Adobe Patches Critical Code Execution Flaws in Dreamweaver, Flash
Security updates released by Adobe on Tuesday patch several vulnerabilities in the company’s Dreamweaver, Flash Player and Connect products.
Flash Player 29.0.0.113 for Windows, Mac, Linux and Chrome OS addresses two critical flaws affecting versions 28.0.0.161 and earlier.
The vulnerabilities have been described as a use-after-free bug (CVE-2018-4919) and a type confusion issue (CVE-2018-4920), both of which can be exploited for remote code execution. While they have been classified as critical, Adobe has assigned them a priority rating of “2,” which indicates that the company does not expect to see exploits any time soon.
The security holes were discovered by Yuki Chen of Qihoo 360 Vulcan Team, who reported them to Adobe via the Chromium Vulnerability Rewards Program.
In Dreamweaver CC, Adobe resolved a critical OS command injection vulnerability discovered by researcher Andrea Micalizzi, also known as “rgod.” The flaw is serious, but the product has never been targeted by hackers, at least to Adobe’s knowledge.
The flaw, CVE-2018-4924, affects versions 18.0 and earlier for Windows and it’s related to the Dreamweaver URI handler. An attacker can exploit the weakness for arbitrary code execution in the context of the current user.
The latest version of Adobe Connect patches two important vulnerabilities: an OS command injection flaw that can lead to arbitrary file deletion, and an unrestricted SWF file upload bug that can be exploited for cross-site scripting (XSS) attacks. Micalizzi and Ciaran McNally have been credited for finding the flaws.
Adobe was recently forced to release an out-of-band update for Flash Player after learning of a vulnerability that had been exploited in targeted attacks by a threat actor believed to be from North Korea.
Microsoft’s Patch Tuesday updates for this month fix over 70 vulnerabilities, including more than a dozen critical flaws affecting the Edge and Internet Explorer web browsers.
Eduard Kovacs is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
A raft of flaws in AMD chips makes bad hacks much, much worse
Secure enclaves like the one found in iPhones are intended to be impenetrable fortresses that handle tasks too sensitive for the main CPUs they work with. AMD’s version of that co-processor contains a raft of critical flaws that attackers could exploit to run malware that’s nearly impossible to detect and has direct access to a vulnerable computer’s most sensitive secrets, a report published Tuesday warned. The chips also contain what the report called “backdoors” that hackers can exploit to gain administrative access.
The flaws—in AMD’s EPYC, Ryzen, Ryzen Pro, and Ryzen Mobile lines of processors—require attackers to first gain administrative rights on a targeted network or computer, which is a hurdle that’s difficult but by no means impossible to clear. From there, attackers can exploit the vulnerabilities to achieve a variety of extraordinary feats that would be catastrophic for the owners’ long-term security. Among other things, the feats include:
Bypassing advanced protections such as AMD’s Secure Encrypted Virtualization, Firmware Trusted Platform Module, and other security features, which are intended to secure systems and sensitive data in the event that malware infects a computer’s operating system
Stealing credentials a vulnerable computer uses to access networks
Physically destroying hardware by attackers in hardware-based “ransomware” scenarios
“All these things are real”
The four classes of vulnerabilities—dubbed Masterkey, Ryzenfall, Fallout, and Chimera—were described in a 20-page report headlined “Severe Security Advisory on AMD Processors.” The advisory came with its own disclaimer that CTS—the Israeli research organization that published the report—”may have, either directly or indirectly, an economic interest in the performance” of the stock of AMD or other companies. It also discloses that its contents were all statements of opinion and “not statements of fact.” Critics have said the disclaimers, which are highly unusual in security reports, are signs that the report is exaggerating the severity of the vulnerabilities in a blatant attempt to influence the stock price of AMD and possibly other companies. Critics also faulted the researchers for giving AMD just 24 hours to review the report before it went public and using a dedicated-website to bring attention to the flaws.
