Google Patches Two More Exploited Zero-Day Vulnerabilities in Chrome

Google on Thursday announced the rollout of a Chrome update to address four security vulnerabilities, including two that are already being exploited in the wild.

The exploited vulnerabilities include CVE-2021-37975, a high-severity use-after-free bug in the V8 engine, and CVE-2021-37976, a medium-severity information leak issue in the core. Both were reported last week.

“Google is aware the exploits for CVE-2021-37975 and CVE-2021-37976 exist in the wild,” the Internet search giant says.

Now rolling out to Windows, Mac and Linux users as Chrome version 94.0.4606.71, the new browser iteration also addresses CVE-2021-37974, a high-severity use-after-free in Safe Browsing.

Google says the report for this vulnerability earned the reporting researcher, namely Weipeng Jiang from Codesafe Team of Legendsec at Qi’anxin Group, a $20,000 bug bounty reward.

Exploitation of these vulnerabilities may lead to the execution of arbitrary code in the context of the browser, the Multi-State Information Sharing and Analysis Center (MS-ISAC) warns in an advisory. Successful exploitation may potentially lead to system compromise.

The update comes roughly one week after Google issued an emergency patch for CVE-2021-37973, a high-severity use-after-free issue in the Portals API that was already being exploited in attacks.

With CVE-2021-37975 and CVE-2021-37976, the number of documented zero-day attacks so far in 2021 has been rounded up to 70. Of these, 14 security flaws were found in Google’s Chrome and Android platforms, data reviewed by SecurityWeek shows.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/AREBtMqEkEg/google-patches-two-more-exploited-zero-day-vulnerabilities-chrome

Google Patches Vulnerability in Cloud Endpoints Proxy

A researcher has disclosed the details of a privilege escalation vulnerability he discovered in a Google Cloud component. The flaw was patched by Google in late August, but some users will need to manually update their systems to prevent potential exploitation.

The vulnerability was found by security researcher Imre Rad, who disclosed his findings last week on the Full Disclosure mailing list.

Rad found the vulnerability in Extensible Service Proxy (ESP), an open source, Nginx-based proxy that enables API management capabilities for JSON/REST or gRPC API services. Its features include authentication, monitoring and logging. ESP is a component of Google’s Cloud Endpoints API management system, which is designed for securing, monitoring and analyzing APIs.

“If SSO is configured for an ESP fronted application where the identity provider is one of the popular ones (Google or Facebook) or an organization’s internal IdP (e.g. Okta), then those API methods can be invoked by a malicious user assuming the identity of anyone,” the researcher told SecurityWeek.

He noted that not all applications that use ESP are affected — applications based on PHP/Symfony are impacted, and possibly also some less popular frameworks. The researcher believes between 100 and 1,000 applications are affected, but he says this is a “gut feeling.”

The vulnerability impacts ESP v1 and certain configurations — the researcher says ESP v2 is not affected. He also noted that some users will need to manually install the patches.

“Unlike with other services (e.g. MySQL instances of the Cloud SQL product), the ESP software is not operated by Google, so the burden of upgrade is on the customers. (Using ESP on AppEngine may be an exception, I think Google bumps the version there.) In line with this architecture, Google is not in the position to prevent abuse globally by implementing some magical server-side fix,” Rad explained.

Google has awarded a bug bounty for the vulnerability report, but the researcher did not want to disclose the exact amount — he said it was several thousand dollars.

“We rolled out a fix on August 31, 2021 to address this issue and ensure that all services are protected. We’re appreciative of the researcher’s work in identifying and reporting this vulnerability,” a Google spokesperson told SecurityWeek.

Google did not respond to follow-up questions regarding the number of impacted applications and users having to manually update the affected component.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/UmUmlf_7qeQ/google-patches-vulnerability-cloud-endpoints-proxy

Threat Actor Promises Pegasus Spyware Protection, Serves Trojan Instead

A threat group is distributing the little-known Sarwent Trojan via a fake website that impersonates Amnesty International and claims to deliver protection against the Pegasus mobile malware.

According to security researchers at Cisco Talos, the attack targets individuals who believe they might have been targeted by the NSO Group’s Pegasus spyware and might be associated with nation-state activity, but Talos has yet to identify links to a specific threat actor.

Initially detailed in 2016, Pegasus is a controversial surveillance software tool that, despite claims of legitimate use, has been reportedly used by oppressive regimes in campaigns targeting journalists, human rights activists, and other individuals opposing the regime.

Following a detailed Amnesty International report on Pegasus released in July this year, and Apple issuing patches for the ForcedEntry zero-day exploit, many people started searching for protection against the spyware, and adversaries decided to take advantage of that.

