A bug bounty hunter claims he has earned a $5,000 reward from Apple for reporting a stored cross-site scripting (XSS) vulnerability on iCloud.com.

Vishal Bharad, a researcher and penetration tester from India, published a blog post earlier this week describing his findings. Bharad said he had attempted to find cross-site request forgery (CSRF), insecure direct object reference (IDOR), logic bugs and other types of issues on Apple’s icloud.com website, but ultimately ended up discovering a stored XSS flaw.

The vulnerability was present in the iCloud-hosted versions of Apple’s Pages and Keynote software. Exploitation involved creating a new document or presentation and entering an XSS payload into its name field.

The attacker would then need to share a link to the malicious document or presentation with the targeted user and convince them to access the “Browse All Versions” feature from the “Settings” menu. Once the victim would click on “Browse All Versions,” the attacker’s malicious payload got executed in their browser.

Bharad said he reported his findings to Apple in August 2020 and in October the tech giant informed him that the security hole had earned him $5,000.

The researcher has published a blog post detailing his findings, as well as a video showing how an attack worked.

[embedded content]

XSS vulnerabilities can have a significant impact, which is why companies such as Google, Facebook and Tesla have paid out tens of thousands of dollars for these types of flaws.

Bug bounty platform HackerOne reported last year that its members had earned more than $4 million for XSS vulnerabilities.

Related: XSS Vulnerability Exposed Google Employees to Attacks

Related: JavaScript Library Introduced XSS Flaw in Google Search

Related: XSS Vulnerability Exploited in Tech Support Scam

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/rSuiBBuSlkc/stored-xss-vulnerability-icloudcom-earned-researcher-5000

Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe

The U.S. Justice Department on Wednesday announced the indictment of three North Korean military intelligence officials linked to high-profile cyber-attacks that included the theft of $1.3 billion in money and crypto-currency from organizations around the world.

The indictment alleges the trio was part of a “wide-ranging criminal conspiracy to conduct a series of destructive cyberattacks” against companies and crypto-currency exchanges around the world.

The DOJ described the scope of the North Korean hacking operation as “extensive and long-running”. 

“The range of crimes they committed is staggering,” said Acting U.S. Attorney Tracy Wilkison. “The conduct detailed in the indictment are the acts of a criminal nation-state that has stopped at nothing to extract revenge and obtain money to prop up its regime.”

[ PREVIOUSLY:  North Korean Hackers Targeting Security Researchers ]

 The new indictment expands on a 2018 case against the Pyongyang hacking group blamed for attacks against Sony Pictures,, the destructive Wannacry worm, a series of brazen online bank robberies against the global financial system, and ongoing ransomware extortion schemes.

The group, known publicly as Lazarus, has also been actively draining billions of dollars from hacks against crypto-currency exchanges.

 The newest indictment adds two new North Korean defendants to the government’s case and named a third Canadian-American citizen who was part of the Lazarus group’s money laundering operations.

From the Justice Department announcement:

The hacking indictment filed in the U.S. District Court in Los Angeles alleges that Jon Chang Hyok (전창혁), 31; Kim Il (김일), 27; and Park Jin Hyok (박진혁), 36, were members of units of the Reconnaissance General Bureau (RGB), a military intelligence agency of the Democratic People’s Republic of Korea (DPRK), which engaged in criminal hacking. These North Korean military hacking units are known by multiple names in the cybersecurity community, including Lazarus Group and Advanced Persistent Threat 38 (APT38). Park was previously charged in a criminal complaint unsealed in September 2018. 

The indictment blames the Lazarus group hackers for a wide range of publicly documented attacks, including the hack of Sony Pictures Entertainment in November 2014, the targeting of AMC Theatres later that year, and a 2015 intrusion into Mammoth Screen, which was producing a fictional series involving a British nuclear scientist taken prisoner in DPRK.

[ RELATED: U.S. Charges North Koreans Over Lazarus Hacks ]

The U.S. government also linked the indicted hackers to billion-dollar bank heists that attacked the SWIFT (Society for Worldwide Interbank Financial Telecommunication) messaging system.  The group is also charged with ATM cash-out schemes that stole $6.1 million from a Pakistan bank.