AMD officials released a statement that read: “At AMD, security is a top priority and we are continually working to ensure the safety of our users as new risks arise. We are investigating this report, which we just received, to understand the methodology and merit of the findings.”
Still, Dan Guido, a chip security expert and the CEO of security firm Trail of Bits, told Ars that whatever ulterior motives it may have, the paper accurately describes a real threat. After spending much of last week testing the proof-of-concept exploits discussed in the paper, he said, he has determined that the vulnerabilities they exploit are real.
“All the exploits work as described,” he said. “The package that was shared with me had well-documented, well-described write-ups for each individual bug. They’re not fake. All these things are real. I’m trying to be a measured voice. I’m not hyping them. I’m not dismissing them.”
Once hackers gain low-level access to a targeted network, they typically collect as much data as they can as quickly as they can in hopes of elevating their privileges. All that’s required to exploit the AMD chip vulnerabilities, Guido said, is a single administrator credential inside the network.
“Once you have administrative rights, exploiting the bugs is unfortunately not that complicated,” he said.
Bypassing signature checks
While AMD chips are supposed to require the firmware that runs on them to be digitally signed, Guido said the exploits massage the code in a way that allows uploaded firmware to pass validation checks without a valid signature. Once the attacker’s malicious firmware is running on the processor, it’s nearly impossible to detect using today’s tools. What’s more, the firmware has direct access to protected memory, hard drives, input/output devices and other computer components that might be out of bounds to more traditional malware.
“I ran the exploit code that let me get shells,” Guido said. “They do make a bad compromise significantly worse. There are no tools to help you find if these issues have been exploited.” The vulnerabilities, he said, are unrelated to a code-execution flaw disclosed in January in AMD’s trusted platform module.
Not so fast
Other researchers played down the severity of the flaws and questioned the veracity of the report, which was published the same day that short seller Viceroy Research issued a report saying AMD shares might lose all their value. AMD shares initially fell following publication of the reports, but they eventually closed higher. The report’s critics, meanwhile said the requirement that an attacker already have administrative rights meant the vulnerabilities weren’t as severe as portrayed.
“All the exploits require root access,” said David Kanter, a chip expert who is founder of Real World Technologies. “If someone already has root access to your system, you’re already compromised. This is like if someone broke into your home and they got to install video cameras to spy on you.”
Still, Kanter agreed with Guido that the vulnerabilities were a major embarrassment for AMD, particularly because most of them reside in the Platform Secure Processor, which is AMD’s version of the secure enclave in the iPhone. Unlike Apple, which custom-designed its secure enclave, AMD relies on a 32-bit Cortex A5 processor designed by ARM.
Enlarge/ A basic overview of AMD’s Zen architecture describing the Secure Processor.
AMD’s Secure Processor, Guido said, “is intended to be the one defensible part of the processor. The fact that you can upload unsigned code and get it to pass validation and the fact that you can manipulate all the mail slot handlers is not what I would expect as someone who needs to trust this component.”
In a series of tweets, Gadi Evron, a veteran security researcher and the CEO and founder of security firm Cymmetria, also confirmed the accuracy of the findings even as he declined to defend the way they were disclosed.
First, https://t.co/YHJ4rWFLvN‘s findings are real. I can confirm they have a PoC on everything. More specifically: 1. All vulnerabilities do not require physical access (need ability to run exe as admin) 2. Fallout does not require reflash of the BIOS, you can just run it [2/3]
Asked why vuln matters if they need admin privileges, Their answer: 1. Bypass credentials guard (Windows). 2. Hide in PSP (AMD secure processor, become insanely persistent). 3. load before CPU (prevent any BIOS update, whatever, and potentially brick the motherboard, etc.). [1/2]
Other vulnerabilities were the result of what Tuesday’s advisory said were manufacturer “backdoors” that were built into a chipset that connects Ryzen and Ryzen Pro processors to hardware devices such as Wi-Fi chips and network cards. One of the backdoors is built into the firmware, the report contended, while the other resides in the hardware. AMD’s partner for the chips, the report said, is ASMedia. In 2016, ASMedia parent company ASUSTeK Computer settled charges brought by the Federal Trade Commission that alleged it neglected security vulnerabilities. The settlement requires ASUSTek to undergo external security audits for 20 years.
