HAProxy Vulnerability Leads to HTTP Request Smuggling
A critical security vulnerability in HAProxy could allow attackers to bypass security controls and access sensitive data without authorization, according to a warning from security research outfit JFrog.
An attacker could exploit the vulnerability – tracked as CVE-2021-40346 (CVSS score of 8.6) – to bypass duplicate HTTP Content-Length header checks. Thus, the attacker could smuggle HTTP requests to the backend server without the proxy server noticing it, or launch a response-splitting attack.
“Our analysis confirmed that the duplication is achieved by making use of the memory layout of HAProxy’s internal representation of an HTTP message to slip a select character from the header’s name to its value. Due to the difficulty in executing such an attack, the risk is low,” according to an HAProxy advisory.
Researchers with JFrog Security, the company credited with discovering the bug, describe the issue as integer overflow in the HAProxy’s parsing of HTTP requests. Specifically, it affects the logic related to the processing of Content-Length headers, in the line responsible for setting a header’s name and value lengths.
In an HTTP request smuggling attack, an adversary targets the HTTP requests between the frontend and backend servers by sending specially crafted requests containing an additional request. This results in the inner request being smuggled through the frontend, mainly because the same established TCP connection is used to forward the requests to the backend.
JFrog researchers crafted a POST request that contains a GET request in its body. Because of the manner in which the POST request’s header is created, HAProxy ends up forwarding it to the backend server with a value length of 0, meaning that it has no body.
The backend server then parses the request as having no body, and then expects to receive the next request on the same connection. Thus, the GET request that was in fact the POST’s body is treated as a legitimate request, resulting in bypassing HAProxy’s ACL filtering.
“HAProxy is only aware of a single HTTP request being forwarded and thus only returns a single HTTP response (the first) from the backend server back to the client,” according to JFrog’s documentation of the problem.
HAProxy versions 2.0.25, 2.2.17, 2.3.14 or 2.4.4 address the issue with size checks for both name and value lengths. Thus, it is recommended to update HAProxy as soon as possible. Workarounds to mitigate the issue are available as well, if updating isn’t possible.
GitHub Patches Security Flaws in Core Node.js Dependencies
GitHub has published documentation on seven vulnerabilities in the Node.js packages and warned that exploitation could expose users to code execution attacks.
“These vulnerabilities may result in arbitrary code execution due to file overwrite and creation when tar is used to extract untrusted tar files or when the npm CLI is used to install untrusted npm packages under certain file system conditions,” GitHub said in an advisory.
A code npm dependency, tar is used to extract and install npm packages. Thousands of projects depend on it and tar has tens of millions of weekly downloads. A core dependency for the npm CLI, @npmcli/arborist allows for the management of node_modules trees.
Four of the identified security holes (two in tar: CVE-2021-32804 and CVE-2021-37713; and two in @npmcli/arborist: CVE-2021-39134 and CVE-2021-39135) impact the npm CLI when a malicious or untrusted npm package is installed and could lead to code execution even when using the –ignore-scripts argument.
Upon package installation, npm CLI ensures contents are written to the appropriate folders only, but the vulnerabilities cross these security boundaries and may lead to arbitrary file overwrites during installation, and subsequent code execution.
Given the large number of projects that depend on tar, GitHub started working on fixes immediately after identifying the issue and also began scanning the npm registry for malicious packages targeting CVE-2021-32804, but says none was identified.
“The scan completed on August 5, 2021 and we did not detect any malicious packages targeting CVE-2021-32804. Note that exploitation of these issues through the npm CLI requires installation of untrusted packages or processing untrusted tar archives using affected versions of tar,” the company said.
The vulnerabilities are addressed in npm CLI versions 6.14.15, 7.21.0, or newer; latest Node.js releases (as of August 31, patches were included in Node 12, 14, and 16); and tar versions 4.4.19, 5.0.11, and 6.1.10.
Several of the identified issues were reported to GitHub by Robert Chen (@chen-robert) and Philip Papurt (@ginkoid). As part of a private security bug bounty program, they received a total bounty payout of $14,500 for the reports.
US Gov Seeks Public Feedback on Draft Federal Zero Trust Strategy
The U.S. government’s Cybersecurity and Infrastructure Security Agency (CISA) and the Office of Management and Budget (OMB) this week announced they are seeking public feedback on draft zero-trust strategic and technical documentation.
