Vulnerabilities recently discovered by Microsoft make it easy for people with a toehold on many Linux desktop systems to quickly gain root system rights— the latest elevation of privileges flaw to come to light in the open source OS.

As operating systems have been hardened to withstand compromises in recent years, elevation of privilege (EoP) vulnerabilities have become a crucial ingredient for most successful hacks. They can be exploited in concert with other vulnerabilities that on their own are often considered less severe, with the latter giving what’s called local access and the former escalating the root access. From there, adversaries with physical access or limited system rights can deploy backdoors or execute code of their choice.

Nimbuspwn, as Microsoft has named the EoP threat, is two vulnerabilities that reside in the networkd-dispatcher, a component in many Linux distributions that dispatch network status changes and can run various scripts to respond to a new status. When a machine boots, networkd-dispatcher runs as root.

The flaws, tracked as CVE-2022-29799 and CVE-2022-29800, combine threats including directory traversal, symlink race, and time-of-check time-of-use (TOCTOU) race condition. After reviewing the Networkd -dispatcher source code, Microsoft researcher Jonathan Bar Or noticed that a component known as “_run_hooks_for_state” implements the following logic:

• Discovers the list of available scripts list by invoking the “get_script_list” method, which calls a separate “scripts_in_path” method that’s intended to return all the files stored in the “/etc/networkd-dispatcher/.d” directory.
• Sorts the script list
• Runs each script with the process subprocess.Popen and supplies custom environment variables

Run_hooks_for_state leaves Linux systems open to the directory-traversal vulnerability, designated as CVE-2022-29799, because none of the functions it uses adequately sanitize the states used to build the proper script path from malicious input. Hackers can exploit the weakness to break out of the “/etc/networkd-dispatcher” base directory.

Run-hooks_for_state contains a separate flaw, CVE-2022-29800, which leaves systems vulnerable to the TOCTOU race condition since there’s a certain time between the scripts being discovered and them being run.

Adversaries can exploit this latter vulnerability to replace scripts that networkd-dispatcher believes to be owned by root with malicious ones of the adversaries’ choice. To ensure Linux executes the hacker-supplied malicious script rather than the legitimate one, the hacker plants multiple scripts until one finally succeeds.

A hacker with minimal access to a vulnerable desktop can chain together exploits for these vulnerabilities that give full root access. The exploit flow looks like this:

1. Prepare a directory ”/tmp/nimbuspwn” and plant a symlink ”/tmp/nimbuspwn/poc.d“ to point to “/sbin”. The “/sbin” directory was chosen specifically because it has many executables owned by root that do not block if run without additional arguments. This will abuse the symlink race issue we mentioned earlier.
2. For every executable filename under “/sbin” owned by root, plant the same filename under “/tmp/nimbuspwn”. For example, if “/sbin/vgs” is executable and owned by root, plant an executable file “/tmp/nimbuspwn/vgs” with the desired payload. This will help the attacker win the race condition imposed by the TOCTOU vulnerability.
3. Send a signal with the OperationalState “../../../tmp/nimbuspwn/poc”. This abuses the directory traversal vulnerability and escapes the script directory.
4. The networkd-dispatcher signal handler kicks in and builds the script list from the directory “/etc/networkd-dispatcher/../../../tmp/nimbuspwn/poc.d”, which is really the symlink (“/tmp/nimbuspwn/poc.d”), which points to “/sbin”. Therefore, it creates a list composed of many executables owned by root.
5. Quickly change the symlink “/tmp/nimbuspwn/poc.d” to point to “/tmp/nimbuspwn”. This abuses the TOCTOU race condition vulnerability—the script path changes without networkd-dispatcher being aware.
6. The dispatcher starts running files that were initially under “/sbin” but in truth under the “/tmp/nimbuspwn” directory. Since the dispatcher “believes” those files are owned by root, it executes them blindly with subprocess.Popen as root. Therefore, our attacker has successfully exploited the vulnerability.

Here’s a visualization:

To gain persistent root access, the researcher used the exploit flow to create a backdoor. The process for this is:

1. Copies /bin/sh to /tmp/sh.
2. Turns the new /tmp/sh it into a Set-UID (SUID) binary
3. Runs /tmp/sh -p. The “-p” flag is necessary since modern shells drop privileges by design.

