Rockwell Automation to Patch Publicly Disclosed Power Monitor Flaws

Rockwell Automation is working on patches for two vulnerabilities affecting its Allen-Bradley PowerMonitor 1000 products. Details of the flaws have been public since November 2018.

Rockwell Automation and ICS-CERT warned recently that PowerMonitor 1000 power monitors are impacted by authentication bypass and stored cross-site scripting (XSS) vulnerabilities.

Allen Bradley PowerMonitor vulnerabilities The affected product is designed to provide load profiling, cost allocation, and energy control information when integrated with other energy monitoring systems.

The XSS flaw, classified as “medium severity” with a CVSS score of 6.1, allows a remote and unauthenticated attacker to inject arbitrary code into a user’s web browser session. The authentication bypass vulnerability, rated “critical” with a CVSS score of 9.8, can be exploited by an unauthenticated attacker to gain admin access to the device.

Advisories published on November 27, 2018, by Luca Chiou, the researcher who uncovered the vulnerabilities, provide enough information to allow malicious actors to exploit the vulnerabilities, a fact that Rockwell Automation has acknowledged in its advisory.

According to Chiou, the XSS flaw can be exploited by adding a new user to a specific file stored on the device. Instead of regular user data, an attacker can add malicious code that will be stored in the application’s database and executed whenever a legitimate user will access a page that displays user account data.

As for the authentication bypass issue, Chiou found that a “disabled” parameter present in the source code of the login page is used to prevent unauthorized users from accessing functions such as Edit, Remove, AddNew, Change Policy Holder, and Security Configuration.

An attacker can use a proxy to remove the “disabled” parameter, which gives them access to the aforementioned functions. They could then use the AddNew function to create a new admin account that gives them complete control over the targeted device.

Learn More About ICS Flaws at SecurityWeek’s 2019 ICS Cyber Security Conference

ICS-CERT and Rockwell Automation list the CVE identifiers CVE-2019-19615 and CVE-2019-19616 for these flaws, but the correct identifiers are likely CVE-2018-19615 and CVE-2018-19616. SecurityWeek has reached out to the DHS’s National Cybersecurity & Communications Integration Center (NCCIC) for confirmation.

Patches have yet to be released, but Rockwell Automation has provided a series of mitigations (registration required) that should prevent attacks. This includes using firewalls to block unauthorized access, running software with lower privileges, minimizing network exposure, and using VPNs for remote access. The automation giant also pointed out that Check Point Software Technologies products include rules for detecting potential attacks exploiting these flaws.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/ZFKJfOW1GtU/rockwell-automation-patch-publicly-disclosed-power-monitor-flaws

Privilege Escalation Vulnerability Found in LG Device Manager

A privilege escalation vulnerability that allows attackers to elevate permissions to SYSTEM has been found in the LG Device Manager application provided by the tech giant for its laptops.

A researcher who uses the online moniker Jackson T. analyzed the tool’s low-level hardware access (LHA) kernel-mode driver, which is associated with the LG Device Manager system service. Specifically, he tested the lha.sys and lha32.sys files shipped with version 1.1.1703.1700.

The security hole, tracked as CVE-2019-8372, allows an attacker who already has non-admin access to the targeted device to abuse the Device Manager app to escalate privileges to SYSTEM.

“This driver is used for Low-level Hardware Access (LHA) and includes IOCTL dispatch functions that can be used to read and write to arbitrary physical memory. When it is loaded, the device created by the driver is accessible to non-administrative users which could allow them to leverage those functions to elevate privileges,” the researcher explained.

According to Jackson, the issue was reported to LG on November 18 and the vendor informed him on February 13 that a patch is being released. The researcher said LG provided him an updated version of the driver for testing roughly one week after he notified the company, and he confirmed that a fix he had proposed was properly implemented.

At the time of writing, there is no mention of the vulnerability on the LG Product Security website.

The researcher has created proof-of-concept (PoC) exploits for both Windows 7 and Windows 10, and published a blog post containing technical details, along with a video showing the exploit in action.

[embedded content]

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/tX_9sQXQOgk/privilege-escalation-vulnerability-found-lg-device-manager

Exploit Code Published for Recent Container Escape Vulnerability

Proof-of-concept (PoC) code is now publicly available for a recently disclosed container escape vulnerability impacting popular cloud platforms, including AWS, Google Cloud, and numerous Linux distributions.

The flaw was discovered last month in runc, a lightweight, portable container runtime used in most containers out there, including cri-o, containerd, Kubernetes, Podman, and others. Tracked as CVE-2019-5736, the vulnerability could be exploited with minimal user interaction to execute code on the host.

