Siemens Patches Several Critical Flaws in SINUMERIK Controllers

Siemens informed customers this week that its SINUMERIK controllers are affected by denial-of-service (DoS), privilege escalation and code execution vulnerabilities, including several flaws that have been classified as “critical.”

Researchers at Kaspersky Lab discovered that SINUMERIK 808D, 828D and 840D controllers – some of which have been discontinued – are affected by ten vulnerabilities.

The most serious of the flaws, based on its CVSS score of 10, is CVE-2018-11466, which allows an attacker on the network to cause a DoS condition on the integrated software firewall or execute arbitrary code in the context of the firewall by sending specially crafted packets to TCP port 102. The security hole can be exploited by an unauthenticated attacker with no user interaction. Critical vulnerabilities found in Siemens SINUMERIK controllers

Another critical flaw, CVE-2018-11457, affects the integrated web server and it can be exploited by a network attacker with access to TCP port 4842 to execute code with elevated privileges by sending specially crafted packets. However, Siemens noted that exploitation is only possible if the port is manually opened in the firewall configuration.

The integrated VNC server is also affected by a critical vulnerability that allows arbitrary code execution with elevated privileges via specially crafted network packets, this time on port 5900. This security hole is tracked as CVE-2018-11458.

The last critical flaw identified by Kaspersky researchers in SINUMERIK controllers is CVE-2018-11462, which can be exploited to elevate privileges, but not to root.

Siemens also said its controllers are impacted by three high-severity flaws that allow local code execution, and three medium-severity bugs that can be exploited for privilege escalation and DoS attacks.

Learn More About ICS Vulnerabilities at SecurityWeek’s ICS Cyber Security Conference

Experts noted recently that CVSS scores can be misleading for ICS vulnerabilities and advised organizations not to prioritize patching based only on CVSS scores. In the case of these SINUMERIK controller vulnerabilities, several of them are critical based on their CVSS score, but many of them have mitigating factors. Furthermore, DoS vulnerabilities can pose a more serious risk in the case of industrial systems compared to privilege escalation or code execution flaws.

Siemens says it’s not aware of malicious exploits for any of these vulnerabilities. Patches and/or mitigations have been released by the German industrial giant for each of the impacted controllers.

Siemens also informed customers this week that its TIM 1531 IRC modules are missing proper authentication mechanisms when connecting on TCP port 102.

The company announced recently its intention to release security advisories on the second Tuesday of every month, similar to Microsoft, Adobe and SAP.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/kpPms23WPrc/siemens-patches-several-critical-flaws-sinumerik-controllers

Facebook Paid Out $1.1 Million in Bug Bounties in 2018

Facebook announced on Thursday that it has paid out more than $1.1 million through its bug bounty program in 2018, which brings the total paid by the social media giant since the launch of its program in 2011 to roughly $7.5 million.

The $1.1 million has been awarded to researchers from over 100 countries for more than 700 valid reports – the average reward amount was roughly $1,500. Facebook says it has received approximately 17,800 reports in total.

In comparison, in 2017, the company paid out more than $880,000 for over 400 valid reports out of a total of 12,000 submissions.

India and the United States were again the countries with the highest number of valid submissions.

Facebook also said it paid out its biggest bounty to date, but it has not disclosed the amount. The company said the vulnerability was related to GraphQL and it could have been exploited by an attacker to find out who was liking or commenting on a post that they would normally not be able to view. While the vulnerability found by the researcher was considered “low severity,” it led Facebook’s security team to uncover a broader issue in its subscription backend logic.

Facebook has been hit by several privacy and security incidents this year, which has resulted in the company expanding its bug bounty program and significantly increasing rewards for some types of vulnerabilities. Researchers who find flaws that can lead to account takeover can now earn as much as $40,000.

The expanded bug bounty program includes rewards for data abuse and compromised third-party apps. One noteworthy report was related to a third-party SDK that was collecting the access tokens of users who utilized the Facebook Login feature in apps using the problematic SDK.

