Georgia Official Seeks to Replace Criticized Voting Machines

Georgia’s new elections chief asked lawmakers Wednesday for $150 million to replace the state’s outdated electronic voting machines. In doing so, he all but closed the door on a hand-marked paper balloting system that experts say is cheapest and most secure.

Secretary of State Brad Raffensperger told Georgia legislators meeting for budget hearings that a new voting system is his top priority. Cybersecurity experts and voting integrity activists say the touch-screen machines Georgia has used since 2002 are vulnerable to hacking and can’t be audited effectively because they produce no verifiable paper record.

The current machines and Georgia’s registration practices became the subject of national criticism during last year’s governor’s race between Democrat Stacey Abrams and Republican Brian Kemp. Kemp served as secretary of state and refused calls to resign from overseeing his own election. He stepped down two days postelection after declaring himself the winner.

Two main systems offered by election equipment vendors have been considered as a replacement. Ballot-marking devices have an electronic touch screen where voters make choices and then print a paper receipt that is read by a scanner. The other system has hand-marked paper ballots that are read by an optical scanner.

Although Raffensperger said the procurement process for the new system would not have a “predetermined outcome,” he told lawmakers he believed a system with ballot-marking devices would be faster and more accurate.

“We believe that you get a better result, a more accurate result, and are actually able to move people through the lines faster when you have a ballot-marking device, so you don’t have to cipher out what someone meant with stray marks,” Raffensperger said.

The amount requested is also in line with the more costly ballot-marking systems.

Raffensperger’s presentation followed a study committee’s recommendation earlier this month to use ballot-marking devices over hand-marked paper ballots by a 13-3 vote.

Commission co-chairman Barry Fleming, a Republican state representative from Harlem, previously estimated initial expenditures would be roughly $50 million for a hand-marked paper ballot system and about $150 million for a ballot-marking machine system.

The three votes for hand-marked paper ballots came from two Democratic lawmakers and the commission’s lone cybersecurity expert, Georgia Tech professor Wenke Lee.

Lee explained why he favored hand-marked paper ballots in an opinion piece published by the Atlanta Journal-Constitution last week.

“Paper provides the trail of evidence for post-election audits to determine if software caused an error in election outcomes and does so without re-running an entire election. Paper is human readable and manually countable when needed,” Lee wrote.

Next, the legislature will have to rewrite election law to specify requirements for the new machines. Many Democrats have vowed to continue pushing for hand-marked paper ballots.

Then, Raffensperger’s office will handle the procurement in line with the change in the law.

Raffensperger said that, ideally, the state would have new machines in place in some cities for municipal elections in November 2019, before having them fully online across the state before November 2020.

He said the funding would cover getting the new machines, decommissioning the old ones, updating electronic poll books, and training and outreach to county elections officials.

Previous Columns by Associated Press:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/xq9zG5-K_nI/georgia-official-seeks-replace-criticized-voting-machines

Apple Patches Dozens of Vulnerabilities in iOS, macOS

Apple this week released new updates for iOS and macOS users to address tens of security vulnerabilities and other bugs in the two platforms.

A total of 31 security flaws were patched with the release of iOS 12.1.3, impacting components such as AppleKeyStore, Bluetooth, Core Media, CoreAnimation, FaceTime, IOKit, Kernel, Keyboard, libxpc, Safari Reader, SQLite, WebKit, and WebRTC.

Many of the addressed issues could result in arbitrary code execution, Apple reveals in an advisory. These include bugs impacting Bluetooth, FaceTime, Kernel, libxpc, SQLite, WebKit, and WebRTC.

Other vulnerability types resolved in the new iOS release include sandbox restriction bypass, privilege escalation, sandbox escape, denial of service, and cross site scripting attack when processing maliciously crafted web content.

Apple also resolved an issue where password autofill would fill in passwords after they were manually cleared, as well as bugs that resulted in malicious applications causing unexpected changes in memory shared between processes. Other flaws could allow malicious applications determine kernel memory layout or read restricted memory.

macOS Mojave 10.14.3 addresses 23 vulnerabilities in AppleKeyStore, Bluetooth, Core Media, CoreAnimation, FaceTime, Hypervisor, Intel Graphics Driver, IOKit, Kernel, libxpc, Natural Language Processing, QuartzCore, SQLite, and WebRTC.

The flaws could lead to arbitrary code execution, restricted memory leakage, denial of service, manipulation of memory shared between processes, privilege escalation, sandbox escape, and sandbox restriction bypass.

