No money was paid and no information was lost during a ransomware cyberattack that exploited a cloud-based vulnerability in the Colorado Department of Transportation’s computer network last spring, officials said Wednesday.

CDOT was one of several government agencies across the country targeted by two Iranian computer hackers in the sweeping extortion scheme, according to a grand jury indictment filed in New Jersey federal court on Wednesday.

Cities and businesses also were targeted by the two men, who are not believed to be connected to the Iranian government but are believed to be in Iran, the U.S. Justice Department said. The hackers extorted about $6 million and caused victims to lose more than $30 million, prosecutors said.

Colorado paid no ransom during the February CDOT attack, but work to contain and eradicate the ransomware, known as SamSam, cost at least $1.5 million, said Brandi Simmons, a spokeswoman for the Colorado governor’s Office of Information Technology. The state also invested in new security controls after the attack, she said.

The hackers exploited a cloud-based server without standard firewalls used by the state to access the CDOT system, Simmons said.

Previous Columns by Associated Press:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/sf_3xyZg7-4/colorado-agency-targeted-nationwide-ransomware-scheme

Cisco has fixed a vulnerability in the web framework code of Cisco Prime License Manager that could allow an attacker to execute arbitrary SQL queries.

The security flaw, which could be exploited remotely without authentication, is the result of lack of proper validation of user-supplied input in SQL queries. As a result, an attacker could send crafted HTTP POST requests containing malicious SQL statements to affected applications, thus triggering the bug. 

“A successful exploit could allow the attacker to modify and delete arbitrary data in the PLM database or gain shell access with the privileges of the postgres user,” Cisco explains in an advisory.

The vulnerability was found by Suhail Alaskar (of Saudi Information Technology Company) in Prime License Manager releases 11.0.1 and later, and impacts both standalone and coresident deployments (where Prime License Manager is installed as part of the Unified Communications Manager and Unity Connection). 

Acoording to Cisco, there are no workarounds to address the vulnerability, but software updates that resolve the issue have been already released. Specifically, Cisco Prime License Manager release patch ciscocm.CSCvk30822_v1.0.k3.cop.sgn addresses the bug. 

“The same COP file can be used with standalone deployments of Cisco Prime License Manager as well as with coresident deployments as part of Cisco Unified Communications Manager and Cisco Unity Connection and with all affected versions,” the company explains. 

The patch can be installed on Prime License Manager, Unified Communications Manager and Unity Connection 11.5(1) only. Earlier releases need to be upgraded to 11.5(1) before installing the patch, which is available for download (along with a Readme containing installation instructions) from the Software Center on Cisco.com.

According to Cisco, the Product Security Incident Response Team (PSIRT) is not aware of the security flaw being exploited, as there are no “public announcements or malicious use of the vulnerability.”

“Cisco Unified Communications Manager and Cisco Unity Connection Releases 12.0 and later have been confirmed to be not affected by this vulnerability as Cisco Prime License Manager is no longer included in these releases,” Cisco notes. 

Related: Cisco Releases Second Patch for Webex Meetings Vulnerability

Related: Cisco Patches Serious Flaws in RV, SD-WAN, Umbrella Products

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/eO8Ifv3aadc/cisco-patches-sql-injection-flaw-prime-license-manager

A team of researchers has introduced the concept of smart greybox fuzzing, which they claim is much more efficient in finding vulnerabilities in libraries that parse complex files compared to existing fuzzers.

Fuzzing is used to find software vulnerabilities by sending malformed input to the targeted application. If the software crashes or behaves unexpectedly, it could indicate the presence of a security flaw. There are three main types of fuzzing: blackbox fuzzing, where the tester has zero knowledge of the target; whitebox fuzzing, where there is full knowledge of the target and the testing is done through the source code; and greybox fuzzing, where the tester has some knowledge of the targeted application.

Five researchers from the National University of Singapore, the Monash University in Australia, and the University Politehnica of Bucharest in Romania have been looking at ways to improve greybox fuzzing and they claim to have achieved impressive results.

Building upon the American Fuzzy Lop (AFL) fuzzer developed by security expert Michał Zalewski (aka lcamtuf), the researchers created a tool called AFLsmart, which implements what they call smart greybox fuzzing (SGF).