One week after the security flaw was publicly disclosed, a Go implementation of the container escape was published on GitHub. The exploit requires root (uid 0) inside the container to work.

“An attacker would need to get command execution inside a container and start a malicious binary which would listen. When someone (attacker or victim) uses docker exec to get into the container, this will trigger the exploit which will allow code execution as root,” the code’s authors explain.

The implementation basically overwrites runc on the host and ensures the system will no longer be able to run Docker containers. Those willing to give it a try should first backup either /usr/bin/docker-runc or /usr/bin/runc and also check /usr/sbin.

This, however, is only one of the exploitation scenarios the vulnerability makes possible. A second scenario involves the use of a malicious Docker image that triggers the exploit, without requiring to exec into the container.

Last week, Amazon and Google confirmed their products were impacted, as did Red Hat, Debian and Ubuntu. LXC was also found affected.

Since then, VMware also confirmed that its products are impacted, and released patches to address the vulnerability in VMware Integrated OpenStack with Kubernetes (VIO-K), VMware PKS (PKS), VMware vCloud Director Container Service Extension (CSE), and vSphere Integrated Containers (VIC).

“VMware product updates resolve mishandled file descriptor vulnerability in runc container runtime. Successful exploitation of this issue may allow a malicious container to overwrite the contents of a host’s runc binary and execute arbitrary code,” VMware notes in an advisory.

Cisco says it has yet to determine which of its products and cloud services are impacted by the flaw, and that it is currently investigating dozens of them. To date, the company was able to confirm a single product not impacted by the flaw, namely Cisco Metacloud.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/ujxpqwohMiM/exploit-code-published-recent-container-escape-vulnerability

CSRF Vulnerability in Facebook Earns Researcher $25,000

A researcher says he received a $25,000 bounty from Facebook after he discovered a critical cross-site request forgery (CSRF) vulnerability that could have been exploited to hijack accounts simply by getting the targeted user to click on a link.

A white hat hacker who uses the online moniker “Samm0uda” found a vulnerable Facebook endpoint, facebook.com/comet/dialog_DONOTUSE/, that could have been leveraged to bypass CSRF protections and perform actions on a user’s behalf by tricking them into accessing a malicious URL.

Samm0uda has published example URLs that could allegedly be used to post something on a user’s timeline, delete their profile picture, and even delete their entire account. The last attack would require the victim to enter their password before the account is deleted.

According to the researcher, the method could have also been used to take control of an account by using requests that would change the targeted user’s email address or phone number in their Facebook account. If an attacker can add their own email address or phone number to an account, they can use the password reset feature to set a new password and lock the legitimate user out.

Hijacking an account using this vulnerability was not as straightforward as it involved accessing two separate URLs – one for adding the new email address or phone number, and one for confirming the action.

However, the researcher still found a way to execute an exploit in one go by authorizing a malicious app on behalf of the victim and obtaining their access token. The attack involved several steps, but Samm0uda said the entire exploit would have been executed “in the blink of an eye.”

The researcher said he reported his findings to Facebook on January 26 and a patch was released by January 31. The social media giant decided to award a $25,000 bounty.

Facebook announced in September the expansion of its bug bounty program to include vulnerabilities that involve the exposure of access tokens. In November, it announced that researchers could earn as much as $40,000 for account takeover exploits that do not require any user interaction, and up to $25,000 if minimal user interaction is required. This explains the relatively big bounty earned by Samm0uda.

Facebook reported in December that it had paid out a total of $1.1 million as part of its bug bounty program last year, and a total of $7.5 million since the launch of its program in 2011.

Samm0uda’s blog describes a significant number of Facebook and Instagram vulnerabilities, including many information disclosure issues, that he discovered in the past year.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/-VNzPH6DvyY/csrf-vulnerability-facebook-earns-researcher-25000

Mozilla, Others Want Big Retailers to Pledge Minimum IoT Security

Eleven organizations are asking major retailers in the United States to stop selling Internet-connected devices that don’t meet minimum security and privacy requirements.

It’s estimated that the number of active Internet of Things (IoT) devices will reach 10 billion by 2020, but several incidents have shown that many such products can pose serious security and privacy risks, including for children. The CloudPets leak from 2017 and the EU’s recent recall of a children’s smartwatch are just two examples.

In an effort to avoid such problems, nearly a dozen privacy and security advocates on Thursday sent a letter to big U.S. retailers asking them to publicly endorse minimum security and privacy guidelines, and use these guidelines to vet the IoT devices they sell to customers.