The proof-of-concept exploit works only when it can use the “org.freedesktop.network1” bus name. The researcher found several environments where this happens, including Linux Mint, in which the systemd-networkd by default doesn’t own the org.freedodesktop.network1 bus name at boot.

The researcher also found several processes that run as the systemd-network user, which is permitted to use the bus name required to run arbitrary code from world-writable locations. The vulnerable processes include several gpgv plugins, which are launched when apt-get installs or upgrades, and the Erlang Port Mapper Daemon, which allows running arbitrary code under some scenarios.

The vulnerability has been patched in the networkd-dispatcher, although it wasn’t immediately clear when or in what version, and attempts to reach the developer weren’t immediately successful. People using vulnerable versions of Linux should patch their systems as soon as possible.

https://arstechnica.com/?p=1850608

Researchers on Friday said that hackers are exploiting the recently discovered SpringShell vulnerability to successfully infect vulnerable Internet of Things devices with Mirai, an open source piece of malware that wrangles routers and other network-connected devices into sprawling botnets.

When SpringShell (also known as Spring4Shell) came to light last Sunday, some reports compared it to Log4Shell, the critical zero-day vulnerability in the popular logging utility Log4J that affected a sizable portion of apps on the Internet. That comparison proved to be exaggerated because the configurations required for SpringShell to work were by no means common. To date, there are no real-world apps known to be vulnerable.

Researchers at Trend Micro now say that hackers have developed a weaponized exploit that successfully installs Mirai. A blog post they published didn’t identify the type of device or the CPU used in the infected devices. The post did, however, say a malware file server they found stored multiple variants of the malware for different CPU architectures.

“We observed active exploitation of Spring4Shell wherein malicious actors were able to weaponize and execute the Mirai botnet malware on vulnerable servers, specifically in the Singapore region,” Trend Micro researchers Deep Patel, Nitesh Surana, and Ashish Verma wrote. The exploits allow threat actors to download Mirai to the “/tmp” folder of the device and execute it following a permission change using “chmod.”

The attacks began appearing in researchers’ honeypots early this month. Most of the vulnerable setups were configured to these dependencies:

• Spring Framework versions before 5.2.20, 5.3.18, and Java Development Kit (JDK) version 9 or higher 
• Apache Tomcat
• Spring-webmvc or spring-webflux dependency
• Using Spring parameter binding that is configured to use a non-basic parameter type, such as Plain Old Java Objects (POJOs)
• Deployable, packaged as a web application archive (WAR)

Trend said the success the hackers had in weaponizing the exploit was largely due to their skill in using exposed class objects, which offered them multiple avenues.

“For example,” the researchers wrote, “threat actors can access an AccessLogValve object and weaponize the class variable ‘class.module.classLoader.resources.context.parent.pipeline.firstpath’ in Apache Tomcat. They can do this by redirecting the access log to write a web shell into the web root through manipulation of the properties of the AccessLogValve object, such as its pattern, suffix, directory, and prefix.”

It’s hard to know precisely what to make of the report. The lack of specifics and the geographical tie to Singapore may suggest a limited number of devices are vulnerable, or possibly none, if what Trend Micro saw was some tool used by researchers. With no idea what or if real-world devices are vulnerable, it’s hard to provide an accurate assessment of the threat or provide actionable recommendations for avoiding it.

https://arstechnica.com/?p=1847013

Hardware manufacturer Zyxel has issued patches for a highly critical security flaw that gives malicious hackers the ability to take control of a wide range of firewalls and VPN products the company sells to businesses.

The flaw is an authentication bypass vulnerability that stems from a lack of a proper access-control mechanism in the CGI (common gateway interface) of affected devices, the company said. Access control refers to a set of policies that rely on passwords and other forms of authentication to ensure resources or data are available only to authorized people. The vulnerability is tracked as CVE-2022-0342.

“The flaw could allow an attacker to bypass the authentication and obtain administrative access of the device,” Zyxel said in an advisory. The severity rating is 9.8 out of a possible 10.