The government also detailed the group’s involvement in the Wannacry ransomware, the creation and deployment of malicious cryptocurrency applications, the development of multiple malicious cryptocurrency applications that gave the North Korean hackers a backdoor into the victims’ computers.

The Lazarus group has recently been flagged targeting security researchers involved in anti-malware research and other offensive exploit development work.

Earlier this week it was reported that North Korean hackers tried to hack into pharmaceutical giant Pfizer in a search for information on a coronavirus vaccine and treatment technology, adding to previous activity associated with the rogue nation trying to access COVID-19 related research.

In July 2017, researchers from Recorded Future monitored internet traffic from North Korea. One of its conclusions was that “most state-sponsored activity is perpetrated from abroad.” Recorded Future suggested at the time that North Korean malicious activity most likel originates from countries such as India, Malaysia, New Zealand, Nepal, Kenya, Mozambique, and Indonesia. 

In late September 2017, the United States Cyber Command reportedly engaged in offensive activity against North Korea, by launching a DDoS attack against its military spy agency, the Reconnaissance General Bureau (RGB). The attack occurred just five weeks after President Trump elevated U.S. Cyber Command to a Unified Combatant Command. 

Related: U.S. Army Report Describes North Korea’s Cyber Warfare Capabilities

Related: North Korea Cyber Experts Raised Up to $2 Billion, UN Says

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. Ryan is a journalist and cybersecurity strategist with more than 20 years experience covering IT security and technology trends. He is a regular speaker at cybersecurity conferences around the world.
Ryan has built security engagement programs at major global brands, including Intel Corp., Bishop Fox and Kaspersky GReAT. He is a co-founder of Threatpost and the global SAS conference series. Ryan’s career as a journalist includes bylines at major technology publications including Ziff Davis eWEEK, CBS Interactive’s ZDNet, PCMag and PC World.
Follow Ryan on Twitter @ryanaraine.

Previous Columns by Ryan Naraine:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/JWJCkscfTPs/us-charges-north-korean-hackers-over-13-billion-bank-heists

Researchers at cybersecurity firm FireEye have analyzed a gateway device used for solar energy installations, and discovered vulnerabilities that could be useful to malicious hackers.

The targeted device is the ConnectPort X2e made by Digi International, a US-based company that provides IT, networking and IoT solutions for industrial, enterprise and smart city applications. FireEye conducted its research on a version of the device offered by Tesla under the SolarCity brand — Tesla acquired solar panel maker SolarCity in 2016.

The X2e device is a programmable gateway used for residential and small commercial solar installations. It’s typically used to read data from a solar inverter and provide a connection to cloud-based applications.

FireEye’s research involved a physical inspection of the device, an analysis of debugging interfaces, removing the NAND storage, analyzing the file system and bootloader, glitch attacks, and software exploitation.

The research led to the discovery of two vulnerabilities: one related to the existence of hardcoded credentials (CVE-2020-9306), and a privilege escalation flaw (CVE-2020-12878) — both were classified as high severity. The security holes were reported to both Tesla and Digi, and they have been patched.

According to FireEye, an attacker who has network access to the targeted device could exploit the vulnerabilities to obtain a root shell and remotely take complete control of the device.

“If an attacker is able to compromise an X2e device, they would have access to a networked device in a home or enterprise,” FireEye researchers Jake Valletta and Sam Sabetan told SecurityWeek.

“X2e’s are typically only used for data collection purposes and if compromised, an attacker could install a backdoor on the X2e which could be used to laterally move in a network, call out to a remote server for persistent access, or stage a larger attack on the victim’s network,” they added, clarifying that “this scenario holds for any compromised IoT device on a network.”

The researchers noted that the device is typically behind a residential firewall so remote attacks directly from the internet should not be possible, unless the user has intentionally made it accessible from the web.

“However, ConnectPort X2e’s are used for various purposes and are not exclusive to solar installations. Therefore, it is possible some X2e devices, based on their use case, are exposed to the Internet,” they explained.

