the most targeted country. Other common targets include the United Kingdom, Australia, Germany, India and Japan.

Within a six month period (February to mid-August 2024) the research found 90 claims of successful attacks against supply chains. IT providers faced the most supply chain breaches (30 breaches) at one-third of all attacks. Other frequently targeted sectors include: 

Due to the multiplication factor on downstream victims, supply chain software attacks can have a unique impact. Security leaders are encouraged to vet vendors and service providers before partnering with them to protect against the ramifications of such incidents. 

https://www.securitymagazine.com/articles/100985-software-supply-chain-experiences-almost-1-attack-every-2-days