“By extending our program to third-party apps, we hope to encourage more companies to see value in teaming up with whitehat researchers to secure their services and the entire technology ecosystem as we all work to counter similar threats. As security work is never finished, we believe that transparency and collaboration are key to staying ahead of adversaries and building trust with security researchers,” said Dan Gurfinkel, Security Engineering Manager at Facebook.

Gurfinkel also revealed that Facebook is teaming up with Google next year for a joint event focused on practical approaches for finding high-quality security holes.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/0C0FQIeIxGs/facebook-paid-out-11-million-bug-bounties-2018

Several Vulnerabilities Patched With Release of WordPress 5.0.1

WordPress developers announced on Thursday the availability of version 5.0.1 of the content management system (CMS), which addresses several types of vulnerabilities.

Researcher Tim Coen has discovered several cross-site scripting (XSS) flaws in WordPress, including one caused by the ability of contributors to edit new comments from users with higher privileges. He also found that a specially crafted URL input can be exploited for XSS attacks – this issue only impacts some plugins.

Coen and researcher Slavco Mihajloski discovered an XSS vulnerability related to the ability of authors on Apache-hosted websites to upload specially crafted files that bypass MIME verification.

“Prior to 5.0.1, WordPress did not require uploaded files to pass MIME type verification, so files could be uploaded even if the contents didn’t match the file extension. For example, a binary file could be uploaded with a .jpg extension,” explained WordPress developer Ian Dunn. “This is no longer the case, and the content of uploaded files must now match their extension. Most valid files should be unaffected, but there may be cases when a file needs to be renamed to its correct extension (e.g., an OpenOffice doc going from .pptx to .ppxs).”

Mihajloski found numerous WordPress vulnerabilities in the past months, but he is displeased with the way the developers of the CMS handle security reports. He says it takes a long time for flaws to get patched and researchers are often provided no feedback.

Researchers at Yoast discovered that, in some uncommon configurations, the user activation screen could be indexed by search engines, leading to the exposure of email addresses and possibly some default passwords. However, WordPress developers noted that the passwords are only exposed in “some rare cases.”

Karim El Ouerghemmi informed WordPress that authors could alter metadata and delete files that they normally would not be authorized to delete. Another metadata-related issue was reported by Sam Thomas, who found that contributors could use specially crafted metadata for PHP object injection.

Finally, Simon Scannell of RIPS Technologies discovered that authors could leverage specially crafted input to create posts of unauthorized types.

For users who have yet to update to version 5.0, the patches have also been included in updates for WordPress 4.9 and older releases.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/Lw4JOrKtkKM/several-vulnerabilities-patched-release-wordpress-501

GitLab Launches Public Bug Bounty Program

Open source Git repository management system GitLab this week announced the launch of a public bug bounty program with rewards of up to $12,000 for critical vulnerabilities found in its products and services.

GitLab aims to make software development easier and more efficient by providing an open source platform that can be used for the entire DevOps lifecycle. While in many ways it’s similar to GitHub, GitLab, which recently raised $100 million, offers a wider range of services.

The company launched a vulnerability disclosure program with the help of HackerOne back in 2014. Then, last year, it announced a small private bug bounty program that has resulted in a total payout of nearly $200,000 for roughly 250 vulnerabilities reported by more than 100 white hat hackers.

GitLab has now decided to launch a public bug bounty program via HackerOne. It covers the GitLab installation, production services, and the company’s other products, including its SaaS offering.

Researchers have been invited to report SQL injection, remote code execution, XSS, CSRF, directory traversal, privilege escalation and information disclosure vulnerabilities.

Critical vulnerabilities, findings that impact more than half of GitLab’s customer base, can earn researchers up to $12,000, while high-severity issues can be worth up to $7,000.

GitLab bug bounty program rewards

“GitLab is a cloud-native company,” said GitLab Director of Security Kathy Wang. “There is literally no physical office – all employees are remote, across 40+ different countries. Every third party product we use is SaaS-based. GitLab.com is hosted on Google Cloud. There is no firm perimeter, from a security perspective. We have to focus on access and credentialing management, as well as internal application security reviews, for example. Working with hackers helps the team scale, so that we can focus on other areas as well.”