FireEye has made available detailed technical information on its research into the X2e device [part 1 and part 2].

Related: Malware Found on USB Drives Shipped With Schneider Solar Products

Related: Vulnerabilities Found in Popular Solar Park Monitoring System

Related: Solar Panel Flaws Put Power Grids at Risk: Researcher

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/FM5NPtRz1oM/research-shows-how-solar-energy-installations-can-be-abused-hackers

Trend Micro says it has found “several” security flaws in the popular Android app ShareIt. ShareIt has been downloaded over a billion times from the Play Store, and, according to App Annie, was one of the 10 most globally downloaded apps in 2019. The app was originally developed by Lenovo (it has since spun off into its own company) and for a time was pre-installed on Lenovo phones.

The report says ShareIt’s vulnerabilities can “be abused to leak a user’s sensitive data and execute arbitrary code with ShareIt permissions.” ShareIt’s permissions, as a local file-sharing app, are pretty extensive. According to the Play Store permissions readout, ShareIt requests access to the entire user storage and all media, the camera and microphone, and location. It can delete apps, run at startup, create accounts and set passwords, and do a whole lot more. It also has full network access. Trend Micro says compromising the app can lead to remote code execution. The security firm says it shared these vulnerabilities with ShareIt three months ago, but the company has yet to issue patches.

ShareIt’s incredible success of a billion Android downloads and 1.8 billion users worldwide (there are also iOS, Windows, and Mac apps) has led to what looks like an incredible amount of app bloat. The app was considered one of the best for local file sharing, but today the Play Store listing shows an app that offers “Infinite Online Videos,” “Tens of millions of high-quality songs,” “GIFs, Wallpapers & Stickers,” a “popular” media section that looks like a social network, a game store, a retail movie download section, COVID-19 check-in activity and case statistics, and what looks like its own form of currency. ShareIt’s website (which, just like the app, does not default to HTTPS) says the service is “now a leading content platform” and popular in Southeast Asia, South Asia, the Middle East, Africa, and Russia.

When private storage isn’t private

Trend Micro’s report details a laundry list of bad decisions made while designing ShareIt that could make it more susceptible to malicious code. One problem is a common Android app vulnerability that arises when developers set up a content provider incorrectly. Android prides itself on intra-app communication, partly because any app can create a content provider and provide its content and services to other apps. If Gmail wants to attach a file to an email, it can do that by showing a list of available file-content providers installed on your phone (it’s basically an “open with” dialog box), and the user can pick their favorite file manager, navigate through their storage, and pass the file they want to Gmail. It’s up to developers to sanitize these cross-app capabilities and only expose the necessary file manager capabilities to Gmail and other apps.

ShareIt doesn’t seem to have given much thought to the need to sanitize its content-provider capabilities. The report says: “The developer behind this disabled the exported attribute via android:exported=”false”, but enabled the android:grantUriPermissions=”true” attribute. This indicates that any third-party entity can still gain temporary read/write access to the content provider’s data.” Passing along some permissions is normal, but Trend Micro found that ShareIt doesn’t try to scope down its permissions at all and will happily serve up its files to any app that asks. A malicious developer needs to only call on the ShareIt’s file-content provider and pass it a file path for the developer to get back any of the files in ShareIt’s “private” directory.

The file paths ShareIt will offer up are limited to its own data files, but that means apps can edit the data ShareIt uses to run, including the app cache that gets generated during install and runtime. The report says that “an attacker may craft a fake [app cache] file, then replace those files via the aforementioned vulnerability to perform code execution.” Normally these files live in private storage, but ShareIt’s private storage is open to the world.

ShareIt also comes with its own Android app installer. With its private storage no longer being “private,” it repeats the same mistakes we saw in Epic’s Fornite installer. It downloads app install files to world-readable storage, where they are vulnerable to a “Man-in-the-disk” attack. App install files need to be protected in private storage before they are installed, but in public storage, the install package could be swapped out as soon as it is downloaded but before install time. Then the user thinks they’re installing the good app they just downloaded, but it’s actually an imposter malicious app.

