Vulnerabilities in WibuKey Could Lead to Code Execution

Vulnerabilities in the WibuKey Digital Rights Management (DRM) solution could be leveraged to disclose information, elevate privileges, or even execute code on affected systems.

Available for many interfaces and operating systems, WibuKey has been used in numerous solutions, including Straton, Archicad, GRAPHISOFT, V-Ray and others. However, Wibu Systems recommends that new projects use another of its technologies instead.

As Cisco’s security researchers point out, over 3,000 companies worldwide have been using the WibuKey solution to protect intellectual property and other digital content.

A total of three vulnerabilities were discovered in the DRM solution, leading to the unauthorized reading of kernel memory information, privilege escalation on the local system, and potential execution of code on accessible WibuKey network servers.

The most important of the three vulnerabilities is an exploitable heap overflow in the WkbProgramLow function of WibuKey Network server management, tracked as CVE-2018-3991. The bug can be triggered using a specially crafted TCP package, and could lead to remote kernel level code execution, Cisco says.

Tracked as CVE-2018-3989, the second vulnerability was found in the 0x8200E804 IOCTL handler functionality of WIBU-SYSTEMS WibuKey.sys version 6.40 (Build 2400).

“A specially crafted IRP request can cause the driver to return uninitialized memory, resulting in kernel memory disclosure,” Cisco Talos explains.

The third security flaw, CVE-2018-3990, is a pool corruption vulnerability in the 0x8200E804 IOCTL handler functionality of WibuKey.sys. An attacker could use a specially crafted IRP request to cause a buffer overflow, which could lead to kernel memory corruption.

The vulnerabilities were found in WIBU-SYSTEMS WibuKey Network server management 6.40.2402.500 and have been addressed this week, with the release of WibuKey 6.50, available on the vendor’s website (the update arrives two years after WibuKey 6.40 was made available).

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/dZBnC2VAeu4/vulnerabilities-wibukey-could-lead-code-execution

Singapore Government Announces Second Bug Bounty Program

The government of Singapore this week announced plans to launch a second bug bounty program in collaboration with hacker-powered security platform HackerOne.

The new bug bounty program will be overseen by the Government Technology Agency of Singapore (GovTech), the agency in charge of driving the digital transformation of the country’s public sector, and the Cyber Security Agency of Singapore (CSA).

The challenge is expected to run for a period of three weeks between December 2018 and January 2019. White hat hackers from Singapore and other countries have been invited to find vulnerabilities in five public-facing government websites and systems. Participants can earn between $250 and $10,000 for each flaw they discover.

The list of targets includes the gov.sg website, the REACH site, the Press Pass Accreditation service of the Ministry of Communications & Information, the site of the Ministry of Foreign Affairs (MFA), and the MFA’s eRegister service.

In the first bug bounty program run by the government of Singapore, organized by the Ministry of Defence, 17 hackers earned nearly $15,000 for 35 unique vulnerabilities – no critical flaws were found and only two were rated “high severity.” The highest reward was $2,000 and the Defence Ministry claimed it responded to vulnerability reports within five hours.

“Singapore is again setting an example for the rest of the world to follow by taking decisive steps towards securing their vital digital assets,” said Marten Mickos, CEO HackerOne. “Only governments that take cybersecurity seriously can reduce their risk of breach and interruption of digital systems. Singapore’s continued commitment to collaboration in cybersecurity is something that will help propel the industry’s progress just as much as it will contribute to protecting Singapore citizen and resident data.”

Next year, Singapore will host SecurityWeek’s 2019 Singapore ICS Cyber Security Conference, an event dedicated to serving critical infrastructure and industrial internet stakeholders in the APAC region. The conference will take place on April 16-18.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/xzV0jgCB_Os/singapore-government-announces-second-bug-bounty-program

UK’s NCSC Adopts HackerOne for Vulnerability Coordination Disclosure

Almost since its inception in October 2016, the UK’s National Cyber Security Centre (NCSC) has been considering how to formalize its vulnerability disclosure process. While the agency has a wider role in strengthening the overall cyber security of UK business, it has a more specific responsibility towards government systems.

In March 2017 it announced the launch of a new vulnerability coordination pilot program. “UK Government is no different to any other organisation and should adopt a mature approach to vulnerability disclosures, wherever they come from,” it said in a blog post.

