Microsoft Rolls Out Spectre Variant 2 Mitigations for Windows 10

Over the weekend, Microsoft started rolling out a new software update for Windows 10 devices to enable the Retpoline mitigations against Spectre attacks.

Publicly detailed in January 2018 along with Meltdown, Spectre is a side-channel attack against modern processors that impacts most modern processors, including those from Intel, AMD, and ARM.

Able to bypass memory isolation mechanisms, the attacks allow malicious applications to access data from other applications, including password managers, web browser, documents, emails, instant messaging data, and more.

Multiple variants of these attacks were made public over the course of last year (Spectre Variant 1 – CVE-2017-5753 and Variant 2 – CVE-2017-5715 and Meltdown Variant 3 – CVE-2017-5754), and Microsoft released patches for some of these too, including Spectre-like variant 4.

Over the weekend, the company started rolling out new updates for Windows 10 users to enable Google’s Retpoline mitigations for Spectre Variant 2.

Available since early 2018, the Retpoline mitigations were already included in Windows 10, but disabled by default on production builds. The update Microsoft released over the weekend enables the mitigation, on certain devices, which “may improve performance of Spectre variant 2 mitigations”

“While Retpoline is currently disabled by default on production Windows 10 client devices, we have backported the OS modifications needed to support Retpoline so that it can be used with Windows 10, version 1809 and have those modifications in the March 1, 2019 update (KB4482887),” Microsoft explains.

The software giant also says it plans to enable Retpoline as part of phased rollout via cloud configuration over the next months.

However, the company is enabling Retpoline performance benefits only in Windows 10, version 1809 and later releases, “due to the complexity of the implementation and changes involved.”

The new mitigations are enabled in OS Build 17763.348, which is available for both Windows 10, version 1809, and Windows Server 2019, all versions, and which brings other fixes and improvements as well.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/gikOtnaG7PQ/microsoft-rolls-out-spectre-variant-2-mitigations-windows-10

Adobe Patches ColdFusion Vulnerability Exploited in the Wild

Adobe has released out-of-band updates for its ColdFusion web application development platform to address a critical vulnerability that has been exploited in the wild.

The zero-day flaw, tracked as CVE-2019-7816, has been described by the vendor as a file upload restriction bypass issue that could lead to arbitrary code execution in the context of the ColdFusion service.

The security hole has been addressed in ColdFusion 11, ColdFusion 2016 and ColdFusion 2018. In addition to installing the updates as soon as possible, Adobe has advised users to apply security configuration settings as shown in the platform’s lockdown guides and the ColdFusion security page.

“This attack requires the ability to upload executable code to a web-accessible directory, and then execute that code via an HTTP request. Restricting requests to directories where uploaded files are stored will mitigate this attack,” Adobe explained.

Charlie Arehart, Moshe Ruzin, Josh Ford, Jason Solarek and Bridge Catalog Team have been credited by Adobe for reporting the vulnerability.

No details have been provided about the attacks exploiting this vulnerability.

This is not the only ColdFusion flaw exploited by malicious actors in recent months. In November, Volexity revealed that a weakness tracked as CVE-2018-15961, which Adobe patched in September, had been exploited by what appeared to be a China-based APT group to upload an old webshell called China Chopper to vulnerable servers.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/5iy8uzm8tdA/adobe-patches-coldfusion-vulnerability-exploited-wild

Two White Hats Earn Over $1 Million via Bug Bounty Programs

Bug bounty platform HackerOne says two of its members have each earned more than $1 million by helping organizations find and fix vulnerabilities in their systems.

While many white hat hackers don’t make much money from bug bounty programs, there are some who have dedicated a lot of time to finding vulnerabilities and they have managed to earn significant rewards.

The first to earn over $1 million through HackerOne-based bug bounty programs was 19-year-old Santiago Lopez from Argentina. Lopez, a self-taught hacker who uses the online moniker “try_to_hack,” signed up for HackerOne in 2015 and he has reported over 1,600 flaws, including to Twitter and Verizon Media.