Tuesday’s report went on to warn that the Chimera vulnerabilities resulting from the purported backdoors may be impossible to fix.
As explained earlier, the report’s findings are highly nuanced because they’re premised on an already serious compromise that allows attackers to gain administrative control of a computer running one of the vulnerable AMD processors. That steep bar is countered by an achievement that’s not possible with most exploits Specifically:
The ability to take complete control over the affected machine, including parts that are normally isolated from malware
The ability to run malicious code before the operating system boots and for infections to persist even after the operating system is reinstalled
The ability to bypass advanced protections such as Windows 10 Credential Guard
People who rely on AMD chips shouldn’t panic, but they also shouldn’t discount the warnings contained in the report, despite the questionable motivations for its release.
This post was updated to add Gadi Evron tweet.
https://arstechnica.com/?p=1274899
Microsoft Patches Over Dozen Critical Browser Flaws
Microsoft’s Patch Tuesday updates for March 2018 fix a total of 75 vulnerabilities, including more than a dozen critical flaws affecting the company’s Edge and Internet Explorer web browsers.
All the security holes rated critical this month affect the web browsers. A vast majority of the issues have been described as remote code execution flaws that exist due to the way browser scripting engines handle objects in memory.
The only critical vulnerability that cannot be exploited for arbitrary code execution can lead to disclosure of information that can be leveraged to further hack the targeted system.
Two of the flaws patched by Microsoft have been publicly disclosed before patches became available, but they are only rated as “important,” and there is no evidence of malicious exploitation. These bugs are a denial-of-service (DoS) issue in ASP.NET and a privilege escalation in Exchange.
The Zero Day Initiative (ZDI) pointed out that the Exchange vulnerability exists in the Outlook Web Access (OWA) component and it can be exploited for phishing attacks.
Another interesting privilege escalation flaw affects the Windows installer and it allows an authenticated attacker to run arbitrary code with elevated permissions.
“At first glance, this doesn’t seem very crucial since an attacker would need the ability to run programs on a target system to exploit this vulnerability,” ZDI said in a blog post. “However, this type of bug is often used by malware authors to “piggyback” their malicious code on top of innocuous code. It’s always easier to convince someone to install ‘GreatNewGame.exe’ instead of ‘EvilMalware.exe’.”
Another noteworthy vulnerability is CVE-2018-0886, a remote code execution bug affecting the Credential Security Support Provider (CredSSP) protocol. In addition to applying Microsoft’s patch, users also need to make some settings changes in order to fully mitigate potential attacks.
Microsoft’s latest security updates also patch vulnerabilities in Hyper-V, Access, Identity Manager, SharePoint, and Windows. The company has also updated the Flash Player components present in its products to address a couple of flaws fixed on Tuesday by Adobe.
Eduard Kovacs is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Researchers Find Critical Security Flaws in AMD Chips
Security researchers said Tuesday they discovered flaws in chips made by Advanced Micro Devices that could allow hackers to take over computers and networks.
Israeli-based security firm CTS Labs published its research showing “multiple critical security vulnerabilities and exploitable manufacturer backdoors” in AMD chips.
CTS itemized 13 flaws, saying they “have the potential to put organizations at significantly increased risk of cyberattacks.”
The report comes weeks after Intel disclosed similar hardware-based flaws dubbed Meltdown and Spectre, sparking widespread computer security concerns and a congressional inquiry.
CTS said the newly discovered flaws could compromise AMD’s new chips that handle applications in the enterprise, industrial and aerospace sectors, as well as consumer products.
