ESET Discovers UEFI Bootkit in Cyber Espionage Campaign

Threat hunters at ESET are training the spotlight on a previously undocumented UEFI bootkit capable of hijacking the EFI System Partition (ESP) to maintain persistence on infected Windows machines.

The ESET discovery is the second real-world UEFI bootkit to be publicly documented in recent weeks, following Kaspersky’s report on a new Windows UEFI bootloader fitted into the FinSpy surveillance spyware product.

According to ESET researchers Anton Cherepanov and Martin Smolar, the malware has evaded detection for almost a decade and was engineered to bypass Windows Driver Signature Enforcement to load its own unsigned driver.

“We traced the roots of this threat back to at least 2012, previously operating as a bootkit for systems with legacy BIOSes,” the research team said, noting that the upgrade to UEFI went unnoticed and undocumented for many years. “The days of UEFI (Unified Extensible Firmware Interface) living in the shadows of the legacy BIOS are gone for good.”

ESET named the threat “ESPecter” and warned it is capable of injecting code to set up command-and-control server connections.

[ READ: FinSpy Surveillance Spyware Fitted With UEFI Bootkit ]

ESET, which sells anti-malware software to corporate customers around the world, said the bootkit was spotted on a compromised machine along with a user-mode client component with keylogging and document-stealing functionalities

From the ESET report:

By patching the Windows Boot Manager, attackers achieve execution in the early stages of the system boot process, before the operating system is fully loaded. This allows ESPecter to bypass Windows Driver Signature Enforcement (DSE) in order to execute its own unsigned driver at system startup.

This driver then injects other user-mode components into specific system processes to initiate communication with ESPecter’s C&C server and to allow the attacker to take control of the compromised machine by downloading and running additional malware or executing C&C commands.

The researchers say they were not able to attribute ESPecter to any known threat actor, but noted there were signs of Chinese debug messages in the user-mode client component, a suggestion that an unknown Chinese-speaking threat actor may be behind this campaign.

“After all the years of insignificant changes, those behind ESPecter apparently decided to move their malware from legacy BIOS systems to modern UEFI systems. They decided to achieve this by modifying a legitimate Windows Boot Manager binary (bootmgfw.efi) located on the ESP while supporting multiple Windows versions spanning Windows 7 through Windows 10,” the team said.

[ READ: Russian Cyberspies Use UEFI Rootkit in Attacks ]

The persistence method only works if the Secure Boot feature in Windows is disabled, a reality on older versions of Microsoft’s operating system.

For Windows OS versions that support Secure Boot, ESET said the attacker could disable the feature via an “evil maid” physical access attack or exploiting additional security vulnerabilities to expand the attack.

“ESPecter shows that threat actors are relying not only on UEFI firmware implants when it comes to pre-OS persistence and, despite the existing security mechanisms like UEFI Secure Boot, invest their time into creating malware that would be easily blocked by such mechanisms, if enabled and configured correctly,” the researchers said.

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. Ryan is a journalist and cybersecurity strategist with more than 20 years experience covering IT security and technology trends. He is a regular speaker at cybersecurity conferences around the world.
Ryan has built security engagement programs at major global brands, including Intel Corp., Bishop Fox and Kaspersky GReAT. He is a co-founder of Threatpost and the global SAS conference series. Ryan’s career as a journalist includes bylines at major technology publications including Ziff Davis eWEEK, CBS Interactive’s ZDNet, PCMag and PC World.
Follow Ryan on Twitter @ryanaraine.

Previous Columns by Ryan Naraine:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/wHS2vNC7l9g/eset-discovers-uefi-bootkit-cyber-espionage-campaign

Yubico Enables Biometric Logins With New YubiKey Bio Series

Yubico this week announced the general availability of YubiKey Bio Series, its first security key to support biometric authentication on desktop computers.

Featuring support for the FIDO2/WebAuthn and U2F protocols, YubiKey Bio Series leverages fingerprint recognition to enable users to securely log in to their accounts using a second factor or without passwords at all.

The new security keys support the biometric enrollment and management features that have been implemented in modern platforms and operating systems.

According to Yubico, the devices have a three chip architecture and they store the biometric fingerprint material in a separate secure element, to ensure increased protection from physical attacks.

With the new YubiKey Bio, users can log in to desktop applications and services that support FIDO protocols, the company says. Microsoft 365 and Azure Active Directory, Citrix Workspace, GitHub, Duo, IBM Security Verify, as well as Okta and Ping Identity are supported out-of-the-box.