“He was first inspired to get started after seeing the movie Hackers and learned to hack by watching free online tutorials and reading popular blogs. In 2015, at 16-years-old, he signed up for HackerOne and earned his first bounty of $50 months later. He chose his alias ‘try_to_hack’ to keep himself motivated — he was determined to try to hack companies regardless of whether he knew he could succeed,” HackerOne said of Lopez. “He keeps the name today to remind him of how he started as a bug bounty hacker. Over the past three years of hacking after school and now full-time, he has earned nearly forty times the average software engineer salary in Buenos Aires on bug bounties alone.”

The second HackerOne member to earn over $1 million – just a few days after Lopez passed this milestone – is Mark Litchfield, aka “mlitchfield.” He has helped companies such as Dropbox, Yelp, Venmo, Starbucks, Shopify and Rockstar Games address roughly 900 security holes.

HackerOne on Friday published its 2019 Hacker Report, which shows that over 300,000 white hat hackers have registered on the platform and they have earned a total of over $42 million in bounties for more than 100,000 vulnerabilities they have submitted.

In 2018, hackers earned $19 million through HackerOne, which is nearly as much as in all the previous years combined. India, the United States, Russia, Pakistan and the United Kingdom account for 51% of the researchers taking part in bug bounty programs, but the company noted that hackers from African countries have also increasingly signed up.

The largest bounties have come from the US and Canada, followed by the UK, Germany, Russia and Singapore.

A vast majority of the hackers are under the age of 35 – 47% are in the 18-24 age range – and 81% claim to have learned to hack on their own. Hacking websites is the speciality of 70% of HackerOne members, followed by APIs (6.8%) and data storage systems (3.7%).

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/N557Sf1yayo/two-white-hats-earn-over-1-million-bug-bounty-programs

Cobalt Strike Bug Exposes Attacker Servers

A recently addressed vulnerability in the Cobalt Strike penetration testing platform could be exploited to identify attacker servers, Fox-IT security researchers reveal.

The bug, which was addressed in January with the release of Cobalt Strike version 3.13, consisted of an uncommon whitespace in server responses and had been leveraged by researchers to identify Cobalt Strike servers for one and a half years.

Designed for adversary simulation, the Cobalt Strike platform is commonly used by penetration testers and red teamers to test a system’s resilience, but has also become the weapon of choice for various threat actors over the past several years.

The platform is commercially and publicly available, and pirated/cracked versions of the software are also being distributed, which contributed to its wide adoption. Some of the actors using it include the financially motivated FIN7 and state-affiliated APT29 groups.

The platform consists of two components, namely an implant (called beacon) and a server (referred to as team server). Written in Java, the server can be used to manage the Cobalt Strike beacons, can act as a webserver for beacons to connect to command and control (C&C), and can also be set to serve the beacon payload, landing pages and arbitrary files.

Communication with the servers, Fox-IT explains, can be fingerprinted via Intrusion Detection System (IDS) signatures and other techniques, thus helping researches draw a better picture of team servers used in the wild.

Analysis of these servers also allowed Fox-IT to discover a bug in the webserver component of the Cobalt Strike team server (which is based on NanoHTTPD, an open source webserver written in Java), which unintendedly returns a surplus whitespace in all its HTTP responses.

This allowed researchers to identify publicly-exposed NanoHTTPD servers, including possible Cobalt Strike team servers.

Using the available data, the researchers were able to “historically identify the state of publicly reachable team servers on the Internet.” Thus, they noticed a steady growth in Cobalt Strike (NanoHTTPD) webservers on ports 80 and 443 as the framework gained popularity over years, but also a decline since early January 2019, when the flaw was addressed.

The security researchers found a total of 7,718 unique Cobalt Strike team servers or NanoHTTPD hosts between January 2015 and February 2019 (the full list is on GitHub), but note that these are used for both legitimate and illegitimate operations, as they cannot be distinguished easily.