One interesting vulnerability reported through the company’s private bug bounty program was disclosed in February. The flaw, which GitLab initially decided not to patch, could have been exploited to hijack users’ custom domains and point them to malicious content.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/P1TB3zUXzj0/gitlab-launches-public-bug-bounty-program

Rhode Island Sues Alphabet Over Google+ Security Incidents

A government organization in Rhode Island announced on Wednesday that it has filed a lawsuit against Google’s parent company, Alphabet Inc., over the recent security incidents involving the Google+ social network.

The Employees’ Retirement System of Rhode Island filed a motion in the Northern District of California asking to lead a shareholder class action against Alphabet. The Internet giant has been accused of misleading federal regulators and shareholders by failing to “disclose ongoing breaches in private user information from its social media platform Google+.”

“Google had an obligation to tell its users and investors that private information wasn’t being protected,” commented Rhode Island General Treasurer Seth Magaziner. “Instead, Google executives decided to hide the breaches from its users and continued to mislead investors and federal regulators. This is an unconscionable violation of public trust by Google, and we are seeking financial restitution on behalf of the Rhode Island pension fund and other investors.”

The lawsuit focuses on the two recent incidents involving Google+. The first was brought to light in October, when Google announced its decision to shut down the social network. The announcement also disclosed the existence of an API bug that exposed the personal information of as many as 500,000 users.

The company said the flaw, which it had discovered in March, gave hundreds of third-party apps access to information such as name, email address, occupation, gender and age. However, there was no evidence that the vulnerability was actually exploited.

The initial plan was to shut down Google+ by the end of next August, but Google has decided to do it four months earlier, in April 2019, after discovering another API vulnerability, this time one that affected roughly 52 million users.

The recently discovered flaw was introduced in November via a software update and it allowed applications to view profile information, including name, occupation, age, and email address, even if the account was configured to be private.

Shortly after Google disclosed the first incident, a group of US senators sent the company a letter asking for additional information, particularly regarding the decision to keep the incident a secret.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/mZyKpLkq82s/rhode-island-sues-alphabet-over-google-security-incidents

Grammarly Launches Public Bug Bounty Program

Grammarly, the popular service for checking grammar and spelling, this week announced the launch of a public bug bounty program.

Grammarly has been running a private bug bounty program with HackerOne for more than a year. The program has nearly 1,500 participants and resulted in payouts totaling $50,000.

The company has now decided to make its program public – also via HackerOne – and it’s prepared to pay up to $3,000 for critical vulnerabilities. However, Grammarly says it may pay bonuses for unusual hacks, and rewards could be higher than expected if a report leads its internal security team to discover a more severe issue.

“Pricing is flexible, depending on the impact of the discovered vulnerability or for other instances such as a well-defined report or its automated version, which makes it easier to improve our internal testing framework,” Joe Xavier, VP of Engineering at Grammarly, told SecurityWeek.

The highest rewards are for critical vulnerabilities affecting Grammarly browser extensions, mobile keyboards, the Microsoft Office add-in, or the Desktop Editor.

Grammarly bug bounty program

“We are open to various kinds of vulnerability reports, especially those that pertain to our native applications which carry a higher bounty,” Xavier explained. “With regards to specific threats, we are interested in CSRF, XXE and WAF break-in attack scenarios. We are excluding attacks that require physical access to a user’s computer.”

“We cover all our current product offerings for end-users with our public bug bounty program,” he added. “This includes the Grammarly Web editor, browser extensions (Chrome, Safari, Firefox, and Edge), native app for macOS and Windows, and mobile keyboard for iOS and Android.”

Earlier this year, Grammarly rushed to release patches for its browser extensions after Google Project Zero researcher Tavis Ormandy discovered a vulnerability that could have been exploited by malicious websites to access user data.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/VDrUVFXJZvw/grammarly-launches-public-bug-bounty-program

Windows Kernel Vulnerability Exploited in Attacks

Microsoft’s Patch Tuesday updates for December 2018 address nearly 40 vulnerabilities, including a zero-day flaw affecting the Windows kernel.