[ READ: Apple Confirms New Zero-Day Attacks on Older iPhones ]

A fake website designed to look similar to that of Amnesty International, the threat actor claims to be offering “Amnesty Anti Pegasus,” an anti-virus tool that can supposedly protect against NSO Group’s spyware.

Instead, however, users are served the Sarwent remote access tool (RAT), which allows attackers to easily upload and execute payloads on the compromised machines, as well as to exfiltrate any data deemed to be of interest.

Although low volume, the campaign has snagged victims worldwide, including in the United States, the United Kingdom, Colombia, Czech Republic, India, Romania, Russia, and Ukraine, according to the Cisco Talos report.

The adversary behind the campaign appears to be a Russian speaker that has been using Sarwent since at least January 2021, targeting all types of individuals globally. The threat actor likely used the Trojan or one with a similar backend since 2014, the security researchers say.

“Given the available data, we remain uncertain about the intentions of the actor. The use of Amnesty International’s name, an organization whose work often puts it at odds with governments around the world, as well as the Pegasus brand, a malware that has been used to target dissidents and journalists on behalf of governments, certainly raises concerns about who exactly is being targeted and why,” Cisco Talos said.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/XA8yPyYkmRw/threat-actor-promises-pegasus-spyware-protection-serves-trojan-instead

Hackers Can Exploit Apple AirTag Vulnerability to Lure Users to Malicious Sites

Apple’s AirTag product is affected by a vulnerability that could be exploited by hackers to lure unsuspecting users to phishing or other types of malicious websites.

Security consultant Bobby Rauch discovered that AirTags, which Apple sells for $30 and advertises as a “supereasy way to keep track of your stuff,” are affected by a stored cross-site scripting (XSS) vulnerability.

While the issue has not been patched by Apple, Rauch disclosed its details this week after becoming frustrated with the tech giant’s vulnerability reporting process.

Apple AirTag vulnerability When AirTag users enable “lost mode” to indicate that they cannot locate the device, they can add their phone number and a custom message that will be displayed to anyone who finds and scans the AirTag with an NFC phone — this includes Android phones.

Rauch noticed that the unique page generated on the found.apple.com domain for each AirTag is affected by a stored XSS vulnerability. More precisely, the XSS flaw can be exploited by inserting a malicious payload into the phone number field on the page.

In a theoretical attack scenario described by the researcher, the attacker enables “lost mode” for their own AirTag and intercepts the request associated with this action. They then inject the malicious payload into the phone number field. The attacker then needs to drop the AirTag device in a location where the targeted user — or anyone, if the attack is opportunistic — picks it up and scans it. Once the AirTag is scanned, the malicious payload is triggered immediately.

Rauch demonstrated the attack by injecting a payload that redirects the victim to an iCloud phishing page. Since it’s an Apple product, the victim might not find an iCloud login page to be suspicious — in reality, users who find and scan an AirTag don’t need to provide any credentials.

In addition to directing users to phishing pages, an attacker could lure users to malware distribution websites, or they could inject a payload for session token hijacking or clickjacking. The researcher also noted that the attacker could leverage the malicious found.apple.com link by sending it directly to the targeted user on a desktop or laptop device — in this case the payload is triggered when the link is accessed and there is no need to scan the AirTag.

Rauch told cybersecurity blogger Brian Krebs that he reported his findings to Apple on June 20, and decided to publicly disclose the vulnerability after becoming frustrated with Apple’s slow progress and refusal to answer his questions about giving him credit for the vulnerability and a possible bug bounty.

SecurityWeek has reached out to Apple for comment and will update this article if the company responds.

This is the second time in recent days that a researcher has disclosed the details of a vulnerability before Apple could release a patch. Researcher Denis Tokarev (aka illusionofchaos) has made public the details of three iOS vulnerabilities that were reported to Apple months ago, but which the tech giant failed to address.

Many cybersecurity experts have complained over the past years about Apple’s bug bounty program, including due to delayed responses and rewards they considered too small. The company said it awarded a total of $3.7 million to the researchers who responsibly disclosed security flaws last year.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/SJGNiIgGSmw/hackers-can-exploit-apple-airtag-vulnerability-lure-users-malicious-sites

Credit Union’s Legal Battle With Tech Giant Fiserv Rumbles On

Local credit union, Bessemer System Federal Credit Union (BSFCU), sued Fortune 500 tech giant Fiserv over ‘amateurish security lapses’ in 2019. Fiserv counterclaimed with a motion to dismiss, and Bessemer motioned to dismiss the counterclaim.