The vulnerability is present in the following devices:

The advisory comes after other hardware makers have recently reported their products have similar vulnerabilities that are actively being exploited in the wild. Sophos, for instance, said that an authentication bypass vulnerability allowing remote code execution was recently fixed in the Sophos Firewall v18.5 MR3 (18.5.3) and older. CVE-2022-1040 was already being used to target companies, primarily in Asia.

Trend Micro also warned that hackers were exploiting a vulnerability in its Trend Micro Apex Central that made it possible to upload and execute malicious files. The flaw is tracked as CVE-2022-26871.

Zyxel credited the discovery of CVE-2022-0342 to Alessandro Sgreccia from Tecnical Service SrL and Roberto Garcia H and Victor Garcia R from Innotec Security. There are no known reports of the vulnerabilities being actively exploited.

https://arstechnica.com/?p=1845801

Hype and hyperbole were on full display this week as the security world reacted to reports of yet another Log4Shell. The vulnerability came to light in December and is arguably one of the gravest Internet threats in years. Christened Spring4Shell—the new code-execution bug in the widely used Spring Java framework—quickly set the security world on fire as researchers scrambled to assess its severity.

One of the first posts to report on the flaw was tech news site Cyber Kendra, which warned of severe damage the flaw might cause to “tonnes of applications” and “can ruin the Internet.” Almost immediately, security companies, many of them pushing snake oil, were falling all over themselves to warn of the imminent danger we would all face. And all of that before a vulnerability tracking designation or advisory from Spring maintainers was even available.

All aboard

The hype train started on Wednesday after a researcher published a proof-of-concept exploit that could remotely install a web-based remote control backdoor known as a web shell on a vulnerable system. People were understandably concerned because the vulnerability was so easy to exploit and was in a framework that powers a massive number of websites and apps.

The vulnerability resides in two Spring products: Spring MVC and Spring WebFlux, which allow developers to write and test apps. The flaw results from changes introduced in JDK9 that resurrected a decade-old vulnerability tracked as CVE-2010-1622. Given the abundance of systems that combine the Spring framework and JDK9 or later, no wonder people were concerned, particularly since exploit code was already in the wild (the initial leaker quickly took down the PoC, but by then it was too late.)

On Thursday, the flaw finally received the designation CVE-2022-22965. Security defenders also got a much more nuanced description of the threat it posed. The leaked code, Spring maintainers said, ran only when a Spring-developed app ran on top of Apache Tomcat and then only when the app is deployed as a file type known as a WAR, short for web archive.

“If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit,” the Spring maintainers wrote. “However, the nature of the vulnerability is more general, and there may be other ways to exploit it.”

While the post left open the possibility that the PoC exploit could be improved to work against other configurations, no one has unearthed a variation that does, at least for now.

“It’s a thing that developers should fix, if they’re using an affected version,” Will Dormann, a vulnerability analyst at CERT, said in a private message. “But we’re still in the boat of not knowing of a single application out there that is exploitable.”

On Twitter, Dormann took Cyber Kendra to task.

“Ways that Cyber Kendra made this worse for everyone,” he wrote. “1) Sensational blog post indicating that this is going to ruin the internet (red flag!) 2) Linking to a git commit about deserialization that has absolutely nothing to do with the issue demonstrated by the original party.”

A Cyber Kendra representative didn’t respond to an email seeking comment. In fairness, the line about ruining the internet was later struck through.

SpringShell, not Spring4Shell

Sadly, even though there’s consensus that, at least for now, the vulnerability doesn’t pose anything near the threat of Log4Shell, the Spring4Shell name has largely stuck. That’s will likely mislead some about its severity. Going forward, Ars will refer to it by its more appropriate name, SpringShell.

Several researchers say they have detected scans in the wild that use the leaked CVE-2022-22965 PoC or an exploit very much like it. It’s not unusual for researchers to benignly test servers to understand how prevalent a new vulnerability is. Slightly more concerning is a report on Friday in which researchers from Netlab 360 said a variant of Mirai—malware that can wrangle thousands of IoT devices and produce crippling denial-of-service attacks—“has won the race as the first botnet that adopted this vulnerability.”