“The attacker can steal sensitive data”

A whole extra problem is that ShareIt’s game store can apparently download app data over unsecured HTTP, where it can be subject to a man-in-the-middle attack. ShareIt registers itself as the handler for any link that ends its domains, like “wshareit.com” or “gshare.cdn.shareitgames.com,” and it will automatically pop up when users click on a download link. Most apps force all traffic to HTTPS, but ShareIt does not. Chrome will shut down HTTP download traffic, so this would have to be done through a Web interface other than the main browser.

Trend Micro ends by saying, “We reported these vulnerabilities to the vendor, who has not responded yet. We decided to disclose our research three months after reporting this since many users might be affected by this attack, because the attacker can steal sensitive data and do anything with the apps’ permission.” Users should probably uninstall the app ASAP. If you’re looking for a more secure file-sharing alternative, Google’s file manager can do local sharing over Wi-Fi now and should be written with better security practices.

https://arstechnica.com/?p=1742615

It’s the second Tuesday of February, and that means Microsoft and other software makers are releasing dozens of updates to fix security vulnerabilities. Topping off this month’s list are two zero-days under active exploit and critical networking flaws that allow attackers to remotely execute malicious code or shut down computers.

The most important patch fixes a code-execution flaw in Adobe Reader, which despite its long-in-the-tooth status remains widely used for viewing and working with PDF documents. CVE-2021-21017, as the critical vulnerability is tracked, stems from a heap-based buffer overflow. After being tipped off by an anonymous source, Adobe warned that the flaw has been actively exploited in limited attacks that target Reader users running Windows.

Adobe didn’t provide additional details about the vulnerability or the in-the-wild attacks exploiting it. Typically, hackers use specially crafted documents sent by email or published online to trigger the vulnerability and execute code that installs malware on the device running the application. Adobe’s use of the word “limited” likely means that the hackers are narrowly focusing their attacks on a small number of high-value targets.

Microsoft, meanwhile, has issued a fix for a vulnerability in Windows 10 and Windows Server 2019 that’s also under active attack. The flaw, indexed as CVE-2021-1732, allows attackers to run their malicious code with elevated system rights.

Chain of exploits?

Hackers typically use these so-called elevation-of-privilege exploits alongside attack code that targets a separate vulnerability. The former will allow code execution while the latter ensures the code runs with privileges that are high enough to access sensitive parts of the operating system. Microsoft credited JinQuan, MaDongZe, TuXiaoYi, and LiHao of DBAPPSecurity Co. Ltd. with discovering and reporting the vulnerability.

In a blog post published after the vulnerability was patched, the DBAPPSecurity researchers said an advanced persistent threat hacker group called Bitter was exploiting the vulnerability in “a very limited number of attacks” against targets in China. The attackers could use it to escape the security sandbox when targets were using either Internet Explorer or Adobe Reader.

“The quality of this vulnerability [is] high and the exploit is sophisticated,” the researchers wrote. “The use of this in-the-wild zero-day reflects the organization’s strong vulnerability reserve capability. The threat organization may have recruited members with certain strength, or buying it from vulnerability brokers.”

The simultaneous patching of CVE-2021-21017 and CVE-2021-1732, their nexus to Windows, and the ability for CVE-2021-1732 to defeat an important Reader defense raise the distinct possibility that in-the-wild attacks are combining exploits for the two vulnerabilities. Neither Microsoft nor Adobe has provided details that confirm this speculation, however.

Microsoft on Tuesday published a security bulletin strongly urging users to patch three vulnerabilities in the Windows TCP/IP component, which is responsible for sending and receiving Internet traffic. CVE-2021-24074 and CVE-2021-24094 are both rated as critical and allow attackers to send maliciously manipulated network packets that execute code. Both flaws also allow hackers to launch denial-of-service attacks—as does a third TCP/IP vulnerability tracked as CVE-2021-24086.

The bulletin said that developing reliable code-execution exploits will be hard but that DoS attacks are much easier and hence likely to be exploited in the wild.