BSFCU was founded 75 years ago by employees of the Bessemer and Lake Erie Railroad in Greenville, Pa. It now provides community credit union services to Mercer County, Pennsylvania. Fiserv is one or the world’s largest fintech companies. It is ranked 205 in the Fortune 500, and has a market value of around $80 billion.

In August 2018, Brian Krebs had reported on a Fiserv platform security lapse that enabled one customer to see the email address, phone number and full bank account number of another – an example of what OWASP calls ‘broken access control’. BSFCU subsequently performed its own security review and found further vulnerabilities in the online banking website that Fiserv had provided.

A banner on its homepage states, “Due to vulnerabilities we discovered with the Ezcardinfo site, we have discontinued all new enrollments effective immediately. We will be discontinuing all access to the site after notifying all current users.”

According to BSFCU, Fiserv responded with “an aggressive ‘notice of claims’ attempting to silence Bessemer by threatening civil and criminal prosecution if Bessemer discussed Fiserv’s security problems with third parties”, including other Fiserv customers.

In the end, Bessemer sued Fiserv, and Fiserv counterclaimed against Bessemer. And, of course, Bessemer filed a motion to dismiss Fiserv’s counterclaim. It is U.S. District Judge Robert J. Colville’s Memorandum Opinion on Bessemer’s motion, delivered on September 15, 2021, that brings us up to date.

Fiserv’s counterclaim asserts “breach of contract, breach of the duty of good faith and fair dealing, and ‘Contractual Recovery of Attorneys’ Fees and Costs’.” Much of this centers around Bessemer’s security review, which Fiserv claims to be in breach of the Master Agreement between the two parties. It describes the security review as a ‘brute force attack’.

Fiserv claims that the motive behind the cyberattack was to manufacture a breach that could be used to embarrass and extort Fiserv into acceding to Bessemer’s demands over the payment of outstanding invoices. The implication is that the security review was used to justify bad faith attempts to refuse to pay early termination fees and other invoices when due. Bessemer claims the security review was “a completely innocent and… required inquiry into the security measures implemented by Fiserv Solutions.”

Judge Colville declined to comment on these different descriptions, saying, “At this time, the Court has only the benefit of two diametrically opposed descriptions of the ‘security review,’ with the two presenting nearly no agreement as to the precise nature of the computer activity involved, Bessemer’s motivations, and/or the information that was accessed and/or acquired by Bessemer.”

Bessemer’s motion to dismiss the breach of contract counterclaim ‘with prejudice’ claims that Fiserv failed to perform the contract, while Bessemer did not breach it. Bessemer also claimed that counterclaiming for Fiserv attorney fees should be excluded: “The proper procedural path would have been for Fiserv [Solutions] to include the fees in its prayer for relief, not to assert an independent claim. This distinction matters because, should Fiserv[] [Solutions’] other claims be dismissed, it should not be able to maintain its status as a counterclaimant based solely on an attorneys’ fees provision.”

In the end, the judge agreed with Bessemer over the attorney fees, but did not find grounds to dismiss the rest of Fiserv’s counterclaim. He concluded, “The Court will grant in part and deny in part Bessemer’s Motion to Dismiss Counterclaims (ECF No. 92). The Motion will be granted as to Fiserv Solutions’ “Counterclaim” for “Contractual Recovery of Attorneys’ Fees and Costs,” and denied in all other respects. An appropriate Order of Court follows.”

Bessemer is unbowed and the fight will continue. CEO Joy Peterson gave SecurityWeek the following statement: “BSFCU was very concerned by the security review uncovering crucial security problems at Fiserv that placed our members at risk of identity theft and fraud. We terminated Fiserv and are taking appropriate legal actions against Fiserv for its repeated security failures. Fiserv’s retaliatory sue-the-victim gambit is antithetical to the values of the credit union movement. Our credit union does not dignify bullying, and Fiserv’s tactics will not deter us from protecting our members. We look forward to a trial in this matter.”

As it stands, Bessemer’s claim against Fiserv is largely intact and ongoing, while Fiserv’s counterclaim against Bessemer remains largely intact and ongoing. The message for organizations seeking to protect their business with the help of security products is to be very careful of what you sign. It is largely the reason why many CISOs will only accept limited term contracts. It is easier to renew a contract that proves successful, than to get out of one that does not.

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Previous Columns by Kevin Townsend:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/sC-T2W8pjTE/credit-unions-legal-battle-tech-giant-fiserv-rumbles

AMD Chipset Driver Vulnerability Can Allow Hackers to Obtain Sensitive Data

Chipmaker AMD has patched a driver vulnerability that could allow an attacker to obtain sensitive information from the targeted system.