The intent was to work with an invited group of security practitioners, with advice from LutaSecurity and using a recognized vulnerability coordination platform, before launching the new process. This was quietly introduced on 15 November 2018 when a new Vulnerability Reporting page appeared on the NCSC website.

The full vulnerability reporting service was announced this week. Through the pilot program, the NCSC said it had learned “how to handle vulnerabilities within an organisation, and how to work together with the researcher community.”

The key points of the new process are that it uses HackerOne as the platform provider and the NCC Group as the assessment partner. LutaSecurity is involved “to ensure we are following industry best practice.”

“One of the key learning points,” writes the NCSC in its announcement, “was to understand that a vulnerability disclosure is not in itself an incident. However, when a vulnerability is used in an attack, it is an incident?. This means that if an unpatched vulnerability gets publicized, it could become an incident?. Therefore, having a mature and co-ordinated vulnerability disclosure process helps decrease the risk of an incident occurring.”

This is the basic argument for ‘responsible disclosure’. The argument for ‘full disclosure’ is that if the vulnerability is not rapidly fixed it could be discovered independently and used maliciously as a zero-day attack by bad actors. The success of responsible disclosure in preventing a vulnerability from becoming an incident thus depends on being able to hold the organization (website owner, vendor etcetera) to account.

This is the purpose of the HackerOne platform. It effectively holds the vulnerability in escrow giving the vulnerability finder and relevant security team enough time to resolve the issue — hopefully working together. Under normal circumstances the time allowed by HackerOne is 30 days. In some circumstances, it can in good faith take longer to fix a vulnerability — but HackerOne still imposes a time limit.

“Last resort,” explains the HackerOne guidelines: “If 180 days have elapsed with the Security Team being unable or unwilling to provide a vulnerability disclosure timeline, the contents of the Report may be publicly disclosed by the Finder. We believe transparency is in the public’s best interest in these extreme cases.”

By adopting the HackerOne platform, the NCSC is being open and transparent in the handling of vulnerabilities on government websites and systems. It still asks that vulnerabilities should first, if possible, be reported to the owner of the website or system. It is possible, then, that some vulnerabilities could bypass the HackerOne platform and its controls.

Interestingly, the NCSC stresses that any vulnerabilities reported to it (that is, via HackerOne) will remain outside of the recently published GCHQ vulnerabilities equities process. The equities process explains how a particular vulnerability could be retained for government use and not disclosed by GCHQ. NCSC makes clear, however, “it’s also important to highlight that anything reported to us is exempt from the equities process and will be disclosed.” HackerOne ensures this.

By being open and transparent, and using recognized good practices in its vulnerability coordination process, the NCSC demonstrates the fine line that exists between it and GCHQ (NCSC is part of GCHQ). Where GCHQ must, by the nature of its work, be very secretive, the NCSC attempts to be as open as possible in its own work.

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Previous Columns by Kevin Townsend:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/kXSyIzrTqig/uks-ncsc-adopts-hackerone-vulnerability-coordination-disclosure

Hack the Air Force 3.0 Earns Researchers $130,000

The U.S. Defense Department and bug bounty platform HackerOne on Thursday announced the results of Hack the Air Force 3.0.

Hack the Air Force 3.0, the third bug bounty program run by the Air Force with assistance from HackerOne, took place between October 19 and November 22. Nearly 30 white hat hackers took part in the challenge and they discovered more than 120 vulnerabilities, for which they earned over $130,000. The DoD previously revealed that the minimum payout was $5,000 for critical vulnerabilities.

“It’s critical to allow these researchers to uncover vulnerabilities in Air Force websites and systems, which ultimately strengthens our cybersecurity posture and decreases our vulnerability surface area,” said Capt. James “JT” Thomas, Air Force Digital Services. “By opening up these types of challenges to more countries and individuals, we get a wide range of talent and experience we would normally not have access to in order to harden out networks.”

Previous Hack the Air Force challenges paid out roughly $130,000 in the first edition and over $100,000 in the second challenge. Over 430 unique security flaws have been fixed as a result of these events.

The DoD has launched several other bug bounty challenges in the past years, including Hack the Pentagon, Hack the Army, Hack the Marine Corps and Hack the Defense Travel System. With the latest Hack the Air Force, the total amount paid out to researchers has reached over $630,000, which represents the rewards for more than 5,000 valid vulnerabilities.