The vulnerability was addressed in Cobalt Strike 3.13, but Fox-IT believes it was in the platform for almost 7 years, provided it has been using NanoHTTPD since the first version, released in 2012.

“The fact that the removal of this space is documented in the change log leads us to believe that the Cobalt Strike developers have become aware of the implications of such a space in the server response, and its potential value to blue teams,” Fox-IT says.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/DMZ90fqt8Ts/cobalt-strike-bug-exposes-attacker-servers

Magecart Hackers Change Tactics Following Public Exposure

One of the multiple hacking groups operating under the “Magecart” umbrella has changed its tactics following a November 2018 report exposing their activity.

Generically referred to as Group 4, the actor was described as the most advanced of the six groups that have been employing Magecart web skimmers at the time (the number has increased since), and RiskIQ’s security researchers even suggested the group might originate from established cybercrime operations.

The public exposure apparently determined Group 4 to make a series of changes to their modus operandi, especially since parts of their infrastructure were also taken down, RiskIQ now reports.

Since November, the group has been observed registering close to a hundred new domains and setting up a large pool of servers to route these domains and deliver skimmers.

The hackers removed IP overlaps and only put a maximum of five domains on one IP address and ensured they don’t route to other IPs, pool IP space with different hosters (previous infrastructure was fixed on bulletproof hosters or those that would ignore malicious activity). Furthermore, the group now uses a variety of standard JavaScript libraries.

“Just like we’re professionals in cybersecurity, they’re professionals in cybercrime. We may not hold their ‘job’ in high regard, but Group 4 is an advanced group of professional criminals and a dangerous adversary,” RiskIQ says.

The domains associated with the group’s skimming activities are proxies that point toward a large internal network. The researchers also discovered that the proxies upstream skimmer requests towards a backend delivering the skimmer script.

Other Magecart hackers rely on kits that are a combination of PHP and MySQL-based backends. This means that the same server that obtains the stolen data is also the source of the skimming code and hosts the backend.

In addition to changing their infrastructure, the group also updated key elements of the skimmer, which no longer uses the old functionality, although it continues to include old code. Features in the code are now enabled with feature flags, with new features being turned off by default.

Previously, the skimmer was an overlay payment phishing system, but the new code uses skimming existing payment forms instead. The skimmer goes through page forms and pulls out the payment data, which reduces it to only around 150 lines of code.

It also adds a new event listener to hook into the process of the payment-completion process, which listens for the usage of the return/enter key. The option is added with a feature flag and might be experimental, as the researchers only observed it turned off.

The exfiltration URL was simplified, as the code picks a random domain from a pool of pre-configured domains; takes the page scheme, adds the domain and generates a three letter random .jpg file path; appends the skimmed data as URL arguments; and includes the URL as an image element and removes it as soon as it’s loaded. The exfiltrated data is encrypted.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/SHTORdjrhMw/magecart-hackers-change-tactics-following-public-exposure

Chrome Zero-Day Exploited to Harvest User Data via PDF Files

Exploit detection service EdgeSpot says it has spotted several PDF documents that exploit a zero-day vulnerability in Chrome to collect information on users who open the files through Google’s web browser.

EdgeSpot claims to have identified several samples in the wild. When one of the PDFs is opened with Chrome, a document is shown to the user, but various pieces of information are collected and sent to a remote server in the background.

Researchers say there is no suspicious activity when the files are opened using a viewer such as Adobe Reader, but outbound traffic has been detected when they are opened with Chrome.

EdgeSpot says the specially crafted documents, which have been observed since late December, collect data such as IP address, operating system and Chrome versions, and the full path of the PDF file on the victim’s system.

The data is sent via an HTTP POST request to a remote server without requiring any user interaction. The samples analyzed by the researchers have been sending the data to one of two domains: burpcollaborator.net or readnotify.com.