To make matters more confusing, a separate code-execution vulnerability surfaced last week that affects Spring Cloud Function, which allows developers to easily decouple the business logic in an app from a specific runtime. The flaw, tracked as CVE-2022-22963, resides in the Spring Expression Language, typically known as SpEL.

Both vulnerabilities are potentially serious and should by no means be ignored. That means updating the Spring Framework to 5.3.18 or 5.2.20, and out of an abundance of caution also upgrading to Tomcat 10.0.20, 9.0.62, or 8.5.78. Those using the Spring Cloud Function should update to either 3.1.7 or 3.2.3.

For people who aren’t sure if their apps are vulnerable to CVE-2022-22965, researchers at security firm Randori have released a simple, non-malicious script that can do just that.

So by all means, test and patch like there’s no tomorrow, but don’t believe the hype.

https://arstechnica.com/?p=1845362

A researcher has successfully used the critical Dirty Pipe vulnerability in Linux to fully root two models of Android phones—a Pixel 6 Pro and Samsung S22—in a hack that demonstrates the power of exploiting the newly discovered OS flaw.

The researcher chose those two handset models for a good reason: They are two of the few—if not the only—devices known to run Android version 5.10.43, the only release of Google’s mobile OS that’s vulnerable to Dirty Pipe. Because the LPE, or local privilege escalation, vulnerability wasn’t introduced until the recently released version 5.8 of the Linux kernel, the universe of exploitable devices—whether mobile, Internet of Things, or servers and desktops—is relatively small.

Behold, a reverse shell with root privileges

But for devices that do package affected Linux kernel versions, Dirty Pipe offers hackers—both benign and malicious—a platform for bypassing normal security controls and gaining full root control. From there, a malicious app could surreptitiously steal authentication credentials, photos, files, messages, and other sensitive data. As I reported last week, Dirty Pipe is among the most serious Linux threats to be disclosed since 2016, the year another high-severity and easy-to-exploit Linux flaw named Dirty Cow came to light.

Android uses security mechanisms such as SELinux and sandboxing, which often make exploits hard, if not impossible. Despite the challenge, the successful Android root shows that Dirty Pipe is a viable attack vector against vulnerable devices.

“It’s exciting because most Linux kernel vulnerabilities are not going to be useful to exploit Android,” Valentina Palmiotti, lead security researcher at security firm Grapl, said in an interview. The exploit “is notable because there have only been a few public Android LPEs in recent years (compare that to iOS where there have been so many). Though because it only works 5.8 kernels and up, it’s limited to the two devices we saw in the demo.”

In a video demonstration published on Twitter, a security researcher who asked to be identified only by his Twitter handle Fire30 runs a custom-built app he wrote, first on a Pixel 6 Pro and then a Samsung S22. Within seconds, a reverse shell that gives full root access opens on a computer connected to the same Wi-Fi network. From there, Fire30 has the ability to override most security protections built into Android.

The root achieved is tethered, meaning it can’t survive a reboot. That means hobbyists who want to root their devices so they have capabilities not normally available would have to perform the procedure each time the phone turns on, a requirement that is unattractive to many rooting aficionados. Researchers, however, may find the technique more valuable, because it allows them to perform diagnostics that otherwise wouldn’t be possible.

But perhaps the group most interested will be people trying to install malicious wares. As the video shows, attacks have the potential to be fast and stealthy. All that’s required is local access to the device, usually in the form of it running a malicious app. Even if the universe of vulnerable devices is relatively small, there’s little doubt Dirty Pipe could be used to thoroughly compromise it.

“This is a highly reliable exploit that will work without customization on all vulnerable systems,” Christoph Hebeisen, head of security research at mobile security provider Lookout, wrote in an email. “This makes it a highly attractive exploit to use for attackers. I expect that weaponized versions of the exploit will appear, and they will be used as a preferred exploit when a vulnerable device is encountered because the exploit is reliable. Also, it may well be included in rooting tools for users rooting their own devices.”