The recent Hack the Marine Corps program resulted in payouts totaling over $150,000 for 150 flaws.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/QOU4qs6vCmM/hack-air-force-30-earns-researchers-130000

Google Finds Internet Explorer Zero-Day Exploited in Targeted Attacks

An out-of-band update released by Microsoft on Wednesday for its Internet Explorer web browser patches a zero-day vulnerability exploited by malicious actors in targeted attacks.

Microsoft has credited Clement Lecigne of Google’s Threat Analysis Group for reporting the vulnerability, but neither Microsoft nor Google have shared any details about the attacks involving the flaw.

The security hole is tracked as CVE-2018-8653 and it has been described as a remote code execution vulnerability related to how the scripting engine used by Internet Explorer handles objects in memory.

“The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user,” Microsoft explained in an advisory. “An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”

According to the tech giant, an attacker can exploit the vulnerability by getting the targeted user to visit a specially crafted website using Internet Explorer. The victim can be lured to the malicious site using social engineering tactics.

Microsoft says the flaw impacts Internet Explorer 9 on Windows Server 2008, Internet Explorer 10 on Windows Server 2012, and Internet Explorer 11 on Windows 10, Windows Server 2019, Windows Server 2016, Windows Server 2008 R2, Windows Server 2012 R2, Windows 7, and Windows 8.1.

Since there are no workarounds for addressing this vulnerability, users should install the updates provided by Microsoft as soon as possible.

“Customers who have Windows Update enabled and have applied the latest security updates, are protected automatically. We encourage customers to turn on automatic updates,” Microsoft said.

Microsoft has patched a significant number of zero-day vulnerabilities this year, and since August it has resolved at least one zero-day every month. The list includes a flaw exploited by cybercriminals to deliver a RAT – Microsoft initially did not want to address this weakness –, Windows vulnerabilities disclosed by a researcher on Twitter, and several security bugs exploited in attacks aimed at the Middle East.

With this month’s Patch Tuesday updates, the company fixed a Windows kernel privilege escalation flaw exploited by a new threat actor named SandCat and possibly other groups.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/UhjnBh3q0Cc/google-finds-internet-explorer-zero-day-exploited-targeted-attacks

Servers Can Be Bricked Remotely via BMC Attack

Hackers could remotely brick servers by launching firmware attacks that involve the Baseboard Management Controller (BMC), researchers at firmware security company Eclypsium have demonstrated.

Firmware attacks can pose a serious threat as they allow attackers to gain persistent access and control over a targeted system. However, these types of attacks often require physical access to the targeted device so they are less likely to cause widespread problems, such as a piece of ransomware.

However, Eclypsium has demonstrated an attack method that can pose an even bigger problem than ransomware, especially for enterprises. The company’s researchers showed that an attacker can leverage the BMC to remotely brick a server and make it very difficult for an organization to restore.

The BMC is a small computer present on a majority of server motherboards. A component of the Intelligent Platform Management Interface (IPMI), it allows administrators to remotely control and monitor a server without having to access the operating system or applications running on it. Admins can use the BMC to reboot a device, install an operating system, update the firmware, monitor system parameters, and analyze logs.

While the capabilities provided by the BMC can be highly useful for administrators, the system also introduces an attack vector that can be used to cause serious damage.

For instance, a malicious firmware update can allow attackers to plant a piece of highly persistent malware that can survive a reinstallation of the operating system and a complete wipe of the hard drive. Attackers can also move laterally to management networks that are supposed to be isolated.

Eclypsium recently reported finding some BMC vulnerabilities in Supermicro motherboards. These flaws are related to the fact that the code responsible for processing firmware updates fails to verify an update’s cryptographic signature, allowing attackers to load malicious code onto the BMC.

New research made public by Eclypsium on Wednesday shows how such BMC vulnerabilities can be exploited to remotely brick the servers in an organization’s data center and cause serious damage and disruption.

An attacker would first need to gain remote access to the targeted system, either via compromised credentials or vulnerabilities in one of the applications running on the device. Once they have access, hackers can use legitimate BMC update tools to install corrupted firmware that causes the device to completely stop working, and the process does not even require any special authentication or credentials.

“This malicious BMC firmware update contains additional code that, once triggered, will erase the UEFI system firmware and critical components of the BMC firmware itself,” Eclypsium researchers explained. ”These changes to the host and BMC will cause all attempts to boot or recover the system to fail, rendering it unusable. These firmware images cause all attempts to boot or recover the system to fail, rendering it unusable.”