The actively exploited vulnerability, tracked as CVE-2018-8611, has been described by Microsoft as a privilege escalation issue related to the failure of the Windows kernel to properly handle objects in memory.

“An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights,” Microsoft said in its advisory.

Exploitation of the vulnerability requires access to the targeted system. The security hole impacts all supported versions of Windows.

Microsoft has credited Kaspersky Lab researchers for reporting the vulnerability. The cybersecurity firm is expected to publish a report detailing the flaw and the attacks exploiting it.

This is the third month in a row Microsoft patches a Windows zero-day discovered by experts at Kaspersky. In October, the tech giant patched CVE-2018-8453, a privilege escalation exploited by a threat group known as FruityArmor. Last month, it fixed CVE-2018-8589, which had been used in limited attacks aimed at entities in the Middle East.

Microsoft’s latest round of patches also resolves an “important” denial-of-service (DoS) flaw in .NET that has been publicly disclosed.

“The vulnerability can be exploited remotely without authentication by issuing a specially crafted request to the vulnerable application,” explained Chris Goettl, director of product management and security at Ivanti. “The vulnerability is rated as Important likely due to complexity to exploit, but it has been publicly disclosed meaning enough information has been revealed to the public to give a threat actor a head start on creating an exploit to take advantage of the vulnerability. Public disclosures increase the odds a vulnerability will be exploited.”

The list of critical vulnerabilities patched this month includes nine remote code execution flaws impacting the .NET framework, the Edge and Internet Explorer web browsers, Windows DNS servers, and the text-to-speech feature.

Adobe this month patched 87 vulnerabilities affecting the Windows and macOS versions of its Acrobat products.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/kJ6qUJhfE1k/windows-kernel-vulnerability-exploited-attacks

Adobe Patches 87 Vulnerabilities in Acrobat Software

The December 2018 Patch Tuesday updates released by Adobe address a total of 87 vulnerabilities affecting the company’s Acrobat software.

The vulnerabilities impact the Windows and macOS versions of Acrobat and Acrobat Reader DC (Continuous and Classic 2015 tracks), and Acrobat and Acrobat Reader 2017 products.

The list of security holes includes various types of critical bugs that can lead to arbitrary code execution, including buffer errors, untrusted pointer dereference, use-after-free, and heap overflow. The critical flaws also include several security bypass issues that can lead to privilege escalation.

Tens of out-of-bounds read, integer overflow and security bypass issues that can result in information disclosure have been classified as “important.”

Representatives of Tencent, Source Incite, NSFocus, Beihang University, Trend Micro, the Chinese Academy of Sciences, Baidu, Qihoo 360, Ruhr-Universität Bochum, Cisco Talos, Zero Day Initiative, Palo Alto Networks, Knownsec 404 Security Team, and various independent researchers have been credited by Adobe for responsibly disclosing the flaws.

Adobe says there is no indication that any of these vulnerabilities have been exploited in the wild.

The software giant recently released an out-of-band update for Flash Player to address a zero-day vulnerability exploited by a sophisticated threat group against a hospital associated with the Russian presidential administration.

The attack may have been related to the recent Kerch Strait incident involving Russia and Ukraine.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/1GoOPEeap10/adobe-patches-87-vulnerabilities-acrobat-software

New Exploit Kit Targets SOHO Routers

A newly identified exploit kit is targeting home and small office routers in an attempt to compromise the mobile devices or desktop computers connected to the routers, according to Trend Micro.

Dubbed Novidade, the exploit kit employs cross-site request forgery (CSRF) to change the Domain Name System (DNS) settings of routers to attack web applications and redirect traffic from the connected devices to the IP address of their server.

The exploit kit was initial observed in August 2017, and two more variants have been discovered since, including one involved in the DNSChanger system of a recent GhostDNS campaign. Novidade, however, might not be limited to a single campaign, but concurrently used in different attacks.

The tool might have been sold to multiple groups or its source code leaked, thus enabling threat actors to build their own variations. Most of the observed campaigns employed phishing attacks to retrieve banking credentials in Brazil, but a recent campaign suggests the actor is expanding their target area, or that more cybercriminals are using Novidade.