A screenshot posted by EdgeSpot shows that one of the malicious files was a modified version of a document from Lonely Planet on the history of the Bay Islands in Honduras. Based on the names of the malicious files, they all appear to reference Honduras.

A majority of the samples found by EdgeSpot have very low detection rates on VirusTotal at the time of writing – they are either marked as “clean” by all antiviruses or they are detected by only 2-3 products.

EdgeSpot said it reported its findings to Google on December 26. However, it claims that Chrome developers only plan on rolling out a fix in late April. SecurityWeek has reached out to Google for comment and will update this article if the company responds.

“We decided to release our finding prior to the patch because we think it’s better to give the affected users a chance to be informed/alerted of the potential risk, since the active exploits/samples are in the wild while the patch is not near away,” EdgeSpot said.

Until a patch is released, users have been advised to avoid opening suspicious PDF documents via Chrome and use other PDF viewers.

Adobe also released patches recently for some Reader vulnerabilities that can be exploited to harvest user data via PDF files.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/gcZW3bhEJ-A/chrome-zero-day-exploited-harvest-user-data-pdf-files

‘Thunderclap’ Flaws Expose Computers to Attacks via Peripheral Devices

Researchers have disclosed the details of an attack method that can allow a malicious actor to take control of a computer and gain access to sensitive data by connecting a specially crafted device to its Thunderbolt port.

The attack, dubbed Thunderclap, involves a series of vulnerabilities that can be exploited via Thunderbolt, a hardware interface created by Apple and Intel for connecting peripheral devices to a computer. The security holes were discovered by a team of researchers from Rice University in the United States, University of Cambridge in the United Kingdom, and SRI International.

The flaws impact a vast majority of the laptops and desktop computers made by Apple since 2011. However, Thunderbolt 3 is often supported via USB Type-C ports, which means that computers designed to run Windows and Linux can be vulnerable as well. The researchers noted that exploitation is also possible through devices connected via PCI Express or chips directly soldered to the targeted computer’s motherboard.

Thunderclap attack uses Thunderbolt port While launching an attack requires physical access to the targeted system, the experts noted that an attacker can use apparently harmless devices such as chargers of video projectors, which, in addition to launching an attack, can also perform their intended task to avoid raising suspicion.

The researchers reported their findings to affected vendors back in 2016 and have been working with them ever since to develop patches. Both Apple and Microsoft have rolled out some fixes for macOS (starting with version 10.12.4) and Windows (in Windows 10), but they only address the most dangerous problems discovered by the experts.

Intel has created patches for the Linux kernel (expected to be released soon) and one unnamed notebook vendor said it would try to address the issues before adding Thunderbolt to its new product lines.

Thunderclap attacks are mitigated on Windows and some Linux systems due to a Thunderbolt access control mechanism that prompts users when a device is connected, but many people would likely click through these prompts. Furthermore, the researchers pointed out that the access control prompt is not displayed if the attack is carried out via a PCI Express peripheral.

“In general terms, platforms remain insufficiently defended from peripheral devices over Thunderbolt such that users should not connect devices they do not know the provenance of or do not trust,” the researchers noted.

The Thunderclap attack leverages the fact that peripheral devices are given direct memory access (DMA), which means they can read from and write to all the system memory without oversight from the operating system.

The targeted memory can store valuable information, such as passwords, financial information, and browsing data. Attackers could also inject code that would be executed with the highest privileges, giving them complete control over the machine.

The input-output memory management unit (IOMMU) was designed to provide protection against such attacks by restricting the access of peripherals to memory. However, IOMMU introduces some performance penalties and it’s often disabled by default. On the other hand, the researchers have demonstrated that even if IOMMU is enabled and configured properly, attacks are still possible via the Thunderclap vulnerabilities.

The researchers have made available technical details for Thunderclap and released an open source platform that can be used by other researchers and vendors interested in testing their products against these types of DMA attacks.