“The two RCE vulnerabilities are complex which make it difficult to create functional exploits, so they are not likely in the short term,” Tuesday’s bulletin said. “We believe attackers will be able to create DoS exploits much more quickly and expect all three issues might be exploited with a DoS attack shortly after release. Thus, we recommend customers move quickly to apply Windows security updates this month.”

The three vulnerabilities stem from a flaw in Microsoft’s implementation of TCP/IP and affect all supported versions of Windows versions. Non-Microsoft implementations aren’t affected. Microsoft said it identified the vulnerabilities internally.

56 vulnerabilities

In all, Microsoft patched 56 vulnerabilities across multiple products including Windows, Office, and SharePoint. Microsoft rated 11 of the vulnerabilities as critical. As usual, affected users should install patches as soon as practical. Those who can’t patch immediately should refer to workarounds listed in the advisories.

A word, too, about Adobe Reader. Adobe has devoted significant resources over the past few years to improving the security of the product. That said, Reader includes a bevy of advanced features that casual users rarely, if ever, need. These advanced features create the kind of attack surface that hackers love. The vast majority of computer users may want to consider a default reader that has fewer bells and whistles. Edge, Chrome, or Firefox are all suitable replacements.

Post updated to add details from DBAPPSecurity blog post.

https://arstechnica.com/?p=1740984

Users of Google’s Chrome browser have faced three security concerns over the past 24 hours in the form of a malicious extension with more than 2 million users, a just-fixed zero-day, and new information about how malware can abuse Chrome’s sync feature to bypass firewalls. Let’s discuss them one by one.

First up, the Great Suspender, an extension with more than 2 million downloads from the Chrome Web Store, has been pulled from Google servers and deleted from users’ computers. The extension has been an almost essential tool for users with small amounts of RAM on their devices. Since Chrome tabs are known to consume large amounts of memory, the Great Suspender temporarily suspends tabs that haven’t been opened recently. That allows Chrome to run smoothly on systems with modest resources.

Characteristically terse

Google’s official reason for the removal is characteristically terse. Messages displayed on devices that had the extension installed say only, “This extension contains malware” along with an indication that it has been removed. A Google spokesman declined to elaborate.

The longer back story is that, as reported in a GitHub thread in November, the original extension developer sold it last June, and it began showing signs of malice under the new ownership. Specifically, the thread said, a new version contained malicious code that tracked users and manipulated Web requests.

The automatic removal has left some users in the lurch because they can no longer easily access suspended tabs. Users in this Reddit thread have devised several ways to recover their tabs.

High severity zero-day

Next, Google on Thursday released a Chrome update that fixes what the company said was a zero-day vulnerability in the browser. Tracked as CVE-2021-21148, the vulnerability stems from a buffer overflow flaw in V8, Google’s open-source JavaScript engine. Google rated the severity as “high.”

Once again, Google provided minimal information about the vulnerability, saying only that the company “is aware of reports that an exploit for CVE-2021-21148 exists in the wild.”

In a post published Friday by security firm Tenable, however, researchers noted that the flaw was reported to Google on January 24, one day before Google’s threat analysis group dropped a bombshell report that hackers sponsored by a nation-state were using a malicious website to infect security researchers with malware. Microsoft issued its own report speculating that the attack was exploiting a Chrome zero-day.

Google has declined to comment on that speculation or provide further details about exploits of CVE-2021-21148.

Sync abuse

Lastly, a security researcher reported on Thursday that hackers were using malware that abused the Chrome sync feature to bypass firewalls so the malware could connect to command and control servers. Sync allows users to share bookmarks, browser tabs, extensions, and passwords across different devices running Chrome.

The attackers used a malicious extension that wasn’t available in the Chrome Web Store. The above link provides a wealth of technical details.

A Google spokesman said that developers won’t be modifying the sync feature because physically local attacks (meaning those that involve an attacker having access to the computer) are explicitly outside of Chrome’s threat model. He included this link, which further explains the reasoning.

None of these concerns mean you should ditch Chrome, or even the sync feature. Still, it’s a good idea to check the version of Chrome installed to ensure it’s the latest, 88.0.4324.150.

