Google Patches Yet Another Serious V8 Vulnerability in Chrome

An update released this week by Google for Chrome 90 patches yet another serious vulnerability affecting the V8 JavaScript engine used by the web browser.

The flaw, tracked as CVE-2021-21227 and rated high severity, was reported to Google by researcher Gengming Liu from Chinese cybersecurity firm Singular Security Lab.

The researcher earned $15,000 for reporting the vulnerability, which Google described as “insufficient data validation in V8.”

Liu told SecurityWeek that the flaw can be exploited for remote code execution in the targeted user’s browser, but noted that, similar to other recently disclosed V8 vulnerabilities, it does not escape the Chrome sandbox — a sandbox escape bug is needed to exploit CVE-2021-21227 in real world attacks.

The hacker says CVE-2021-21227 is related to CVE-2020-16040 and CVE-2020-15965, similar high-severity V8 vulnerabilities that Google patched in Chrome in December and September 2020, respectively.

CVE-2020-16040 and CVE-2020-15965 were reported to Google by Lucas Pinheiro of Microsoft Browser Vulnerability Research. Liu discovered CVE-2021-21227 while analyzing the patches for the two vulnerabilities found by Pinheiro — he says they all impact the same function.

Google has patched several serious V8 vulnerabilities in recent weeks, including some for which PoC exploits were released before patches were made available. For some of these security holes, Google warned that exploits exist in the wild.

The Chrome 90 update released this week (version 90.0.4430.93) includes 9 security fixes, including for a couple of other high-severity issues, three medium-severity bugs, and one low-severity vulnerability. Bug bounty amounts are not listed, except for a medium-severity insufficient policy enforcement issue reported by researcher Rob Wu, who earned $5,000 for his findings.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/jQUuwVpKNCY/google-patches-yet-another-serious-v8-vulnerability-chrome

FBI/DHS Issue Guidance for Network Defenders to Mitigate Russian Gov Hacking

The FBI and DHS have issued a Joint Cybersecurity Advisory on the threat posed by the Russian Foreign Intelligence Service (SVR) via the cyber actor known as APT 29 (aka the Dukes, Cozy Bear, Yttrium and CozyDuke).

This advisory primarily looks at the threats posed by APT 29, the evolution of its methods, and best practices to defend against the actor. It should be read in conjunction with, and as a supplement to, a separate advisory published earlier this month by the NSA, CISA and the FBI. The earlier advisory examined current vulnerabilities used by APT 29, and mitigations that can be employed against that use.

The new advisory, provides “information on the SVR’s cyber tools, targets, techniques, and capabilities to aid organizations in conducting their own investigations and securing their networks.” Noticeably, the advisory uses the term SVR and APT 29 indistinguishably throughout, indicating that it sees no difference between the cyber actor and the Russian intelligence agency.

The advisory highlights the primary attack methods used by APT 29, discusses tradecraft similarities to SolarWinds-enabled intrusions, and provides general APT 29 tradecraft observations.

In 2018, SVR compromised a major network by using low and slow password spraying until they found an administrative account that did not require MFA authentication. Through this, the SVR modified target email account permissions to allow any authenticated network user to read the accounts.

“During the period of their access,” says the advisory, “the actors consistently logged into the administrative account to modify account permissions, including removing their access to accounts presumed to no longer be of interest, or adding permissions to additional accounts.”

In another incident, SVR exploited CVE-2019-19781 – at that time a zero-day vulnerability – to compromise a VPN device and obtain network access. “Following exploitation of the device in a way that exposed user credentials,” notes the advisory, “the actors identified and authenticated to systems on the network using the exposed credentials… in line with information of interest to a foreign intelligence service.”

In 2020, the governments of the U.S., UK, and Canada all attributed intrusions perpetrated using malware known as WELLMESS and targeting Covid-19 vaccine developers, to APT 29. The FBI’s investigation was that SVR was using unpatched publicly known vulnerabilities to access the target networks. Once this was achieved, the attacker focused on the victim’s vaccine research repository and Active Directory servers.

“These intrusions, which mostly relied on targeting on-premises network resources,” warns the advisory, “were a departure from historic tradecraft, and likely indicate new ways the actors are evolving in the virtual environment.”

The FBI and DHS do not explicitly specify within the advisory that SVR was responsible for the SolarWinds compromise of Orion, but do say that use of that compromise against other targets “indicate similar post-infection tradecraft with other SVR-sponsored intrusions.” In particular, this involves obtaining access to email accounts – especially those associated with IT staff – “to collect useful information about the victim networks, determine if victims had detected the intrusions, and evade eviction actions.”