The company also warned that an attack can be set up so that the malicious payload is activated at a specified time, which could allow hackers to bring down an entire data center at once.

[embedded content]

While it is possible to recover a server hit by such an attack, the process is slow and requires advanced technical knowledge as it involves physically connecting to the chip on each affected server and installing new firmware.

Eclypsium CEO Yuriy Bulygin told SecurityWeek that this new research – in addition to demonstrating for the first time that BMC attacks can be used to brick servers – shows that an attacker can bypass BMC network isolation by infecting the BMC through the host.

“Most people think about firmware attacks and permanent damage attacks as being physical attacks,” John Loucaides, VP of engineering at Eclypsium, said via email. “The purpose of this demonstration is to help understand the remote attack vector, which means it can be performed at scale with enormous potential damage.”

“Indeed, BMC vulnerabilities have been shown before, and system firmware vulnerabilities have been shown before. However, you don’t usually see how easy it is to use these issues in attack operations that disrupt infrastructure,” Loucaides added.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/tfX3Sngk7cc/servers-can-be-bricked-remotely-bmc-attack

Serious Flaws Found in ABB Safety PLC Gateways

Researchers discovered that some gateways made by Swiss industrial tech company ABB are affected by potentially serious vulnerabilities, but firmware updates will not be made available by the vendor as the impacted products have reached end of life.

Industrial cybersecurity firm Applied Risk published an advisory this week describing two vulnerabilities in Pluto Gateway products from ABB.

The affected gateways, GATE-E1 and GATE-E2, allow ABB’s programmable safety controllers (safety PLCs) to communicate with other control systems.

According to Applied Risk, the devices are missing authentication mechanisms on their administrative telnet and web interfaces, allowing an attacker to easily gain unauthorized access. The flaw, which both Applied Risk and ABB have classified as “critical,” can be exploited to modify the device’s configuration and cause a denial-of-service (DoS) condition by continuously resetting the product.

“The vulnerability is caused by the lack of support for authentication in the product,” ABB explained. “At the time when the product was developed, it was not designed to provide security services such as authentication.”

Applied Risk also reported finding a persistent cross-site scripting (XSS) flaw that allows an attacker to inject malicious code via the administrative HTTP and telnet interfaces. The code gets executed when a legitimate admin accesses the device’s web portal. This vulnerability has been assigned a severity rating of “high.”

Learn More About ICS Vulnerabilities at SecurityWeek’s ICS Cyber Security Conference

Applied Risk told SecurityWeek that the vulnerabilities can be exploited remotely over the network, and possibly over the Internet if the network is configured for this type of access.

ABB has published separate advisories for the missing authentication and XSS vulnerabilities. The company told customers that the products have reached end of life (EOL) so they will not receive any firmware updates. However, users should receive an email from the vendor containing instructions on how an installation can be secured.

There is no evidence that any of these flaws have been exploited for malicious purposes.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/l6BQG76QGPk/serious-flaws-found-abb-safety-plc-gateways

Irish Data Authority Probes Facebook Photo Breach

The Irish data watchdog on Friday launched an investigation into Facebook, after the social media titan admitted a “bug” may have exposed unposted photos from up to 6.8 million users.

The Irish Data Protection Commission (DPC) probe will take place under strict new European privacy laws outlined in the General Data Protection Regulation (GDPR).

It follows a similar probe launched in October — when Facebook admitted a security breach exposed 50 million user accounts.

“The Irish DPC has received a number of breach notifications from Facebook since the introduction of the GDPR on May 25, 2018,” said head of communications Graham Doyle.

“With reference to these data breaches, including the breach in question, we have this week commenced a statutory inquiry examining Facebook’s compliance with the relevant provisions of the GDPR.”

The Irish DPC has primary European jurisdiction over Facebook as the California-based firm has established its international headquarters in Dublin.

GDPR legislation gives regulators vast powers to sanction firms failing to sufficiently secure personal data.

Corporations can be fined up to four percent of their annual global turnover if they neglect to conform.

That means Facebook faces a theoretical fine of 1.4 billion euros ($1.6 billion), based on its 2017 annual revenue of 35.2 billion euros ($40.6 billion).

On Friday Facebook said using the social media login and granting permission to third-party applications to access photos may have led to the unintended breach between September 13 and 25.

“When someone gives permission for an app to access their photos on Facebook, we usually only grant the app access to photos people share on their timeline,” engineering director Tomer Bar announced in a message to developers.