The usual advice about browser extensions also applies, which is essentially to install them only when they’re truly useful and after vetting the security in user comments. That advice wouldn’t have saved Great Suspender users, however, which is precisely the problem with extensions.

https://arstechnica.com/?p=1740160

SolarWinds, the previously little-known company whose network-monitoring tool Orion was a primary vector for one of the most serious breaches in US history, has pushed out fixes for three severe vulnerabilities.

Martin Rakhmanov, a researcher with Trustwave SpiderLabs, said in a blog post on Wednesday that he began analyzing SolarWinds products shortly after FireEye and Microsoft reported that hackers had taken control of SolarWinds’ software development system and used it to distribute backdoored updates to Orion customers. It didn’t take long for him to find three vulnerabilities, two in Orion and a third in a product known as the Serv-U FTP for Windows. There’s no evidence any of the vulnerabilities have been exploited in the wild.

The most serious flaw allows unprivileged users to remotely execute code that takes complete control of the underlying operating system. Tracked as CVE-2021-25274 the vulnerability stems from Orion’s use of the Microsoft Message Queue, a tool that has existed for more than 20 years but is no longer installed by default on Windows machines.

Hard to miss

As Rakhmanov poked through the Windows Computer Management console, he quickly seized on the following security permissions for one of the dozens of private queues it enabled:

“It’s pretty hard to miss that warning shield showing that the queue, like all the queues, is unauthenticated,” the researcher wrote. “In short, unauthenticated users can send messages to such queues over TCP port 1801. My interest was piqued, and I jumped in to look at the code that handles incoming messages. Unfortunately, it turned out to be an unsafe deserialization victim.”

Trustwave SpiderLabs described the flaw this way in a separate advisory:

SolarWinds Collector Service uses MSMQ (Microsoft Message Queue) and it doesn’t set permissions on its private queues. As a result, remote unauthenticated clients can send messages that the Collector Service will process. Additionally, upon processing of such messages, the service deserializes them in insecure manner allowing remote arbitrary code execution as LocalSystem.

Database Credentials for Everyone

The second Orion vulnerability, tracked as CVE-2021-25275, is the result of Orion storing database credentials in an insecure manner. Specifically, Orion keeps the credentials in a file that’s readable by unprivileged users. Rakhmanov facetiously called this “Database Credentials for Everyone.”

While the files cryptographically protect the passwords, the researcher was able to find code that converts the password to plaintext. The result: anyone who can log in to a box locally or through the Remote Desktop Protocol can gain the credentials for the SolarWindsOrionDatabaseUser.

“The next step is to connect to the Microsoft SQL Server using the recovered account, and at this point, we have complete control over the SOLARWINDS_ORION database,” Rakhmanov wrote. “From here, one can steal information or add a new admin-level user to be used inside SolarWinds Orion products.”

Create your own admin account

The third vulnerability, tracked as CVE-2021-25276, resides in the Serv-U FTP for Windows. The program stores details for each account in a separate file. Those files can be created by any authenticated Windows user.

Rakhmanov wrote:

Specifically, anyone who can log in locally or via Remote Desktop can just drop a file that defines a new user, and the Serv-U FTP will automatically pick it up. Next, since we can create any Serv-U FTP user, it makes sense to define an admin account by setting a simple field in the file and then set the home directory to the root of C:\ drive. Now we can log in via FTP and read or replace any file on the C:\ since the FTP server runs as LocalSystem.

Fixes for Orion and Serv-U FTP are available here and here. People who rely on either of these products should install patches as soon as possible.

https://arstechnica.com/?p=1739666

Network security provider SonicWall said on Monday that hackers are exploiting a critical zero-day vulnerability in one of the devices it sells.

The security flaw resides in the Secure Mobile Access 100 series, SonicWall said in an advisory updated on Monday. The vulnerability, which affects SMA 100 firmware versions 10.x, isn’t slated to receive a fix until the end of Tuesday.