These examples indicate that a primary intention for the SVR is intelligence gathering, as befits a foreign intelligence agency. While the actor may not directly seek to damage the networks it compromises, the information it gathers may be used offensively – as seen, for example, in the use of data stolen from the Democratic National Committee (DNC) by APT 29 in 2016 prior to the presidential election that year. Other offensive uses for stolen data would depend on the nature of the data stolen.

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Previous Columns by Kevin Townsend:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/npR_v4OifRk/fbidhs-issue-guidance-network-defenders-mitigate-russian-gov-hacking

US Air Force Adopts Zero Trust to Secure Flightline Operations

Air Force Flightliine

Zero trust is an important part of business transformation. As the information infrastructure expands with new technologies and locations, zero trust allows organizations to focus on protecting the data, regardless of where it is sourced or how it is used.

Now the U.S. Air Force has adopted zero trust to improve and protect its flightline.

The flightline, strictly speaking, is the aircraft’s maintenance area; either an area of runway or a hanger. It effectively includes any part of the airfield where an aircraft is being prepared for flight. However, data from each aircraft in the flightline must be returned to a central repository for analysis and to ensure that enough parts are available to guarantee – quite literally – the uptime of each machine.

Typically, in the past, data from the aircraft would be transferred to a USB drive and literally walked to applications in the hanger, or further afield to the central repository. The flightline consequently would comprise the aircraft in its maintenance position, a maintenance engineer with a USB drive, and the central server. This is what is being updated to zero trust.

The primary driver for the move to zero trust is the digitization of workflows. This allows processes that had previously been done on paper to be done digitally – but requires a new level of digital protection to protect the data and the workflows.

“You could describe the adoption of a zero-trust model as part of the digitization of aircraft maintenance,” said Duncan Greatwood, CEO of Xage. “The key parts,” he continued, “are firstly the movement of data – often by the physical carriage of a USB drive.”

This is neither efficient nor ultimately very secure. An important aspect of the new process is consequently the secure transfer of data into and out of the aircraft using the Xage zero trust fabric, ensuring both the confidentiality and integrity of that data.

Maintenance workflows can also be digitalized. “Historically,” said Greatwood, this tended to be done on paper checklists and clipboards, with smartphone photos of parts of the aircraft texted to the managers.

“What we’re doing is Integrating with the Air Force to allow a digitized app to replace the paper with an online list of what needs to be done in the workflow, while allowing comments and photos to be added as the work is done.” The results can then be collected and transferred with zero trust to the central computers.

While improving the ‘business’ functions of the flightline may have been the primary driver for the implementation of a zero trust-based network solution, Greatwood believes that security is also improved. “A USB key can be lost or stolen or hacked,” he said. (Consider how Stuxnet is thought to have been introduced to Natanz in 2010.) The elimination of any need to walk data between locations is a vast improvement in security.

The ‘insider threat’ must also be considered. It is a serious threat, even in military environments that employ more detailed screening. A key principle of zero trust is the least amount of trust for the least period of time. This ensures that even if an insider turns bad – either for ideological or financial reasons or merely accidentally – the amount of harm that can be done is minimized.

The new zero trust model is being rolled out first at Dover Air Force Base in Delaware

Xage Security was founded in 2017 by Roman Arutyunov (VP Products) and Susanto Irwan (VP Engineering) with headquarters in Palo Alto, California. Duncan Greatwood is the CEO. Xage raised $16 million in Series A funding during 2018.

Related: Zero Trust or Bust?

Previous Columns by Kevin Townsend:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/Eh43yccBF6E/us-air-force-adopts-zero-trust-secure-flightline-operations

Sift Raises $50M at ‘Unicorn’ Valuation

Fraud prevention technology provider Sift is now the 11th cybersecurity company to reach “unicorn” status in 2021, following a new $50 million round of venture capital funding.

Sift, which rebranded itself in January 2019 by dropping “Science” from “Sift Science,” says it plans to use the new injection of cash to continue expanding its product portfolio, as well as to hire new talent to scale product, engineering, and sales teams globally.

The San Francisco, California-based company provides organizations with the necessary tools to identify fraud patterns, helping them prevent payment fraud, account hijacking, and other forms of abuse. In 2020, Sift’s Digital Trust & Safety platform processed in excess of $250 billion in transactions.

The round was led by Insight Partners, with participation from Union Square Ventures and Stripe, and brings the total raised to date by Sift to $158 million, as well as the company’s valuation at above $1 billion.