It also stands to reason other types of devices running vulnerable versions of Linux can also be easily rooted with Dirty Pipe. On Monday, storage device maker QNAP said that some of its NAS devices are affected by the vulnerability and company engineers are in the process of investigating precisely how. Currently QNAP has no mitigations available and is recommending users check back and install security updates once they become available.

https://arstechnica.com/?p=1841295

Linux has yet another high-severity vulnerability that makes it easy for untrusted users to execute code capable of carrying out a host of malicious actions including installing backdoors, creating unauthorized user accounts, and modifying scripts or binaries used by privileged services or apps.

Dirty Pipe, as the vulnerability has been named, is among the most serious Linux threats to be disclosed since 2016, the year another high-severity and easy-to-exploit Linux flaw (named Dirty Cow) came to light as it was being used to hack a researcher’s server. Researchers in 2016 demonstrated how to exploit Dirty Cow to root any Android phone regardless of the the mobile OS version. Eleven months later, researchers unearthed 1,200 Android apps in third-party markets that maliciously exploited the flaw to do just that.

When Nobody becomes all powerful

The name Dirty Pipe is meant to both signal similarities to Dirty Cow and provide clues about the new vulnerability’s origins. “Pipe” refers to a pipeline, a Linux mechanism for one OS process to send data to another process. In essence, a pipeline is two or more processes that are chained together so that the output text of one process (stdout) is passed directly as input (stdin) to the next one.

Tracked as CVE-2022-0847, the vulnerability came to light when a researcher for website builder CM4all was troubleshooting a series of corrupted files that kept appearing on a customer’s Linux machine. After months of analysis, the researcher finally found that the customer’s corrupted files were the result of a bug in the Linux kernel.

The researcher—Max Kellermann of CM4all parent company Ionos—eventually figured out how to weaponize the vulnerability to allow anyone with an account—including least privileged “nobody” accounts—to add an SSH key to the root user’s account. With that, the untrusted user could remotely access the server with an SSH window that has full root privileges.

Other researchers quickly showed that the unauthorized creation of an SSH key was only one of many malicious actions an attacker can take when exploiting the vulnerability. This program, for instance, hijacks an SUID binary to create a root shell, while this one allows untrusted users to overwrite data in read-only files:

Other malicious actions enabled by Dirty Pipe include creating a cron job that runs as a backdoor, adding a new user account to /etc/passwd + /etc/shadow (giving the new account root privileges), or modifying a script or binary used by a privileged service.

“It’s about as severe as it gets for a local kernel vulnerability,” Brad Spengler, president of Open Source Security, wrote in an email. “Just like Dirty Cow, there’s essentially no way to mitigate it, and it involves core Linux kernel functionality.”

The vulnerability first appeared in Linux kernel version 5.8, which was released in August 2020. The vulnerability persisted until last month, when it was fixed with the release of versions 5.16.11, 5.15.25 and 5.10.102. Virtually all distributions of Linux are affected.

Throwing a wrench in Android

Dirty Pipe also afflicts any release of Android that’s based on one of the vulnerable Linux kernel versions. Since Android is so fragmented, affected device models can’t be tracked in a uniform basis. The latest version of Android for the Pixel 6 and the Samsung Galaxy S22, for instance, run 5.10.43, meaning they’re vulnerable. A Pixel 4 on Android 12, meanwhile, runs 4.14, which is unaffected. Android users can check which kernel version their device uses by going to Settings > About phone > Android version.

“The Dirty Pipe vulnerability is extremely serious in that it allows an attacker to overwrite—temporarily or permanently—files on the system they should not be able to change,” Christoph Hebeisen, head of security research at mobile security provider Lookout, wrote in an email. “Attackers can use this to change the behavior of privileged processes, effectively gaining the capability to execute arbitrary code with extensive system privileges.”

The Lookout researcher said the vulnerability can be exploited on Android handsets through a malicious app that elevates its privileges, which by default are supposed to be limited. Another avenue of attack, he said, is to use a different exploit to gain limited code execution (for example, with the system rights of a legitimate app that’s hacked) and combine it with Dirty Pipe so the code gains unfettered root.