The new YubiKey Bio Series, Yubico says, meets stringent hardware security key requirements, and it works cross platform (Windows, macOS, and Chrome OS) and cross browser (Chromium-based browsers), courtesy of support for WebAuthn. YubiKey Bio is available in USB-A and USB-C form factors, allows users to easily switch devices, supports security key PINs (where biometrics cannot be used), and is supported by the Yubico Authenticator for Desktop app on desktop.

“With the launch of the YubiKey Bio Series, we are proud to raise the standard for biometric security keys, enabling simple and strong passwordless authentication for our enterprise customers and everyday YubiKey users,” said Stina Ehrensvärd, CEO and co-founder of Yubico.

The YubiKey Bio is now available at $80 for the USB-A form-factor and $85 for the USB-C form-factor.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/msighpUiwu8/yubico-enables-biometric-logins-new-yubikey-bio-series

Microsec.ai Exits Stealth With Cloud Application Runtime Protection Platform

Microsec.ai on Tuesday emerged from stealth mode to deliver a Cloud Native Application Protection Platform (CNAPP) solution designed to protect cloud-native applications at runtime.

The company’s agentless CNAPP solution aims to secure multi-cloud IaaS and PaaS environments, as well as containers and data, through a single, unified interface.

Founded in February 2021, the Santa Clara, California-based company offers support for major cloud infrastructure providers, including AWS, Azure, Google, IBM, and Oracle.

Microsec.ai claims to provide visibility into containers, microservices, network traffic, workloads, misconfigurations, and vulnerabilities, while also helping organizations remain compliant with policies and regulations and improve their overall security and governance.

“Business critical applications must be always-on and intellectual property must be continuously protected or the business suffers. Today, these valuable resources run in continuously changing IaaS environments that are under constant attack,” Mitthan Meena, Microsec co-founder and CEO, said.

The company also aims to provide full data loss prevention (DLP) capabilities to ensure the safety of sensitive data at rest and in motion.

Furthermore, Microsec.ai’s CNAPP solution provides network and architecture graph dashboards, so that administrators can view resource relationships, traffic, sensitive data, and any existing issues in context, and to be able to address them immediately.

Organizations also benefit from cloud security posture management (CSPM) and cloud workload protection (CWP), courtesy of machine learning-based detections.

“Protection for these environments and the data they contain needs to be continuous, data-centric, self-healing, and fast-to-deploy. Static, complicated, manual, and platform-centric options can’t meet the moment; it’s long past time to embrace runtime protection for multi-cloud environments,” Meena also said.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/-oyfyksXQf0/microsecai-exits-stealth-cloud-application-runtime-protection-platform

Hackers Could Disrupt Industrial Processes via Flaws in Widely Used Honeywell DCS

A distributed control system (DCS) product offered by Honeywell is affected by vulnerabilities that could allow malicious actors to disrupt industrial processes.

Researchers at industrial cybersecurity firm Claroty discovered that Honeywell’s Experion Process Knowledge System (PKS) is affected by three types of vulnerabilities. Two of them, CVE-2021-38395 and CVE-2021-38397, have been assigned a severity rating of critical and can allow an attacker to remotely execute arbitrary code on the system or cause a denial of service (DoS) condition.

The third flaw, tracked as CVE-2021-38399 and classified as high severity, is a path traversal issue that can allow an attacker to access files and folders.

Vulnerabilities found in Honeywell DCS The industrial giant published a security advisory for these vulnerabilities in February, when it informed customers about its plans for releasing patches this year. Some versions of the impacted products, however, will not receive fixes.

In a blog post published on Tuesday, Claroty detailed the vulnerabilities found by its Team82 researchers, as well as their potential impact in real world environments.

The Honeywell Experion PKS product is used by organizations worldwide to control large industrial processes. The DCS leverages controllers that can be programmed using engineering workstation software named Experion PKS Configuration Studio. The logic programmed for a controller is downloaded from the engineering station to the DCS components.

“In the case of the Experion PKS, Team82 found that it is possible to mimic the download code procedure and use these requests to upload arbitrary DLL/ELF files (for simulators and controllers, respectively). The device then loads the executables without performing checks or sanitization, giving an attacker the ability to upload executables and run unauthorized native code remotely without authentication,” Claroty explained.