Since November 2020, SecurityWeek has tracked 13 cyber-security companies that gained unicorn status, at a valuation above $1 billion. They include Aqua, Axonius, BigID, Coalition, Feedzai, Forter, ID.me, Lacework, Orca, OwnBackup, Socure, Venafi and Wiz.

“With this new investment we can continue to build out our Digital Trust & Safety platform to help merchants not only fight all types of fraud and abuse, but reduce friction for legitimate customers and grow revenue,” said Marc Olesen, president and CEO at Sift.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/q4Erqv6NTIs/sift-raises-50m-unicorn-valuation

Endpoint Management Firm Automox Raises $110 Million

Cyber hygiene and patch management company Automox on Tuesday announced raising $110 million in a Series C funding round that brings the total raised by the firm to more than $152 million.

The latest funding round was led by Insight Partners, with participation from Blackstone, Koch Disruptive Technologies and TechOperators. The money will be invested in sales and expanding the functionality of Automox’s endpoint management platform.

The company’s cloud-native platform is designed to provide visibility, automation and control capabilities that can help organizations manage and secure endpoints.

Automox says its solutions are used by roughly 2,000 customers across 30 countries. The company expects to significantly boost hiring this year.

It also announced on Tuesday that Dmitri Alperovitch, CrowdStrike co-founder and former CTO, has been appointed chairman of its board of directors.

“Enabling our customer’s journey to the IT Operations Cloud began with simplifying endpoint management and tackling the huge issues of software deployment, managing patches and updates, and managing configuration settings,” said Automox CEO Jay Prassl.

He added, “This new funding will accelerate our ability to deliver greater breadth of capabilities in the platform as we continue to help enterprise customers shift away from a disparate collection of on-premises management tools, towards managing their entire infrastructure from the IT Operations Cloud.”

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/mBO8JjDowiE/endpoint-management-firm-automox-raises-110-million

Adobe Releases Open Source Anomaly Detection Tool “OSAS”

Adobe this week announced the open-source availability of ‘One-Stop Anomaly Shop’ (OSAS), a new tool designed to help security teams discover anomalies in datasets.

Building on previous research, white papers, and other projects from Adobe’s Security Intelligence Team, OSAS out-of-the-box allows researchers to experiment with datasets, control data processing and feature combining, and help identify a solution for detecting security threats.

The new open-source project tackles the issue of data sparsity, which may appear when using machine learning (ML) algorithms and models with security logs that present a large feature-space, in which case previously unseen examples may be poorly handled.

To reduce this effect, OSAS implements a two-step approach to data processing, where raw data is first consumed and tagged based on standard recipes (and complex features are also created), and labels are then used as input features for both supervised and unsupervised ML algorithms.

Adobe OSAS

A command-line interface (CLI) tool, OSAS currently can be used to automatically generate a custom pipeline configuration file, to create a pre-trained model for the custom pipeline, and to apply the created model on previously unseen data.

Courtesy of an automatic learning/tagging function, OSAS can be used on a variety of datasets and projects, while the “Expert Knowledge Based” tagging component allows for the targeting of security threats, in a semi-supervised learning operation, similar to a “Risk Based Alerting” model.

Adobe has made the full source code of the project available on GitHub, alongside a dockerized variant that features a WebUI and ElasticSearch OpenDistro integration.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/iloLGmkvvtY/adobe-releases-open-source-anomaly-detection-tool-osas

Vulnerabilities in Eaton Product Can Allow Hackers to Disrupt Power Supply

Power management solutions provider Eaton has released patches for its Intelligent Power Manager (IPM) software to address several potentially serious vulnerabilities, including ones that researchers say could allow hackers to disrupt power supply.

Eaton’s IPM solution is designed to ensure system uptime and data integrity by allowing organizations to remotely monitor, manage and control the uninterruptible power supply (UPS) devices on their network.

According to security advisories published this month by Eaton and the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the IPM product is affected by six high-severity vulnerabilities that can be exploited for SQL injection, command execution, deleting arbitrary files, uploading arbitrary files, and remote code execution.

While some of the vulnerabilities can only be exploited by an authenticated attacker, others can be exploited without authentication, including for arbitrary code execution.

Learn more about vulnerabilities in industrial systems at SecurityWeek’s ICS Cyber Security Conference and SecurityWeek’s Security Summits virtual event series

Amir Preminger, VP of research at industrial cybersecurity firm Claroty, who has been credited by Eaton for reporting the six vulnerabilities, told SecurityWeek that the issues were identified in a web server interface of the IPM software that enables users to configure the product. This web server is typically accessible from the local network and is not hosted on public-facing servers.