While Kellermann said that Google merged his bug fix with the Android kernel in February, there are no indications Android versions based on a vulnerable release of the Linux kernel are fixed. Users should assume that any device running a version of Android based on a vulnerable version of the Linux kernel is susceptible to Dirty Pipe. Google representatives didn’t respond to an email seeking comment.

https://arstechnica.com/?p=1838884

Academic researchers have devised a new working exploit that commandeers Amazon Echo smart speakers and forces them to unlock doors, make phone calls and unauthorized purchases, and control furnaces, microwave ovens, and other smart appliances.

The attack works by using the device’s speaker to issue voice commands. As long as the speech contains the device wake word (usually “Alexa” or “Echo”) followed by a permissible command, the Echo will carry it out, researchers from Royal Holloway University in London and Italy’s University of Catania found. Even when devices require verbal confirmation before executing sensitive commands, it’s trivial to bypass the measure by adding the word “yes” about six seconds after issuing the command. Attackers can also exploit what the researchers call the “FVV,” or full voice vulnerability, which allows Echos to make self-issued commands without temporarily reducing the device volume.

Alexa, go hack yourself

Because the hack uses Alexa functionality to force devices to make self-issued commands, the researchers have dubbed it “AvA,” short for Alexa vs. Alexa. It requires only a few seconds of proximity to a vulnerable device while it’s turned on so an attacker can utter a voice command instructing it to pair with an attacker’s Bluetooth-enabled device. As long as the device remains within radio range of the Echo, the attacker will be able to issue commands.

The attack “is the first to exploit the vulnerability of self-issuing arbitrary commands on Echo devices, allowing an attacker to control them for a prolonged amount of time,” the researchers wrote in a paper published two weeks ago. “With this work, we remove the necessity of having an external speaker near the target device, increasing the overall likelihood of the attack.”

A variation of the attack uses a malicious radio station to generate the self-issued commands. That attack is no longer possible in the way shown in the paper following security patches that Echo-maker Amazon released in response to the research. The researchers have confirmed that the attacks work against 3rd- and 4th-generation Echo Dot devices.

AvA begins when a vulnerable Echo device connects by Bluetooth to the attacker’s device (and for unpatched Echos, when they play the malicious radio station). From then on, the attacker can use a text-to-speech app or other means to stream voice commands. Here’s a video of AvA in action. All the variations of the attack remain viable, with the exception of what’s shown between 1:40 and 2:14:

The researchers found they could use AvA to force devices to carry out a host of commands, many with serious privacy or security consequences. Possible malicious actions include:

• Controlling other smart appliances, such as turning off lights, turning on a smart microwave oven, setting the heating to an unsafe temperature, or unlocking smart door locks. As noted earlier, when Echos require confirmation, the adversary only needs to append a “yes” to the command about six seconds after the request.
• Call any phone number, including one controlled by the attacker, so that it’s possible to eavesdrop on nearby sounds. While Echos use a light to indicate that they are making a call, devices are not always visible to users, and less experienced users may not know what the light means.
• Making unauthorized purchases using the victim’s Amazon account. Although Amazon will send an email notifying the victim of the purchase, the email may be missed or the user may lose trust in Amazon. Alternatively, attackers can also delete items already in the account shopping cart.
• Tampering with a user’s previously linked calendar to add, move, delete, or modify events.
• Impersonate skills or start any skill of the attacker’s choice. This, in turn, could allow attackers to obtain passwords and personal data.
• Retrieve all utterances made by the victim. Using what the researchers call a “mask attack,” an adversary can intercept commands and store them in a database. This could allow the adversary to extract private data, gather information on used skills, and infer user habits.

The researchers wrote:

With these tests, we demonstrated that AvA can be used to give arbitrary commands of any type and length, with optimal results—in particular, an attacker can control smart lights with a 93% success rate, successfully buy unwanted items on Amazon 100% of the times, and tamper [with] a linked calendar with 88% success rate. Complex commands that have to be recognized correctly in their entirety to succeed, such as calling a phone number, have an almost optimal success rate, in this case 73%. Additionally, results shown in Table 7 demonstrate the attacker can successfully set up a Voice Masquerading Attack via our Mask Attack skill without being detected, and all issued utterances can be retrieved and stored in the attacker’s database, namely 41 in our case.

https://arstechnica.com/?p=1838449

Millions of WordPress sites have received a forced update over the past day to fix a critical vulnerability in a plugin called UpdraftPlus.