The letter is addressed to Target, Walmart, Best Buy and Amazon, and it was signed by Mozilla, the Internet Society, Consumers International, ColorOfChange, Open Media & Information Companies Initiative, Common Sense Media, Story of Stuff, the Center for Democracy and Technology, the Consumer Federation of America, 18 Million Rising, and Hollaback.

The guidelines focus on five main requirements: using encryption for all network communications, on-by-default and automatic security updates, the use of strong passwords for remote authentication, a vulnerability management program maintained by the vendor, and the inclusion of a privacy policy.

“While many products can and should be expected to meet a high set of privacy and security standards, these minimum requirements are a strong start that every reputable consumer company must be expected to meet,” Mozilla said.

The use of encryption ensures that communications between the device and servers are protected against eavesdropping or unauthorized modifications. Automatic security updates help protect users against attacks exploiting known vulnerabilities.

The use of strong passwords and forcing users to change default passwords during the initial setup of the device is also good for protecting IoT products against attacks.

Vulnerability management is also important. Vendors should make it easy for researchers to report vulnerabilities found in their products, and they should have an internal process in place to handle these reports.

Finally, the privacy policy accompanying every product should be easily accessible and written so that it can be understood by the targeted customer category.

“At a minimum, users should be notified about substantive changes to the policy,” Mozilla said. “If data is being collected, transmitted or shared for marketing purposes, that should be clear to users and, in line with the EU’s General Data Protection Regulation (GDPR), there should be a way to opt-out of such practices. Users should also have a way to delete their data and account. Additionally, like in GDPR, this should include a policy setting standard retention periods wherever possible.”

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/HL7YGWxHvO0/mozilla-others-want-big-retailers-pledge-minimum-iot-security

Hackers Target WordPress Sites via WP Cost Estimation Plugin

Malicious actors have been hacking WordPress websites by exploiting vulnerabilities in a fairly popular plugin called WP Cost Estimation & Payment Forms Builder.

Developed by Loopus, the plugin allows WordPress website administrators to create cost calculators and payment forms. The tool is offered on CodeCanyon for $28 and it has been purchased from this marketplace nearly 12,000 times.

Defiant, the developer of the Wordfence security plugin for WordPress websites, reported on Wednesday that it has been seeing attacks exploiting vulnerabilities in WP Cost Estimation & Payment Forms Builder to plant backdoors on websites.

The targeted flaws were patched by the developer months ago, but since no security warning was issued many users have not installed the updates and left their websites vulnerable to attacks.

According to Wordfence researchers, malicious actors have been exploiting two vulnerabilities related to uploading and deleting files.

WP Cost Estimation normally prevents users from uploading dangerous file types to the server, but a flaw in the plugin allowed them to upload malicious PHP files with an apparently harmless extension.

The second flaw allows attackers to delete arbitrary files. In the attacks spotted by Wordfence, they deleted the wp-config.php file, which makes WordPress believe that a fresh install is taking place – since no database configuration is present – enabling the hacker to connect the site to their own database and log in as administrator.

While both vulnerabilities should allow hackers to achieve the same goal, both security holes have been exploited in attacks aimed at the same site, which has led experts to believe that the file upload exploit did not produce the expected result.

Discussions on CodeCanyon reveal that several users reported that their sites had been hacked through this plugin. Some of the messages exchanged between the developer and users of WP Cost Estimation roughly 4 months ago suggest that the flaws may have had a zero-day status at some point – malicious actors exploited the weaknesses before the developer learned of their existence.

While investigating the efficiency of the patches released for these vulnerabilities, Wordfence researchers discovered another potentially serious flaw – an upload directory traversal issue that can be exploited to overwrite any file with a whitelisted type.

“Even with a whitelist only allowing images and archives to be uploaded, an attacker could cause serious trouble with an exploit. Any image on a site could be overwritten, allowing defacement campaigns to replace them en masse. If any backups are kept in an accessible location in a zip archive, an attacker could replace this backup with their own poisoned version, containing new users in the database or backdoors buried elsewhere in the file structure. When the backup is restored (perhaps following a mysterious case of overwritten images), these backdoors would be deployed,” the researchers explained.

Wordfence researchers reported this flaw to Loopus on January 26 and a patch was released a few days later.

It’s not uncommon for malicious actors to exploit recently patched or zero-day flaws affecting plugins to target WordPress websites. Recently disclosed attacks involved the AMP for WP, WordPress GDPR Compliance, and Total Donations plugins.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/LKKEJyjgiBI/hackers-target-wordpress-sites-wp-cost-estimation-plugin

Google Paid Out $3.4 Million for Vulnerabilities Reported in 2018

Google revealed recently that it paid out a total of $3.4 million for flaws reported in 2018 by researchers through its Vulnerability Reward Program (VRP).