Learn more about vulnerabilities in industrial systems at SecurityWeek’s ICS Cyber Security Conference and SecurityWeek’s Security Summits virtual event series

An attacker could exploit the vulnerabilities to cause significant disruptions or to abuse the DCS for further attacks on the targeted organization’s network. However, Claroty pointed out that the ports an attacker needs access to in order to exploit the vulnerabilities are typically not exposed to the internet. The attacker would need to find a way to access the targeted organization’s OT network before exploiting the flaws.

Honeywell said the vulnerabilities impact its C200, C200E, C300 and ACE controllers. The ACE and C200 controllers will not receive patches, but mitigations are available, especially since network access is required for exploitation.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday released both an advisory and a notification to inform organizations about the threat posed by these vulnerabilities.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/lD1lZVB52Xs/hackers-could-disrupt-industrial-processes-flaws-widely-used-honeywell-dcs

Suit Blames Baby’s Death on Cyberattack at Alabama Hospital

An Alabama woman whose 9-month-old daughter died has filed suit against the hospital where she was born claiming it did not disclose that its computer systems had been crippled by a cyberattack, which resulted in diminished care that resulted in the baby’s death.

Springhill Medical Center was deep in the midst of a ransomware attack when Nicko Silar was born July 17, 2019, and the resulting failure of electronic devices meant a doctor could not properly monitor the child’s condition during delivery, according to the lawsuit by Teiranni Kidd, the child’s mother.

Left with severe brain injuries and other problems, the baby died last year after months of intensive care at another hospital.

The lawsuit, initially filed in Mobile County in 2019 while Nicko was still alive, was first reported by The Wall Street Journal on Thursday.

The malpractice lawsuit, which seeks an unspecified amount of money from the hospital and Dr. Katelyn Braswell Parnell, who delivered Nicko, contends Springhill did not reveal the severity of the cyberattack publicly or to Kidd. The woman “would have gone to a different and safer hospital for labor and delivery” had she known what was going on, it claims.

Springhill has denied wrongdoing and asked a judge to dismiss the most serious part of the lawsuit, which contends officials conspired to publicly create a “false, misleading, and deceptive narrative” about the cyberattack in a scheme that made the child’s delivery unsafe.

[ Read: German Hospital Hacked, Patient Taken to Another City Dies ]

The hospital claimed any blame lies with Parnell, who “was fully aware of the inaccessibility of the relevant systems, including those in the labor and delivery unit, and yet determined that (Kidd) could safely deliver her at Springhill.” Under Alabama law, the hospital did not have any legal duty to provide Kidd with details of the cyberattack, the hospital argued.

Parnell and her medical group, Bay Area Physicians for Women, denied she did anything that hurt Nicko or caused the child’s injuries and death.

Springhill released a public statement about the cyberattack the day before the child was born saying staff “has continued to safely care for our patients and will continue to provide the high quality of service that our patients deserve and expect,” WKRG-TV reported at the time.

Previous Columns by Associated Press:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/QyNta7m2TF8/suit-blames-babys-death-cyberattack-alabama-hospital

McAfee Enterprise, FireEye Products Merged Into $2B Entity

Private equity giant Symphony Technology Group (STG) this week announced the merger of McAfee Enterprise and the newly acquired FireEye Products into a single entity with $2 billion in annual revenue.

The Menlo Park, Calif.-based STG has tapped FireEye’s Bryan Palma to head up the combined entity, which will continue to sell security products for endpoints, infrastructure, applications, and cloud deployments.

The STG announcement is the latest chapter in McAfee’s bumpy corporate saga. In March this year, McAfee Corp sold off the McAfee Enterprise business to a consortium led by STG in an all-cash transaction valued at $4 billion.

FireEye Products was purchased by STG in June this year for $1.2 billion after Mandiant decided to split off its solutions unit from the endpoint protection and cloud security product side of the house.

Symphony Technology Group also counts RSA Security among its high-profile portfolio companies.

In a brief statement, STG said the combination of McAfee Enterprise and FireEye Products will immediately create a pure play cybersecurity vendor more than 40,000 customers, 5,000 employees, and nearly $2 billion in annual revenue.

Previous Columns by SecurityWeek News:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/TzZIOQiUIKc/mcafee-enterprise-fireeye-products-merged-2b-entity

ChamelGang Hackers Target Energy, Aviation, and Government Sectors

New “ChamelGang” APT group group has not been associated with any existing threat actor

A new advanced threat group has been detected targeting energy and aviation firms in Russia, and institutions including governments in nine other countries. The group has not been associated with any existing APT, nor is its country of origin known. It has been named ChamelGang after its practice of blending into the background like a chameleon.