Monday’s update came a day after security firm NCC Group said on Twitter that it had detected “indiscriminate use of an exploit in the wild.” The NCC tweet referred to an earlier version of the SonicWall advisory that said its researchers had “identified a coordinated attack on its internal systems by highly sophisticated threat actors exploiting probable zero-day vulnerabilities on certain SonicWall secure remote access products.”

In an email, an NCC Group spokeswoman wrote: “Our team has observed signs of an attempted exploitation of a vulnerability that affects the SonicWall SMA 100 series devices. We are working closely with SonicWall to investigate this in more depth.”

In Monday’s update, SonicWall representatives said the company’s engineering team confirmed the submission by NCC Group included a “critical zero-day” in the SMA 100 series 10.x code. SonicWall is tracking it as SNWLID-2021-0001. The SMA 100 series is a line of secure remote access appliances.

The disclosure makes SonicWall at least the fifth large company to report in recent weeks that it was targeted by sophisticated hackers. Other companies include network management tool provider SolarWinds, Microsoft, FireEye, and Malwarebytes. CrowdStrike also reported being targeted but said the attack wasn’t successful.

Neither SonicWall nor NCC Group said that the hack involving the SonicWall zeroday was linked to the larger SolarWinds hack campaign. Based on the timing of the disclosure and some of the details in it, however, there is widespread speculation that the two are connected.

NCC Group has declined to provide additional details before the zeroday is fixed to prevent the flaw from being exploited further.

People who use SonicWall’s SMA 100 series should read the company’s advisory carefully and follow stopgap instructions for securing products before a fix is released. Chief among them:

1. If you must continue operation of the SMA 100 Series appliance until a patch is available
   • Enable MFA.  This is a *CRITICAL* step until the patch is available.
   • Reset user passwords for accounts that utilized the SMA 100 series with 10.X firmware
2. If the SMA 100 series (10.x) is behind a firewall, block all access to the SMA 100 on the firewall;
3. Shut down the SMA 100 series device (10.x) until a patch is available; or
4. Load firmware version 9.x after a factory default settings reboot. *Please back up your 10.x settings*
   • Important Note: Direct downgrade of Firmware 10.x to 9.x with settings intact is not supported.  You must first reboot the device with factory defaults and then either load a backed up 9.x configuration or reconfigure the SMA 100 from scratch.
   • Ensure that you follow multifactor authentication (MFA) best practice security guidance if you choose to install 9.x.
     SonicWall firewalls and SMA 1000 series appliances, as well as all respective VPN clients, are unaffected and remain safe to use.

This post was updated to correct the description of the SMA 100.

https://arstechnica.com/?p=1738904

Google researchers have detailed a sophisticated hacking operation that exploited vulnerabilities in Chrome and Windows to install malware on Android and Windows devices.

Some of the exploits were zero-days, meaning they targeted vulnerabilities that at the time were unknown to Google, Microsoft, and most outside researchers (both companies have since patched the security flaws). The hackers delivered the exploits through watering-hole attacks, which compromise sites frequented by the targets of interest and lace the sites with code that installs malware on visitors’ devices. The boobytrapped sites made use of two exploit servers, one for Windows users and the other for users of Android.

Not your average hackers

The use of zero-days and complex infrastructure isn’t in itself a sign of sophistication, but it does show above-average skill by a professional team of hackers. Combined with the robustness of the attack code—which chained together multiple exploits in an efficient manner—the campaign demonstrates it was carried out by a “highly sophisticated actor.”

“These exploit chains are designed for efficiency & flexibility through their modularity,” a researcher with Google’s Project Zero exploit research team wrote. “They are well-engineered, complex code with a variety of novel exploitation methods, mature logging, sophisticated and calculated post-exploitation techniques, and high volumes of anti-analysis and targeting checks. We believe that teams of experts have designed and developed these exploit chains.”

The modularity of the payloads, the interchangeable exploit chains, and the logging, targeting, and maturity of the operation also set the campaign apart, the researcher said.