In a 20-page white paper, the researchers said the AMD Secure Processor, the gatekeeper responsible for the security of AMD processors, contains “critical vulnerabilities” that “could allow malicious actors to permanently install malicious code inside the Secure Processor itself.”
“These vulnerabilities could expose AMD customers to industrial espionage that is virtually undetectable by most security solutions,” the researchers said.
CTS said AMD’s Ryzen chipset, which AMD outsourced to a Taiwanese chip manufacturer, ASMedia, “is currently being shipped with exploitable manufacturer backdoors inside.”
This could allow attackers “to inject malicious code into the chip” and create “an ideal target” for hackers, the researchers said.
“CTS believes that networks that contain AMD computers are at a considerable risk,” the report said.
“The vulnerabilities we have discovered allow bad actors who infiltrated the network to persist in it, surviving computer reboots and reinstallations of the operating system.
“This allows attackers to engage in persistent, virtually undetectable espionage, buried deep in the system.”
AMD, one of the largest semiconductor firms specializing in processors for PCs and servers, said it was studying the latest report. “At AMD, security is a top priority and we are continually working to ensure the safety of our users as new risks arise,” the California-based company said in a statement.
“We are investigating this report, which we just received, to understand the methodology and merit of the findings.”
Analysts at the security firm enSilo said the AMD flaws could be worse than those affecting Intel chips.
“The impact of these vulnerabilities is more severe than Meltdown/Spectre as it allows an attacker to execute highly privileged code and persist on the victim machine,” enSilo said in a blog post.
Additionally, some of the flaws may be nearly impossible to patch.
“We estimate that without patches from AMD, protection against the vulnerabilities can be limited at best,” enSilo researchers said. “The best protection is to block malware that attempts to leverage these vulnerabilities.”
Facebook Flaws Exposed Friend Lists, Payment Card Data
A researcher last year discovered some information disclosure vulnerabilities in Facebook that exposed users’ friend lists and partial payment card information. The social media giant patched one of the flaws within hours.
Web security consultant Josip Franjković had been analyzing the Facebook application for Android when he identified a flaw that allowed him to obtain any user’s list of friends via a specially crafted request.
Facebook users can prevent others from seeing their friends, but the vulnerability discovered by Franjković could have been exploited to obtain this information regardless of the targeted user’s privacy settings.
GraphQL is an open source data query language designed by Facebook for its mobile applications. GraphQL queries can only be used for Facebook’s own applications—only whitelisted query IDs are allowed—and they require an access token.
Franjković discovered that he could use the client token from the Facebook app for Android, and he could bypass the whitelist by sending a request containing a “doc_id” parameter instead of “query_id.”
Once he bypassed the whitelisting mechanism, the researcher started sending GraphQL queries. While most returned data that had already been public, a query named CSPlaygroundGraphQLFriendsQuery leaked the friend list of the user whose ID was included in the request.
The second issue identified by the expert was also related to GraphQL and it, too, was found during the analysis of the Facebook app for Android. An attacker could have exploited the flaw to obtain partial payment card information by sending a query containing the targeted user’s ID and an access token that could have been taken from a Facebook app.
The security hole was described as an insecure direct object reference (IDOR) bug and it provided access to the first 6 and last 4 digits of a payment card, expiry date, type of card, first name of the cardholder, and zip code and country. Users typically enter credit card details on Facebook to pay for ads.
The friend list leak and whitelist bypass vulnerabilities were reported by Franjkovic to Facebook on October 6, 2017 and they were patched in mid-October. The payment card leak issue was reported in February 2017 and it was patched in 4 hours and 13 minutes. The details of the security holes were only disclosed by Franjković on Monday and Facebook posted a link to the researcher’s blog post on its Bug Bounty page. The researcher has not disclosed the bug bounty amounts he received for his findings.
This is the third round of Facebook vulnerabilities disclosed by Franjković this year. He previously shared the details of two account takeover flaws via Oculus integration and Facebook’s partners portal.