ChamelGang was first detected following repeated anti-virus alerts on the presence of Cobalt Strike Beacon in RAM at a Russian Energy organization. This breach was investigated and analyzed by Positive Technologies (PT). Using what it learned, PT discovered and analyzed a second attack by the same threat group against an organization in the Russian aviation sector.

PT subsequently found attacks against institutions in nine other countries, including the United States, India, Nepal, Taiwan, and Japan, where in five countries, researchers discovered compromised government servers. These other attacks have not been analyzed in PT’s report on ChamelGang, but all of the victims have been notified by their national CERTs. Since the gang uses the ProxyShell vulnerabilities in its attack chain, PT thinks it possible that vulnerable servers in the UK will be targeted in the future.

The attack against the Russian energy organization made use of a trusted relationship compromise. Such attacks differ from supply chain attacks: the former makes use of the legitimate communication channels in a trusted relationship, while the latter compromises goods (hardware or software) supplied from one company to another. In this case, ChamelGang exploited a JBoss Application Server vulnerability (CVE-2017-12149, patched by RedHat more than four years ago) in a subsidiary organization.

It took only two weeks for the gang to cross to the primary target. They acquired the dictionary password of the local administrator on one of the servers, and used RDP to penetrate the network. They remained on the network for three months, gaining control of most of it, before being detected.

In the second attack analyzed by PT, the gang used the ProxyShell chain of vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207). In this case, however, they were resident for just eight days before being expelled, and had little time to do serious damage.

“Targeting the fuel and energy complex and aviation industry in Russia isn’t unique – this sector is one of the three most frequently attacked,” comments Denis Kuvshinov, head of threat analysis at PT. “Most often such attacks lead to financial or data loss – in 84% of all cases last year, the attacks were specifically created to steal data, and that causes major financial and reputational damage.”

A distinctive feature of the ChamelGang attacks is the use of three previously unknown malwares: ProxyT, BeaconLoader, and the DoorMe backdoor. The gang also employed the better-known Cobalt Strike Beacon, FRP and Tiny Shell.

PT found the DoorMe backdoor to be one of the most interesting new artefacts. “This is a native IIS module that is registered as a filter through which HTTP requests and responses are processed,” explains Denis Goydenko, head of information security threat response at PT. “Its principle of operation is unusual: the backdoor processes only those requests in which the correct cookie parameter is set. At the time of the incident investigation, DoorMe was not detected by antivirus tools, and although the technique of installing this backdoor is known, we haven’t seen its use in recent times.”

In the first compromise, the DoorMe variant could receive six commands: return current directory, username, and hostname; run an arbitrary command by cmd.exe/c; run a command by creating a new process; write a file (to different methods; and copy the timestamps from one file to another.

In the second compromise, DoorMe had been expanded and the method of obfuscation changed. The number of commands it can receive had been expanded to 11, with the addition of, return the current working directory of the application (two methods); get information on the content of a selected directory; get a list of processes; and terminate and delete a specified process.

Of the other two new malwares, ProxyT is designed to check whether there is a connection to a remote URL. BeaconLoader is uploaded using DLL Hijacking. It receives the addresses of the functions and libraries necessary for its operation, and then it checks the name of the parent process and the privilege type.

A second version of BeaconLoader was also discovered, this time uploaded using the IKEEXT service. This version was similar but not identical to the first version. In both cases, Cobalt Strike Beacon was the ultimate payload.

The common factor in the ChamelGang compromises seems to be the existence of vulnerable versions of Microsoft Exchange Server and use of the ProxyShell and ProxyLogon vulnerabilities. Rapid patching is the most obvious preventative measure – but it is worth noting that on August 31, 2021, Trustwave found that 21.17% of Exchange Servers were still susceptible to the ProxyShell and ProxyLogon vulnerabilities, while 5.92% were vulnerable to ProxyLogon. Until these servers are patched, they will continue to be attacked by both ChamelGang and other threat actors.

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Previous Columns by Kevin Townsend:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/xnvvcbVja7c/chamelgang-hackers-target-energy-aviation-and-government-sectors

Third-Party Identity Risk Provider SecZetta Raises $20.5 Million

Third-party identity risk solutions provider SecZetta this week announced that it has raised $20.5 million in Series B funding, which brings the total raised by the company to $30.5 million.