The mandatory patch came at the request of UpdraftPlus developers because of the severity of the vulnerability, which allows untrusted subscribers, customers, and others to download the site’s private database as long as they have an account on the vulnerable site. Databases frequently include sensitive information about customers or the site’s security settings, leaving millions of sites susceptible to serious data breaches that spill passwords, user names, IP addresses, and more.

Bad outcomes, easy to exploit

UpdraftPlus simplifies the process of backing up and restoring website databases and is the Internet’s most widely used scheduled backup plugin for the WordPress content management system. It streamlines data backup to Dropbox, Google Drive, Amazon S3, and other cloud services. Its developers say it also allows users to schedule regular backups and is faster and uses fewer server resources than competing WordPress plugins.

“This bug is pretty easy to exploit, with some very bad outcomes if it does get exploited,” said Marc Montpas, the security researcher who discovered the vulnerability and privately reported it to the plugin developers. “It made it possible for low-privilege users to download a site’s backups, which include raw database backups. Low-privilege accounts could mean a lot of things. Regular subscribers, customers (on e-commerce sites, for example), etc.”

Montpas, a researcher at website security firm Jetpack Scan, said he found the vulnerability during a security audit of the plugin and provided details to UpdraftPlus developers on Tuesday. A day later, the developers published a fix and agreed to force-install it on WordPress sites that had the plugin installed.

Stats provided by WordPress.org show that 1.7 million sites received the update on Thursday, and more than an additional 287,000 had installed it as of press time. WordPress says the plugin has 3+ million users.

In disclosing the vulnerability on Thursday, UpdraftPlus wrote:

This defect allows any logged-in user on a WordPress installation with UpdraftPlus active to exercise the privilege of downloading an existing backup, a privilege which should have been restricted to administrative users only. This was possible because of a missing permissions check on code related to checking current backup status. This allowed the obtaining of an internal identifier which was otherwise unknown and could then be used to pass a check upon permission to download.

This means that if your WordPress site allows untrusted users to have a WordPress login, and if you have any existing backup, then you are potentially vulnerable to a technically skilled user working out how to download the existing backup. Affected sites are at risk of data loss / data theft via the attacker accessing a copy of your site’s backup, if your site contains anything non-public. I say “technically skilled” because at that point, no public proof of how to leverage this exploit has been made. At this point in time, it relies upon a hacker reverse-engineering the changes in the latest UpdraftPlus release to work it out. However, you should certainly not rely upon this taking long but should update immediately. If you are the only user on your WordPress site, or if all your users are trusted, then you are not vulnerable, but we still recommend updating in any case.

https://arstechnica.com/?p=1835318

A couple of days after the FBI warned that a ransomware group called BlackByte had compromised critical infrastructure in the US, the group hacked servers belonging to the San Francisco 49ers football team and held some of the team’s data for ransom.

Media representatives for the NFL franchise confirmed a security breach in an emailed statement following a post on BlackByte’s dark web site, on which the hacker group attempts to shame and scare victims into making big payouts in exchange for a promise not to leak the data and to provide a decryption key that allows the data to be recovered. The recent post made available for download a 379MB file named “2020 Invoices” that appeared to show hundreds of billing statements the 49ers had sent partners including AT&T, Pepsi, and the city of Santa Clara, where the 49ers play home games.

A busy three months

In an emailed statement, franchise representatives said investigators were still assessing the breach.

“While the investigation is ongoing, we believe the incident is limited to our corporate IT network,” the statement said. “To date, we have no indication that this incident involves systems outside of our corporate network, such as those connected to Levi’s Stadium operations or ticket holders.”

The team said it notified law enforcement and is working with third-party cybersecurity firms to perform the investigation. “[W]e are working diligently to restore involved systems as quickly and as safely as possible,” the statement said.

On Friday, the FBI and the Secret Service issued a joint statement warning that BlackByte, a group first spotted last year, has been on a hacking spree over the past three months and that it has successfully breached an array of sensitive networks.