“The goal of the Eaton IPM software is to enable users to manage their UPS system. By exploiting a server using this software, an attacker can disrupt the UPS operations and therefore disrupt the power supply to equipment that relies on the UPS as its power source,” Preminger explained.

He added, “The bottom line is that this product should be patched, since a few of the CVEs are pre-auth and could be exploited by adversaries without prior knowledge about the server setup.”

The security holes impact Eaton IPM and Intelligent Power Manager Virtual Appliance (IPM VA) running versions prior to 1.69, and Intelligent Power Protector (IPP) running versions prior to 1.68. Versions 1.69 and 1.68 address the vulnerabilities. Organizations can also block ports 4679 and 4680 to prevent exploitation.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/LTU289oMw18/vulnerabilities-eaton-product-can-allow-hackers-disrupt-power-supply

CISA, NIST Provide New Resource on Software Supply Chain Attacks

In a joint document published this week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST) provide information on software supply chain attacks, the associated risks, and how organizations can mitigate them.

The software supply chain is part of the information and communications technology (ICT) supply chain framework, which represents “the network of retailers, distributors, and suppliers that participate in the sale, delivery, and production of hardware, software, and managed services,” CISA and NIST explain.

Aside from the SolarWinds incident, other notorious supply chain attacks over the past several years include the CCleaner malware campaign, the MeDoc (Ukrainian accounting software) compromise leading to NotPetya, Operation ShadowHammer, the infection of IoT devices running Windows 7, and the abuse of Kaspersky Lab software to steal NSA files.

A software supply chain attack occurs when threat actors manage to compromise a vendor’s environment and poison their software before it reaches customers, with the purpose of infiltrating the customers’ systems.

Once a vendor has been hacked, customers are compromised either through the acquisition of new, already infected software, or through the installation of malicious updates or hotfixes.

“These types of attacks affect all users of the compromised software and can have widespread consequences for government, critical infrastructure, and private sector software customers,” CISA and NIST note in a document titled Defending Against Software Supply Chain Attacks.

Common techniques that attackers use when launching software supply chain attacks include update hijacking, tampering with code signing, and the compromise of open-source code. Thus, the adversary may compromise a vendor’s update mechanism, hack signing systems or employ self-signing certificates, or add their own code to publicly accessible code libraries.

“Software supply chain attacks typically require strong technical aptitude and long-term commitment, so they are often difficult to execute. […] In general, advanced persistent threat (APT) actors are more likely to have both the intent and capability to conduct the types of highly technical and prolonged software supply chain attack campaigns that may harm national security,” CISA and NIST say.

Software supply chain compromise allows attackers to bypass in-place defenses for initial access, while also enabling them to gain persistent access to the targeted environment to perform financial theft, data exfiltration, cyber-espionage, to disable defenses, and even cause physical harm.

To mitigate the risks associated with supply chain attacks, network defenders should apply industry best practices before the attack occurs, CISA and NIST say. They also recommend that organizations use third-party software “in the context of a risk management program” that should include a formal, organization-wide C-SCRM approach.

The agencies also provide a series of recommendations on how organizations can prevent the acquisition of malicious or vulnerable software, on how to mitigate already deployed malicious or vulnerable applications, and on how organizations can increase resilience.

Defending Against Software Supply Chain Attacks also includes recommendations for software vendors, such as to implement and follow a software development life cycle (SDLC) and integrate a secure software development framework (SSDF) to ensure they won’t supply malicious or vulnerable software.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/tYREsdveCJM/cisa-nist-provide-new-resource-software-supply-chain-attacks

Apple Patches macOS Security Bypass Vulnerability Exploited by ‘Shlayer’ Malware

Apple has patched a serious security bypass vulnerability in macOS that has been exploited in the wild by at least one threat group.

The tech giant on Monday informed customers that it has patched tens of vulnerabilities in macOS Catalina, Mojave and Big Sur. The Big Sur update fixes nearly 60 security holes, including a logic issue tracked as CVE-2021-30657 that, Apple says, can allow a malicious application to bypass Gatekeeper checks.

macOS has three main security mechanisms designed to protect users against malicious files downloaded from the internet: file quarantine, which prompts the user and asks for confirmation when executing a file; Gatekeeper, which checks code-signing information to ensure an application comes from a trusted developer and it has not been tampered with; and notarization, which involves automatically scanning software for malicious content before it is allowed to run.