The flaw, tracked as CVE-2021-26333 and classified by AMD as medium severity, affects the company’s Platform Security Processor (PSP) chipset driver, which is used by several graphics cards and processors.

According to AMD, which described it as an information disclosure issue, an attacker who has low privileges on the targeted system can “send requests to the driver resulting in a potential data leak from uninitialized physical pages.”

AMD has advised users to update the PSP driver to version 5.17.0.0 through Windows Update or update the Chipset Driver to version 3.08.17.735.

Kyriakos Economou, co-founder of cybersecurity research and development company ZeroPeril, has been credited for discovering the vulnerability. In a technical advisory detailing the findings, the researcher noted that attacks are possible due to information disclosure and memory leakage bugs.

He claims that an attacker could leverage the vulnerability to obtain registry key mappings containing NTLM hashes of authentication credentials, or to obtain data that could be useful for bypassing exploit mitigations such as Kernel Address Space Randomization (KASLR).

“For example, [the NTLM hashes] can be used to steal credentials of a user with administrative privilege and/or be used in pass-the-hash style attacks to gain further access inside a network” the advisory reads.

Economou also noted that AMD’s list of impacted products may be incomplete. The vulnerability has been confirmed to impact Ryzen 2000 and 3000 series CPUs, which are currently not mentioned in AMD’s advisory.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/OeiflZMXboY/amd-chipset-driver-vulnerability-can-allow-hackers-obtain-sensitive-data

Operator of ‘DownThem’ DDoS Attack Service Convicted

An Illinois man who operated an infamous online service allowing users to launch distributed denial-of-service (DDoS) attacks on selected targets was found guilty of three felonies.

The man, Matthew Gatrel, 32, of St. Charles, was convicted for operating the DownThem “booting” service, through which subscribers would pay to have their targets of choice flooded with unwanted traffic that would disable or slow down computers.

Gatrel also owned and operated AmpNode.com, a “bulletproof” service that allowed paying customers to host “spoofing” servers pre-configured with scripts to facilitate DDoS attacks. The servers also contained lists of vulnerable “attack amplifiers” that were abused to target victims.

DownThem had over 2,000 registered users and is believed to have been responsible for more than 200,000 launched attacks. Subscribers employed the service to target home users, municipal and local government websites, schools and universities, and financial institutions globally.

The booting service itself used the powerful servers of the AmpNode bulletproof hosting service. Other AmpNode customers also operated for-profit DDoS services, the United States Department of Justice says.

Gatrel provided customers with technical guidance on launching attacks and bypassing DDoS protection services. He also used the DownThem service to demonstrate its capabilities to prospective customers.

DownThem provided customers with various subscription plans, differentiated by cost, based on attack capability. Users could select the attack duration and power and could even launch simultaneous attacks.

Gatrel was convicted on three counts: unauthorized impairment and conspiracy to commit unauthorized impairment of a protected computer, and conspiracy to commit wire fraud. Facing up to 35 years in prison, he will be sentenced on January 27, 2022.

DownThem was seized in December 2018, when the U.S. announced charges against Gatrel. One month later, authorities announced that they had started tracking the users of this and other DDoS-for-hire services.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/xsrYtZceEtU/operator-downthem-ddos-attack-service-convicted

Pakistani Man Involved in AT&T Hacking Scheme Sentenced to Prison in U.S.

Muhammad Fahd, a 35-year-old Pakistani national, has been sentenced to 12 years of prison in the United States for his role in a scheme that involved illegally unlocking AT&T phones and hacking into the telecoms giant’s systems.

The scheme started in 2012, when Fahd and others recruited AT&T call center employees for help in unlocking phones sold by AT&T to customers under installment plans. These types of devices can only be used on AT&T’s network, but once a phone has been unlocked it can be used on the network on any provider and the device’s owner can avoid paying for AT&T services or making payments for the phone.

Fahd was initially helped directly by AT&T call center employees to unlock phones, but when in 2013 AT&T implemented a new system that made it more difficult for employees to unlock devices, the man hired someone to develop a piece of malware that, once deployed on AT&T’s internal systems, would allow him to remotely unlock phones from Pakistan in larger numbers.

“At Fahd’s request, the employees provided confidential information to Fahd about AT&T’s computer system and unlocking procedures to assist in this process,” the U.S. Justice Department said on Thursday. “Fahd also had the employees install malware on AT&T’s computers that captured information about AT&T’s computer system and the network access credentials of other AT&T employees. Fahd provided the information to his malware developer, so the developer could tailor the malware to work on AT&T’s computers.”

According to authorities, AT&T determined that more than 1.9 million phones were unlocked as part of the scheme, causing losses of over $200 million due to customers stopping to make payments for their phones.