The $3.4 million was awarded for 1,319 reports submitted by 317 researchers from 78 countries. The largest single reward was $41,000 and $181,000 were donated to charity, the company said.

According to the Internet giant, it awarded $1.7 million for flaws affecting the Android mobile operating system and the Chrome web browser. The total paid out since the launch of the VRP in 2010 has reached $15 million.

In comparison, Google paid out a total of $2.9 million in 2017 – roughly $2.2 million for Chrome and Android weaknesses – and the single biggest reward was $112,500.

One of the researchers whose work has been highlighted by Google is 19-year-old Ezequiel Pereira from Uruguay. Pereira discovered a remote code execution vulnerability that provided remote access to the Google Cloud Platform console. This and other flaws he reported in the first months of 2018 earned the expert over $36,000.

“Tomasz Bojarski from Poland discovered a bug related to Cross-site scripting (XSS), a type of security bug that can allow an attacker to change the behavior or appearance of a website, steal private data or perform actions on behalf of someone else. Tomasz was last year’s top bug hunter and used his reward money to open a lodge and restaurant,” Google said in a blog post. “After Dzmitry Lukyanenka, a researcher from Minsk, Belarus, lost his job, he began bug-hunting full-time and became part of our VRP grants program, which provides financial support for prolific bug-hunters over time.”

The company has also announced the winners of its Security and Privacy Research Awards, a project whose goal is to recognize the contributions made by security and privacy experts in academia. Seven experts have been declared winners for 2018 and their universities will receive financial contributions totaling over half a million dollars.

Google announced a few months ago that its bug bounty program had been expanded to include techniques that can be used to bypass the company’s abuse detection systems. The rewards for these types of reports are up to $5,000.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/GSi5tl86gxk/google-paid-out-34-million-vulnerabilities-reported-2018

Many ICS Vulnerability Advisories Contain Errors: Report

Roughly one-third of the ICS-specific vulnerability advisories published in 2018 contained basic factual errors, including when describing and rating the severity of a flaw, according to the 2018 Year in Review report published on Thursday by industrial cybersecurity firm Dragos.

Last year, Dragos tracked 204 public advisories describing vulnerabilities impacting industrial control systems (ICS) and flaws in IT products that affect the safety of process control networks, including VPNs and firewalls. These advisories – an average of 17 advisories per month – covered 443 vulnerabilities. In comparison, the company tracked 163 advisories in 2017, with an average of 14 per month.

Of all the advisories it tracked, Dragos found that 32% had errors, particularly in terms of CVSS scores. Experts widely agree that CVSS scores can be misleading for ICS vulnerabilities, but it’s even more problematic if the CVSS score is not calculated properly.

“The overall high number of inaccurate reports is a risk – many organizations use public advisory data to either reduce risk or satisfy compliance requirements. Inaccurate advisories mean that these efforts are wasted and that relying upon advisories to prioritize patching or other remediation is not meeting the goal of reducing risk,” Dragos said in its report.

The company has pointed out that vulnerabilities reported through third-party vendors typically have a higher chance of getting an incorrect CVSS score assigned. When vendors find a vulnerability themselves and publish an advisory, the chances of an incorrect CVSS score are smaller – Dragos found that only 18% of vendor-produced advisories had errors.

It’s also better when researchers work directly with vendors as opposed to reporting their findings through a third-party agency such as ICS-CERT – 24% of advisories had errors when the flaw was reported directly to the vendor. Dragos noticed that 56% of the advisories published through an unnamed third-party organization had incorrect CVSS scores.

The security firm also determined that many advisories ignore industrial impact and fail to provide information on the likelihood of exploitation, which makes it more difficult for organizations to determine if the flaws require immediate action.

Learn More About ICS Flaws at SecurityWeek’s 2019 ICS Cyber Security Conference

The report also reveals that only 10% of advisories focus on perimeter systems that could be used by malicious actors to pivot into control system networks. On the other hand, 72% of the advisories cover vulnerabilities in HMIs, engineering workstations, field devices and industrial networking components.

Dragos believes researchers should focus more on products that could give attackers access to critical systems, such as VPNs, firewalls, data historians, OPC servers and other remote access systems. It highlighted that attackers who already have access to HMIs, field devices and engineering workstations can likely achieve their goals without the need to exploit any vulnerabilities.

Exploitation of ICS-related vulnerabilities can result in loss of view, when a system no longer displays data to the user or displays false data, and loss of control, when the system can no longer be controlled by the user.

More than half of the flaws disclosed last year can result in both loss of control and loss of view. However, 38% of advisories described issues that had another type of impact.