Patches for these are also available for macOS High Sierra 10.13.6 (Security Update 2019-001 High Sierra) and macOS Sierra 10.12.6 (Security Update 2019-001 Sierra).

This week, Apple also released tvOS 12.1.2, with patches for 24 vulnerabilities, most of which impact WebKit (9) and Kernel (6). watchOS 5.1.3 was pushed with patches for 17 flaws.

Apple addressed 10 vulnerabilities in Safari with the release of version 12.0.3 of the browser. These impact Safari Reader and WebKit and could lead to arbitrary code execution or cross site scripting attacks.

A total of 12 vulnerabilities were patched with the release of iCloud for Windows 7.10 this week, impacting SQLite and WebKit and leading to arbitrary code execution or universal cross site scripting.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/84Zc2I9bSbQ/apple-patches-dozens-vulnerabilities-ios-macos

Code Execution Vulnerability Impacts Linux Package Manager

A remote code execution vulnerability was recently discovered in APT, the high level package manager used in many Linux distributions.

Tracked as CVE-2019-3462, the software bug could be exploited by hackers able to perform network man-in-the-middle (MitM) attacks to inject content and have it executed on the target machine with root privileges. Malicious package mirrors can also exploit the bug.

“The code handling HTTP redirects in the HTTP transport method doesn’t properly sanitize fields transmitted over the wire. This vulnerability could be used by an attacker located as a man-in-the-middle between APT and a mirror to inject malicious content in the HTTP connection,” a Debian Security Advisory detailing the vulnerability reads.

The issue, security researcher Max Justicz explains, is that, when the HTTP server responds with a redirect, APT’s worker process returns a 103 Redirect instead of a 201 URI Done, and the HTTP fetcher process URL-decodes the HTTP Location header and blindly appends it to the 103 Redirect response.

“The parent process will trust the hashes returned in the injected 201 URI Done response, and compare them with the values from the signed package manifest. Since the attacker controls the reported hashes, they can use this vulnerability to convincingly forge any package,” the researcher notes.

APT version 1.6.y, which is present in some Ubuntu distributions, doesn’t just blindly append the URI, but the researcher did find an injection vulnerability in the subsequent 600 URI Acquire requests made to the HTTP fetcher process.

The vulnerability impacts the APT package manager itself, and users are advised to disable redirects in order to prevent exploitation when upgrading to the latest version, which also contains a patch for the vulnerability.

Users who cannot upgrade using APT without redirect can manually download the files (using wget/curl) for their architecture using specific URLs included in the Debian Security Advisory. File hashes are also provided, to check if they match those for the downloaded files.

“For the stable distribution (stretch), this problem has been fixed in version 1.4.9. We recommend that you upgrade your apt packages,” the Debian Security Advisory reads.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/b4GbXUzjRcE/code-execution-vulnerability-impacts-linux-package-manager

Flaws in Moxa IIoT Product Expose ICS to Remote Attacks

Serious vulnerabilities found in an industrial IoT (IIoT) platform from Moxa could enable malicious hackers to launch remote attacks on industrial networks. The vendor has released a patch that should address the flaws.

Over a period of two weeks, researchers from Kaspersky Lab’s Industrial Control Systems Cyber Emergency Response Team (ICS CERT) conducted a black box analysis of Moxa’s ThingsPro 2.

Launched by the industrial networking and automation solutions provider in 2017, ThingsPro 2 is an IIoT gateway and device management solution that allows organizations to collect and analyze data from industrial control systems (ICS), and easily manage and access their assets.

Kaspersky researchers discovered a total of seven previously unknown vulnerabilities that can be exploited to obtain elevated privileges, execute arbitrary commands, access industrial networks, and take control of devices.

Since Moxa ThingsPro is designed to provide access to industrial systems from the Internet, Kaspersky warns that attackers may be able to exploit the vulnerabilities remotely over the Web. A search conducted with Shodan revealed 43 results for “thingspro,” while a search on the Fofa.so platform returned over 150 results for the same string.

While exploiting the privilege escalation and code execution vulnerabilities discovered by Kaspersky requires the attacker to authenticate on the system, researchers did find a user enumeration issue that makes it easier to find valid usernames and launch brute-force attacks to obtain the associated password.

An attacker could also use hidden authentication tokens to access the ThingsPro administration interface. These tokens are not visible in the admin interface to anyone, but they are stored locally in the application database.