Back in 2015, a researcher showed how the Thunderbolt port on MacBooks could be abused to install an OS X firmware bootkit.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/vAZDw5mb6Vo/thunderclap-flaws-expose-computers-attacks-peripheral-devices

New Attacks Show Signed PDF Documents Cannot Be Trusted

Many popular PDF viewers and online validation services contain vulnerabilities that can be exploited to make unauthorized changes to signed PDF documents without invalidating their signature, researchers have warned.

A team of researchers from the Ruhr-University Bochum in Germany has analyzed 22 desktop applications (including their Windows, Linux and macOS versions) and 7 online validation services.

PDF signatures, which rely on cryptographic operations, are widely used by organizations around the world to ensure that their documents are protected against unauthorized modifications. Many governments sign their official documents, researchers often sign scientific papers, and major companies such as Amazon are known to sign documents such as invoices. If a signed document has been changed, its signature should become invalid.

However, the researchers from Ruhr-University Bochum have demonstrated that a vast majority of PDF viewers and online validation services are vulnerable to at least one of the three PDF signature spoofing attack methods they have identified.

The experts showed that an unauthorized user could leverage various techniques to make changes to a PDF document without invalidating its signature.

The list of vulnerable applications includes Adobe Reader, Foxit Reader, LibreOffice, Nitro Reader, PDF-XChange and Soda PDF, which are some of the most popular PDF readers. The list of affected validation services includes DocuSign, eTR Validation Service, DSS Demonstration WebApp, Evotrust, and VEP.si.

The only application that was not vulnerable to at least one type of attack was Adobe Reader 9 running on Linux, while the only non-vulnerable online service was the 5.4 version of the DSS Demonstration WebApp. The researchers have been working with CERT-Bund, Germany’s governmental CERT, to notify impacted vendors and provide them the information needed to address the issues. While some online services have yet to roll out patches, all of the companies providing PDF viewing apps have released fixes.

The three attack methods identified by researchers have been named Universal Signature Forgery (USF), Incremental Saving Attack (ISA), and Signature Wrapping Attack (SWA).

In the case of USF, an attacker can manipulate meta information in the signature so that the application used to open the altered PDF finds the signature, but not the data needed for validation. Despite the missing information, the signature is still showed as valid by some applications, such as Acrobat Reader DC and Reader XI.

The ISA attack, which affects many of the tested apps and services, leverages a legitimate feature in the PDF specification. This feature allows files to be updated by appending changes, such as storing annotations or adding new pages to the document. An attacker can modify a document by making changes to an element that is not part of the signature integrity protection.

Finally, the SWA attack, which impacts many PDF apps and some online validation services, forces the signature verification logic to process different data by “relocating the originally signed content to a different position within the document and inserting new content at the allocated position.”

The researchers have published a paper and created a dedicated website, both of which contain the technical details of the attacks.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/sHVopQgQsTo/new-attacks-show-signed-pdf-documents-cannot-be-trusted

NVIDIA Patches High Risk Vulnerabilities in GPU Display Drivers

NVIDIA has released a security update for the NVIDIA GPU display driver, to address several High severity vulnerabilities impacting GeForce, Quadro, NVS, and Tesla products.

A total of 8 security vulnerabilities were addressed in this round of patches, five of which have a CVSS score of 8.8. Exploitation of these bugs could lead to code execution, denial of service or escalation of privileges on the affected systems, the GPU maker says.

Tracked as CVE‑2019‑5665, the first of the flaws was found in the 3D vision component of the GPU display driver. The bug affects the stereo service software, which does not check for hard links when opening a file.

The second issue, CVE‑2019‑5666, affects the kernel mode layer (nvlddmkm.sys) create context command DDI DxgkDdiCreateContext. Incorrect validation of untrusted input or index fails to ensure the index references a valid position within the array.

CVE‑2019‑5667 is a bug in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiSetRootPageTable, while CVE‑2019‑5668 impacts the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiSubmitCommandVirtual. In both cases, the application dereferences a pointer that, instead of being valid, is NULL.