The vulnerability tracked as CVE-2021-30657 can be exploited to bypass file quarantine, Gatekeeper and notarization using specially crafted applications. Specifically, a script-based application that does not contain an “Info.plist” configuration file is misclassified by Apple’s security mechanisms and is allowed to run without prompting the user.

Apple has credited “an anonymous researcher” for reporting the bug, but the issue was apparently reported to the tech giant by researcher Cedric Owens on March 25. Owens on Monday published a blog post detailing his findings. He also pointed out that an open source application named appify, which allows users to create “the simplest possible Mac app from a shell script,” has been generating apps that unintentionally exploit the vulnerability.

Patrick Wardle, a researcher who specializes in the security of Apple products, published a lengthy blog post on Monday to describe the vulnerability and its root cause in detail. Wardle has created a proof-of-concept (PoC) exploit that is disguised as a harmless PDF document and which executes an application on the compromised device when opened, without the user seeing any warnings.

The researcher said the vulnerability was apparently introduced in macOS 10.15 and older versions of the operating system do not seem to be affected. Apple only patched the issue in macOS Big Sur.

“Though this bug is now patched, it clearly (yet again) illustrates that macOS is not impervious to incredible shallow, yet hugely impactful flaws. How shallow? Well that fact that a legitimate developer tool (appify) would inadvertently trigger the bug is beyond laughable (and sad).” Wardle said.

Wardle has asked Apple device management company Jamf — Jamf in 2019 acquired a Mac endpoint security company founded by Wardle — to look for threats that may have abused this weakness in the wild. Sure enough, Jamf researchers discovered that a variant of the Shlayer malware, which drops adware on infected devices, had been leveraging the vulnerability since at least January 9, 2021, to bypass the file quarantine, notarization and Gatekeeper.

In the attacks observed by Jamf, hackers had used poisoned search engine results to deliver the malware. The developers of Shlayer have been known to come up with clever ways to bypass Apple security mechanisms. Last year, they were spotted delivering notarized exploits.

Apple on Monday also released an iOS update to patch 50 vulnerabilities, as well as security updates for Safari, Xcode and iCloud for Windows.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/1GGqANeeGFo/apple-patches-macos-security-bypass-vulnerability-exploited-shlayer-malware

DC Police Department Hit by Apparent Extortion Attack

The Washington, D.C., police department said Monday that its computer network was breached, and a Russian-speaking ransomware syndicate claimed to have stolen sensitive data, including on informants, that it threatened to share with local criminal gangs unless police paid an unspecified ransom.

The cybercriminals posted screenshots on their dark web site supporting their claim to have stolen more than 250 gigabytes of data.

The District of Columbia’s Metropolitan Police Department said in a statement that it had asked the FBI to investigate the “unauthorized access.” There was no indication that any police operations were affected, and the department did not immediately say whether it had been hit by ransomware.

The Babuk group, a relatively new ransomware gang, said on its website that it had “downloaded a sufficient amount of information from your internal networks” and gave the police three days to contact it or “we will start to contact gangs in order to drain the informants.”

Screenshots it posted suggested it has data from at least four computers, including intelligence reports, information on gang conflicts, the jail census and other administrative files. One of the images, apparently of network locations accessed by the criminals, showed a text document on one computer entitled “How To Restore Your Files.”

Such documents generally include instructions on how to contact the ransomware criminals, whose standard operating procedure is to exfiltrate sensitive data from networks they infiltrate as they sow malware that, once activated, encrypts data. Only after receiving payment do the criminals provide software keys that unscramble the data.

So far this year, 26 government agencies in the U.S. have been hit by ransomware, with cybercriminals releasing online data stolen from 16 of them, said ransomware analyst Brett Callow of the cybersecurity firm Emsisoft. Ransomware victims don’t always pay, often preferring the arduous task of rebuilding networks from backups.

The D.C. police department said it was taking the threat seriously.

“We are aware of unauthorized access on our server. While we determine the full impact and continue to review activity, we have engaged the FBI to fully investigate this matter,” the department statement said. An FBI spokeswoman had no immediate comment.

A worsening global epidemic of ransomware attacks is considered a national security threat by many, doing tens of billions of dollars in damage. U.S. law enforcement is relatively powerless to counteract it as most of the criminals enjoy safe harbor in Russia and other nations with weak rule of law.

Related: Inside the Ransomware Economy

Previous Columns by Associated Press:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/_bQZfOtl8jA/dc-police-department-hit-apparent-extortion-attack