Dec 17 2021

Flaws in Lenovo laptops allow escalating to admin privileges

Category: Access Control,Endpoint security — DISC @ 10:47 am
Flaws in Lenovo laptops allow escalating to admin privileges

The ImControllerService service of Lenovo laptops is affected by a privilege elevation bug that can allow to execute commands with admin privileges.

Lenovo laptops, including ThinkPad and Yoga families, are affected by a privilege elevation issues that resides in the ImControllerService service allowing attackers to execute commands with admin privileges.

The vulnerabilities, tracked as CVE-2021-3922 and CVE-2021-3969, are a race condition vulnerability and a Time of Check Time of Use (TOCTOU) vulnerability respectively.

The flaws affect the ImControllerService service (“System Interface Foundation Service”) of all Lenovo System Interface Foundation versions below 1.1.20.3.

The Lenovo System Interface Foundation Service provides interfaces for multiple features, including system power management, system optimization, driver and application updates, for this reason it is not recommended to disable it.

The vulnerability was reported to Lenovo by researchers at NCC Group on October 29, 2021, and the vendor addressed it with the release of security updates on November 17, 2021. This week the company publicly disclosed the vulnerability.

“The following vulnerabilities were reported in the IMController component of Lenovo System Interface Foundation used by Lenovo Vantage.” reads the advisory published by the company.

“CVE-2021-3922: A race condition vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, that could allow a local attacker to connect and interact with the IMController child process’ named pipe.

CVE-2021-3969: A Time of Check Time of Use (TOCTOU) vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, that could allow a local attacker to elevate privileges.”

According to NCC Group, the ImController service comes installed on certain Lenovo devices, it runs as the SYSTEM user and periodically executes child processes that perform system configuration and maintenance tasks.

An attacker can exploit the vulnerabilities to elevate its privileges to SYSTEM and take over the vulnerable device.

The vulnerability resides in the way the ImControllerService handles the execution of highly privileged child processes which allows an unprivileged attacker with local access to the system to elevate their privileges.

The flawed vulnerable component periodically starts child processes to perform tasks and each of them opens a named pipe server to which any user on the system can connect.

“The parent process establishes a connection to the child’s server as soon as possible in order to send XML serialised commands over the named pipe. The child does not validate the source of the connection and parses the XML serialized commands. One of the commands that the parent process can send instructs the child to load a ‘plugin’ from an arbitrary location on the filesystem. The child process validates the digital signature of the plugin DLL file before loading the file into its address space and yielding execution to it.” reads the post published by NCC Group. “Successful exploitation of two vulnerabilities required to get the child to load a payload of the attacker’s choosing.”

The researchers noticed that the child process does not validate the source of the connection, this means it will begin accepting commands from the attacker using high-performance filesystem synchronization routines after the race condition has been exploited.

NCC Group researchers developed a proof of concept code that never failed to connect to the named pipe before the parent service could do so.

The second issue, the time-of-check to time-of-use (TOCTOU) vulnerability, is exploited to stall the loading process and replace the validated plugin with a malicious DLL file. The DLL is executed with high privileges.

Privilege Escalation Techniques: Learn the art of exploiting Windows and Linux systems

Privilege Escalation Techniques

System Security Threats

Tags: admin privileges, Lenovo laptops, Privilege Escalation Techniques

Dec 16 2021

Active scanning for Apache Log4j 2

Category: Log Management,Log4j,Security vulnerabilities — DISC @ 3:56 pm

Active-scanning-for-Apache-Log4j-2-1Download

Tags: Apache Log4j 2

Dec 16 2021

Apple security updates are out – and not a Log4Shell mention in sight

Category: Log4j,Security patching,Security vulnerabilities — DISC @ 10:26 am
Apple security updates are out – and not a Log4Shell mention in sight

Amongst all the brouhaha about Log4Shell, it’s easy to forget all the other updates that surround us.

Not only is it Patch Tuesday (keep your eye on our sister site news.sophos.com for the latest on that score later in the day)…

…but it’s also time to check your Apple devices, because Apple just pushed out a slew of its they-arrive-when-they’re-ready-and-don’t-expect-any-warning security patches.

The updated versions you’re looking for are:

As for iOS 14 and iOS 12, which are the official previous and pre-previous iPhone operating systems (in the same way that Big Sur and Catalina are the previous incarnations of macOS), there’s no sign of any updates for them.

Observant readers will notice that the URLs in the list above form an unbroken numeric sequence except for a gap at HT212977, so whether that’s a space left open for a delayed update for iOS 14 or not we can’t tell you…

…but we did notice that Apple’s main security noticeboard page, HT201222, still [2021-12-14T12:00Z] doesn’t mention the updates listed above.

In the past, we’ve noticed an apparent correlation between delayed updates for individual platforms and delayed listings on HT201222, but we have no idea whether that is coincidence rather that true correlation, or a desire on Apple’s part to hold off updating the central listing until all the new versions can be displayed in one go.

(Apple, as you know, has an official policy of saying as little as possible about updates and update cycles, so we shall have to wait and see.)

What about Log4Shell?

Apple Device Management

MacOS and iOS Internals

Tags: Apple Device Management, Apple security updates

Dec 16 2021

While attackers begin exploiting a second Log4j flaw, a third one emerges

Category: App Security,Log4j,Security vulnerabilities — DISC @ 9:54 am
While attackers begin exploiting a second Log4j flaw, a third one emerges

Experts warn that threat actors are actively attempting to exploit a second bug disclosed in the popular Log4j logging library.

American web infrastructure and website security company Cloudflare warns that threat actors are actively attempting to exploit a second vulnerability, tracked as CVE-2021-45046, disclosed in the Log4j library.

The CVE-2021-45046 received a CVSS score of 3.7 and affects Log4j versions from 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 (which was released to fix CVE-2021-44228).

The Apache Software Foundation (ASF) has already released a patch for the Log4Shell vulnerability (CVE-2021-44228), but this fix partially address the flaw in certain non-default configurations. An attacker with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) can craft malicious input data using a JNDI Lookup pattern triggering a denial of service (DOS) condition.

Both issues were assessed with the release of Log4j 2.16.0 version that addresses the CVE-2021-45046 by removing support for message lookup patterns and disabling JNDI functionality by default.

“Hot on the heels of CVE-2021-44228 a second Log4J CVE has been filed CVE-2021-45046. The rules that we previously released for CVE-2021-44228 give the same level of protection for this new CVE.” states CloudFlare.”This vulnerability is actively being exploited and anyone using Log4J should update to version 2.16.0 as soon as possible, even if you have previously updated to 2.15.0. The latest version can be found on the Log4J download page.”

The bad news are not ended, because researchers at security firm Praetorian warned of a third security vulnerability the Log4j version 2.15.0 that was released to fix the initial Log4Shell.

This third vulnerability can be exploited by attackers to exfiltrate sensitive data in certain circumstances.

“However, in our research we have demonstrated that 2.15.0 can still allow for exfiltration of sensitive data in certain circumstances. We have passed technical details of the issue to the Apache Foundation, but in the interim, we strongly recommend that customers upgrade to 2.16.0 as quickly as possible.” states the post published by Praetorian.

This image has an empty alt attribute; its file name is image-13.png

Secure By Design

Secure Software Development Fundamentals Professional Certificate

Tags: Log4j, Log4shell, Secure By Design

Dec 15 2021

Log4Shell: A new fix, details of active attacks, and risk mitigation recommendations

Category: Log4j,Security vulnerabilities — DISC @ 1:22 pm
Log4Shell: A new fix, details of active attacks, and risk mitigation recommendations

New versions of Log4j

The recent discovery of a second Log4j vulnerability (CVE-2021-45046) has shown that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations.

This vulnerability could allow attackers to craft malicious input data using a JNDI Lookup pattern, resulting in a denial of service (DoS) attack.

“Note that previous mitigations involving configuration such as to set the system property ‘log4j2.noFormatMsgLookup’ to ‘true’ do NOT mitigate this specific vulnerability,” the Apache Log4j security team noted.

“Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default. This issue can be mitigated in prior releases (<2.16.0) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).” The team advises users either to upgrade to version 2.12.2 (for Java 7) or 2.16.0 (for Java 8 or later), in which the Message Lookups feature has been removed and access to JNDI has been disabled by default, and explained why some of the mitigation measures shared a few days ago are incomplete.

Active exploitation

PoCs are constantly popping up on GitHub and getting forked. GitHub is steadily working on removing them, but the proverbial cat is now out of the bag, and there is no going back.

Exploitation attempts detected so far in the wild can be tied to ransomware groups and access brokers, botnet herders (delivering coin miners), and nation-backed APTs.

“The way modern products are built is using a big hierarchy of dependencies, where developers use libraries written by third-party companies and engineers to speed up the software release process. Log4J is an extremely basic library that allows log writing in Java applications. The way CVE-2021-44228 affects comes in 3 layers – cloud products that directly use the Log4J, web applications that use libraries that use Log4J, and off-the-shelf software which is internally deployed on customer servers and endpoints,” says Michael Assraf, CEO at Vicarius.

“As fixing and deploying cloud applications can be fast, updating libraries that use Log4J can break functionality unless done with caution. The most problematic fixes are internally deployed software, which will have to wait for a vendor update or a security patch, in that scenario customers are advised to wait on further vendor guidance and as of right now are helpless in reacting. Examples include: Elasticsearch, Intellij IDE, Jira Confluence, Apache Tomcat, Minecraft, Apache Hadoop, Eclipse IDE, and many more.”

Gallagher says that the most immediate priority for defenders is to reduce exposure by patching and mitigating all corners of their infrastructure and investigate exposed and potentially compromised systems.

“Where systems have been identified as vulnerable, defenders should run an incident response process and monitor for signs of remote access trojans such as C2 call-backs. Secrets stored on exposed systems should also be rotated, particularly if they are exposed in environment variables. Lastly, consider critical third party vendors who may also be at risk,” he advised.

Mathew Eble, VP of Services at Praetorian, also warned the issue will be prone to false negatives.

“Externally there is no way to cover all the possible paths that exploitation can take. Even when external scanning tools get more sophisticated in how they identify the issue, we strongly advocate not relying on scan results as strong indicator of your risk,” he noted.

This recommendation is based on four issues the company has confirmed when working with customers. Based on this, they have expanded their initial recommendations for defenders.

Log4Shell mitigation

Secure By Design

Secure Software Development Fundamentals Professional Certificate

Tags: Log4j, Log4shell, Secure By Design

Dec 14 2021

Here We Go Again: Second Log4j Flaw Surfaces

Category: Log Management,Log4j,Security logs — DISC @ 11:03 pm
Here We Go Again: Second Log4j Flaw Surfaces

Maybe Log4j vulnerabilities are like rats—for every one that’s visible, multiple others scurry beneath the surface. It’s too early to tell if that’s what will happen with Log4j.

But just a day or so after a damaging vulnerability was disclosed, another has come to light. This time it’s believed to be moderate in severity.

“A second vulnerability involving Apache Log4j was found on Tuesday,” according to a MITRE alert. “The description on the new CVE 2021-45046 said the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was ‘incomplete in certain non-default configurations.’”

“When a vulnerability is discovered and makes as much noise as Log4Shell, it invariably signals that there are additional vulnerabilities in the same software or fixes for that software and that triggers additional research and discovery,” said Casey Ellis, founder and CTO at Bugcrowd.

“The technique of abusing JNDI lookups with user-generated data has been around for years,” agreed Davis McCarthy, principal security researcher at Valtix. “With the attention CVE-2021-44228 has received, I wouldn’t be surprised if we saw a third CVE related to Log4j2.”

Ellis pointed out that “in this case, the initial fix provided was developed in a way that mitigated the exploitable symptom, but didn’t properly address the root cause.”

Indeed, Apache said the fix addressing “CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations,” according to the alert. “This could allow attackers with control over thread context map (MDC) input data when the logging configuration uses a non-default pattern layout with either a context lookup (for example, $${ctx:loginId}) or a thread context map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI lookup pattern resulting in a denial-of-service (DOS) attack.”

The alert said, “Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default.” But previous mitigations that involve “configuration such as to set the system property `log4j2.noFormatMsgLookup` to `true` do not mitigate this specific vulnerability,” MITRE warned. “Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default. This issue can be mitigated in prior releases (<2.16.0) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).”

Ellis said the situation “also highlights the dangerous dependency open source users have on libraries which power large portions of the Internet but are ultimately written and maintained by unfunded volunteers with limited available time.” He gave credit to “ the Log4j maintainers” who he said likely “had an even busier and more stressful week than those in cybersecurity and are working on fixing and improving Log4j’s resilience as quickly as they can.”

Incomplete fixes are often a result of rushing patches to fix vulnerabilities, noted John Bambenek, principal threat hunter at Netenrich. The solution, he said, “is to disable JNDI functionality entirely (which is the default behavior in the latest version).”

Since “at least a dozen groups are using these vulnerabilities,” immediate action should then be taken “to either patch, remove JNDI or take it out of the classpath—preferably all of the above,” said Bambenek.

Manu Singh, risk engineer at Cowbell Cyber, sees an opportunity to show “a real-life use case where cyberinsurers can step up and help businesses.”

Singh said that Cowbell Cyber notified its policyholders of the vulnerabilities. “And our risk engineering team is available to help,” said Singh. “This is crucial in the small and mid-size market where security and IT resources are limited.”

Log4j Breach Discovery Takes 197 Days

LOG4SHELL REPORT

CISA adds Log4Shell Log4j flaw to the Known Exploited Vulnerabilities Catalog

Tags: Log4j, Log4shell

Dec 14 2021

Modern cars: A growing bundle of security vulnerabilities

Category: OT/ICS,Scada Security — DISC @ 9:55 am
Modern cars: A growing bundle of security vulnerabilities
Cars are becoming increasingly smart and an extension to our mobile phones. How is this impacting users’ security and privacy?

With the expansion of our technology in use, our vulnerability surface increases dramatically. Ultimately, this is yet another vulnerability to keep in mind for your own safety and security. As we grow in our technology and dependence thereon, that inherently expands the opportunity for bad actors to take advantage of the dependence. The difference with car vulnerability, however, is you’re not just talking about your personal data being compromised, but rather the influence over your car while driving could affect your immediate physical safety.

In terms of privacy, the onboard computers of used, rented, or crashed/totaled vehicles can contain sensitive residual data from previous drivers such as contact and calendar details, unencrypted videos, and more.

What are the biggest vulnerabilities of today’s modern cars?

The lack of one single “gate keeper” is a substantial issue when it comes to modern car vulnerability. The patchwork of various technologies being meshed together for the overall car means not only is there not one single overseer of that technology but also that protocols are set without security in mind because they need to be able to easily communicate with each other.

In addition, we see the same vulnerabilities that you have with your phones and computers: protocol vulnerability. The difference is what the bad actors could have access to: electronic control units (ECUs) which all communicate to access and control the subsystems in a car such as your braking or navigation system. Not only could the hacker access the vehicle information resulting in influence on the car such as the alert systems within the vehicle, but could also access personal information such as home addresses or phone IPs.

What are the techniques hackers could use to compromise a car?

Hacking Connected Cars: Tactics, Techniques, and Procedures

Tags: cars security, Hacking Connected Cars

Dec 14 2021

Google fixed the 17th zero-day in Chrome since the start of the year

Category: App Security,Web Security — DISC @ 9:25 am
Google fixed the 17th zero-day in Chrome since the start of the year

Google released security updates to address five vulnerabilities in the Chrome web browser, including a high-severity zero-day flaw, tracked as CVE-2021-4102, exploited in the wild.

The CVE-2021-4102 flaw is a use-after-free issue in the V8 JavaScript and WebAssembly engine, its exploitation could lead to the execution of arbitrary code or data corruption.

“Google is aware of reports that an exploit for CVE-2021-4102 exists in the wild.” reads the advisory published by Google which did not share additional info regarding these attacks.

The vulnerability was reported by an anonymous researcher on 2021-12-09.

Google has already addressed 17 zero-day vulnerabilities in Chrome this year, below is the full list:

Be sure to update your Chrome install to the latest 96.0.4664.110 version for Windows, Mac, and Linux.

The other issues fixed by Google with the latest release are:

[$NA][1263457] Critical CVE-2021-4098: Insufficient data validation in Mojo. Reported by Sergei Glazunov of Google Project Zero on 2021-10-26

[$5000][1270658] High CVE-2021-4099: Use after free in Swiftshader. Reported by Aki Helin of Solita on 2021-11-16

[$5000][1272068] High CVE-2021-4100: Object lifecycle issue in ANGLE. Reported by Aki Helin of Solita on 2021-11-19

[$TBD][1262080] High CVE-2021-4101: Heap buffer overflow in Swiftshader. Reported by Abraruddin Khan and Omair  on 2021-10-21

The Browser Hacker’s Handbook 

Tags: Chrome, Google, The Browser Hacker's Handbook, zero-day

Dec 13 2021

A JOURNEY FROM JNDI/LDAP MANIPULATION TO REMOTE CODE EXECUTION DREAM LAND PRESO

Category: Remote code — DISC @ 3:32 pm

Sandboxing remote code execution in the distributed system RCE: Sandbox based on Java and OSGi

Tags: Remote Code Execution

Dec 13 2021

Best Practice for Mitre Att&ck Mapping

Category: Attack Matrix — DISC @ 11:05 am

Best-Practice-for-Mitre-Attack-mapping-1Download

DeTT&CT: Mapping your Blue Team to MITRE ATT&CK™ — MB Secure

MITRE ATT&CK for dummies

How to Improve Threat Detection and Hunting in the AWS Cloud Using the MITRE ATT&CK® Matrix

Tags: Mitre Att&ck Mapping

Dec 13 2021

Hacking tools cheat sheet

Category: Cheat Sheet,Hacking,Security Tools — DISC @ 10:35 am

Hacking-tools-cheat-sheet-1Download

Tags: Hacking tools cheat sheet

Dec 13 2021

Microsoft vulnerabilities have grave implications for organizations of all sizes

Category: Security vulnerabilities — DISC @ 10:02 am
Microsoft vulnerabilities have grave implications for organizations of all sizes

Over 1 million companies worldwide and over 731,000 companies in the U.S. use Office 365, and though Microsoft offers no hard stats, some sources suggest there are over 90,000 Microsoft partners facilitating services and products for clients. It’s no wonder, then, that vulnerabilities in Microsoft solutions are an attractive attack vector.

So far in 2021, the 12 most notable critical Microsoft vulnerabilities fall within five major threat categories:

Tags: Microsoft vulnerabilities

Dec 13 2021

CISA adds Log4Shell Log4j flaw to the Known Exploited Vulnerabilities Catalog

Category: Log4j,Security vulnerabilities,Web Security — DISC @ 9:53 am
CISA adds Log4Shell Log4j flaw to the Known Exploited Vulnerabilities Catalog

CISA adds Log4Shell Log4j flaw to the Known Exploited Vulnerabilities Catalog

The U.S. CISA added 13 new vulnerabilities to the Known Exploited Vulnerabilities Catalog, including Apache Log4Shell Log4j and Fortinet FortiOS issues.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added 13 new vulnerabilities to the Known Exploited Vulnerabilities Catalog, including recently disclosed Apache Log4Shell Log4j and Fortinet FortiOS flaws.

Below is the list of new vulnerabilities added to the Known Exploited Vulnerabilities Catalog, which is the list of issues frequently used as attack vector by threat actors in the wild and that pose significant risk to the federal enterprise.

CVE NumberCVE TitleRemediation Due Date
CVE-2021-44228Apache Log4j2 Remote Code Execution Vulnerability12/24/2021
CVE-2021-44515Zoho Corp. Desktop Central Authentication Bypass Vulnerability12/24/2021
CVE-2021-44168Fortinet FortiOS Arbitrary File Download Vulnerability12/24/2021
CVE-2021-35394Realtek Jungle SDK Remote Code Execution Vulnerability12/24/2021
CVE-2020-8816Pi-Hole AdminLTE Remote Code Execution Vulnerability6/10/2022
CVE-2020-17463Fuel CMS SQL Injection Vulnerability6/10/2022
CVE-2019-7238Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability6/10/2022
CVE-2019-13272Linux Kernel Improper Privilege Management Vulnerability6/10/2022
CVE-2019-10758MongoDB mongo-express Remote Code Execution Vulnerability6/10/2022
CVE-2019-0193Apache Solr DataImportHandler Code Injection Vulnerability6/10/2022
CVE-2017-17562Embedthis GoAhead Remote Code Execution Vulnerability6/10/2022
CVE-2017-12149Red Hat Jboss Application Server Remote Code Execution Vulnerability6/10/2022
CVE-2010-1871Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability6/10/2022

The CVE-2021-44228 flaw made the headlines last week, after Chinese security researcher p0rz9 publicly disclosed a Proof-of-concept exploit for the critical remote code execution zero-day vulnerability (aka Log4Shell) that affects the Apache Log4j Java-based logging library.

The impact of the issue is devastating, thousands of organizations worldwide are potentially exposed to attacks and security experts are already reported exploitation attempts in the wild.

CISA also warns of a recently disclosed arbitrary file download vulnerability in FortiOS, tracked as CVE-2021-44168, that is actively exploited.

“A download of code without integrity check vulnerability [CWE-494] in the “execute restore src-vis” command of FortiOS may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.” reads the advisory published by Fortinet. “Fortinet is aware of an instance where this vulnerability was abused and recommends immediately validating your systems for indicators of compromise”

Log4Shell update: Attack surface, attacks in the wild, mitigation and remediation

Log4Shell explained – how it works, why you need to know, and how to fix it

Tags: CISA, Log4j, Log4shell

Dec 12 2021

LOG4SHELL REPORT

Category: Security Risk Assessment,Security vulnerabilities — DISC @ 9:06 am

VULNERABILITY ASSESSMENT AND MITIGATION

Download Log4Shell report – VULNERABILITY ASSESSMENT AND MITIGATION

How the role of open-source maintainers could be professionalized, as the maintainer who fixed the log4j zero-day says he works on the project in his spare time — Open Source software runs the Internet, and by extension the economy. This is an undisputed fact about reality in 2021.

New zero-day exploit for Log4j Java library is an enterprise nightmare

Software Security: Building Security

This books explains how to introduce the security into the SDLC; how to introduce abuse cases and security requirements in the requirements phase; and how to introduce risk analysis (also known as Threat Modeling) in the design phase and software qualification phase. I really think that each software developer should at least read the first chapter of the book where the authors explain why the old way of securing applications (seeing software applications as “black boxes” that can be protected using firewalls and IDS/IPS) cannot work anymore in today’s software landscape. 

Tags: LOG4SHELL REPORT

Dec 11 2021

Cybereason released Logout4Shell, a vaccine for Log4Shell Apache Log4j RCE

Category: Cyber Threats,Cyberweapons,Web Security — DISC @ 12:48 pm
Cybereason released Logout4Shell, a vaccine for Log4Shell Apache Log4j RCE

Chinese security researcher p0rz9 publicly disclosed a Proof-of-concept exploit for a critical remote code execution zero-day vulnerability, tracked a CVE-2021-44228 (aka Log4Shell), in the Apache Log4j Java-based logging library.

The Log4j is widely used by both enterprise apps and cloud services, including Apple iCloud and Steam.

A remote, unauthenticated attacker can exploit the CVE-2021-44228 to execute arbitrary code on a vulnerable system leading to a complete system takeover.

The vulnerability was discovered by researchers from Alibaba Cloud’s security team that notified the Apache Foundation on November 24. According to the experts, the vulnerability is easy to exploit and does not require special configuration, for this reason, it received a CVSSv3 score of 10/10. Researchers pointed out that Apache Struts2, Apache Solr, Apache Druid, Apache Flink are all affected by this vulnerability.

Now researchers from cybersecurity firm Cybereason have released a script that works as a “vaccine”(dubbed Logout4Shell) that allows remotely mitigating the Log4Shell vulnerability by turning off the “trustURLCodebase” setting in vulnerable instances of the library.

“While the best mitigation against this vulnerability is to patch log4j to 2.15.0 and above, in Log4j version (>=2.10) this behavior can be mitigated by setting system property log4j2.formatMsgNoLookups to true or by removing the JndiLookup class from the classpath. Additionally, if the server has Java runtimes >= 8u121, then by default, the settings com.sun.jndi.rmi.object.trustURLCodebase and com.sun.jndi.cosnaming.object.trustURLCodebase are set to “false”, mitigating this risk. However, enabling these system property requires access to the vulnerable servers as well as a restart.” reads the GitHub Page set up for the Log4Shell project.

Cyberreson experts pointed out that enabling these system property requires access to the vulnerable servers, and the servers have to be restarted. 

A zero-day exploit for Log4j Java library could have a tsunami impact on IT giants

Defensive Security Handbook: Best Practices for Securing Infrastructure

Tags: Apache patch, Defensive Security, Log4j, Log4shell

Dec 10 2021

The Red Team Guide

Category: Information Security,Security Incident — DISC @ 12:54 pm
The Red Team Guide – by Peerlyst

Download a copy of The Red Team Guide

Rtfm: Red Team Field Manual

The Red Team Field Manual (RTFM) is a no fluff, but thorough reference guide for serious Red Team members who routinely find themselves on a mission without Google or the time to scan through a man page. The RTFM contains the basic syntax for commonly used Linux and Windows command line tools, but it also encapsulates unique use cases for powerful tools such as Python and Windows PowerShell. The RTFM will repeatedly save you time looking up the hard to remember Windows nuances such as Windows wmic and dsquery command line tools, key registry values, scheduled tasks syntax, startup locations and Windows scripting. More importantly, it should teach you some new red team techniques.

Download a copy of The Red Team Guide

Incident Response Management Foundation Training Course

Tags: Red team, Red Team Field Manual, Rtfm, The red team guide

Dec 10 2021

Best Tips on Cybersecurity for Students

Category: Cyber career — DISC @ 10:32 am
Best Tips on Cybersecurity for Students

There is a way to avoid cybersecurity threats, and that’s incorporating effective practices in your daily use of the internet. Here are a few best tips for improving cybersecurity.

  1. Use Strong and Varied Password

The “one password fits all platforms” philosophy is ideal for hackers. They only need to get a password to one network to access all of the others as well. To prevent this from happening, you need to set different passwords on all your accounts.

Memorizing all those passwords can be difficult, especially when you consider various platforms you use for studying. However, with password management apps, you won’t have to memorize them. In addition, you need to create a strong password. For a quick solution, you can use a strong random password generator.

  1. Give Your Data Only to Proven Websites

Random websites can ask for detailed personal information if you want to get access to more content or download something. This can be a threat.

Take extra precautions when using unknown platforms. Before you decide to sign up, read their privacy policy and do some research on the company. For example, if you’re looking for an essay writing company, you can first read the info on the best ones on a credible Top Writers Review website. Reviews, Google results, and privacy policies can help you get to know the website better.

  1. Don’t Download Attachments from Unknown Email Senders

Email phishing is among the most frequent types of cyberattacks. A simple email attachment such as a supposed e-book can be a gateway for malware or phishing attacks.

Whenever you get an email from an unknown recipient, don’t download the attachments. Even if the email seems legit, clarify first who the sender is and where they got your email before you download anything.

  1. Stay Away from Unprotected Public WiFi

An unsecured public WiFi gives free access to the network to anyone – including the criminals.

If you are on the same network, it’s easier for cybercriminals to leach onto your device and access everything you have. Even if just want to quickly connect to research document translation companies for your study abroad papers, hackers can get to your data before you finish.

In situations when you can’t avoid using public WiFi, use a VPN and be vigilant. Virtual Private Network or VPN will encrypt all your internet activity. You can download a VPN app on your phone with a few clicks.

  1. Use Platforms and Apps that Encrypt Data

Apps, platforms, and websites with encrypted data will keep your personal information and internet activity safe. Messaging apps with encryption are also more secure.

When browsing, pay attention to whether the websites with a padlock and “https” in their URL are encrypted. These types of websites won’t leak your data to unauthorized parties.

The privacy policy is yet another way of checking whether the app, platform or website is encrypted. For example, if you read in the policy that the site is covered by COPPA (Children’s Online Privacy Protection Act), it is secure. To ensure internet safety for its students, many educational institutions use apps and platforms covered by this act.

  1. Be Vary of URLs in Messages

You might not find anything peculiar about your friend, teacher, or well-known company sending you an URL. Especially if the message comes in the form of a text message or WhatsApp message. Unfortunately, this is one of the tricks of cybercriminals.

This type of attack is quite common. Clicking on the links can completely open the door to your data. So, if you receive a message with a suspicious URL, first inquire what it is about. When a company sends you such a message, go to their official website instead of clicking on the link.

Conclusion

These simple steps of precaution will help you keep your data safe. Being more careful of what actions you take, pages you trust, and how you dispose of your data is necessary. A few tips like these can do a lot for your internet security.

InfoSec Tools and training

InfoSec Books

Cybersecurity Career Master Plan

Tags: cyber security career, Cybersecurity Career Master Plan, infosec career, Tips on Cybersecurity

Dec 09 2021

ALPHV BlackCat – This year’s most sophisticated ransomware

Category: Ransomware — DISC @ 10:29 pm

Ransomware Protection Playbook

Tags: Ransomware Protection Playbook

Dec 09 2021

Kali Linux 2021.4 released: Wider Samba compatibility, The Social-Engineer Toolkit, new tools, and more!

Category: Information Security,Linux Security — DISC @ 10:40 am
Kali Linux 2021.4 released: Wider Samba compatibility, The Social-Engineer Toolkit, new tools, and more!

Samba Client, Kaboxer theme support

Starting Kali Linux 2021.4, the Samba client is now configured for Wide Compatibility so that it can connect to pretty much every Samba server out there, regardless of the version of the protocol in use. This change should make it easier to discover vulnerable Samba servers “out of the box”, without having to configure Kali.

With the latest update of Kaboxer tools no longer look out of place, as it brings support for window themes and icon themes. This allows the program to properly integrate with the rest of the desktop and avoids the usage of ugly fallback themes.

Here is a comparison of how zenmap looks with the default Kali Dark theme, compared to the old appearance:

Kali Linux 2021.4

New Tools in Kali Linux 2021.4

Here’s a quick run down of what’s been added (to the network repositories):

  • Dufflebag – Search exposed EBS volumes for secrets
  • Maryam – Open-source Intelligence (OSINT) Framework
  • Name-That-Hash – Do not know what type of hash it is? Name That Hash will name that hash type!
  • Proxmark3 – if you are into Proxmark3 and RFID hacking
  • Reverse Proxy Grapher – graphviz graph illustrating your reverse proxy flow
  • S3Scanner – Scan for open S3 buckets and dump the contents
  • Spraykatz – Credentials gathering tool automating remote procdump and parse of lsass process
  • truffleHog – Searches through git repositories for high entropy strings and secrets, digging deep into commit history
  • Web of trust grapher (wotmate) – reimplement the defunct PGP pathfinder without needing anything other than your own keyring

More on The Social-Engineer Toolkit

Kali Linux 2021.4 download

Tools and infosec training

Tags: Kali Linux, Kali Linux 2021.4

Dec 09 2021

Microsoft Vancouver leaking website credentials via overlooked DS_STORE file

Category: Web Security — DISC @ 9:36 am
Microsoft Vancouver leaking website credentials via overlooked DS_STORE file

The metadata stored on the file led the researchers to several WordPress database dumps, which contained multiple administrator usernames and email addresses, as well as the hashed password for the Microsoft Vancouver website.

Security researchers – us at CyberNews included – routinely use search engines that index publicly accessible Internet of Things (IoT) devices and web servers for threat intelligence. This helps us warn users and organizations that their data is being exposed and help them plug the leaks.

Back in September, while gathering intelligence on an IoT search engine, our security researchers stumbled upon a DS_STORE file that was apparently stored on a web server owned by Microsoft Vancouver.

Leaving DS_STORE files on remote web servers is dangerous because they display their folder structure, which may result in leaks of sensitive or confidential data. This is exactly what happened with the leftover DS_STORE file present on the Microsoft Vancouver web server.

“By analyzing the file, our Investigations team was able to learn about the files hosted on the Microsoft Vancouver server, as well as several database dump files stored on the server.“

These database dumps contained multiple administrator usernames and email addresses, as well as the hashed password for Microsoft Vancouver’s WordPress website.

According to the company’s website, Microsoft Vancouver is home to teams that work on developing a variety of Microsoft products, including “Notes, MSN, Gears of War, Skype, and mixed reality applications, both for desktop and HoloLens.”

On September 27, CyberNews researchers reached out to Microsoft Canada via their official contact email in order to report their findings and help secure the exposed file.

Unfortunately, we did not hear back from the company right away. Even though warnings from security researchers can sometimes get overlooked by large organizations, several additional emails are usually enough to break through and reach the eyes of security teams. As such, we made multiple additional attempts at contacting Microsoft via customer support email addresses and phone numbers listed on the company’s official websites.

On December 2, public access to the DS_STORE file was finally disabled and it is no longer leaking sensitive data. After the file was secured, we reached out to Microsoft for additional comment regarding the incident but have yet to hear back.

What’s in the file?

Exploitation and Countermeasures for Modern Web Applications

Tags: Web Application Security, website credentials

« Previous Page — Next Page »