The exploit kit is being distributed via malvertising, compromised website injection, and via instant messengers. The landing page performs HTTP requests to a predefined list of local IP addresses that are mostly used by routers. Upon establishing a connection, the toolkit queries the IP address to download an exploit payload, and blindly attack the detected IP address with all its exploits.

The threat also attempts to log into the router with a set of default account names and passwords, and then executes a CSRF attack to change the DNS server to the attacker’s. If the compromise attempt is successful, the actor can perform pharming attacks on all connected devices.

All three variants of Novidade that Trend Micro’s security researchers observed share the same attack approach, but the newest version refines the code on the landing page and adds a new method of retrieving the victim’s local IP address. A shortened URL link is also used on the landing page, for attack statistics.

The list of possible affected router models includes A-Link WL54AP3 / WL54AP2 (CVE-2008-6823), D-Link DSL-2740R and DIR 905L, Medialink MWN-WAPR300 (CVE-2015-5996), Motorola SBG6580, Realtron, Roteador GWR-120, Secutech RiS-11/RiS-22/RiS-33 (CVE-2018-10080), and TP-Link TL-WR340G / TL-WR340GD and WR1043ND V1 (CVE-2013-2645).

Most of the campaigns using Novidade target Brazilian users and aim at stealing banking information. The largest campaign has delivered the exploit kit 24 million times since March, Trend Micro says.

In September and October, two campaigns were observed using different ways to deliver Novidade. One employed notifications on instant messengers regarding the 2018 Brazil presidential election, while the other leveraged compromised websites injected with an iframe to redirect users to Novidade. The attack targeted websites in multiple countries, not just Brazil.

To stay protected, users are advised to keep their devices’ firmware up to date, change the default usernames and passwords on their routers, and also change the router’s default IP address. Disabling remote access is also recommended, as well as using secure web connections (HTTPS) to access sensitive websites to prevent pharming attacks.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/fwlLfWQtGcc/new-exploit-kit-targets-soho-routers

New Bug Prompts Earlier End to Google+ Social Network

Google said Monday it will close the consumer version of its online social network sooner than originally planned due to the discovery of a new software bug.

The Google+ social network will close in April — four months earlier than planned — and the internet giant will focus on operating a version tailored for businesses, according to G Suite product management vice president David Thacker.

Application programming interface programs (APIs) used by developers to access Google+ data will be shut down within 90 days, according to Thacker.

“With the discovery of this new bug, we have decided to expedite the shut-down of all Google+ APIs,” Thacker said in a blog post.

“While we recognize there are implications for developers, we want to ensure the protection of our users.”

A new bug introduced via a software update in November was discovered during routine testing and fixed, according to the company.

Google determined that the vulnerability affected approximately 52.5 million users, allowing applications to see profile information such as name, occupation, age and email address even if access was set to private.

“No third party compromised our systems, and we have no evidence that the app developers that inadvertently had this access for six days were aware of it or misused it in any way,” Thacker said.

In October, Google announced plans to shut down the social network after fixing a bug exposing private data in as many as 500,000 accounts.

A security audit had revealed a software bug that gave third-party apps access to Google+ private profile data people meant to share only with friends.

The data involved was limited to optional profile fields, including name, age, gender, occupation and email address, Google said.

There was no evidence found at the time that developers had taken advantage of the bug, according to Google.

Google+ failed to gain meaningful traction after being launched in 2011 as a challenge to Facebook.

A Google spokesperson cited “significant challenges in creating and maintaining a successful Google+ that meets consumers’ expectations” along with “very low usage” as reasons for pulling the plug.

The social network allows users to download and share data such as pictures and videos.

Meanwhile, Google planned to add new workplace-oriented features to enhance the appeal of Google+ as a “secure corporate social network” to be used inside business operations.

“Our review showed that Google+ is better suited as an enterprise product where co-workers can engage in internal discussions,” the California-based internet firm said.

Previous Columns by AFP:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/n_AtB_Bz5yo/new-bug-prompts-earlier-end-google-social-network