The four zero-days exploited were:

• CVE-2020-6418—Chrome Vulnerability in TurboFan (fixed February 2020)
• CVE-2020-0938—Font Vulnerability on Windows (fixed April 2020)
• CVE-2020-1020—Font Vulnerability on Windows (fixed April 2020)
• CVE-2020-1027—Windows CSRSS Vulnerability (fixed April 2020)

The attackers obtained remote code execution by exploiting the Chrome zero-day and several recently patched Chrome vulnerabilities. All of the zero-days were used against Windows users. None of the attack chains targeting Android devices exploited zero-days, but the Project Zero researchers said it’s likely the attackers had Android zero-days at their disposal.

The diagram below provides a visual overview of the the campaign, which occurred in the first quarter of last year:

In all, Project Zero published six installments detailing the exploits and post-exploit payloads the researchers found. Other parts outline a Chrome infinity bug, the Chrome exploits, the Android exploits, the post-Android exploitation payloads, and the Windows exploits.

The intention of the series is to assist the security community at large in more effectively combating complex malware operations. “We hope this blog post series provides others with an in-depth look at exploitation from a real-world, mature, and presumably well-resourced actor,” Project Zero researchers wrote.

https://arstechnica.com/?p=1734975

Hackers are attempting to exploit a recently discovered backdoor built into multiple Zyxel device models that hundreds of thousands of individuals and businesses use as VPNs, firewalls, and wireless access points.

The backdoor comes in the form of an undocumented user account with full administrative rights that’s hardcoded into the device firmware, a researcher from Netherlands-based security firm Eye Control recently reported. The account, which uses the username zyfwp, can be accessed over either SSH or through a Web interface.

A serious vulnerability

The researcher warned that the account put users at considerable risk, particularly if it were used to exploit other vulnerabilities such as Zerologon, a critical Windows flaw that allows attackers to instantly become all-powerful network administrators.

“As the zyfwp user has admin privileges, this is a serious vulnerability,” Eye Control researcher Niels Teusink wrote. “An attacker could completely compromise the confidentiality, integrity and availability of the device. Someone could for example change firewall settings to allow or block certain traffic. They could also intercept traffic or create VPN accounts to gain access to the network behind the device. Combined with a vulnerability like Zerologon this could be devastating to small and medium businesses.”

Andrew Morris, founder and CEO of security firm GreyNoise, said on Monday that his company’s sensors have detected automated attacks that are using the account credentials in an attempt to log in to vulnerable devices. In most or all of the login attempts, the attackers have simply added the credentials to existing lists of default username/password combinations used to hack into unsecured routers and other types of devices.

“By definition, anything we’re seeing has to be opportunistic,” Morris said, meaning the attackers are using the credentials against IP addresses in a pseudorandom manner in hopes of finding connected devices that are susceptible to takeover. GreyNoise deploys collection sensors in hundreds of data centers worldwide to monitor Internetwide scanning and exploitation attempts.

The login attempts GreyNoise is seeing are happening over SSH connections, but Eye Control researcher Teusink said the undocumented account can also be accessed using a Web interface. The researcher said that a recent scan showed that more than 100,000 Zyxel devices have exposed the Web interface to the Internet.

Teusink said the backdoor appears to have been introduced in firmware version 4.39, which was released a few weeks ago. A scan of Zyxel devices in the Netherlands showed that about 10 percent of them were running that vulnerable version. Zyxel has issued a security advisory noting the specific device models that are affected. They include:

Firewalls

• ATP series running firmware ZLD V4.60
• USG series running firmware ZLD V4.60 ZLD
• USG FLEX series running firmware ZLD V4.60
• VPN series running firmware ZLD V4.60

AP controllers

• NXC2500 running firmware V6.00 through V6.10
• NXC5500 running firmware V6.00 through V6.10

For firewall models, a fix is already available. AP controllers, meanwhile, are scheduled to receive a fix on Friday. Zyxel said it designed the backdoor to deliver automatic firmware updates to connected access points over FTP.

People who use one of these affected devices should be sure to install a security fix as soon as it becomes available. Even when devices are running a version predating 4.6, users should still install the update, since it fixes separate vulnerabilities found in earlier releases. Disabling remote administration is also a good idea unless there is a good reason for allowing it.

https://arstechnica.com/?p=1732882