Learn More About ICS Flaws at SecurityWeek’s 2019 ICS Cyber Security Conference

The vulnerabilities were reported to Moxa in January 2018 and they were patched in late July. The vendor released an advisory for the flaws in October 2018 and Kaspersky has now made technical details available.

The security holes impact Moxa ThingsPro 2 series running version 2.1 or prior of the firmware. The flaws have been patched with the release of version 2.3 and the vendor has also provided mitigations for the user enumeration issue, which can be addressed by using strong passwords.

“Moxa is a trusted and respected brand in the industrial systems world,” said Kaspersky researcher Alexander Nochvay. “However, despite the company’s vast expertise and experience, its new product had a number of vulnerabilities, which shows that it is important even for industry leaders to conduct proper cybersecurity tests. We call on all ICS-product developers to act responsibly, performing regular vulnerability checks, treating the security of solutions for industrial systems as an integral and essential part of development.”

Moxa recently teamed up with cybersecurity firm Trend Micro to launch TXOne Networks, a company focusing on securing industrial internet of things (IIoT) environments.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/hEaY6tEEdhc/flaws-moxa-iiot-product-expose-ics-remote-attacks

Flaws in Omron HMI Product Exploitable via Malicious Project Files

Japan-based electronics company Omron has released an update for its CX-Supervisor product to address several vulnerabilities that can be exploited for denial-of-service (DoS) attacks and remote code execution.

CX-Supervisor is a piece of software that allows organizations to create human-machine interfaces (HMIs) for supervisory control and data acquisition (SCADA) systems. According to ICS-CERT, the tool is used worldwide, mainly in the energy sector.

Omron CX-Supervisor vulnerabilities Researcher Esteban Ruiz of Source Incite has found several vulnerabilities in CX-Supervisor, including issues that have been assigned a “high” severity rating. The expert reported his findings to the vendor through Trend Micro’s Zero Day Initiative (ZDI).

Both ZDI and ICS-CERT have published advisories for the vulnerabilities found by Ruiz. The list includes use-after-free, lack of proper validation for user-supplied input, and type confusion issues that can be exploited to execute arbitrary code/commands. One of the security holes allows an attacker to delete any file on the system, which can result in a DoS condition.

The flaws can be exploited by convincing the targeted user to open a specially crafted project file on a vulnerable version of CX-Supervisor.

Learn More About ICS Flaws at SecurityWeek’s 2019 ICS Cyber Security Conference

According to ZDI, the vulnerabilities were reported to the vendor in July 2018. ICS-CERT says the flaws have been patched with the release of version 3.5.0.11. The agency also recommends that users upgrade their development projects and save them in a new format for version 3.5.0.11.

A significant number of vulnerabilities have been found in this Omron product in the past year and ZDI will soon publish even more advisories for CX-Supervisor. An October advisory from ICS-CERT discloses four other flaws that can be exploited via malicious project files.

Ruiz has also discovered a vulnerability in Omron’s CX-One product. ZDI and ICS-CERT posted advisories earlier this month.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/B1zVQCGQJ2M/flaws-omron-hmi-product-exploitable-malicious-project-files

Exploit for Recent Flash Zero-Day Added to Fallout Exploit Kit

An updated version of the Fallout exploit kit recently emerged with an exploit for a recent Flash zero-day included in its arsenal, Malwarebytes Labs security researchers warn.

First detailed in September 2018, the toolkit was observed delivering malware families ranging from ransomware to backdoors, but also fingerprinting the browser profile to identify targets of interest.

The exploit kit (EK) remained active throughout the end of 2018, but its operators took a break in early January, apparently in order to improve their malicious kit. During Fallout’s absence, RIG EK’s activity intensified, Malwarebytes now reveals.

The Fallout EK is distributed via malvertising chains, especially via adult traffic. In attacks observed starting January 15, when the toolkit recommenced activity, GandCrab ransomware was identified as the payload.

One of the most notable additions to Fallout is an exploit for CVE-2018-15982, a vulnerability in Adobe’s Flash Player that leads to remote code execution. Adobe’s patch for the flaw arrived after a threat actor had been abusing it in attacks.

The first EK to implement an exploit for this security bug was Underminer in mid-December 2018, but it appears that Fallout wasn’t too far behind.

Due to the large number of critical vulnerabilities impacting Flash Player, Adobe is moving toward completely killing the plugin in 2020, and major Internet companies are supporting this decision. Later this year, Firefox will disable Flash by default (Chrome has been blocking Flash for two years).