Eduard Kovacs is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Critical Vulnerabilities Addressed in SecurEnvoy SecurMail
Multiple critical vulnerabilities impacting SecurEnvoy SecurMail could result in an attacker being able to read encrypted emails and even delete or overwrite messages in an inbox.
SecurEnvoy SecurMail was meant to provide businesses with secure email communications andclaimsto be offering organizations the full advantages of encryption without the hassle of deployment or management operations.
This week, SEC Consult revealed information on seven critical vulnerabilities in the product that “break the core security promises of the product,” as they can expose sensitive information to attackers.
The flaws were discovered during a short testing period in November 2017, SEC Consult reveals in anadvisory. The discovered vulnerabilities were recently addressed with the release of SecurMail 9.2.501, or hotfix patch “1_012018.”
“As other SecureEnvoy products (besides the analyzed SecurMail) appear to be highly integrated (all products are installed with a single setup file) we suspect other components to also suffer from severe security deficits,” SEC Consult notes.
The discovered vulnerabilities include two Cross Site Scripting (CVE-2018-7703, CVE-2018-7707) flaws residing in the lack of functionality to encode user input when creating HTML pages.
The security firm also found that there are no path traversal checks in the application (CVE-2018-7705, CVE-2018-7706), and that authorization checks are only partially implemented in the application, an Insecure Direct Object Reference (CVE-2018-7704) vulnerability. These flaws could allow a legitimate recipient to read mails sent to other recipients in plain text.
The application was also plagued with a Missing Authentication and Authorization (CVE-2018-7702) flaw, where no authentication was required on the SecurEnvoy server for a client to send emails. This could allow anyone with network access to the server to arbitrarily send emails spoofing other sender addresses.
The issue could also be exploited by attackers with network access to the server to resend previous communication to arbitrary recipients. Thus, they could extract all emails stored on the server and could also modify arbitrary messages.
SecurEnvoy SecurMail was also impacted by a Cross Site Request Forgery (CVE-2018-7701) vulnerability, as no protections against such flaws existed within the web interface. Thus, an attacker could delete a victim’s email or impersonate the victim and reply to their emails. Attacks are possible against the API used to send emails, which do not require authentication on the server.
“Since these vulnerabilities were found during a very short time frame, SEC Consult believes that the product may contain a large number of other security vulnerabilities. As already several core security promises have been broken during this short crash test, no further tests were conducted,” SEC Consult notes.
The vulnerabilities were found in SecurEnvoy SecurMail version 9.1.501 and were addressed with security patch “1_012018.” Version 9.2.501 of the software is no longer vulnerable.
In their advisory, SEC Consult also published proof-of-concept code for the discovered vulnerabilities.
Remotely Exploitable Flaws Found in SmartCam Cameras
Hanwha’s SmartCam cameras are affected by more than a dozen vulnerabilities, including critical flaws that can be exploited remotely to take control of devices.
The impacted cameras are widely used for surveillance and monitoring. They can record at high resolutions, they have night vision capabilities and motion sensors, and they allow their users to talk to the person being monitored via a built-in speaker. The product can be controlled remotely from any type of device and all the recorded video is stored in the cloud.
Samsung Electronics sold its Samsung Techwin security division to South Korean conglomerate Hanwha Group in 2014. However, Hanwha’s SmartCam products are still branded “Samsung.”
Researchers have analyzed these devices and discovered a significant number of flaws. The issues were disclosed last week by Vladimir Dashchenko, senior security researcher at Kaspersky Lab, at the company’s Security Analyst Summit (SAS) in Cancun. The security firm also published a blog post on Monday describing the findings.
The vulnerabilities can be exploited for intercepting traffic due to the use of HTTP for firmware updates and interaction with the camera, manipulating the web-based user interface, remote code execution with root privileges, denial-of-service (DoS) attacks, brute-force attacks on the admin account, and bypassing authentication.