Impact of ICS vulnerabilities disclosed in 2018

“Vulnerabilities which lead to both a loss of view and control occur in the core of traditional control networks affecting both field devices (PLCs, RTUs, etc.) as well as management devices such as human-machine interface (HMI) systems and engineering workstation (EWS) software. This means that over half (60%) of ICS-related vulnerabilities can cause an operations outage, at least for the component affected by the advisory,” Dragos explained.

In addition to its ICS vulnerabilities report, Dragos on Thursday published two other reports describing threat groups and the landscape, and lessons learned from threat hunting and incident response.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/Y5VI1TNLKkQ/many-ics-vulnerability-advisories-contain-errors-report

Third-Party Patch Released for Code Execution Flaw in OpenOffice

An unofficial patch has been made available for a recently disclosed remote code execution vulnerability affecting the Apache OpenOffice open source productivity suite.

The flaw, described as a path traversal issue and tracked as CVE-2018-16858, was disclosed in early February by researcher Alex Inführ. The expert found that a hacker could execute code on a system by getting the targeted user to open a specially crafted document that loaded a Python file placed by the attacker anywhere on the device.

The attack involves a document containing a specially crafted link pointing to a Python script. When the victim opens the document and hovers over the link, the malicious code gets executed without any warning message being displayed. In order to avoid raising suspicion and make the attack more likely to succeed, a hacker can create a document where the entire page is filled with links whose color has been set to white – this way the victim only sees a blank page before the exploit is executed.

Inführ says the vulnerability impacts both LibreOffice and OpenOffice. However, LibreOffice developers released a patch less than two weeks after being notified.

OpenOffice developers, however, do not appear to have issued any fixes and have not made any comments on the vulnerability. SecurityWeek has reached out to them more than one week ago, but received no response.

ACROS Security’s 0patch service has released an unofficial patch for OpenOffice to address this vulnerability. The micropatch can be applied to the latest version of OpenOffice for Windows. Micropatches have been released for LibreOffice as well.

0patch releases fix for OpenOffice vulnerability

0patch has published a video showing an exploit attempt without and with the patch applied:

[embedded content]

0patch this week also released a fix for an Adobe Reader vulnerability that had been unpatched. Adobe released an official patch the next day.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/pGkmd2SCJvE/third-party-patch-released-code-execution-flaw-openoffice

SAP Patches Critical Vulnerability in HANA XSA

SAP this week released its February 2019 set of security fixes, to address over a dozen vulnerabilities across its product portfolio, including a Hot News flaw in SAP HANA Extended Application Services, advanced model.

A total of 13 Security Notes were issued as part of this month’s SAP Security Patch Day, along with 3 updates to previously released security notes. Of these, 2 Notes are rated Hot News, 4 rated High priority, and 10 considered Medium priority.

Affected SAP products this month include Business Client, HANA XSA, ABAP Platform (SLD Registration), Disclosure Management, Solution Tools Plug-In (ST-PI), Note Assistant, Business Objects, Manufacturing Integration and Intelligence, Business One Mobile Android App, and WebIntelligence BILaunchPad (Enterprise).

The first of the Hot News Notes (CVSS score of 9.8) is an update to a Security Note released on April 2018 Patch Day and includes security updates for the browser control Chromium delivered with SAP Business Client.

Featuring a CVSS score of 9.4, the Hot News Note for HANA XSA addresses a missing authentication check that could allow an attacker to gain access to high-privileged functionalities, in addition to being able to read, modify, or delete sensitive information.

The security flaw impacts XS Advanced selected versions in both SAP HANA 1 and SAP HANA 2, Onapsis, a company specialized in securing Oracle and SAP applications, says.

Affected customers should upgrade the XS Advanced component. If that is not possible in the short term, a workaround to prevent attacks is available, relying on disabling the affected component if not in use.

Another vulnerability addressed in HANA XSA this month was a potential Information Disclosure rated Medium severity (CVSS score of 6.8).

The High priority Security Notes in this month’s SAP Security Patch Day include an XML External Entity (XXE) vulnerability in SLD Registration of ABAP Platform, Missing Authorization check in Disclosure Management, and access to Easy Access Menu in ABAP Platform.

Additionally, SAP issued an update to a security note released on November 2014 Patch Day, a potential information disclosure relating to database server file system. Successful exploitation could lead to an attacker accessing information stored in files on the operating system level on the database server.

This month, SAP also addressed Cross-Site Scripting (XSS) flaws, an Unrestricted File Upload vulnerability, a cross site request forgery, and a Directory Traversal vulnerability.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/3f0RCbvte0w/sap-patches-critical-vulnerability-hana-xsa