The re-launched Fallout EK was also observed to include support for encrypted communications (HTTPS) and a new landing page format, and to leverage Powershell to run the final payload.

The use of Powershell instead of iexplorer.exe is “most likely an attempt at evasion, as traditionally we’d expect the Internet Explorer process to drop the payload,” Malwarebytes says.

This development is yet again proof that exploit kit developers are continuously monitoring the security vulnerabilities scene to implement new exploits and techniques.

“In 2018, several zero-days for Internet Explorer and Flash Player were found and turned into easily adaptable proof of concepts. Even though the market share for IE and Flash continues to drop, there are many countries still running older systems where the default browser is Internet Explorer,” Malwarebytes notes.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/yosD1m7Wd6I/exploit-recent-flash-zero-day-added-fallout-exploit-kit

Microsoft Launches Azure DevOps Bug Bounty Program

Microsoft announces new Azure DevOps bounty program

Microsoft of Thursday announced the launch of a new bug bounty program targeting Azure DevOps, a cloud service that allows users to collaborate on code development.

The tech giant is prepared to offer between $500 and $20,000 for vulnerabilities found in DevOps online services and the latest versions of DevOps Server and Team Foundation Server.

Bug bounty hunters have been invited to submit their findings to secure(at)microsoft.com. Eligible vulnerabilities include cross-site scripting (XSS), cross-site request forgery (CSRF), cross-tenant data tampering or access, insecure direct object reference, injections, server-side code execution, deserialization bugs, security misconfigurations not caused by the user, and the use of components with known vulnerabilities.

The highest rewards have been offered for critical remote code execution vulnerabilities that are disclosed via a high-quality report. Privilege escalation flaws can earn researchers between $1,000 and $8,000 depending on their severity and the quality of the report. Information disclosure weaknesses are also worth up to $8,000.

“The researcher community plays an essential role in keeping our customers secure, and we will review every submission and recognize your efforts according to our program criteria. If your submission isn’t eligible for bounty but still helps us fix or improve our product, we’ll offer public thanks and recognition for your contribution,” Microsoft said.

Microsoft currently runs nine other bug bounty programs. The highest rewards have been offered for vulnerabilities in Hyper-V (up to $250,000), Microsoft Identity (up to $100,000), and bypasses for anti-exploitation techniques in Windows (up to $100,000).

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/2zZe4tbBoRE/microsoft-launches-azure-devops-bug-bounty-program

Serious Flaws Found in ControlByWeb Industrial Weather Station

Researchers have discovered two potentially serious vulnerabilities in an industrial-grade weather station made by ControlByWeb, a company that specializes in products that allow organizations to remotely monitor and control electrical devices.

ControlByWeb’s Ethernet I/O products come with a built-in web server that enables access from a web browser. The company says its products can be easily integrated into industrial automation and SCADA systems, or they can be used as standalone devices.

Applied Risk researchers Tom Westenberg and John Elder have analyzed ControlByWeb’s X-320M product, a high-end, web-enabled controller designed for monitoring and recording weather information. The product can publish weather data to specialized weather services, it can send email and SMS notifications if specified parameters are exceeded, and it can remotely activate relays on other products made by the company.

ControlByWeb weather station vulnerabilities The experts discovered that the device’s Web-Enabled Instrumentation-Grade Data Acquisition module is affected by a denial-of-service (DoS) vulnerability that can be exploited to disrupt all TCP-based communications on the device through specific network settings.

Specifically, the attacker can set the “IP Filter Range 1” option in the setup.html page from 255.255.255.255 to 0.0.0.0, which causes a persistent DoS condition that prevents access to the device until a factory reset is performed.

The second vulnerability is a stored cross-site scripting (XSS) bug that affects the “Site Description” input field on the same HTML page. An attacker could inject a malicious script into this field and it would get executed when a legitimate user visits the device’s status page.

Learn More About ICS Flaws at SecurityWeek’s 2019 ICS Cyber Security Conference

The vulnerabilities, tracked as CVE-2018-18881 and CVE-2018-18882, have both been rated “high severity.” They both require the attacker to authenticate on the targeted device, but Applied Risk told SecurityWeek that these devices are shipped with default credentials that are publicly available. If the default credentials have not been changed by the user and the device is directly connected to the Internet without any additional protection, exploitation of the flaws is not difficult.

The vulnerabilities impact devices running version 1.05 or prior of the firmware. ControlByWeb has released version 1.06 to patch the vulnerabilities.