Experts have identified roughly 2,000 IP addresses associated with cameras exposed to the Internet, but they believe the actual number of vulnerable devices is much higher considering that the flaws can be exploited even against devices that are not directly accessible from the Web due to weaknesses in the SmartCam cloud infrastructure.
One of the flaws found by Kaspersky can be exploited to register cameras that have yet to be registered. This not only prevents legitimate owners from registering and using their cameras, but also allows hackers to take control of the cameras they have registered.
Due to vulnerabilities in the cloud infrastructure, an attacker could have spoofed the update server in an effort to push malicious firmware to a device. Modified firmware can provide privileged access to the targeted camera, serving as an entry point to the rest of the network housing the device, experts say.
Researchers also discovered that a hacker can easily clone a camera in an effort to spoof its video feed.
“The attacker then resets the password using a vulnerability in the password generation algorithm and modifies the firmware of the cloned camera (which is an identical camera located on the attacker’s side). The victim’s camera is then remotely disabled. As a result, the victim will receive a video signal from the attacker’s cloned camera,” Kaspersky researchers explained.
The setup process for the cameras also involves providing credentials for social media and other online services for sending notifications to the user, which can be abused by cybercriminals for phishing and spam campaigns.
Dashchenko told SecurityWeek that remote attacks against these cameras are a multi-stage process that starts with identifying the targeted device’s serial number and MAC address. The serial number can be obtained by either guessing or brute-forcing it.
Large-scale attacks are also possible with the use of scripts and automation mechanisms, Dashchenko said.
Kaspersky’s ICS-CERT team has conducted its research on Hanwha SNH-V6410PN/PNW SmartCam devices, but the same firmware is used for multiple camera models — different features in the firmware are active depending on the model — which means many of the company’s products are likely affected by these vulnerabilities.
The vendor patched many of the vulnerabilities shortly after being notified and Kaspersky has only disclosed the details of the flaws that have been fixed.
Eduard Kovacs is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Potent malware that hid for six years spread through routers
Researchers have discovered malware so stealthy it remained hidden for six years despite infecting at least 100 computers worldwide.
Slingshot—which gets its name from text found inside some of the recovered malware samples—is among the most advanced attack platforms ever discovered, which means it was likely developed on behalf of a well-resourced country, researchers with Moscow-based Kaspersky Lab reported Friday. The sophistication of the malware rivals that of Regin—the advanced backdoor that infected Belgian telecom Belgacom and other high-profile targets for years—and Project Sauron, a separate piece of malware suspected of being developed by a nation-state that also remained hidden for years.
Complex ecosystem
“The discovery of Slingshot reveals another complex ecosystem where multiple components work together in order to provide a very flexible and well-oiled cyber-espionage platform,” Kaspersky Lab researchers wrote in a 25-page report published Friday. “The malware is highly advanced, solving all sorts of problems from a technical perspective and often in a very elegant way, combining older and newer components in a thoroughly thought-through, long-term operation, something to expect from a top-notch well-resourced actor.”
The researchers still don’t know precisely how Slingshot initially infected all its targets. In several cases, however, Slingshot operators got access to routers made by Latvian manufacturer MikroTik and planted a malicious code in it. Specifics of the router technique still aren’t known, but they involve using the a MikroTik configuration utility called Winbox to download dynamic link library files from the router’s file system. One of the files, ipv4.dll, is a malicious download agent created by the Slingshot developers. Winbox transfers ipv4.dll to the target’s computer, loads it into memory, and executes it.
This DLL then connects to a hardcoded IP and port (in every cases we saw it was the router’s IP address), downloads the other malicious components, and runs them.
To run its code in kernel mode in the most recent versions of operating systems that have Driver Signature Enforcement, Slingshot loads signed vulnerable drivers and runs its own code through their vulnerabilities.