“In this case, the bug potentially gave developers access to other photos, such as those shared on Marketplace or Facebook Stories.”

The earlier October DPC investigation was launched after Facebook admitted attackers exploited a vulnerability in the website’s code in a manner which could have granted access to private accounts.

That probe has been touted as the first major test of GDPR legislation.

Facebook is already under scrutiny as a result of its role in the Cambridge Analytica (CA) data scandal.

Following revelations from a whistleblower it was revealed that tens of millions of users had their personal data hijacked by CA, a political firm working for Donald Trump in 2016.

Previous Columns by AFP:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/E0b5Qr9go14/irish-data-authority-probes-facebook-photo-breach

Code Execution Flaw in SQLite Affects Chrome, Other Software

Many applications using the popular SQLite database management system could be exposed to attacks due to a potentially serious vulnerability that can lead to remote code execution, information disclosure, and denial-of-service (DoS) attacks.

The vulnerability was discovered by researchers of the Blade Team at China-based internet giant Tencent. The experts have named the flaw “Magellan” and they claim it affects any piece of software that uses SQLite or Chromium – Chromium relies on WebSQL, which is based on SQLite.

SQLite vulnerability dubbed Magellan affects Chrome and other apps SQLite is one of the most popular database systems and it’s present in a significant number of operating systems, web application frameworks, web browsers, and various applications made by tech giants such as Adobe and Microsoft. In addition to Google Chrome, the open source web browser project Chromium powers Opera, Slimjet Browser, SRWare Iron, Torch, Comodo Dragon, CoolNovo, Yandex Browser, and Vivaldi.

According to Tencent Blade researchers, the vulnerability can be exploited remotely by getting the targeted user to access a specially crafted web page. Tencent Blade says it’s not releasing any details or exploit code, but claims to have successfully tested it against a Google Home device.

The vulnerability has been patched by SQLite developers with the release of version 3.26.0 on December 1. It has also been addressed in Chromium and in Chrome (with the release of Chrome 71 on December 4). Google has classified the vulnerability as “high severity,” but it has yet to determine the bug bounty it will pay to the researchers who discovered it.

The patches have already been used to create a PoC exploit that crashes Chrome and the Electron development framework. However, there is no evidence that the vulnerability has been exploited for malicious purposes.

Dr. D. Richard Hipp, the creator of SQLite, confirmed someone’s suspicion on Hacker News that the vulnerability only impacts systems that accept and run arbitrary SQLite queries, rather than all applications that only use SQLite for database management.

“The vulnerability only exists in applications that allow a potential attacker to run arbitrary SQL. If an application allows that, it is usually called an ‘SQL Injection’ vulnerability and is the fault of the application, not the database engine. The one notable exception to this rule is WebSQL in Chrome,” Hipp explained.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/qy1sr6ITW3s/code-execution-flaw-sqlite-affects-chrome-other-software

Photos of 6.8 Million Facebook Users Exposed by API Bug

Facebook revealed on Friday that a bug related to its Photo API could have allowed third-party apps to access users’ photos, even ones that were supposed to be private.

According to the social media giant, its internal team discovered a bug in the Photo API that impacted users who had utilized Facebook Login and allowed third-party apps to access their photos.

Applications that are granted access to photos are normally allowed to access only images shared on a user’s timeline. However, due to this flaw, developers could have accessed other photos as well, including ones shared on Facebook Marketplace or via Stories, or photos that were only uploaded to the social media service but not posted.

The vulnerability exposed photos for 12 days, between September 13 and September 25, 2018. Facebook believes the bug impacted up to 6.8 million users and 1,500 applications built by over 870 developers. The company pointed out that only apps granted access to photos by the user could have exploited the flaw.

Facebook says it’s notifying impacted people via an alert in their account and it also plans on releasing tools early next week that will allow developers to determine which of their users may have been affected by the issue. Developers will be instructed to delete photos obtained as a result of this bug.

Facebook announced this week that it has paid out more than $1.1 million through its bug bounty program in 2018, with roughly $7.5 million paid by the social media giant since the launch of its program in 2011.

The $1.1 million has been awarded to researchers from over 100 countries for more than 700 valid reports.

Facebook has been hit by several privacy and security incidents this year, which has resulted in the company expanding its bug bounty program and significantly increasing rewards for some types of vulnerabilities.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/nL68yZt839c/photos-68-million-facebook-users-exposed-api-bug