The new investment round was led by SYN Ventures and new investor MassMutual Ventures. Existing investors ClearSky and Rally Ventures also contributed.

SecZetta’s identity risk platform helps organizations manage the risks associated with third-party users that need access to various internal resources. These include affiliates, contractors, partners, vendors, supply chains, and more.

Founded in 2019, SecZetta is based in Newport, Rhode Island. The company claims its solution can provide efficient third-party identity risk management without an increase in costs, through automation.

The new funding, the company says, will help it strengthen third-party identity risk initiatives, expand the capabilities of its platform, and help drive growth in both existing and new markets.

SecZetta claims it has significantly increased its customer base, and says it’s hiring aggressively to support global growth.

“To be successful, organizations need to automate best practices for managing the dynamic relationships required by their third-party resources and redefine the lines between identity and risk management,” David Pignolet, CEO and founder of SecZetta, said. “This is SecZetta’s sweet spot, enabling organizations to manage the identity lifecycle and risk of third-party workers with the same or greater diligence as their employees.”

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/GbVeEisNgFU/third-party-identity-risk-provider-seczetta-raises-205-million

Proposed Bill Would Require Organizations to Report Ransomware Payments

U.S. senators this week introduced a bill that would require critical infrastructure organizations to inform the Cybersecurity and Infrastructure Security Agency (CISA) if they experience a cyberattack, and it would also require most private companies to notify the government if they have made a payment in response to a ransomware attack.

The bipartisan bill, named the Cyber Incident Reporting Act, was introduced by senators Gary Peters (D-MI) and Rob Portman (R-OH), who also plan on introducing separate legislation to update the Federal Information Security Modernization Act with requirements for federal agencies and their contractors to report cyberattacks.

The Cyber Incident Reporting Act aims to help the government deal with cyberattacks and help it hold threat actors who target U.S. networks accountable.

If the bill becomes law, critical infrastructure owners and operators will be required to report cyberattacks to CISA within 72 hours.

In addition, other organizations will have to inform CISA within 24 hours if they have decided to make a ransomware payment. This applies to state and local governments, businesses with over 50 employees and even non-profits. Organizations would need to evaluate alternatives before paying cybercriminals.

Federal reporting requirements would be coordinated by a Cybersecurity Incident Reporting Council.

CISA would be given the authority to subpoena organizations that fail to report incidents or ransomware payments. Compliance failures could result in action being taken by the Justice Department and the company being banned from working with the government.

The bill also requires CISA to warn organizations about the vulnerabilities exploited in ransomware attacks, and the National Cyber Director to create a joint task force for preventing and disrupting ransomware attacks.

“This bipartisan bill will give the National Cyber Director, CISA, and other appropriate agencies broad visibility into the cyberattacks taking place across our nation on a daily basis to enable a whole-of-government response, mitigation, and warning to critical infrastructure and others of ongoing and imminent attacks,” said Senator Portman. “This bill strikes a balance between getting information quickly and letting victims respond to an attack without imposing burdensome requirements.”

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/r62oXux0uLU/proposed-bill-would-require-organizations-report-ransomware-payments

Neiman Marcus Confirms Payment Cards Compromised in Data Breach

Luxury retail company Neiman Marcus Group on Thursday confirmed that customer information was indeed stolen in a data breach.

During the incident, which occurred in May 2020, hackers were able to exfiltrate information associated with online customer accounts, including payment card data, the company says.

A total of 4.6 million online customers were affected by the attack and Neiman Marcus is working on notifying them. The company also says that 3.1 million payment and virtual gift cards were compromised, 85% of which were either expired or invalid.

Personal information stolen in the attack includes names and contact information, usernames, passwords, as well as answers to security questions associated with the online accounts.

The attackers, the company says, were able to steal payment card numbers and expiration dates, but not associated CVV numbers. For the affected Neiman Marcus virtual gift card numbers, PINs were not compromised.

“No active Neiman Marcus-branded credit cards were impacted. At this time, the Company has no evidence that Bergdorf Goodman or Horchow online customer accounts were affected,” Neiman Marcus said.

The company notes that it has also prompted users to change their passwords, provided they did not do so since May 2020.

“We are working hard to support our customers and answer questions about their online accounts. We will continue to take actions to enhance our system security and safeguard information,” said Geoffroy van Raemdonck, the CEO of Neiman Marcus Group.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/0GjDXQg__QE/neiman-marcus-confirms-payment-cards-compromised-data-breach