Applied Risk says it has also notified ICS-CERT, which also released an advisory on Thursday.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/78MjqhDm3kk/serious-flaws-found-controlbyweb-industrial-weather-station

Flaw in Reservation System Impacts Many Airlines

A vulnerability discovered in a reservation system used by hundreds of airlines around the world could expose the details of millions of their customers, researchers warned this week.

Researcher Noam Rotem and Safety Detective discovered the flaw after booking a flight with El Al, the flag carrier of Israel. They noticed that a link sent to customers when booking a flight contained a parameter whose value could be modified to access other people’s flights – this is known as an insecure direct object reference (IDOR) vulnerability.

An attacker can exploit this vulnerability to obtain passenger name records (PNRs), names, and details on associated flights. A PNR is a record stored by global distribution systems (GDS) and it can include names, contact information, ticket data, itinerary, passport numbers, dates of birth and even payment information. PNRs are at the root of many security weaknesses involving GDS.

While Rotem and Safety Detective found the flaw in El Al services, they soon discovered that the issue actually affected the reservation system provided by Spain-based GDS provider Amadeus, whose services are used by more than 200 airlines, including American Airlines, United Airlines, Air France, Singapore Airlines, Qantas, Lufthansa, and British Airways.

Someone who is in possession of a passenger’s PNR and name can access an airline’s customer portal and make changes to flight options (e.g. seats and meals), claim frequent flyer miles, and update the phone number and email address, which can then be leveraged to cancel or change a reservation via customer support services.

PNR codes can often be obtained from social media websites, where unknowing individuals post pictures of their boarding pass. However, researchers also discovered that the lack of brute-force protections on the Amadeus system allows an attacker to obtain the PNRs of random individuals through a brute-force attack.

Rotem and Safety Detective believe nearly half of all airlines worldwide may be affected.

They notified Amadeus of their findings and the company rolled out a patch, according to a blog post published on Tuesday. However, The Register has reported that the fix is incomplete and the vulnerability can still be exploited.

SecurityWeek has reached out to Safety Detective for confirmation on the incomplete patch, but we have yet to hear back.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/hmSPt8X3jXU/flaw-reservation-system-impacts-many-airlines

Two Code Execution Flaws Patched in Drupal

Updates released on Wednesday for Drupal 7, 8.5 and 8.6 address two potentially serious vulnerabilities that can be exploited for arbitrary code execution.

One of the flaws has been described as a weakness that allows remote execution of arbitrary PHP code. The issue is related to the phar stream wrapper built into PHP and how it handles untrusted phar:// URIs.

“Some Drupal code (core, contrib, and custom) may be performing file operations on insufficiently validated user input, thereby being exposed to this vulnerability,” Drupal developers explained in an advisory. “This vulnerability is mitigated by the fact that such code paths typically require access to an administrative permission or an atypical configuration.”

In response to this vulnerability, the developers of the content management system (CMS) have decided to add .phar to the list of dangerous extensions. As a result, all .phar files uploaded to Drupal will be automatically converted to .txt in order to prevent their execution.

In addition, Drupal has decided to disable the phar:// wrapper on Drupal 7 sites running a version of PHP earlier than 5.3.3. The wrapper can be manually re-enabled for earlier versions of PHP, but that also reintroduces the vulnerability, which is why users have been advised to consider updating their PHP version.

The second vulnerability patched in the latest versions of Drupal is related to PEAR Archive_Tar, a third-party library for handling .tar files in PHP. Exploitation of this flaw, which involves the phar wrapper and a specially crafted .tar file, can result in arbitrary file deletion and possibly even remote code execution.

The developers of Archive_Tar have patched the vulnerability (CVE-2018-1000888) and the library has now been updated in the Drupal core to prevent exploitation.

Drupal 8.6.6, 8.5.9 and 7.62 patch the two vulnerabilities. Drupal 8 versions prior to 8.5.x have reached end of life and no longer receive security updates.

Both vulnerabilities have been classified as “critical.” However, it’s worth noting that Drupal rates security holes based on the NIST Common Misuse Scoring System rather than CVSS, which means that “critical” is actually the second highest rating after “highly critical.”

Drupal developers also announced that, from now on, individual advisories will be published for each vulnerability patched in the CMS – until now, multiple flaws were disclosed in the same advisory.

Cybercriminals have been known to exploit Drupal vulnerabilities to hack websites, which is why it’s important that users keep their installations up to date.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/rXh_uWNHxfk/two-code-execution-flaws-patched-drupal