“As of November 2021, BlackByte ransomware had compromised multiple US and foreign businesses, including entities in at least three US critical infrastructure sectors (government facilities, financial, and food and agriculture),” the advisory stated. “BlackByte is a Ransomware as a Service (RaaS) group that encrypts files on compromised Windows host systems, including physical and virtual servers.”

Shells, bugs, and print bombs

BlackByte first surfaced last July, when people discussed it in a Bleeping Computer forum. An early version of BlackByte’s ransomware contained a flaw that exposed encryption keys used to lock up victims’ data. The bug allowed security firm Trustwave to release a decryptor tool that recovered data for free. An updated version fixed the bug.

An analysis published by security firm Red Canary said the hacking group was able to hack some of its victims by exploiting ProxyShell, the name of a series of vulnerabilities in Microsoft Exchange Server. The vulnerabilities allow hackers to gain pre-authentication remote code execution. From there, bad actors could install a shell that pipes commands to the compromised server. A host of adversaries—with nation-state-backed hackers from Iran among them—have exploited the vulnerabilities. Microsoft patched them last March.

Another characteristic of BlackByte, Red Canary said, was its use of “print bombing.” This feature caused all printers connected to an infected network to print ransom notes at the top of each hour that said, “Your [sic] HACKED by BlackByte team. Connect us to restore your system.”

The joint advisory issued by the FBI and Secret Service didn’t identify any of the organizations that have been breached by BlackByte. The advisory also provided a list of indicators admins and security personnel can use to determine if networks have been compromised by the group. It’s not unusual for ransomware hackers to remain in compromised networks for weeks as they work to worm their way in. Admins should use the indicator list as soon as possible to determine if their networks have been hacked.

https://arstechnica.com/?p=1834161

Western Digital has patched three critical vulnerabilities—one with a severity rating of 9.8 and another with a 9.0—that make it possible for hackers to steal data or remotely hijack storage devices running version 3 of the company’s My Cloud OS.

CVE-2021-40438, as one of the vulnerabilities is tracked, allows remote attackers with no authentication to make devices forward requests to servers of the attacker’s choosing. Like the other two flaws Western Digital fixed, it resides in the Apache HTTP Server versions 2.4.48 and earlier. Attackers have already successfully exploited it to steal hashed passwords from a vulnerable system, and exploit code is readily available.

The vulnerability, with a severity rating of 9 out of a maximum 10, stems from a Server-Side Request Forgery. This class of bug lets attackers funnel malicious requests to internal systems that are behind firewalls or otherwise not accessible outside a private network. It works by inducing server-side applications to make HTTP requests to an arbitrary domain of the attacker’s choosing.

CVE-2021-39275, meanwhile, carries a severity rating of 9.8 out of a possible score of 10. It allows remote attackers to crash vulnerable systems and possibly execute malicious code. Two additional vulnerabilities—CVE-2021-36160 and CVE-2021-34798—make it possible to remotely crash vulnerable systems.

Apache released patches for the vulnerabilities last October. Why the disk maker took four months to incorporate them into its disk OS is not clear.

Many people are often slow to patch vulnerabilities in periphery devices such as network-attached storage devices. That would be a mistake in the case of storage devices running Western Digital’s My Cloud proprietary operating system. In June, Western Digital advised users of a different product, the My Book Live, to immediately unplug the devices from the Internet. Meanwhile, the company responded to what later turned out to be the mass exploitation of a zero-day vulnerability.

Last year, Western Digital laid out a schedule for phasing out use of My Cloud OS 3. Starting earlier this week, users of the older OS with devices that are compatible with the current OS version 5 were required to update to the new version. If they didn’t, the users would no longer be able to connect to the devices over the Internet, receive security updates, or get technical support. On April 15, support for version 3 will end completely. Devices that aren’t compatible with version 5 by then will lose remote access, meaning they will only be able to access files over local networks.

“We recommend that all eligible users upgrade to My Cloud OS 5 immediately to benefit from the latest security fixes,” Western Digital said in an advisory. Instructions for upgrading are here.

Listing image by followtheseinstructions / Flickr

https://arstechnica.com/?p=1827015