Fahd was indicted in the United States in 2017 and was arrested the next year in Hong Kong. He was extradited in 2019 and he pleaded guilty to conspiracy to commit wire fraud in 2020.

In addition to the 12-year prison sentence, Fahd was ordered to pay $200 million in restitution.

The AT&T employees who helped the Pakistani national have also been prosecuted.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/Joc1y7AAhzg/pakistani-man-involved-att-hacking-scheme-sentenced-prison-us

Mirai Botnet Starts Exploiting OMIGOD Flaw as Microsoft Issues More Guidance

Microsoft on Thursday published additional guidance on addressing recently disclosed vulnerabilities in the Open Management Infrastructure (OMI) framework, along with new protections to resolve the bugs within affected Azure Virtual Machine (VM) management extensions.

Microsoft’s guidance was published just as researchers noticed that one of the vulnerabilities is already being exploited in the wild. It appears that the Mirai botnet is attempting to compromise vulnerable systems and that it also closes port 5896 (OMI SSL port) to keep other attackers out.

An open-source Web-Based Enterprise Management (WBEM) implementation, OMI allows for the management of Linux and UNIX systems and is used in various Azure services and Azure Virtual Machine (VM) management extensions.

As part of the September 2021 patches, Microsoft addressed four issues in OMI, one critical bug leading to unauthenticated remote code execution and three high-severity flaws allowing an attacker to elevate privileges. The issues were identified by security researchers with Wiz, which named the RCE defect OMIGOD.

The OMIGOD vulnerability, officially tracked as CVE-2021-38647, is the one reportedly exploited by the Mirai botnet.

According to Microsoft, OMIGOD “only impacts customers using a Linux management solution (on-premises SCOM or Azure Automation State Configuration or Azure Desired State Configuration extension) that enables remote OMI management.”

Microsoft has released additional protections for the affected extensions and encourages customers to update them for both cloud and on-premises deployments. Where automatic updates are enabled, the patches should become globally available by September 18, without a reboot. Otherwise, manually updating the affected components is required.

Affected extensions include System Center Operations Manager (SCOM), Azure Automation State Configuration (DSC Extension), Azure Automation State Configuration (DSC Extension), Log Analytics Agent, Azure Diagnostics (LAD), Azure Automation Update Management, Azure Automation, Azure Security Center, and Container Monitoring Solution.

OMI as a standalone package was patched in August and customers are advised to manually update it to version 1.6.8-1 or above to remain protected.

“New VM’s in these regions will be protected from these vulnerabilities post the availability of updated extensions,” Microsoft says.

The tech giant also notes that VMs deployed within a Network Security Group (NSG) or protected by a perimeter firewall, where access to Linux systems that expose the OMI ports is restricted, should be safe from the RCE flaw.

Azure customers running Linux VMs are advised to apply the available patches as soon as possible, especially since a proof-of-concept (PoC) exploit targeting the flaws is already publicly available.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/s2I1CRVA1rs/mirai-botnet-starts-exploiting-omigod-flaw-microsoft-issues-more-guidance

German Election Authority Confirms Likely Cyber Attack

Suspected hackers last month briefly disrupted the website of the authority running Germany’s September 26 general election, a spokesman for the body told AFP Wednesday.

The development, first reported by Business Insider, comes as German federal prosecutors probe alleged cyber attacks against lawmakers during the campaign to choose a new parliament and a successor to Chancellor Angela Merkel.

“At the end of August the website of the Federal Returning Officer only had limited accessibility for a few minutes due to a malfunction,” the spokesman said when asked about the hacking report.

“The problem was analysed and the technical concepts were further developed accordingly. The information for the public through the website of the Federal Returning Officer was and is ensured.”

Business Insider reported that the website, which publishes the official results of the vote, was bombarded with data requests in a so-called distributed denial of service attack, leading the servers to break down.

Citing government sources, it said that IT systems necessary for the election itself to go off smoothly were not affected, possibly due to extra protections in place.

The federal prosecutor’s office said last week it had opened “an investigation on suspicion of espionage” over accusations made by the German government about “phishing” attacks against MPs by Russian intelligence.

Berlin has pointed the finger at hackers from Russia’s “Ghostwriter” group which reportedly specialises in spreading disinformation.

German intelligence believes they have been trying to gain access to the private email accounts of federal and regional MPs and says Russia’s military intelligence service GRU is behind the attacks.

The European Union and United States have repeatedly accused Moscow of attempting to meddle in democratic elections, something the Kremlin has disputed.

Previous Columns by AFP:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/Gcjfy1qb7fQ/german-election-authority-confirms-likely-cyber-attack