Following infection, Slingshot would load a number of modules onto the victim device, including two huge and powerful ones: Cahnadr, the kernel-mode module, and GollumApp, a user-mode module. The two modules are connected and able to support each other in information gathering, persistence, and data exfiltration.
The most sophisticated module is GollumApp. This contains nearly 1,500 user-code functions and provides most of the above described routines for persistence, file system control, and C&C communications.
Canhadr, also known as NDriver, contains low-level routines for network, IO operations, and so on. Its kernel-mode program is able to execute malicious code without crashing the whole file system or causing Blue Screen—a remarkable achievement. Written in pure C language, Canhadr/Ndriver provides full access to the hard drive and operating memory despite device security restrictions, and [it] carries out integrity control of various system components to avoid debugging and security detection.
The researchers said Slingshot may have used other methods, including zero-day vulnerabilities, to spread. It has been active since at least 2012 and remained operational through last month. The ability for such a fully featured piece of malware to remain hidden for so long is one of the things that makes it so advanced.
One of the ways Slingshot concealed itself was its use of an encrypted virtual file system that was typically located in an unused part of the hard drive. By segregating malware files from the file system of the infected computer, Slingshot stood a much better chance of remaining undetected by antivirus engines. Other stealth techniques included encrypting all text strings in its various modules, calling system services directly to bypass so-called hooks used by security products, and the ability to shut down components when forensic tools are loaded.
The main purpose of the malware appears to be espionage. Kaspersky Lab’s analysis suggested Slingshot was used to log desktop activity and clipboard contents and to collect screenshots, keyboard data, network data, passwords, and USB connection data. The ability for Slingshot to access the operating system kernel means the malware had access to whatever data was stored on the hard drive or in the internal memory of an infected machine. Infected computers were located primarily in Kenya and Yemen, but also in Afghanistan, Libya, Congo, Jordan, Turkey, Iraq, Sudan, Somalia, and Tanzania. Most of the victims appeared to be targeted individuals. Some, however, were government organizations and institutions.
Debug messages written in perfect English suggest that the developers spoke that language. As is typical for Kaspersky Lab reports, Friday’s report didn’t attempt to identify the developers of Slingshot, other than to say they most likely worked on behalf of a nation-state.
“Slingshot is very complex, and the developers behind it have clearly spent a great deal of time and money on its creation,” company researchers wrote. “Its infection vector is remarkable—and, to the best of our knowledge, unique.”
https://arstechnica.com/?p=1273197
Cisco Patches Hard-coded Password in PCP Software
Cisco this week announced the availability of software updates to address a hard-coded password vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software.
Due to the existence of the hard-coded account password, an unauthenticated, local attacker could log into the underlying Linux operating system. The vulnerability can be abused to connect to the affected system via Secure Shell (SSH) using the hard-coded credentials.
According to Cisco, an attacker successfully exploiting the vulnerability could access the underlying operating system as a low-privileged user. However, the attacker could elevate privileges to root and take full control of the vulnerable system.
Because of the privilege escalation possibility, the vulnerability has a Security Impact Rating (SIR) of Critical, although it was also assessed with a Common Vulnerability Scoring System (CVSS) Base score of 5.9, which would normally come with a SIR of Medium.
The vulnerability impacts Cisco PCP Software release 11.6 only and no prior builds were found to be affected by it, Cisco notes in anadvisory. Impacted customers should update to Cisco PCP releases 12.1 and later, as no workarounds that address this vulnerability exist.
The company also notes that it is not aware of “any public announcements or malicious use of the vulnerability.”
This week, the company also addressed CVE-2018-0147, a Critical (CVSS base score of 9.8) vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS), which could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device.
“The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a crafted serialized Java object. An exploit could allow the attacker to execute arbitrary commands on the device with root privileges,” Ciscoexplains.
The company alsoaddresseda High risk (CVSS base score of 7.3) bug in the FTP server of the Cisco Web Security Appliance (WSA). Due to incorrect FTP user credential validation, an unauthenticated, remote attacker could exploit the bug to log into the server without a valid password or username.