According to the experts, AFLsmart is highly efficient in analyzing libraries that parse structurally complex files, such as audio, video, image, document and database files.

In coverage-based greybox fuzzing, the fuzzer is provided a seed file and it randomly flips, deletes, copies or adds bits in order to generate new files that can be parsed by the tested library in order to find potential vulnerabilities. The problem, however, is that in the case of complex file formats, bit flips do not generate valid files.

The researchers have overcome this challenge by defining what they call “innovative mutation operators” that work on the virtual file structure rather than the bit level, which helps ensure that files remain valid.

“We introduce a novel validity-based power schedule that enables SGF to spend more time generating files that are more likely to pass the parsing stage of the program, which can expose vulnerabilities much deeper in the processing logic,” the researchers explained in a paper.

In their experiments, they tested 11 popular open source libraries that process executable binary (ELF), image, audio and video files. The list includes Binutils, LibPNG, ImageMagick, LibJPEG-turbo, LibJasper, FFmpeg, LibAV, WavPack, and OpenJPEG.

These libraries were tested with AFLsmart and, for comparison, with the AFL, AFLfast and Peach fuzzers. AFLsmart uncovered 33 vulnerabilities, double compared to AFL and AFLfast – Peach did not find any flaws.

The new tool discovered a total of 42 vulnerabilities in the tests conducted by the researchers, and 17 of these issues have so far been assigned CVE identifiers. Of the 33 aforementioned bugs, 8 have been assigned CVEs. The types of security holes include assertion failures, heap and stack buffer overflows, null pointer dereferences, and divided-by-zero bugs.

The researchers said they plan on making the AFLsmart fuzzer available as open source.

Related: Microsoft Uses Neural Networks to Improve Fuzzing

Related: Google Wants More Projects Integrated With OSS-Fuzz

Related: Fuzzing Tests Show ICS Protocols Least Mature

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/MHxAx7mz1QE/researchers-introduce-smart-greybox-fuzzing

Security blogger Brian Krebs revealed recently that an API used by the United States Postal Service (USPS) had a vulnerability that potentially exposed the data of 60 million customers.

read more

http://feedproxy.google.com/~r/Securityweek/~3/97PQz8LrbFk/industry-reactions-usps-exposing-user-data

Cisco has released a new round of patches for a potentially serious Webex vulnerability first addressed one month ago.

read more

http://feedproxy.google.com/~r/Securityweek/~3/EPyRm-cgsqQ/cisco-releases-second-patch-webex-meetings-vulnerability

Siemens informed customers on Tuesday that some of the Linux and GNU components of a multifunctional platform for its SIMATIC S7-1500 industrial automation controllers are affected by over 20 vulnerabilities.

read more

http://feedproxy.google.com/~r/Securityweek/~3/UZZ75TpQzu0/siemens-warns-linux-gnu-flaws-controller-platform

Researchers with software risk measurement and management company Checkmarx were able to create two mobile applications that abuse the functionality of smart bulbs for data exfiltration.

read more

http://feedproxy.google.com/~r/Securityweek/~3/nBPYbckxA1c/researchers-use-smart-bulb-data-exfiltration

Two recently disclosed Linux kernel vulnerabilities that remain unpatched could be exploited for local denial-of-service (DoS).

The flaws, both which were made public last week, impact Linux kernel 4.19.2 and previous versions. Both represent NULL pointer deference bugs that can be exploited by local attackers and are considered Medium severity. 

read more

http://feedproxy.google.com/~r/Securityweek/~3/K1BFVUMonzo/dos-vulnerabilities-impact-linux-kernel

The United States Postal Service (USPS) has fixed an API flaw that potentially exposed data on 60 million customers. A researcher reported the flaw to USPS more than a year ago; but it wasn’t until security blogger Brian Krebs contacted the organization this month that it took any action.

read more

http://feedproxy.google.com/~r/Securityweek/~3/ucOraj_F9Ik/us-postal-service-api-flaw-exposes-data-60-million-customers

VMware Fixes Vulnerability That Earned Researcher $100,000 at Hacking Contest

VMware has patched a critical Workstation and Fusion vulnerability disclosed recently by a researcher at a hacking competition in China.

read more

http://feedproxy.google.com/~r/Securityweek/~3/I-MA9u5cPNk/vmware-patches-workstation-flaw-disclosed-hacking-contest