The OMB has drafted a federal strategy to transition the U.S. government towards a zero-trust architecture and is now seeking public feedback to improve the documentation and improve the government’s cybersecurity stance.
The draft strategy, which falls in line with the Executive Order on Improving the Nation’s Cybersecurity (EO 14208) that requires for civilian agencies’ enterprise security architecture to be changed based on zero trust principles – clarifies zero trust priorities for these agencies.
The strategy focuses on consolidating identity systems, implementing multi-factor authentication to combat phishing, encrypting traffic within internal networks, improving application security, and more. With the transition to a zero trust architecture expected to take years, the government is expected to adjust the strategy as new practices and technologies emerge.
Separately, CISA released the Cloud Security Technical Reference Architecture (TRA) and Zero Trust Maturity Model to support EO 14208. The Cloud Security TRA is meant to provide agencies with guidance on the cloud service adoption’s shared risk model, and the building and monitoring of a cloud environment.
Designed to complement OMB’s Zero Trust Strategy, the Zero Trust Maturity Model is expected to help agencies in their journey to zero trust by delivering a roadmap and resources for an optimal zero trust environment.
Public comments and feedback for both the TRA and Zero Trust Maturity Model can be submitted through October 1, 2021, via email.
Canadian-US National Sentenced to Prison for Cybercrime Schemes
A Canadian and U.S. dual-national was sentenced to 11 years in prison for laundering illicit funds from cybercrime schemes such as business email compromise, ATM cash-outs, and bank cyber-heists.
The man, Ghaleb Alaumary, 36, of Mississauga, Ontario, pleaded guilty to two counts of money laundering conspiracy and received a 140-months prison sentence. He was also ordered to pay more than $30 million in restitution.
Documents presented in court show that Alaumary and his co-conspirators engaged in ATM cash-out operations, BEC schemes, and bank cyber-heists to steal funds. Then, they used various bank accounts and digital currency to launder the money.
Alaumary pleaded guilty in the Southern District of Georgia in one money laundering case in which he conspired to send spoofed emails to a Canadian university in 2017. The emails purported to come from a construction company and demanded that payment was made for a major building project.
The scheme resulted in the university wiring $11.8 million CAD (roughly $9.4 million USD) to a bank account controlled by Alaumary and his co-conspirators, who then arranged with various people in the U.S. and abroad to launder the funds, according to a statement from the U.S. Justice Department.
Weeks later, Alaumary was involved in a scheme in which a co-conspirator made several trips to Texas to steal hundreds of thousands of dollars through impersonating wealthy bank customers.
Alaumary pleaded guilty in a second case to recruiting individuals to withdraw stolen funds from ATMs. The funds came from bank cyber-heists and various fraud schemes and were laundered through cash withdrawals, wire transfers, and through cryptocurrency.
Some of the funds, the United States Department of Justice reveals, came from a 2019 Maltese bank cyber-heist perpetrated by North Korean hackers.
Alaumary and his co-conspirators also targeted banks headquartered in India, Malta, and Pakistan, as well as businesses in the U.S. and the U.K., individuals in the U.S., and a professional soccer club in the U.K.
Governments, vigilantes, and criminal hackers have a new way to disrupt botnets running the widely used attack software Cobalt Strike, courtesy of research published on Wednesday.
Cobalt Strike is a legitimate security tool used by penetration testers to emulate malicious activity in a network. Over the past few years, malicious hackers—working on behalf of a nation-state or in search of profit—have increasingly embraced the software. For both defender and attacker, Cobalt Strike provides a soup-to-nuts collection of software packages that allow infected computers and attacker servers to interact in highly customizable ways.
The main components of the security tool are the Cobalt Strike client—also known as a Beacon—and the Cobalt Strike team server, which sends commands to infected computers and receives the data they exfiltrate. An attacker starts by spinning up a machine running Team Server that has been configured to use specific “malleability” customizations, such as how often the client is to report to the server or specific data to periodically send.
Then the attacker installs the client on a targeted machine after exploiting a vulnerability, tricking the user or gaining access by other means. From then on, the client will use those customizations to maintain persistent contact with the machine running the Team Server.
The link connecting the client to the server is called the web server thread, which handles communication between the two machines. Chief among the communications are “tasks” servers send to instruct clients to run a command, get a process list, or do other things. The client then responds with a “reply.”
Feeling the squeeze
Researchers at security firm SentinelOne recently found a critical bug in the Team Server that makes it easy to knock the server offline. The bug works by sending a server fake replies that “squeeze every bit of available memory from the C2’s web server thread,” SentinelOne researcher Gal Kristal wrote in a post.
Kristal went on to write:
This would allow an attacker to cause memory exhaustion in the Cobalt Strike server (the “Teamserver”) making the server unresponsive until it’s restarted. This means that live Beacons cannot communicate to their C2 until the operators restart the server.
Restarting, however, won’t be enough to defend against this vulnerability as it is possible to repeatedly target the server until it is patched or the Beacon’s configuration is changed.
Either of these will make the existing live Beacons obsolete as they’ll be unable to communicate with the server until they’re updated with the new configuration. Therefore, this vulnerability has the potential to severely interfere with ongoing operations.
All that’s needed to perform the attack is to know some of the server configurations. These settings are sometimes embedded in malware samples available from services such as VirusTotal. The configurations are also obtainable by anyone with physical access to an infected client.
Black hats, beware
To make the process easier, Sentinel One published a parser that captures configurations obtained from malware samples, memory dumps, and sometimes the URLs that clients use to connect to servers. Once in possession of the settings, an attacker can use a communication module included with the parser to masquerade as a Cobalt Strike client that belongs to the server.
In all, the tool has:
Parsing of a Beacon’s embedded Malleable profile instructions
Parsing of a Beacon’s configuration directly from an active C2 (like the popular nmap script)
Basic code for communicating with a C2 as a fake Beacon
The fake client can then send the server replies, even when the server sent no corresponding task first. A bug, tracked as CVE-2021-36798, in the Team Server software prevents it from rejecting replies that contain malformed data. An example is the data accompanying a screenshot the client uploads to the server.
“By manipulating the screenshot’s size we can make the server allocate an arbitrary size of memory, the size of which is totally controllable by us,” Kristal wrote. “By combining all the knowledge of Beacon communication flow with our configuration parser, we have all we need to fake a Beacon.”
While it’s true that exploits can be used against white hat and black hat hackers alike, the latter category is likely to be most threatened by the vulnerability. That’s because most professional security defenders pay for licenses to use Cobalt Strike, while many malicious hackers, by contrast, obtain pirated versions of the software.
A patch made available by Cobalt Strike creator HelpSystems will take time before it’s leaked to people pirating the software. It’s available to license holders now.
Two-for-Tuesday vulnerabilities send Windows and Linux users scrambling
The world woke up on Tuesday to two new vulnerabilities—one in Windows and the other in Linux—that allow hackers with a toehold in a vulnerable system to bypass OS security restrictions and access sensitive resources.
As operating systems and applications become harder to hack, successful attacks typically require two or more vulnerabilities. One vulnerability allows the attacker access to low-privileged OS resources, where code can be executed or sensitive data can be read. A second vulnerability elevates that code execution or file access to OS resources reserved for password storage or other sensitive operations. The value of so-called local privilege escalation vulnerabilities, accordingly, has increased in recent years.
Breaking Windows
The Windows vulnerability came to light by accident on Monday when a researcher observed what he believed was a coding regression in a beta version of the upcoming Windows 11. The researcher found that the contents of the security account manager—the database that stores user accounts and security descriptors for users on the local computer—could be read by users with limited system privileges.
That made it possible to extract cryptographically protected password data, discover the password used to install Windows, obtain the computer keys for the Windows data protection API—which can be used to decrypt private encryption keys—and create an account on the vulnerable machine. The result is that the local user can elevate privileges all the way to System, the highest level in Windows.
“I don’t know the full extent of the issue yet, but it’s too many to not be a problem I think,” researcher Jonas Lykkegaard noted. “Just so nobody is in doubt what this means, it’s EOP to SYSTEM for even sandboxed apps.”
yarh- for some reason on win11 the SAM file now is READ for users. So if you have shadowvolumes enabled you can read the sam file like this:
I dont know the full extent of the issue yet, but its too many to not be a problem I think. pic.twitter.com/kl8gQ1FjFt
People responding to Lykkegaard pointed out that the behavior wasn’t a regression introduced in Windows 11. Instead, the same vulnerability was present in the latest version of Windows 10. The US Computer Emergency Readiness Team said that the vulnerability is present when the Volume Shadow Copy Service—the Windows feature that allows the OS or applications to take “point-in-time snapshots” of an entire disk without locking the filesystem—is turned on.
The advisory explained:
If a VSS shadow copy of the system drive is available, a non-privileged user may leverage access to these files to achieve a number of impacts, including but not limited to:
Extract and leverage account password hashes
Discover the original Windows installation password
Obtain DPAPI computer keys, which can be used to decrypt all computer private keys
Note that VSS shadow copies may not be available in some configurations; however, simply having a system drive that is larger than 128GB in size and then performing a Windows Update or installing an MSI will ensure that a VSS shadow copy will be automatically created. To check if a system has VSS shadow copies available, run the following command from a privileged command prompt: vssadmin list shadows
Researcher Benjamin Delpy showed how the vulnerability can be exploited to obtain password hashes or other sensitive data:
Q: what can you do when you have #mimikatz🥝 & some Read access on Windows system files like SYSTEM, SAM and SECURITY?
Currently, there is no patch available. A Microsoft representative said company officials are investigating the vulnerability and will take appropriate action as needed. The vulnerability is being tracked as CVE-2021-36934. Microsoft said here that exploits in the wild are “more likely.”
Et tu, Linux kernel?
Most versions of Linux, meanwhile, are in the process of distributing a fix for a vulnerability disclosed on Tuesday. CVE-2021-33909, as the security flaw is tracked, allows an untrusted user to gain unfettered system rights by creating, mounting, and deleting a deep directory structure with a total path length that exceeds 1GB and then opening and reading the /proc/self/mountinfo file.
“We successfully exploited this uncontrolled out-of-bounds write and obtained full root privileges on default installations of Ubuntu 20.04, Ubuntu 20.10, Ubuntu 21.04, Debian 11, and Fedora 34 Workstation,” researchers from Qualys, the security firm that discovered the vulnerability and created proof-of-concept code that exploits it, wrote. “Other Linux distributions are certainly vulnerable, and probably exploitable.”
The exploit Qualys described comes with significant overhead, specifically roughly 1 million nested directories. The attack also requires about 5GB of memory and 1 million inodes. Despite the hurdles, a Qualys representative described the PoC as “extremely reliable” and said it takes about three minutes to complete.
Here’s an overview of the exploit:
1/ We mkdir() a deep directory structure (roughly 1M nested directories) whose total path length exceeds 1GB, we bind-mount it in an unprivileged user namespace, and rmdir() it.
2/ We create a thread that vmalloc()ates a small eBPF program (via BPF_PROG_LOAD), and we block this thread (via userfaultfd or FUSE) after our eBPF program has been validated by the kernel eBPF verifier but before it is JIT-compiled by the kernel.
3/ We open() /proc/self/mountinfo in our unprivileged user namespace and start read()ing the long path of our bind-mounted directory, thereby writing the string “//deleted” to an offset of exactly -2GB-10B below the beginning of a vmalloc()ated buffer.
4/ We arrange for this “//deleted” string to overwrite an instruction of our validated eBPF program (and therefore nullify the security checks of the kernel eBPF verifier) and transform this uncontrolled out-of-bounds write into an information disclosure and into a limited but controlled out-of-bounds write.
5/ We transform this limited out-of-bounds write into an arbitrary read and write of kernel memory by reusing Manfred Paul’s beautiful btf and map_push_elem techniques from:
People running Linux should check with the distributor to determine if patches are available to fix the vulnerability. Windows users should await advice from Microsoft and outside security experts.
https://arstechnica.com/?p=1781750
“Clickless” exploits from Israeli firm hacked activists’ fully updated iPhones
Getty Images
Smartphones belonging to more than three dozen journalists, human rights activists, and business executives have been infected with powerful spyware that an Israeli firm sells, purportedly to catch terrorists and criminals, The Washington Post and other publications reported.
The handsets were infected with Pegasus, full-featured spyware developed by NSO Group. The Israel-based exploit seller has come under intense scrutiny in recent years after repressive governments in the United Arab Emirates, Mexico, and other countries have been found using the malware against journalists, activists, and other groups not affiliated with terrorism or crime.
Pegasus is frequently installed through “zero-click” exploits, such as those sent by text messages, which require no interaction from victims. After the exploits surreptitiously jailbreak or root a target’s iPhone or Android device, Pegasus immediately trawls through a wealth of the device’s resources. It copies call histories, text messages, calendar entries, and contacts. It is capable of activating the cameras and microphones of compromised phones to eavesdrop on nearby activities. It can also track a target’s movements and steal messages from end-to-end encrypted chat apps.
iPhone 12 running iOS 14.6 felled
According to research jointly done by 17 news organizations, Pegasus infected 37 phones belonging to people who don’t meet the criteria NSO says is required for its powerful spyware to be used. Victims included journalists, human rights activists, business executives, and two women close to murdered Saudi journalist Jamal Khashoggi, according to The Washington Post. Technical analysis from Amnesty International and the University of Toronto’s Citizen Lab confirmed the infections.
“The Pegasus attacks detailed in this report and accompanying appendices are from 2014 up to as recently as July 2021,” Amnesty International researchers wrote. “These also include so-called ‘zero-click’ attacks which do not require any interaction from the target. Zero-click attacks have been observed since May 2018 and continue until now. Most recently, a successful ‘zero-click’ attack has been observed exploiting multiple zero-days to attack a fully patched iPhone 12 running iOS 14.6 in July 2021.”
All 37 infected devices were included in a list of more than 50,000 phone numbers. It remains unknown who put the numbers on it, why they did so, and how many of the phones were actually targeted or surveilled. A forensic analysis of the 37 phones, however, often shows a tight correlation between time stamps associated with a number on the list and the time surveillance began on the corresponding phone, in some cases as brief as a few seconds.
Amnesty International and a Paris-based journalism nonprofit called Forbidden Stories had access to the list and shared it with the news organizations, which went on to do further research and analysis.
Reporters identified more than 1,000 people in more than 50 countries whose numbers were included on the list. Victims included Arab royal family members, at least 65 business executives, 85 human rights activists, 189 journalists, and more than 600 politicians and government officials—including cabinet ministers, diplomats, and military and security officers. The numbers of several heads of state and prime ministers also appeared on the list. The Guardian, meanwhile, said 15,000 politicians, journalists, judges, activists, and teachers in Mexico appear on the leaked list.
As detailed here, hundreds of journalists, activists, academics, lawyers, and even world leaders appear to have been targeted. Journalists on the list worked for leading news organizations, including CNN, the Associated Press, Voice of America, The New York Times, The Wall Street Journal, Bloomberg News, Le Monde in France, the Financial Times in London, and Al Jazeera in Qatar.
“The targeting of the 37 smartphones would appear to conflict with the stated purpose of NSO’s licensing of the Pegasus spyware, which the company says is intended only for use in surveilling terrorists and major criminals,” Sunday’s Washington Post said. “The evidence extracted from these smartphones, revealed here for the first time, calls into question pledges by the Israeli company to police its clients for human rights abuses.”
NSO pushes back
NSO officials are pushing back hard on the research. In a statement, they wrote:
The report by Forbidden Stories is full of wrong assumptions and uncorroborated theories that raise serious doubts about the reliability and interests of the sources. It seems like the “unidentified sources” have supplied information that has no factual basis and [is] far from reality.
After checking their claims, we firmly deny the false allegations made in their report. Their sources have supplied them with information which has no factual basis, as evident by the lack of supporting documentation for many of their claims. In fact, these allegations are so outrageous and far from reality that NSO is considering a defamation lawsuit.
NSO Group has a good reason to believe the claims that are made by the unnamed sources to Forbidden Stories are based on [a] misleading interpretation of data from accessible and overt basic information, such as HLR Lookup services, which have no bearing on the list of the customers’ targets of Pegasus or any other NSO products. Such services are openly available to anyone, anywhere, and anytime and are commonly used by governmental agencies for numerous purposes, as well as by private companies worldwide.
The claims that the data was leaked from our servers is a complete lie and ridiculous, since such data never existed on any of our servers.
In its own statement, Apple officials wrote:
Apple unequivocally condemns cyberattacks against journalists, human rights activists, and others seeking to make the world a better place. For over a decade, Apple has led the industry in security innovation and, as a result, security researchers agree iPhone is the safest, most secure consumer mobile device on the market. Attacks like the ones described are highly sophisticated, cost millions of dollars to develop, often have a short shelf life, and are used to target specific individuals. While that means they are not a threat to the overwhelming majority of our users, we continue to work tirelessly to defend all our customers, and we are constantly adding new protections for their devices and data.
Repeat offender
This is by no means the first time that NSO has come under international criticism when its Pegasus spyware was found targeting journalists, dissidents, and others with no clear ties to crime or terrorism. The NSO spyware came to light in 2016 when Citizen Lab and security firm Lookout found it targeting a political dissident in the United Arab Emirates.
Researchers at the time determined that text messages sent to UAE dissident Ahmed Mansoor exploited what were three iPhone zero-day vulnerabilities to install Pegasus on his device. Mansoor forwarded the messages to Citizen Lab researchers, who determined that the linked webpages led to a chain of exploits that would have jailbroken his iPhone and installed the Pegasus spyware.
In 2019, Google’s Project Zero exploit research team found NSO exploiting zero-day vulnerabilities that gave full control of fully patched Android devices. Days later, Amnesty International and Citizen Lab disclosed that the mobile phones of two prominent human rights activists were repeatedly targeted with Pegasus. That same month, Facebook sued NSO, allegedly for attacks that used clickless exploits to compromise WhatsApp users’ phones.
Last December, Citizen Lab said a clickless attack developed by NSO exploited what had been a zero-day vulnerability in Apple’s iMessage to target 36 journalists.
The exploits that NSO and similar firms sell are extremely complex, costly to develop, and even more expensive to purchase. Smartphone users are unlikely to ever be on the receiving end of one of these attacks unless they are in the crosshairs of a wealthy government or law enforcement agency. People in this latter category should seek guidance from security experts on how to secure their devices.
https://arstechnica.com/?p=1781429
iOS zero-day let SolarWinds hackers compromise fully updated iPhones
The Russian state hackers who orchestrated the SolarWinds supply chain attack last year exploited an iOS zero-day as part of a separate malicious email campaign aimed at stealing Web authentication credentials from Western European governments, according to Google and Microsoft.
In a post Google published on Wednesday, researchers Maddie Stone and Clement Lecigne said a “likely Russian government-backed actor” exploited the then-unknown vulnerability by sending messages to government officials over LinkedIn.
Moscow, Western Europe, and USAID
Attacks targeting CVE-2021-1879, as the zero-day is tracked, redirected users to domains that installed malicious payloads on fully updated iPhones. The attacks coincided with a campaign by the same hackers who delivered malware to Windows users, the researchers said.
The campaign closely tracks to one Microsoft disclosed in May. In that instance, Microsoft said that Nobelium—the name the company uses to identify the hackers behind the SolarWinds supply chain attack—first managed to compromise an account belonging to USAID, a US government agency that administers civilian foreign aid and development assistance. With control of the agency’s account for online marketing company Constant Contact, the hackers could send emails that appeared to use addresses known to belong to the US agency.
The federal government has attributed last year’s supply chain attack to hackers working for Russia’s Foreign Intelligence Service (abbreviated as SVR). For more than a decade, the SVR has conducted malware campaigns targeting governments, political think tanks, and other organizations in countries like Germany, Uzbekistan, South Korea, and the US. Targets have included the US State Department and the White House in 2014. Other names used to identify the group include APT29, the Dukes, and Cozy Bear.
In an email, Shane Huntley, the head of Google’s Threat Analysis Group, confirmed the connection between the attacks involving USAID and the iOS zero-day, which resided in the WebKit browser engine.
“These are two different campaigns, but based on our visibility, we consider the actors behind the WebKit 0-day and the USAID campaign to be the same group of actors,” Huntley wrote. “It is important to note that everyone draws actor boundaries differently. In this particular case, we are aligned with the US and UK governments’ assessment of APT 29.”
Forget the sandbox
Throughout the campaign, Microsoft said, Nobelium experimented with multiple attack variations. In one wave, a Nobelium-controlled web server profiled devices that visited it to determine what OS and hardware the devices ran on. If the targeted device was an iPhone or iPad, a server used an exploit for CVE-2021-1879, which allowed hackers to deliver a universal cross-site scripting attack. Apple patched the zero-day in late March.
In Wednesday’s post, Stone and Lecigne wrote:
After several validation checks to ensure the device being exploited was a real device, the final payload would be served to exploit CVE-2021-1879. This exploit would turn off Same-Origin-Policy protections in order to collect authentication cookies from several popular websites, including Google, Microsoft, LinkedIn, Facebook, and Yahoo and send them via WebSocket to an attacker-controlled IP. The victim would need to have a session open on these websites from Safari for cookies to be successfully exfiltrated. There was no sandbox escape or implant delivered via this exploit. The exploit targeted iOS versions 12.4 through 13.7. This type of attack, described by Amy Burnett in Forget the Sandbox Escape: Abusing Browsers from Code Execution, is mitigated in browsers with Site Isolation enabled, such as Chrome or Firefox.
It’s raining zero-days
The iOS attacks are part of a recent explosion in the use of zero-days. In the first half of this year, Google’s Project Zero vulnerability research group has recorded 33 zero-day exploits used in attacks—11 more than the total number from 2020. The growth has several causes, including better detection by defenders and better software defenses that require multiple exploits to break through.
The other big driver is the increased supply of zero-days from private companies selling exploits.
“0-day capabilities used to be only the tools of select nation-states who had the technical expertise to find 0-day vulnerabilities, develop them into exploits, and then strategically operationalize their use,” the Google researchers wrote. “In the mid-to-late 2010s, more private companies have joined the marketplace selling these 0-day capabilities. No longer do groups need to have the technical expertise; now they just need resources.”
The iOS vulnerability was one of four in-the-wild zero-days Google detailed on Wednesday. The other three were:
The four exploits were used in three different campaigns. Based on their analysis, the researchers assess that three of the exploits were developed by the same commercial surveillance company, which sold them to two different government-backed actors. The researchers didn’t identify the surveillance company, the governments, or the specific three zero-days they were referring to.
Representatives from Apple didn’t immediately respond to a request for comment.
https://arstechnica.com/?p=1780318
Microsoft discovers critical SolarWinds zero-day under active attack
SolarWinds, the company at the center of a supply chain attack that compromised nine US agencies and 100 private companies, is scrambling to contain a new security threat: a critical zero-day vulnerability in its Serv-U product line.
Microsoft discovered the exploits and privately reported them to SolarWinds, the latter company said in an advisory published on Friday. SolarWinds said the attacks are entirely unrelated to the supply chain attack discovered in December.
“Microsoft has provided evidence of limited, targeted customer impact, though SolarWinds does not currently have an estimate of how many customers may be directly affected by the vulnerability,” company officials wrote. “SolarWinds is unaware of the identity of the potentially affected customers.”
Only SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP—and by extension, the Serv-U Gateway, a component of those two products—are affected by this vulnerability, which allows attackers to remotely execute malicious code on vulnerable systems.
An attacker can gain privileged access to exploited machines hosting Serv-U products and could then install programs; view, change, or delete data; or run programs on the affected system. The vulnerability exists in the latest Serv-U version 15.2.3 HF1, released on May 5, and all prior versions.
SolarWinds has issued a hotfix to mitigate the attacks while the company works on a permanent solution. People running Serv-U version 15.2.3 HF1 should apply hotfix (HF) 2; those using Serv-U 15.2.3 should apply Serv-U 15.2.3 HF1 and then apply Serv-U 15.2.3 HF2; and those running Serv-U versions prior to 15.2.3 should upgrade to Serv-U 15.2.3, apply Serv-U 15.2.3 HF1, and then apply Serv-U 15.2.3 HF2. The company says customers should install the fixes immediately.
The hotfixes are available here. Disabling SSH access also prevents exploitation.
The federal government has attributed last year’s supply chain attack to hackers working for Russia’s Foreign Intelligence Service, abbreviated as the SVR, which for more than a decade has conducted malware campaigns targeting governments, political think tanks, and other organizations in countries including Germany, Uzbekistan, South Korea, and the US. Targets have included the US State Department and the White House in 2014.
The hackers used that access to push a malicious software update to about 18,000 customers of SolarWinds’ Orion network management product. Of those customers, roughly 110 received a follow-on attack that installed a later-stage payload that exfiltrated proprietary data. The malware installed in the attack campaign is known as Sunburst. Again, SolarWinds said the exploits underway now have no connection.
Late last year, zero-day vulnerabilities in SolarWinds’ Orion product came under exploit by a different set of attackers that researchers have tied to China’s government. Those attackers installed malware that researchers call SuperNova. Threat actors linked to China have also targeted SolarWinds. At least one US government agency was targeted in this operation. https://arstechnica.com/?p=1779520
Microsoft’s emergency patch fails to fix critical “PrintNightmare” vulnerability
An emergency patch Microsoft issued on Tuesday fails to fully fix a critical security vulnerability in all supported versions of Windows that allows attackers to take control of infected systems and run code of their choice, researchers said.
The threat, colloquially known as PrintNightmare, stems from bugs in the Windows print spooler, which provides printing functionality inside local networks. Proof-of-concept exploit code was publicly released and then pulled back, but not before others had copied it. Researchers track the vulnerability as CVE-2021-34527.
A big deal
Attackers can exploit it remotely when print capabilities are exposed to the Internet. Attackers can also use it to escalate system privileges once they’ve used a different vulnerability to gain a toe-hold inside of a vulnerable network. In either case, the adversaries can then gain control of the domain controller, which as the server that authenticates local users, is one of the most security-sensitive assets on any Windows network.
“It’s the biggest deal I’ve dealt with in a very long time,” said Will Dormann, a senior vulnerability analyst at the CERT Coordination Center, a nonprofit, United States federally funded project that researches software bugs and works with business and government to improve security. “Any time there’s public exploit code for an unpatched vulnerability that can compromise a Windows domain controller, that’s bad news.”
After the severity of the bug came to light, Microsoft published an out-of-band fix on Tuesday. Microsoft said the update “fully addresses the public vulnerability.” But on Wednesday—a little more than 12 hours after the release—a researcher showed how exploits could bypass the patch.
“Dealing with strings & filenames is hard,” Benjamin Delpy, a developer of the hacking and network utility Mimikatz and other software, wrote on Twitter.
Accompanying Delpy’s tweet was a video that showed a hastily written exploit working against a Windows Server 2019 that had installed the out-of-band patch. The demo shows that the update fails to fix vulnerable systems that use certain settings for a feature called point and print, which makes it easier for network users to obtain the printer drivers they need.
Buried near the bottom of Microsoft’s advisory from Tuesday is the following: “Point and Print is not directly related to this vulnerability, but the technology weakens the local security posture in such a way that exploitation will be possible.”
A tragedy of gaffes
The incomplete patch is the latest gaffe involving the PrintNightmare vulnerability. Last month, Microsoft’s monthly patch batch fixed CVE-2021-1675, a print spooler bug that allowed hackers with limited system rights on a machine to escalate privilege to administrator. Microsoft credited Zhipeng Huo of Tencent Security, Piotr Madej of Afine, and Yunhai Zhang of Nsfocus with discovering and reporting the flaw.
A few weeks later, two different researchers—Zhiniang Peng and Xuefeng Li from Sangfor—published an analysis of CVE-2021-1675 that showed it could be exploited not just for privilege escalation but also for achieving remote code execution. The researchers named their exploit PrintNightmare.
Eventually, researchers determined that PrintNightmare exploited a vulnerability that was similar (but ultimately different from) CVE-2021-1675. Zhiniang Peng and Xuefeng Li removed their proof-of-concept exploit when they learned of the confusion, but by then, their exploit was already widely circulating. There are currently at least three PoC exploits publicly available, some with capabilities that go well beyond what the initial exploit allowed.
Microsoft’s fix protects Windows servers that are set up as domain controllers or Windows 10 devices that use default settings. Wednesday’s demo from Delpy shows that PrintNightmare works against a much wider range of systems, including those that have enabled a Point and Print and selected the NoWarningNoElevationOnInstall option. The researcher implemented the exploit in Mimikatz.
“Credentials will be required”
Besides trying to close the code-execution vulnerability, Tuesday’s fix for CVE-2021-34527 also installs a new mechanism that allows Windows administrators to implement stronger restrictions when users try to install printer software.
“Prior to installing the July 6, 2021, and newer Windows Updates containing protections for CVE-2021-34527, the printer operators’ security group could install both signed and unsigned printer drivers on a printer server,” a Microsoft advisory stated. “After installing such updates, delegated admin groups like printer operators can only install signed printer drivers. Administrator credentials will be required to install unsigned printer drivers on a printer server going forward.”
Despite Tuesday’s out-of-band patch being incomplete, it still provides meaningful protection against many types of attacks that exploit the print spooler vulnerability. So far, there are no known cases of researchers saying it puts systems at risk. Unless that changes, Windows users should install both the patch from June and Tuesday and await further instructions from Microsoft. Company representatives didn’t immediately have a comment for this post.
Tags: 
Tags: 
Tags: 
Tags: 