This security issue affects Cisco AsyncOS for WSA Software running any release of Cisco AsyncOS 10.5.1 for WSA Software. Cisco AsyncOS 10.5.2-042 or later releases address the flaw.
Multiple Medium severity bugs were addressed in other Cisco products.
Sophisticated Cyberspies Target Middle East, Africa via Routers
CANCUN – KASPERSKY SECURITY ANALYST SUMMIT – A cyber espionage group whose members apparently speak English has been targeting entities in the Middle East and Africa by hacking into their routers.
Researchers at Kaspersky Lab have analyzed this threat actor’s operations and determined that it has likely been active since at least 2012, its most recent attacks being observed in February.
Roughly 100 Slingshot victims have been identified, a majority located in Kenya and Yemen, but targets have also been spotted in Afghanistan, Libya, Congo, Jordan, Turkey, Iraq, Sudan, Somalia and Tanzania. While the campaign seems to focus on individuals, the security firm has also observed attacks aimed at government organizations and, strangely, some internet cafés.
The main piece of malware used by this group — dubbed Slingshotbased on internal strings found by researchers — is interesting due to the fact that it infects computers through compromised routers, specifically ones made by Latvia-based Mikrotik.
It’s unclear how the targeted routers get compromised, but Kaspersky pointed out that the WikiLeaks Vault7 files, which are believed to be tools developed and used by the CIA, do include a Mikrotik exploit. The vendor claims to have patched the vulnerability leveraged by the Vault7 exploit and it’s unclear if that is the initial vector used by the attackers.
Once they gain access to a router, hackers can abuse a legitimate piece of software called WinBox, a management tool provided by Mikrotik that downloads some DLL files from the router and loads them directly into the computer’s memory.
By abusing this functionality, the Slingshot hackers can deliver the malware to the targeted router’s administrator.
The malware is basically a first-stage loader that replaces legitimate DLL files in Windows with malicious versions that have the exact same size. The malicious DLLs are loaded by the services.exe process, which has SYSTEM privileges.
The main modules downloaded by Slingshot are called Cahnadr and GollumApp. Cahnadr, also known as Ndriver, is a kernel-mode payload and it provides all the capabilities required by user-mode modules, including anti-debugging, rootkit functionality, injecting modules into the services.exe process, network communications, and sniffing capabilities for various protocols.
GollumApp is the main user-mode module and it’s designed to manage other user-mode modules while constantly interacting with Cahnadr. It includes a wide range of spying-focused functionality that allows attackers to capture screenshots, log keystrokes, collect system and network data, harvest passwords, manipulate clipboard data, run new processes with SYSTEM privileges, and inject other malicious modules into a specified process.
Since it can run in kernel mode, a feature typically present in sophisticated threats, the malware allows attackers to take full control of the infected machine.
Slingshot attempts to evade detection by using various methods, including calling system services directly in an effort to bypass security product hooks, encrypting strings in its modules, and selectively injecting processes depending on what security product is present.
Slingshot also employs some clever techniques when it comes to command and control (C&C) communications – the malware hides its traffic in legitimate communication protocols, keeping an eye out for packets that contain a special mark.
As for who is behind Slingshot, Kaspersky says it bears the hallmarks of a state-sponsored cyber espionage campaign. Its level of sophistication rivals the one of actors such as ProjectSauron and Regin.
Researchers said most of the debug messages are written in perfect English and several strings in the code reference Lord of the Rings characters.
“Slingshot is a sophisticated threat, employing a wide range of tools and techniques, including kernel mode modules that have to date only been seen in the most advanced predators,” said Alexey Shulmin, lead malware analyst at Kaspersky Lab. “The functionality is very precious and profitable for the attackers, which could explain why it has been around for at least six years.”
Eduard Kovacs is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Tags:
Tags:
Tags:
Tags:
Tags:
Tags:
Tags:
Tags: