Cyber News Roundup for September 13, 2024

/by

Recent cybersecurity updates include the National Vulnerability Database (NVD) struggling with a critical backlog, which hampers its effectiveness in vulnerability analysis. SonicWall is dealing with a significant access control vulnerability (CVE-2024-40766) in SonicOS, currently exploited in the wild. Avis has disclosed a breach affecting nearly 300,000 customers. On a positive note, Google Cloud has introduced new air-gapped backup vaults to boost ransomware protection, and MasterCard is set to acquire Recorded Future for $2.65 billion.

Read these stories and more in today’s Cyber News Roundup.

 

The Fall of the National Vulnerability Database

The National Vulnerability Database (NVD) has experienced a significant slowdown, leaving thousands of vulnerabilities without analysis, which is critical for identifying risks. This has raised concerns in the cybersecurity community, especially as many organizations and government contractors rely on NVD for vulnerability management. The issues stem from a backlog, underfunding, and challenges in handling the increasing volume of CVEs. While alternatives like Open Source Vulnerabilities (OSV) exist, NVD remains essential for many, especially under federal requirements​. (Darkreading)

 

SonicWall vulnerability exploited in the wild

A recently patched access control vulnerability (CVE-2024-40766) affecting SonicWall’s SonicOS is being exploited in the wild, BleepingComputer reports. The vulnerability affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions. SonicWall urges customers to apply the patch as soon as possible. The company adds, “SonicWall strongly advises that customers using GEN5 and GEN6 firewalls with SSLVPN users who have locally managed accounts immediately update their passwords to enhance security and prevent unauthorized access. Users can change their passwords if the ‘User must change password’ option is enabled on their account. Administrators must manually enable the ‘User must change password’ option for each local account to ensure this critical security measure is enforced.” (Bleepingcomputer)

 

Car rental company Avis discloses data breach

According to notification letters sent to customers on Wednesday and filed with California’s Office of the Attorney General, the breach, which was discovered last Thursday, saw the unknown threat actor having access to its business applications from August 3 until August 6, resulting in the theft of “some customers’ personal information, including their names and other undisclosed sensitive data.” This is a developing story. (BleepingComputer)

 

Wisconsin Medicare users had information leaked in MOVEit breach

More fallout from the MOVEIt breach of last year: “the Centers for Medicare & Medicaid Services (CMS), which is a federal agency that manages the Medicare program, as well as the Wisconsin Physicians Service Insurance Corporation (WPS) said on Friday that they have begun notifying people whose personal information leaked after hackers exploited a vulnerability in the MOVEit software.” The discovery follows a second investigation into the breach conducted by WPS in May, after receiving “new information” about the breach. (The Record)

 

1.7 million impacted in payment processing breach

In an ironic twist, payment gateway provider Slim CD says they’ve swiftly initiated an investigation into a breach affecting around 1.7 million individuals. While the company claims to be moving quickly to address the issue, the breach actually occurred in August 2023 but went undetected until almost a year later in June 2024. Information exposed in the attack includes names, physical addresses, credit card numbers, and payment card expiration dates. Despite the impact, Slim CD has not offered any free identity theft protection services to those affected, instead advising individuals to stay vigilant and order a free credit report. (Bleeping Computer), (The Register)

 

Avis breach impacts almost 300,000 customers

An update to a story we first brought to you on Monday: Car rental company Avis is now reporting that a breach discovered last week has impacted over 299,000 of its customers, which, according to Bleeping Computer, is less than 1% of the company’s customer base. The threat actor was able to access business applications last month and stole personal information, including names and other undisclosed data. (Bleeping Computer)

 

New RaaS operation is recruiting criminal affiliates

Palo Alto Networks’ Unit 42 has published a report on Repellent Scorpius, a ransomware-as-a-service operation that surfaced in May 2024. The group distributes the Cicada3301 ransomware and conducts double-extortion attacks by exfiltrating data before deploying the ransomware. The researchers state, “Unit 42 has evidence to suggest that the Repellent Scorpius operators have developed a RaaS affiliate program. It operates a control panel for affiliates and ransom payment pages for victims, and actively recruits initial access brokers (IAB) and network intruders on Russian-language cybercrime forums.” (PalloAlto)

 

Earth Preta deploys new malware in the Asia-Pacific

Trend Micro is tracking new variants of malware used by the China-aligned threat actor Earth Preta (also known as “Mustang Panda”). The threat actor is using spearphishing emails and removable drives to deploy malware against government entities in the Asia-Pacific region. Trend Micro states, “Earth Preta employed a variant of the worm HIUPAN to propagate PUBLOAD into their targets’ networks via removable drives. PUBLOAD was used as the main control tool for most of the campaign and to perform various tasks, including the execution of tools such as RAR for collection and curl for data exfiltration. PUBLOAD was also used to introduce supplemental tools into the targets’ environment, such as FDMTP to serve as a secondary control tool, which was observed to perform similar tasks as that of PUBLOAD; and PTSOCKET, a tool used as an alternative exfiltration option.” (Trendmicro)

 

Slim CD notifies 1.7M customers of data breach

Electronic payment firm, ESlim CD, has notified nearly 1.7 million credit card holders that their data may have been stolen after an attacker accessed their systems between August 17, 2023, and June 15, 2024. A third party investigation uncovered the incident on June 15. Slim CD said it reviewed its data privacy and security policies and implemented additional safeguards following the incident. KnowBe4 awareness advocate, James McQuiggan said, “When organizations realize that cybercriminals are inside their network for long periods, there is a gap with continuous security monitoring. Accompanied by a robust Security Incident Management (SIEM) system integrated with threat intelligence, the breach could have been detected sooner.” (SC Media)

 

Google Cloud introduces air-gapped backup vaults

Google Cloud has introduced air-gapped backup vaults as part of its enhanced Backup and Disaster Recovery (DR) service, now available in preview. These vaults provide robust protection against ransomware and unauthorized data manipulation by creating immutable and indelible backups, preventing modification or deletion until a set retention period elapses. Isolated from the customer’s Google Cloud project, these air-gapped vaults reduce the risk of direct attacks on backups. (Cyber Security News)

 

Lazarus Group’s VM Connect campaign spoofs CapitalOne

New research from Reversing Labs shows that the Lazarus Group is continuing its campaign of tempting targeting developers with malicious software packages on open-source repositories by posing as employees of the financial services firm Capital One. Again seeking to lure developers into downloading the malware by directing them to a GitHub repository containing a “homework task.” This is similar, but different from a story we reported on last week in which the Lazarus Group was seen doing the same thing through LinkedIn using CovertCatch. In this case Reversing Labs researchers says it is connected to a 2023 VMConnect campaign focused on Python modules. They added, “It is clearly intended to create a sense of urgency for the would-be job seeker, thus making it more likely that they would execute the package without performing any type of security or even source code review first.” (InfoSecurity Magazine)

 

Mastercard buys Recorded Future

Financial payment company MasterCard announced yesterday that it will acquire the threat intelligence company Recorded Future for $2.65 billion, adding to its current portfolio of security products, which include risk assessments and transaction protection. In its press release, MasterCard noted that “Recorded Future is a well-known intelligence firm that boasts more than 1,900 clients internationally, including 45 governments and over half of Fortune 500 companies.” The firm will remain an independent subsidiary, and the deal is expected to close in the first quarter of 2025. (Cyberscoop)

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts.

Cyber News Roundup for September 6, 2024

/by

Recent cybersecurity headlines are buzzing with urgent and dramatic developments. From a critical remote code execution flaw in Progress Software’s WhatsUp Gold to a disruptive cyberattack hitting Transport for London’s internal systems, the stakes have never been higher. Sweden is on edge over potential Russian sabotage, while a new Cicada ransomware variant is targeting VMware ESXi systems. Halliburton’s confirmation of a major data breach and the FBI’s alert on North Korean social engineering in the crypto sector only add to the urgency. Dive into these stories and more to discover what they mean for the future of cybersecurity.

 

Critical RCE flaw affects Progress Software’s WhatsUp Gold

Censys has published an advisory on a remote code execution vulnerability affecting Progress Software’s WhatsUp Gold network monitoring and management solution, SecurityWeek reports. The researchers explain, “The vulnerability exists in the GetFileWithoutZip functionality of WhatsUp Gold. An attacker can send a crafted request with directory traversal payloads to upload files to arbitrary locations on the server. By uploading malicious files, the attacker can achieve remote code execution.” Several proof-of-concept exploits have been published on GitHub, and users are urged to update to version 2023.1.3 as soon as possible. (Censys, SecurityWeek)

 

Transport for London suffers cyberattack

The local government body responsible for most of the transport system in Greater London is currently dealing with a cyberattack, but representatives state that there is no evidence that customer information was compromised during the incident. The BBC has stated that the attack mainly impacted the transport provider’s backroom systems at the corporate headquarters. (BBC News)

 

Sweden warns of heightened risk of Russian sabotage

Security companies in Sweden have reported an increase in sabotage attempts, such as flying mapping drones over defense facilities, and other “more aggressive” espionage, cyber-attacks and misinformation activities. This appears to be connected to the fact that Sweden is supporting Ukraine, and has joined NATO, and evidence of increased aggression in espionage as well as disinformation about the reliability of Swedish military products has been seen in large and small companies involved in the manufacture of weapons and related technologies. (The Guardian)

 

New Cicada variant preys on VMWare ESXi systems

This new ransomware-as-a-service group, named Cicada3301 is already quite busy, with 23 victims since mid-June, according to its leak site. Its ransomware is written in Rust and targets Windows and Linux/ESXi hosts. Researchers at Truesec analyzed a variant that targets VMware ESXi systems, and said it appears to be a version of the Windows malware. They added that “the Cicada3301 ransomware has several interesting similarities to the ALPHV ransomware.” (Security Affairs)

 

SlowTempest espionage campaign unfolds within China

Researchers at Securonix are tracking what is being called a highly coordinated espionage operation that is targeting people and organizations within China and appears to be the work of an organization with deep knowledge of Chinese language and culture. The goal of the attackers appears to be espionage, persistent access, and potential sabotage, with the end goal being to infiltrate government or high-profile business sectors. The researchers cannot say where the attacks are ultimately coming from or who is behind them, but they note that the sophisticated attack has been designed not just to gain access to their victims, but to maintain it in order to achieve broader strategic objectives, potentially aligned with state-sponsored activities. (The Record)

 

Threat actors have poisoned GlobalProtect VPN software to deliver WikiLoader

Hackers have been targeting VPNs like GlobalProtect to inject malware and steal sensitive data, compromising private networks without detection. Cybersecurity researchers at Palo Alto Networks discovered that threat actors have poisoned GlobalProtect VPN software to deliver WikiLoader, a sophisticated malware loader. Active since late 2022, WikiLoader primarily spreads via phishing but recently shifted to SEO poisoning, leading users to fake installer pages. The malware uses complex evasion techniques, including DLL sideloading and shellcode decryption, making detection difficult. WikiLoader’s operators utilize compromised WordPress sites and MQTT brokers for command and control. The malware creates persistence through scheduled tasks and hides in over 400 files within a malicious archive. Despite the malware’s complexity, it was detected by Cortex XDR through behavioral indicators. Mitigations include enhanced SEO poisoning detection, robust endpoint protection, and application whitelisting. (Cyber Security News)

 

Voldemort malware delivered via social engineering

Proofpoint describes a social engineering campaign that’s impersonating tax authorities in Europe, Asia, and the US in order to deliver a custom strain of malware dubbed “Voldemort.” The researchers explain, “The attack chain comprises multiple techniques currently popular within the threat landscape as well as uncommon methods for command and control (C2) like the use of Google Sheets. Its combination of the tactics, techniques, and procedures (TTPs), lure themes impersonating government agencies of various countries, and odd file naming and passwords like ‘test’ are notable. Researchers initially suspected the activity may be a red team, however the large volume of messages and analysis of the malware very quickly indicated it was a threat actor.” The researchers don’t attribute the activity to any particular threat actor, but they believe the campaign’s goal is cyberespionage. (Proogpoint)

 

Halliburton confirms data stolen in cyberattack

Following up on a story from last week on Cyber Security Headlines, the U.S. oil service giant confirmed Tuesday that corporate data was stolen from its computer systems during a ransomware attack it suffered in August. Halliburton stopped short of confirming a ransomware extortion scheme but said significant portions of its IT systems were disrupted. The company said it engaged law enforcement to help identify exactly what data was stolen and who they will need to notify. The company’s acknowledgement comes on the heels of CISA, the FBI, and HHS blaming the RansomHub gang for the attack. (SecurityWeek)

 

FBI warns crypto firms of aggressive North Korean social engineering

​On Tuesday, the FBI warned that North Korean hacking groups are aggressively targeting crypto company employees in sophisticated social engineering attacks. After the threat actors identify specific DeFi and crypto businesses, they then target employees with offers of new employment or investment opportunities to deploy crypto-stealing malware. The communications use fluent English and leverage detailed personal information to boost credibility and appeal. The FBI added that the threat actors are also well-versed in technical aspects of cryptocurrency. The FBI provided a list of indicators associated with North Korean social engineering activity and best practices for companies to lower the risk of compromise. (Bleeping Computer and The Record)

 

North Korean social engineering attacks target the cryptocurrency sector

The US Federal Bureau of Investigation (FBI) has issued an advisory on North Korean social engineering campaigns targeting employees in the cryptocurrency industry. The Bureau notes, “North Korean malicious cyber actors conducted research on a variety of targets connected to cryptocurrency exchange-traded funds (ETFs) over the last several months. This research included pre-operational preparations suggesting North Korean actors may attempt malicious cyber activities against companies associated with cryptocurrency ETFs or other cryptocurrency-related financial products. For companies active in or associated with the cryptocurrency sector, the FBI emphasizes North Korea employs sophisticated tactics to steal cryptocurrency funds and is a persistent threat to organizations with access to large quantities of cryptocurrency-related assets or products.” (FBI)

 

Iran paid at least $3 million in ransom following attack on banking system

POLITICO reports that Iran paid at least $3 million in ransom last month to extortionists who threatened to leak information stolen from up to 20 Iranian banks. The hacking group “IRLeaks” claimed to have stolen personal and financial data belonging to millions of Iranians. Iran hasn’t acknowledged the incident, but the country’s supreme leader said in the wake of the attack that the US and Israel are attempting “to spread psychological warfare to push us into political and economic retreat and achieve its objectives.” POLITICO cites sources as saying that IRLeaks is likely a financially motivated group, unaffiliated with a nation-state. (Politico)

 

Indictments follow swatting attack on CISA boss Easterly

Following up on the story from last December in which a swatting attack was placed on the home of Jen Easterly, two individuals have now been identified as instigating this attack along with about 100 other threats against U.S. politicians, members of Congress and senior Federal law enforcement officials. The two individuals, both in their 20s, are from Romania and Serbia. (The Record)

 

Cisco issues patches for smart licensing utility

These patches deal with two issues regarding the company’s Smart Licensing Utility. The first would allow unauthenticated attackers to access sensitive information or to log in as administrators. It exists due to “an undocumented static user credential for an administrative account present in the Utility.” The second issue is due to “excessive verbosity in a debug log file, which could allow an attacker to send a crafted HTTP request and obtain log files containing sensitive data, including credentials.” Since there are no workarounds available, Cisco recommends migrating to Smart License Utility version 2.3.0. (Security Week)

 

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts.

Protect your network against the latest threats with RedSeal

/by

In today’s rapidly evolving cybersecurity landscape, organizations are confronted with increasing challenges to stay ahead of emerging vulnerabilities, including critical issues such as the OpenSSH vulnerability (CVE-2024-6387). In response to these urgent threats, RedSeal unveiled its latest release, designed to empower customers with advanced tools for enhancing network integrity and safeguarding sensitive data.

The newly launched update not only addresses immediate security concerns but also introduces significant improvements in usability through a redesigned interface and streamlined administration features. With these enhancements, RedSeal ensures that users can navigate the complexities of modern cyber threats with greater confidence and efficiency.

What’s New?

 

RedSeal Version 10.1.3 is here.

Released on July 29, 2024, Version 10.1.3 of the RedSeal platform tackled the OpenSSH vulnerability (CVE-2024-6387) head-on. This crucial update ensures that your network remains protected against the latest threats, reinforcing our commitment to improving your security posture.

But that’s not all! Earlier in the month, Version 10.1.2 made several modules available in a redesigned user interface (UI) aimed at improving your overall experience:

 

1. Comprehensive inventory management

Staying informed about your network’s assets is crucial for effective management and security. Our enhanced UI provides a detailed summary of devices, subnets, and hosts, including any new additions. This means you can keep up with changes and ensure that your network inventory is always complete.

 

2. Advanced network investigation

Understanding the reachability of every asset helps you grasp the full impact of potential threats. With our advanced analysis tools in the enhanced UI, you can visualize the blast radius and perform hop-by-hop analyses with greater ease. This deeper insight allows you to better manage risk and make more informed decisions about how to improve your network’s security.

 

3. Simplified model administration

Managing your network model efficiently is key to maintaining accurate and up-to-date information. Our streamlined model administration tools in the new UI make it easier to collect data, complete your inventory, and refine your network model, saving you time and reducing complexity.

 

4. Sophisticated vulnerability management

To help you assess and manage risks more efficiently, the new UI for vulnerability management enables several additional views for prioritization that incorporate insights based on a Zero Trust approach to threats.

 

We’re committed to continually improving your RedSeal experience and ensuring that you have the tools you need to keep your network secure and resilient. Thank you for being part of our community—your feedback and engagement fuel our innovation!

For more information about RedSeal’s network exposure analytics solutions or to stay informed, please visit redseal.net or reach out to us at hello@redseal.net.

Unmasking the Shadows: Proactively Identifying and Minimizing Your Attack Surface

/by

At Black Hat 2024, RedSeal’s CTO Wayne Lloyd and Technical Director Arron Lowe took the stage to unveil strategies designed to fortify your organization’s defenses. During this presentation, they dive deep into innovative methods for reducing your vulnerability landscape, emphasizing how to map your network without relying on traditional scans to uncover hidden threats.

Check out a replay of this informative breakout to discover how to leverage network zones and policies to streamline your defenses and implement effective incident response tactics to mitigate the impact of potential attacks. Witness live demonstrations of attack path modeling, showcasing how adversaries can exploit and navigate your network. This session provides invaluable insights into staying ahead of increasingly sophisticated threats and enhancing your overall security posture.

 

Cyber News Roundup for August 30, 2024

/by
Stay updated with this week’s top cybersecurity stories: The Justice Department is suing the Georgia Institute of Technology over failing to meet Pentagon contract cybersecurity standards. Meanwhile, amateur radio enthusiasts face a million-dollar ransomware attack, and Chinese hackers exploit a zero-day flaw in Cisco appliances. Additionally, a woman cleverly uses an AirTag to catch thieves stealing her mail. Discover more about these incidents and other pressing cybersecurity challenges in today’s roundup.

 

SonicWall warns of critical access control flaw

SonicWall released a bulletin detailing the vulnerability that impacts SonicOS’s use on its Gen 5, Gen 6, and some Gen 7 firewalls. The vulnerability doesn’t require authentication or user interaction, allowing an attacker to gain access to the device or cause a system crash. SonicWall released a security update and said those unable to install it immediately should disable WAN management access from the internet. While the company didn’t disclose any active exploitation, CISA previously warned about active exploitation of SonicWall vulnerabilities by advanced threat actors. (Bleeping Computer)

 

FBI taken to task on electronic media security

A recent audit by the Department of Justice’s Office of the Inspector General found three “significant weaknesses” in policies and procedures used by the FBI for managing and disposing of electronic media containing sensitive information. These included not adequately tracking media removed from laptops, failing to consistently label media with classification levels like Top Secret, and inadequate internal access controls with media awaiting destruction. This included pallets of exposed devices sitting unsecured in waste storage facilities. The FBI issued a new directive to address the issues. (Bleeping Computer)

 

Seattle-Tacoma International Airport hit by cyberattack

The airport confirmed the incident caused an IT systems outage, resulting in delayed flights and issues with its reservation system over the weekend. The Port of Seattle first noticed the problem on August 24th. No group has taken credit for the attack, yet. While IT systems were down, the airport used X to communicate with travelers, recommending using airline websites to check travel information. As of this recording, its website remains down. The FBI confirmed to The Seattle Times that it is working with partners to investigate. (Bleeping Computer)

 

Volt Typhoon suspected of exploiting Versa bug

Researchers at Lumen Technologies’ Black Lotus Labs discovered an actively exploited zero-day flaw (CVE-2024-39717) affecting the SD-WAN management platform Versa Director. Versa has issued a patch for the vulnerability, and users are urged to upgrade to version 22.1.4 or later. The flaw allows threat actors to execute code by uploading Java files disguised as PNG images.

The researchers found a custom-made web shell designed to exploit the vulnerability, which they attribute to the Chinese threat actor Volt Typhoon. Lumen states, “Analysis of our global telemetry identified actor-controlled small-office/home-office (SOHO) devices exploiting this zero-day vulnerability at four U.S. victims and one non-U.S. victim in the Internet service provider (ISP), managed service provider (MSP) and information technology (IT) sectors as early as June 12, 2024. The threat actors gain initial administrative access over an exposed Versa management port intended for high-availability (HA) pairing of Director nodes, which leads to exploitation and the deployment of the VersaMem web shell.” (Black Lotus, The Register and Ars Technica)

 

Texas credit union user data exposed in another MOVEit breach

Just when we thought MOVEit breaches had faded from the headlines, a new one has surfaced, this time involving the Texas Dow Employees Credit Union (TDECU). The credit union revealed that over 500,000 members had their personal info compromised, including names, dates of birth, social security numbers, bank account and credit card numbers, as well as driver’s license and taxpayer IDs. The breach occurred over a year ago but was just discovered in July 2024. This raises significant concerns about the credit union’s security measures and the extended exposure of sensitive information. TDECU confirmed the breach was isolated to files transferred via MOVEit and that its internal network security remained intact. (Infosecurity Magazine)

 

PoC exploit for zero-click vulnerability now available to the masses

A security researcher named “Ynwarcs” has published proof-of-concept exploit code for a critical zero-click remote code execution vulnerability in Windows TCP/IP (CVE-2024-38063). The vulnerability affects all Windows 10, Windows 11, and Windows Server systems that have IPv6 enabled and requires no user interaction. The researcher released a PoC exploit code for the flaw on GitHub. Microsoft said affected orgs should apply the latest security updates and monitor for unusual IPv6 packet activity. (Dark Reading)

 

Woman uses AirTag to catch thieves stealing her mail

A California woman was tired of having mail stolen from her P.O. box so she took matters into her own hands by mailing herself an AirTag. Santa Barbara County police responded to a report of mail theft the morning of August 19 and were able to track down the AirTag and the suspects in Santa Maria, California. Deputies found the woman’s mail, including the package containing the AirTag, in addition to other items that may have been stolen from more than a dozen victims. Deputies arrested Virginia Franchessca Lara, 27, and Donald Ashton Terry, 37, who were booked on several felonies including possession of fictitious checks, identity theft, credit card theft, and conspiracy. (NPR)

 

Iran targeting presidential administration officials

CNN reports that a threat group believed to be working at the behest of Iran’s Islamic Revolutionary Guard Corps has targeted officials in both the former Trump and Biden administrations with phishing emails since at least 2022. This included former national security advisor John Bolton and an unnamed ex-diplomat with the Biden administration. Earlier this month the FBI announced It concluded that Iranian-linked attackers successfully attacked the Trump campaign and targeted the Harris campaign with similar tactics. Despite this, U.S. Cyber Command and NSA chief Gen. Timothy Haugh said that the US is “in a really good position” to respond to hacking attempts around the election compared to 2016. He also said he expected to see an increase in hacking activity ahead of the election. (CNN, The Record)

 

More Telegram arrest warrants in France

According to documents seen by Politico, French authorities also issued an arrest warrant for Telegram co-founder Nikolai Durov back in March, brother of CEO Pavel Durov. The document also showed authorities issued the warrants after Telegram gave “no answer” to judicial requests to identify a Telegram user suspected in a child sex abuse case. This lack of response seems par for the course. The U.S.-based National Center for Missing & Exploited Children, the Canadian Centre for Child Protection, and the U.K.-based Internet Watch Foundation all told NBC News that outreach to Telegram about CSAM issues largely goes ignored.

Additionally, French prosecutors announced they released Pavel Durov from police custody after a 96-hour window for questioning. They plan to have him brought to court for a possible indictment shortly. (Politico, NBC News, AP News)

 

Hitachi Energy urges SCADA upgrade

In a new security advisory, Hitachi Energy warned customers to update its MicroSCADA X SYS600 power monitoring systems to version 10.6 to mitigate several severe vulnerabilities. The two most critical vulnerabilities allow for an SQL injection attack due to an improper user query validation, and the other is an argument injection where attackers coil modify system files or applications on the systems. Hitachi Energy said it saw no signs of exploitation and discovered the flaws internally. Hitachi says over 10,000 substations use its MicroSCADA X systems, including critical infrastructure sites like airports, hospitals, railways, and data centers. (Dark Reading)

 

Mirai botnet variant exploits zero-day in CCTV cameras

Akamai says the Corona Mirai botnet variant is exploiting a zero-day remote code execution vulnerability affecting the brightness function of old CCTV cameras made by AVTECH, the Record reports. The affected camera models have been discontinued for several years, but they’re still widely used in critical infrastructure sectors. CISA issued an advisory on the vulnerability earlier this month, noting that organizations should take the following steps to mitigate the impact:

“Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.

“Locate control system networks and remote devices behind firewalls and isolating them from business networks.

“When remote access is required, use more secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.” (Akama,  The Record, CISA)

 

Telegram CEO Pavel Durov charged in France

Telegram CEO Pavel Durov has been charged in France with several counts related to criminal activity on Telegram and the company’s alleged unwillingness to cooperate with law enforcement, the Associated Press reports. According to the BBC, the charges include “complicity in the administration of an online platform to enable illicit transactions by an organized gang” and “complicity in organised criminal distribution of sexual images of children.” Durov has been released on a €5 million bail but is barred from leaving France. Slate notes that Durov’s arrest has been criticized by free-speech and privacy advocates, particularly concerning the two counts related to “cryptology services” which could “imply that France sees the use of internationally based, unregulated ‘encryption’ services as a crime all its own.” (AP)

 

DICK’S Sporting Goods suffers cyberattack

The largest chain of sporting goods retail stores in the U.S. has now confirmed that confidential information was exposed in a cyberattack that was detected Wednesday, August 21. An anonymous source quoted by BleepingComputer said that email systems had been shut down, and all employees had been locked out of their accounts. IT staff is now manually validating employees’ identities on camera before they can regain access to internal systems. Phone lines at local stores are also down due to the incident. (BleepingComputer)

 

Hacking Microsoft Copilot Is “scary easy”

One of the more intriguing presentations at Black Hat this month was from security researcher Michael Bargury, a former senior security architect in Microsoft’s Azure Security CTO office and now co-founder and chief technology officer of Zenity. He demonstrated how attackers can use Copilot to search for data, exfiltrate it without producing logs, and socially engineer victims to phishing sites even if they don’t open emails or click on links. Much of this has to do with modifying the behavior of bots, which Microsoft refers to as “copilots,” through prompt injection. Based on Copilot’s visibility deep into the enterprise, including emails, messaging applications, and much more, it is an attractive target for malicious actors, he said. A detailed description of his findings is available at DarkReading. The link is available in the show notes to this episode. (Dark Reading)

 

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts

 

Tales from the Trenches: Navigating the Complexities of Vulnerabilities and Exposure

/by

Today’s Tales from the Trenches is brought to you by Brad Schwab, Senior Security Solutions Consultant.

Navigating the complexities of cybersecurity tools can be a challenge. At RedSeal, we turn this challenge into an opportunity, enabling you to harness the full power of our platform to strengthen your security posture. Our solution offers a single source of truth for your network cyber terrain through four core pillars:

  • Network visualization
  • Attack path management
  • Risk prioritization
  • Continuous compliance

Today, let’s dive into one of our standout features—the Risk tab—and explore how we can use our Risk Management Methodology of Discover, Investigate, and Act to transform your risk management strategy.

For many new users, the Risk tab’s heat map, with its vibrant, color-coded indicators, may appear a bit noisy. However, this visual tool is designed to streamline your risk prioritization and attack path management process. To help you better understand the Risk tab intuitively, during onboarding we’ll first guide you through RedSeal concepts of business value, exposure, and downstream risk. This clarity is crucial to understanding an exposure-based approach to vulnerability prioritization and mitigation.

Once you’re acquainted with the basics, the Risk tab’s heat map becomes a powerful asset. Its primary purpose is to help you prioritize remediation efforts based on your as-built network design—most likely revealing unexpected access. Each box on the map represents a network host, with its customizable color and size indicating risk levels specific to your network environment’s segmentation. By clicking on any host, you unlock detailed information about vulnerabilities and the access deeper into the network they grant—downstream risk. This ensures that the Risk Map adapts to your specific needs, allowing you to Discover, Investigate, and Act on risk in ways that are most relevant to your organization.

Why is this important? Because effective risk prioritization not only enhances your cybersecurity posture, but also shows segmentation exposure, and optimizes your response strategies—saving time and resources. At RedSeal, we are committed to empowering you to make a real difference in your cybersecurity efforts. With RedSeal automation, we enable your teams to free up time spent on weeks-long, inaccurate manual tasks and perform them in seconds—with 100% accuracy.

We know that even the most sophisticated tools are only as effective as your ability to use them. Today, we’ve spotlighted the Risk tab—essential for transforming and mitigating risk. Through this crucial feature of RedSeal, you’re empowered to quickly and efficiently discover vulnerabilities, investigate for an optimal response, and allocate resources to act.

Reach out to RedSeal or schedule a demo today today for a personalized walkthrough and discover how RedSeal can revolutionize your approach to cybersecurity.

Cyber News Roundup for August 26, 2024

/by

Start this week in the know on the latest in cyber news. We’ve got headlines from around the globe to keep you informed, from the Justice Department taking the Georgia Institute of Technology to court over cybersecurity breaches related to Pentagon contracts, amateur radio enthusiasts reeling from a million-dollar ransomware attack, and Chinese hackers exploiting a zero-day flaw in Cisco appliances. Additionally, Halliburton faces operational disruptions following a cyberattack, and the Kremlin deals with a contentious DDoS incident affecting multiple digital platforms.

Discover more about these incidents and other pressing cybersecurity challenges in today’s update.

 

The Justice Department is suing the Georgia Institute of Technology and an affiliated company for allegedly failing to meet required cybersecurity standards for Pentagon contracts

The Justice Department is suing the Georgia Institute of Technology and an affiliated company for allegedly failing to meet required cybersecurity standards for Pentagon contracts. The lawsuit, backed by the False Claims Act, purports that Georgia Tech’s Astrolavos Lab did not develop a proper system security plan as mandated by the Department of Defense, and falsely reported their cybersecurity assessment to the Pentagon. Despite implementing a plan in February 2020, the lab reportedly failed to cover all necessary devices. The whistleblower lawsuit, filed by two former Georgia Tech cybersecurity team members, alleges a lack of enforcement of cybersecurity regulations at the university. Georgia Tech disputes the claims, stating that the lawsuit misrepresents their commitment to innovation and integrity, and insists there was no breach or data leak involved. (Cyberscoop)

 

Ham radio enthusiasts pay a million dollar ransom

The ARRL (American Radio Relay League) is a national association for amateur radio enthusiasts in the United States. A letter to their members says that in early May 2024, ARRL’s network was compromised by threat actors (TAs) using dark web-purchased information. The attackers infiltrated both on-site and cloud-based systems, deploying ransomware across various devices, from desktops to servers. The highly coordinated attack took place on May 15, leading to significant disruption. Despite ARRL being a small non-profit, the attackers demanded a multi-million-dollar ransom. After tense negotiations, ARRL paid a $1 million ransom, largely covered by insurance. The organization quickly formed a crisis management team and involved the FBI, who categorized the attack as uniquely sophisticated. Most systems have been restored, with Logbook of The World (LoTW) back online within four days. ARRL is now simplifying its infrastructure and establishing an Information Technology Advisory Committee to guide future IT decisions. (ARRL)

 

Chinese threat actor exploited Cisco zero-day

Researchers at Sygnia warn that the China-aligned threat actor Velvet Ant exploited a zero-day vulnerability (CVE-2024-20399) affecting on-premises Cisco Switch appliances. The flaw, which was patched last month, “allows an attacker with valid administrator credentials to the Switch management console to escape the NX-OS command line interface (CLI) and execute arbitrary commands on the Linux underlying operating system.” Velvet Ant exploited the vulnerability to “deploy tailored malware, which runs on the underlying OS and is invisible to common security tools.” (Cisco)

 

Halliburton takes systems offline following cyberattack

The oil field services company informed regulators and the media on Friday about a recent cyberattack that “necessitated the shut-down of certain systems.” The attack happened on Wednesday and affected operations at its headquarters in Houston. According to the 8-K report submitted on Thursday to the SEC, the company said hackers “gained access to certain of its systems.” (The Record)

 

Kremlin complains of DDoS attack, digital experts not so sure

Disruptions that occurred on Wednesday for some Russian users of WhatsApp, Telegram, Skype, Discord, Twitch, Wikipedia, Steam and even PornHub, are being blamed by the Russian internet regulator Roskomnadzor on a DDoS incident targeting Russian telecom operators. Local digital experts disagree with this statement, arguing that it is impossible to organize a DDoS attack on all 2,000 Russian telecom operators simultaneously. Stanislav Shakirov, co-founder and technical director of the Russian digital rights organization Roskomsvoboda, suggested that the regulator “likely tried to block Telegram, which inadvertently impacted other services.” (The Record)

 

Windows Recall to reappear

Microsoft is deploying an updated version of its Recall feature, which had been initially announced this spring and immediately derided by industry analysts as keylogger or spyware. The idea behind Recall was to take snapshots of a user’s desktop every few seconds as tool for keeping track of things. It was removed from widespread Copilot+ PC release on June 13, but is now being deployed to testers in coming weeks. Microsoft has not fully clarified how the new version will differ but has said it will include “just in time” decryption and that Windows Insiders would need a Copilot+ PC. (The Register)

 

Two years later, Log4Shell still being exploited

This is according to researchers at Datadog Security Labs. “Cybercriminals are still finding targets for Log4Shell exploits that evade detection and plant malware scripts on unpatched corporate systems.” This is due to vulnerabilities that remain unpatched even though fixes have been made available. “Security experts have warned that eradicating the problem will be a long, laborious process because of software dependencies and so-called “transitive dependencies” that make patching very difficult.” Datadog for example has noted nation-state APT actors linked to China, Iran, North Korea and Turkey using obfuscated LDAP requests (that is an Active Directory protocol) to evade detection, leading to the execution of malicious scripts on compromised systems. (Security Week)

 

Mandiant uncovers a privilege escalation vulnerability in Microsoft Azure Kubernetes Services

A privilege escalation vulnerability in Microsoft Azure Kubernetes Services (AKS) could have allowed attackers to access sensitive information, such as service credentials used by the cluster, Mandiant reports. The issue affected AKS clusters using Azure CNI for network configuration and Azure for network policy. Attackers with command execution in a pod within the cluster could exploit this vulnerability to download cluster node configurations, extract TLS bootstrap tokens, and access all secrets in the cluster. The flaw could be exploited even without root privileges or hostNetwork enabled. Microsoft resolved the issue after being notified. Mandiant highlights the risk of Kubernetes clusters lacking proper configurations, as attackers could use this vulnerability to compromise the cluster, access resources, and even expose internal cloud services. The flaw also allowed attackers to use the TLS bootstrap token to gain broader access to cluster secrets. (SecurityWeek)

 

Configuration flaw may affect thousands of apps using AWS ALB

Miggo Research has discovered a critical configuration flaw potentially affecting up to 15,000 applications that use AWS Application Load Balancer (ALB) for authentication. The researchers explain, “First, the attacker creates their own ALB instance with authentication configured in their account. The attacker then uses this ALB to sign a token they fully control. Next, the attacker alters the ALB configuration and sets the issuer field to the victim’s expected issuer. AWS subsequently signs the attacker’s forged token with the victim’s issuer. Finally, the attacker uses this minted token against the victim’s application, bypassing both authentication and authorization.”

To mitigate this risk, Miggo says AWS customers should:

  1. “Verify that every application using the ALB authentication feature checks the token signer.
  2. “Restrict your targets to accept traffic only from your Application Load Balancer.”

AWS has updated its documentation to include this guidance, but it’s up to the customers to make the recommended changes. (miggo)

 

Feds tapping into encrypted messaging haul

According to a review of court records by 404 Media, US law enforcement agencies ramped up access to encrypted chat messages obtained as part of a trove of messages from European agencies from the phone company Sky back in 2021. Records show no indication US agencies have bulk access to this data, rather received from European partners for particular people under investigation. It’s unclear how authorities obtained this trove of messages, but Sky itself claimed someone created a fake version of the app and sold phones loaded with it on “unauthorized channels.” The cases profiled by 404 Media all involved prosecutions involving narcotics smuggling and distribution.  (404 Media)

 

Microchip Technology hit by cyberattack

The US chipmaker reported to the Securities and Exchange Commission that “potentially suspicious activity” over the weekend inhibited the use of “certain servers and some business operations.” As of this recording, it says it’s still operating “at less than normal levels,” with order volume impacted.  Its response to the incident sounds bog-standard: isolating impacted systems, shutting down services, and calling in third-party experts to help investigate. No other specific on who orchestrated the attack, but we’ll follow up as more details come to light. (The Record)

 

Poisoning LLMs to create insecure code

At the USENIX Security Symposium, a team of academic researchers presented details CodeBreaker, a set of techniques to poison large language model training sets to make them more likely to suggest vulnerable code. This saw the researchers systematically create code samples that don’t register as malicious with static analysis tools. This builds on previous research that used malicious code in comments and split workloads to introduce vulnerabilities to the training set. Of course, this kind of poisoning isn’t new. Research has previously found malicious code popping up in StackOverflow tutorials. And given the lack of quality control when ingesting code scraped from the internet, vulnerable code suggestions are already a reality in these training sets. (Dark Reading)

 

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts.

Embracing Continuous Threat Exposure Management (CTEM)

/by

With new vulnerabilities emerging daily and cyber threats becoming more sophisticated, organizations must evolve their cybersecurity strategies to protect their digital assets. One such strategy endorsed by a leading industry analyst firm is gaining traction with forward-thinking CISOs: Continuous Threat Exposure Management (CTEM). In this blog, we’ll explore the basics of CTEM, its benefits, and how it fits into modern cybersecurity strategies. 

What is Continuous Threat Exposure Management (CTEM)? 

Continuous Threat Exposure Management (CTEM) is a comprehensive framework or process designed to provide ongoing visibility and management of cybersecurity threats and vulnerabilities, putting greater priority on those that have greater business impact. No network will ever be perfect, and you can’t prevent or fix every single issue. CTEM emphasizes practical scoping, proactive threat discovery, continuous risk assessment and validation, and cross-team collaboration—to reduce both existing and future exposures. 

It’s important to note that with CTEM, “threat exposure” is not limited to vulnerabilities or external threats. An exposure is anything that puts an organization’s assets at risk. It could be an outdated password or firewall rule, a misconfigured router or gateway, an unknown device, a known vulnerability, or an unintended connection. It could be in on-premises, private cloud, public cloud, OT, or IoT environments. The sheer type and volume of exposures in today’s complex, hybrid networks are too many for overwhelmed teams to manage.   

A Fundamental Shift in Cybersecurity

Traditional cybersecurity strategies focus on event-based vulnerability management and periodic assessments. However, this type of episodic, reactive approach can leave significant gaps in protection, as threats evolve faster than many organizations can respond. 

CTEM represents a fundamental shift away from managing vulnerabilities based solely on severity or Common Vulnerability Scoring System (CVSS) scores. Instead of simply identifying and patching vulnerabilities, it takes into consideration the entire context of the exposure, including its exploitability, blast radius, and verified business impact to prioritize remediation efforts within the context of the business. As the term implies, Continuous Threat Exposure Management is a more continuous, holistic approach that encompasses dynamic threat assessment and response. 

The Five Stages of CTEM

Continuous Threat Exposure Management is a structured approach with five key stages, each critical to managing and mitigating cybersecurity threats effectively.

Stage 1 – Scoping (of business risks and relevant attack surfaces): This stage involves identifying the mission-critical priorities for the business, understanding the systems and processes involved, and determining risk owners and appetites. Scopes don’t limit the CTEM program’s reach but rather provide a means of organizing, reporting, and communicating exposure management work and results to senior leadership and business teams. Understanding the organization’s full attack surface, as well as that of individual scopes, helps put the broader concept of threat exposure management into meaningful business context. 

Stage 2 – Discovery (of all assets and threat exposures): This stage involves identifying all assets and connectivity (hidden and visible) and continuously assessing them for vulnerabilities and other exposures (known, unknown, and emerging). Running discovery against scopes outlined in the previous stage helps increase awareness of risks among relevant business teams and makes exposure management successes more impactful in later stages.  

Stage 3 – Prioritization (of exposure management work): In this stage, threat exposures of all types are prioritized, considering internal, external, business, and technical factors. Prioritization must go beyond CVSS scores and severity to include concepts of visibility, exploitability, asset criticality, and potential impact. Again, prioritization within and across defined scopes helps teams focus on high-business-value issues. 

Stage 4 – Validation (of exposure—and exposure management—viability/impact): In this stage, thinking like an attacker and verifying suggested remediation are key. Validating the exploitability of an exposure through virtual pentesting, red teaming, and attack path analysis—including the blast radius and further lateral movement—helps refine prioritization. Validating that proposed changes are feasible and won’t conflict with existing policies helps build the business case for remediation and collaboration. 

Stage 5 – Mobilization (of teams and stakeholders): While automated remediation makes sense for certain types of black-and-white issues, there is a lot of gray area in which stakeholders across teams must make decisions about how to address an exposure, whether that exposure is fixable or not. In this stage, communication and collaboration are key to documenting and operationalizing exposure management work for the (present and future) benefit of the entire organization. 

How RedSeal Supports the CTEM Process 

While the CTEM term might be relatively new or unfamiliar, the framework’s core principles have been at the heart of RedSeal’s approach for two decades. Since 2004, RedSeal has been pioneering network exposure management to close gaps in cybersecurity defenses on premises and in the cloud. Our hybrid network modeling technology is key to helping our customers know their networks better than their adversaries do.   

RedSeal integrates with hundreds of networking and security tools to simplify and accelerate the CTEM process, delivering a unique combination of capabilities from a single platform: 

  1. Scoping: RedSeal models the entire connected network across public cloud, private cloud, and on-prem environments; then, it maps resources into physical/logical/custom topology groups to help organizations understand and organize their attack surface. This visualization helps stakeholders easily identify business-critical systems and assets and define scopes within their business context.
  2. Discovery: RedSeal continuously identifies all assets and exposures, including those due to hidden assets, misconfigurations, unintended connections (direct and indirect), firewall rules, and policy violations, as well as known and unknown vulnerabilities. It also runs automated attack path analysis and compliance checks against external regulations/standards, internal policies, and best practices to keep exposure assessments current.
  3. Prioritization: RedSeal considers a range of internal, external, business, and technical factors to assess risk and prioritize all exposures. Risk scores are calculated based on security controls, asset criticality, and vulnerability data—combined with unmatched network context, which includes the visibility, exploitability, exploitation potential, and potential impact of the exposure. Exposures with greater business impact take higher priority.
  4. Validation: RedSeal runs virtual penetration tests to confirm the viability of exposure exploitation, analyze lateral movement (blast radius), and measure the impact of exposures. It validates vulnerability scans and security controls such as network segmentation and device configurations. Simulating what-if scenarios, the platform minimizes unforeseen complications when making changes to live environments.
  5. Mobilization: Unlike any other platform on the market, RedSeal serves as the single source of truth for teams collaborating on CTEM. It delivers detailed remediation guidance, including an asset’s precise logical and physical location as well as access paths for containing unpatchable exposures. It also sends alerts directly to stakeholders when policy violations are detected and provides an executive-level dashboard and score to measure the CTEM program over time.  

Overall, the RedSeal network exposure management platform embodies the proactive, continuous cybersecurity model that CTEM advocates—and includes a comprehensive set of technical capabilities to accelerate the process. 

Accelerate CTEM with RedSeal 

Ultimately, Continuous Threat Exposure Management is about proactively mitigating threats and reducing risk. CTEM is not a standalone solution or any single tool but rather a comprehensive, coordinated process to enhance an organization’s overall protection and security posture. With the right level of visibility and collaboration among teams, a CTEM strategy can also inform and support more reactive and longer-term initiatives, such as incident response and digital resilience programs. 

By leveraging the capabilities of the RedSeal platform, organizations can significantly enhance their CTEM process, ensuring they stay ahead of cyber threats, mitigate risks efficiently, and safeguard their digital assets in an increasingly complex cyber environment. Contact us for a demo today. 

 

Updated Monday, August 26, 2024

The Critical Role of Asset Inventory in Modern Network Security

/by

Accurate asset inventory is not just a good practice—it’s a necessity. With increasing frequency, news headlines reveal the fallout from data breaches, ransomware attacks, and other cyber threats that exploit gaps in network visibility. We’ve found that 76% of organizations believe they have an accurate understanding of their network infrastructure, however through RedSeal deployment, 100% of the time we find network devices, subnets, or paths that aren’t on a model. Security professionals know they need to be aware of assets within their environment, but how?

Bringing all assets and connections into a cohesive interactive model

Proper asset inventory is the backbone of effective network security. It ensures that every device, endpoint, and resource within your network is documented, tracked, and assessed for risk. RedSeal provides meticulous documentation of a network’s assets, while keeping the information current and complete. Without a comprehensive and up-to-date inventory, you risk vulnerabilities that can be exploited by attackers.

What can you do with RedSeal?

  • Comprehensive discovery: RedSeal actively discovers and inventories all Layer 2 and Layer 3 network devices and endpoints, covering both IPv4 and IPv6 connected assets. This broad scope ensures that no device is left unaccounted for.
  • Cloud and SDN integration: In a world where cloud platforms and Software-Defined Networks (SDNs) are prevalent, RedSeal extends its reach to discover and inventory resources across multiple cloud environments and SDNs.
  • Business value assignment: RedSeal allows you to assign business value to assets, which can be done either automatically or manually. This feature is crucial for prioritizing risk analysis and understanding the potential impact of asset-related vulnerabilities.
  • Stale device identification: RedSeal helps identify stale devices, hosts, and credentials that may pose security risks, ensuring that your network remains clean and secure.
  • Data consolidation: Import, consolidate, deconflict, and store host data from various sources, including name, location, OS, access, installed patches, and applications. This consolidated view simplifies management and improves accuracy.
  • Missing device detection: RedSeal detects potentially missing devices and hosts not reflected in the current network model, helping you maintain an accurate and complete inventory.

Recent insights

Recent reports highlight how companies have faced severe security breaches due to incomplete asset inventories. For instance, MOVEit cyberattacks, one of the largest data thefts of 2023, underscores the urgent need for robust asset management practices, as more than 2,000 organizations including New York City’s public school system, and payroll solutions used by British Airways and BBC saw themselves at the center of the widespread attack.

The RedSeal advantage

In an era where cyber threats are becoming more sophisticated, maintaining an accurate and comprehensive asset inventory is non-negotiable. From automatically discovering devices and creating a network inventory to continuously monitoring of the completeness and health of your inventory and with ability to accelerate capacity planning, disaster recovery, and new security design, RedSeal provides the tools necessary to ensure your network model reflects the full extent of your assets, helping you stay secure and resilient in a challenging landscape. Reach out to RedSeal or schedule a demo today to learn how to bolster your cybersecurity efforts and make the strategic move that promises long-term benefits and peace of mind.

Cyber News Roundup for August 16, 2024

/by

This week, CISA issues warnings about Cisco device vulnerabilities, while APT42 targets U.S. presidential campaigns. A Tennessee man is arrested for aiding North Korean IT schemes, and a severe CPU flaw from AMD raises alarms. Plus, GPS spoofing hacks are grounding commercial airliners, researchers uncover flaws in Georgia’s voter portal, and ransomware operators exploit ESXi hypervisors for mass encryption. We’ve rounded up the highlights from this week’s headlines on critical issues shaping the digital security landscape.

 

CISA warns of actively exploited Cisco devices

CISA has warned organizations about threat actors exploiting improperly configured Cisco devices, specifically targeting the legacy Cisco Smart Install (SMI) feature. Malicious hackers are acquiring system configuration files, which can lead to network compromises. CISA noted the continued use of weak password types on Cisco devices, making them vulnerable to password cracking attacks. Additionally, Cisco disclosed critical vulnerabilities in their end-of-life Small Business SPA IP phones, which can be remotely exploited but will not receive patches. (SecurityWeek)

 

Iran’s APT42 targets US presidential campaigns

Google’s Threat Analysis Group (TAG) has published a report on the Iran-aligned threat actor APT42’s targeting of US presidential campaigns. Google confirms that APT42 has targeted both the Trump and Biden-Harris campaigns with spearphishing attacks: “In May and June, APT42 targets included the personal email accounts of roughly a dozen individuals affiliated with President Biden and with former President Trump, including current and former officials in the U.S. government and individuals associated with the respective campaigns. We blocked numerous APT42 attempts to log in to the personal email accounts of targeted individuals.” TAG adds that the group “successfully gained access to the personal Gmail account of a high-profile political consultant.” The researchers note that APT42 has also ramped up its phishing attacks against users in Israel, targeting “people with connections to the Israeli military and defense sector, as well as diplomats, academics, and NGOs.” (Google)

 

Tennessee man arrested for alleged participation in North Korean employment scheme

The US Justice Department has arrested a man in Nashville, Tennessee, for allegedly helping North Korean IT workers get remote jobs at companies in the US and the UK. Matthew Isaac Knoot is accused of running a “laptop farm” to make the North Korean workers appear as if they were located in the US. The Justice Department stated, “The victim companies shipped laptops addressed to ‘Andrew M.’ to Knoot’s residences. Following receipt of the laptops, and without authorization, Knoot logged on to the laptops, downloaded and installed unauthorized remote desktop applications, and accessed the victim companies’ networks, causing damage tqqq o the computers. The remote desktop applications enabled the North Korean IT workers to work from locations in China, while appearing to the victim companies that ‘Andrew M.’ was working from Knoot’s residences in Nashville. For his participation in the scheme, Knoot was paid a monthly fee for his services by a foreign-based facilitator who went by the name Yang Di.”

The Justice Department says North Korea’s remote IT workers “have been known individually earn up to $300,000 annually, generating hundreds of millions of dollars collectively each year, on behalf of designated entities, such as the North Korean Ministry of Defense and others directly involved in the DPRK’s UN-prohibited WMD programs.” (DOJ)

 

Researchers find flaws in Georgia voter portal

Security researcher Jason Parker alerted ProPublica and Atlanta News First of a flaw in a portal run by the Georgia Secretary of State’s Office. This would allow someone to submit a voter cancellation request for anyone in the state. Parker said they attempted to contact the Secretary of State’s Office but did not receive a response. The portal launched on July 29th and already garnered attention for exposing driver’s license numbers.  Parker found that by inspecting the portal’s source HTML, anyone could delete code requiring them to submit a driver’s license number and proceed to request a voter cancellation. The state eventually patched the issues, but security researcher Zach Edwards told ProPublica “It’s shocking to have one of these bugs occur on a serious website.” (ProPublica)

 

AMD SinkClose flaw helps install nearly undetectable malware

A warning from chip maker AMD about a high-severity CPU vulnerability which has been named SinkClose. The vulnerability affects multiple generations of its EPYC, Ryzen, and Threadripper processors, and allows attackers with Kernel-level (Ring 0) privileges to gain Ring -2 privileges and install malware that becomes nearly undetectable. For context, “Ring -2 is one of the highest privilege levels on a computer, running above Ring -1 (used for hypervisors and CPU virtualization) and Ring 0, which is the privilege level used by an operating system’s Kernel.” SinkClose has apparently passed undetected for almost 20 years.(BleepingComputer)

 

Ransomware operators exploit ESXi hypervisor vulnerability for mass encryption

Microsoft has also uncovered a vulnerability in ESXi hypervisors which it says is being exploited by “several ransomware operators to obtain full administrative permissions on domain-joined ESXi hypervisors.” The vulnerability “involves a domain group whose members are granted full administrative access to the ESXi hypervisor by default without proper validation.” Microsoft has disclosed the findings to VMware, and recommends that administrators apply the updates released by VMware. (Microsoft)

 

GPS spoofers hack clocks on commercial airliners

The relatively recent phenomenon of GPS spoofing involves hackers modifying GPS signals used by commercial airlines to navigate. The technique is also used to disorient drones and missiles in conflict zones. But now, according to Ken Munro, founder of British cybersecurity firm Pen Test Partners, and speaking recently at DEF CON, the technology is being used to change the times and dates on the clocks in aircraft cockpits, sometimes by years, Causing the plane to lose access to its digitally-encrypted communication systems, and requiring them to be grounded for weeks while engineers manually reset their onboard systems. (Reuters)

 

At Defcon, researchers reveal significant vulnerabilities in Google’s Quick Share

At Defcon 32, researchers Or Yair and Shmuel Cohen from SafeBreach revealed significant vulnerabilities in Google’s Quick Share, a peer-to-peer file transfer utility for Android, Windows, and Chrome OS. Quick Share uses various protocols like Bluetooth and Wi-Fi Direct, but these were not originally designed for file transfers. The researchers identified ten vulnerabilities, including a critical Remote Code Execution (RCE) flaw on Windows systems, dubbed QuickShell. This RCE exploit combines five of the vulnerabilities, allowing attackers to bypass security controls and take full control of target devices. The flaws also enable attackers to force file downloads and hijack Wi-Fi connections. Google has acknowledged the seriousness of these issues, assigning CVEs to two of the vulnerabilities. (Hack Read)

 

U.S. operation of “laptop farm” for North Korea shutdown

Tennessee resident Matthew Isaac Knoot has been arrested for allegedly running a ‘laptop farm’ to help North Korean IT workers secure remote jobs with American companies. Here’s how the scheme worked: Knoot would steal the identities of U.S. citizens and pose as U.S.-based IT professionals. Once hired, the company would send the work laptop to Knoot’s home, which he then gave the North Koreans access to, allowing them to log in remotely. If convicted, Knoot could face up to 20 years in prison, including a mandatory minimum of two years for aggravated identity theft. (Security Week)

 

Millions on the line as AI Teams advance in security challenge

Ninety teams competed at DEF CON over the weekend in the Artificial Intelligence Cyber Challenge hosted by the U.S. government’s Defense Advanced Research Projects Agency (DARPA) to develop autonomous tools that can find and fix vulnerabilities in open-source software. Twenty-two unique vulnerabilities were discovered in major open-source programs like the Linux kernel, with 15 automatically patched.  The seven finalists are now tasked with building out their AI systems before the final competition at the 2025 DEF CON, with nearly $30 million up for grabs in prize money. (CyberScoop)

 

South Korean government says North Korean hackers stole tank and spy plane information

The South Korean government says North Korean hackers stole sensitive information on South Korea’s tanks and spy planes, BleepingComputer reports. The spy plane data was reportedly stolen from a South Korean defense contractor that produces operating manuals for military equipment. BleepingComputer cites local media reports as saying that “the leakage of the K2 tank data occurred when engineers working on one of the tank’s part makers moved to a competing company, taking along with them in external storage drives design blueprints, development reports, and details about the tank’s overpressure system.” (People Power Party, Bleepingcomputer)

 

NIST finalizes post-quantum encryption standards 

On Tuesday, the National Institute of Standards and Technology (NIST) published three new encryption algorithms to bolster global cybersecurity efforts against future attacks using quantum technologies. The new standards are designed for general encryption and digital signatures. The algorithms, called FIPS 203, FIPS 204, and FIPS 205, are published to NIST’s post-quantum cryptography (PQC) project website. Head of the PQC project, Dustin Moody, urges security practitioners to immediately begin using the new algorithms to keep their data secure. (Dark Reading)

 

Orion loses $60 million in BEC scam

Luxembourg-based company, Orion, who is a leading supplier of carbon black, a material used to make tires, ink, batteries, and plastics was tricked into making several wire transfers through a Business Email Compromise (BEC) attack. According to documents filed with the Securities and Exchange Commission (SEC), a non-executive employee “was the target of a criminal scheme that resulted in multiple fraudulently induced outbound wire transfers to accounts controlled by unknown third parties.” Orion expects to record “a one-time pre-tax charge of approximately $60 million.” if the funds are not recovered. (The Record)

 

Azure AI health bot infected with critical vulnerabilities

Multiple privilege escalation issues in Microsoft Azure’s cloud-based Health Bot service exposed the platform to server-side request forgery (SSRF) and access to cross-tenant resources. The Azure AI Health Bot Service enables healthcare organizations to build their own virtual health assistants to interact with patients and manage administrative workloads. Depending on the nature of the integration, the chatbots could potentially have privileged access to extremely sensitive health information. Researchers at Tenable, who identified the issues said, though Microsoft quickly patched the vulns, they showcase inherent concerns about chatbot risks. (Dark Reading)

 

Palo Alto Networks patches several vulnerabilities

Palo Alto Networks has issued patches for several vulnerabilities, including the high-severity CVE-2024-5914, which affects the Cortex XSOAR product. This flaw allows unauthenticated attackers to execute commands within certain configurations. Patches are available starting with version 1.12.33. Additionally, updates were released for Prisma Access Browser, addressing over 30 vulnerabilities in the Chromium-based browser. Two medium-severity flaws were also patched, impacting PAN-OS and the GlobalProtect app. Palo Alto Networks is not aware of any active exploitation of these vulnerabilities. (SecurityWeek)

 

Microsoft patches zero-click RCE vulnerability

Microsoft has issued a patch for a zero-click remote code execution vulnerability (CVE-2024-38063) that affects all Windows machines using IPv6, which is enabled by default, BleepingComputer reports. Microsoft says “[a]n unauthenticated attacker could repeatedly send IPv6 packets, that include specially crafted packets, to a Windows machine which could enable remote code execution.” The vulnerability was discovered by a researcher at Kunlun Lab, who noted that the bug is triggered before the packet reaches the Windows firewall. There’s no evidence of exploitation so far, but Microsoft has given the flaw its “Exploitation more likely” label. Users are urged to update Windows as soon as possible or disable IPv6 until patches can be applied. (Bleepingcomputer)

 

Massive cyberattack hits Central Bank of Iran and other Iranian banks

News agency Iran International has reported a massive cyberattack that has disrupted the operations of the Central Bank of Iran (CBI) along with several other banks in the country, disabling the computer systems of many banks in the country. As reported in Security Affairs, “this incident coincides with intensified international scrutiny of Iran’s operations in the Middle East,” amid announcement from Tehran regarding attacks on Israel as well as its widely reported attempts to influence the upcoming U.S. Presidential election. According to the news agency, this is one of the largest cyberattacks on Iran’s state infrastructure to date. (Security Affairs)

 

Kim Dotcom to be extradited from New Zealand

After a 12-year fight, the infamous Kit Dotcom is being extradited to the U.S. to face criminal charges relating to the operations of his now closed file-sharing website Megaupload. Dotcom, whose real name is Kim Schmitz, holds Finnish and German nationalities and has been living in New Zealand, and has faced numerous charges since the mid-1990s for computer fraud, data espionage, and many other nefarious activities. U.S. authorities say, “Dotcom and three other Megaupload executives cost film studios and record companies more than $500 million by encouraging paying users to store and share copyrighted material, which generated more than $175 million in revenue for the website.” (Reuters)

 

Have questions? Reach out to RedSeal today to chat with one of our cybersecurity experts.