The fifth High severity flaw is CVE‑2019‑5669, residing in the kernel mode layer handler for DxgkDdiEscape. When leveraging a sequential operation to read from or write to a buffer, the software uses an incorrect length value, thus accessing memory outside of the bounds of the buffer.

Another important vulnerability NVIDIA addressed in this round of patches is CVE‑2019‑5670, which also impacts the kernel mode layer handler for DxgkDdiEscape and causes the software to access memory outside of its buffer. This could lead to denial of service, escalation of privileges, code execution or information disclosure.

Another flaw is CVE‑2019‑5671, a denial of service flaw in in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where the software does not release a resource after its effective lifetime has ended.

The last bug is CVE‑2018‑6260, where application data processed on the GPU is accessible through a side channel exposed by the GPU performance counters. Exploitation of this vulnerability requires local user access, but the flaw also impacts Linux, FreeBSD, and Solaris.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/KZUkCybA3o4/nvidia-patches-high-risk-vulnerabilities-gpu-display-drivers

Hackers Exploit WinRAR Vulnerability to Deliver Malware

Malicious hackers have started exploiting a critical WinRAR vulnerability disclosed less than one week ago, just as RARLab has released the final version of the update that should patch the flaw.

Researchers at Check Point Software Technologies warned on February 20 that WinRAR, a tool utilized by over 500 million users worldwide, is affected by a remote code execution vulnerability that can be exploited by getting the targeted user to open a specially crafted ACE archive.

The security hole, tracked as CVE-2018-20250, impacts the unacev2.dll library, which is used by WinRAR for unpacking files compressed with the old ACE format. An attacker can exploit the flaw to stealthily extract a file from an archive to an arbitrary location on the system, while also extracting a harmless file to the folder specified by the victim. Code execution can be achieved by extracting a malicious file to the Startup folder in Windows, which would get executed the next time the operating system boots.

When Check Point disclosed its findings, RARLab informed users that version 5.70 beta 1 prevented attacks by completely removing unacev2.dll. The company says the library has not been updated since 2005 and it no longer has access to its source code.

RARLab announced on Tuesday that it has released the final version of WinRAR 5.70, but in-the-wild exploits had already been spotted.

The 360 Threat Intelligence Center of Chinese cybersecurity firm Qihoo 360 revealed on Monday, five days after the flaw was disclosed, that they had seen a malicious email delivering a backdoor by exploiting the WinRAR vulnerability.

The malicious file, stored in an archive with the .zip extension, extracted a file named “CMSTray.exe” to the Windows Startup folder. Less than half of the antivirus engines on VirusTotal detect the threat at the time of writing.

Bleeping Computer has analyzed CMSTray.exe and found that the file connects to an IP address in Mexico, from which it downloads the Cobalt Strike Beacon penetration testing tool. The tool allows the attackers to gain remote access to the targeted device.

ACROS Security’s 0patch service has released an unofficial fix for the WinRAR vulnerability. Unlike the official patch, the one from 0patch does not remove support for the ACE archive format.

Mitja Kolsek‏, the CEO of ACROS Security, claims to have seen four types of emails delivering malicious ACE files. The list includes fake invoices, delivery documents, purchase orders, and bank statements.

Email delivers WinRAR exploit

Kolsek‏ has pointed out that while exploitation of CVE-2018-20250 involves specially crafted ACE files, blocking files with the .ace extension is not an effective protection method as attackers can simply rename .ace files to .rar or .zip.

This is not the first time a WinRAR vulnerability has been exploited by malicious actors. Back in 2014, a flaw in the archiving tool was leveraged in cyber espionage campaigns.

Exploit acquisition firm Zerodium currently offers up to $80,000 for remote code execution flaws in WinRAR.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/Gl9BE6109QU/hackers-exploit-winrar-vulnerability-deliver-malware