19.11.2021
NEWS:
UK and US join forces to strike back in cyber-space
The US and UK are joining forces to “impose consequences” on their shared adversaries who conduct malicious cyber-activities. The combined action would address “evolving threats with a full range of capabilities”, they said. The shared adversaries were not named but the announcement follows increasing concern over Russia-based ransomware. The plan was discussed last week at an annual meeting of intelligence chiefs, in the US. Gen Sir Patrick Sanders and Government Communications Headquarters (GCHQ) director Sir Jeremy Fleming and US Cyber Command head Gen Paul Nakasone “reaffirmed” their commitment to jointly disrupt and deter new and emerging cyber-threats.
https://www.bbc.com/news/technology-59335332
The COVID-19 crisis has fuelled the increase of cybercrime in all its forms
The accelerated digitalization related to the COVID-19 pandemic has significantly influenced the development of a number of cyber threats, according to the new edition of Europol’s Internet Organised Crime Threat Assessment. Criminals have been quick to abuse the current circumstances to increase profits, spreading their tentacles to various areas and exposing vulnerabilities, connected to systems, hospitals or individuals. While ransomware groups have taken advantage of widespread teleworking, scammers have abused COVID-19 fears and the fruitless search for cures online to defraud victims or gain access to their bank accounts.
Managing the Cybersecurity Vulnerabilities of Artificial Intelligence
Last week, Andy Grotto and I published a new working paper on policy responses to the risk that artificial intelligence (AI) systems, especially those dependent on machine learning (ML), can be vulnerable to intentional attack. As the National Security Commission on Artificial Intelligence found, “While we are on the front edge of this phenomenon, commercial firms and researchers have documented attacks that involve evasion, data poisoning, model replication, and exploiting traditional software flaws to deceive, manipulate, compromise, and render AI systems ineffective.”
https://www.lawfareblog.com/managing-cybersecurity-vulnerabilities-artificial-intelligence
Russian ransomware gangs start collaborating with Chinese hackers
There’s some unusual activity brewing on Russian-speaking cybercrime forums, where hackers appear to be reaching out to Chinese counterparts for collaboration. These attempts to enlist Chinese threat actors are mainly seen on the RAMP hacking forum, which is encouraging Mandarin-speaking actors to participate in conversations, share tips, and collaborate on attacks. According to a new report by Flashpoint, high-ranking users and RAMP administrators are now actively attempting to communicate with new forum members in machine-translated Chinese. The forum has reportedly had at least thirty new user registrations that appear to come from China, so this could be the beginning of something notable.
ENISA: On the Watch for Incident Response Capabilities in the Health Sector
The European Union Agency for Cybersecurity issues an analysis of the current state of development of sectoral CSIRT capabilities in the health sector since the implementation of the NIS Directive. Cybersecurity attacks on healthcare can be life threatening for patients and provoke effects on the physical world. These attacks may also affect the entire health supply chain with damaging consequences for all stakeholders concerned such as citizens, public authorities, regulators, professional associations, industries, small and medium enterprises.
https://securityaffairs.co/wordpress/124608/security/enisa-ir-capabilities-health-sector.html
INCIDENTS:
Robinhood says hackers also got thousands of phone numbers
Robinhood has revealed that “several thousand entries” in a list obtained by hackers included phone numbers, indicating that a November 3rd security breach compromised more information than the company originally reported. More precisely, the list contains around 4,400 phone numbers according to Motherboard, which reportedly obtained the list from a “proxy for the hackers.” Earlier this month, Robinhood reported that an employee falling victim to a social engineering attack led to hackers obtaining 5 million customers’ emails, and 2 million customers’ names. Additionally, around 300 customers had more details like zip codes and dates of birth stolen, while 10 customers had “more extensive account details revealed.” Phone numbers weren’t mentioned in the company’s original post.
https://www.securityweek.com/fbi-hacker-offers-sell-data-allegedly-stolen-robinhood-breach
Cloudflare Battles 2 Tbps DDoS Attack Launched by Mirai Botnet
Web security services provider Cloudflare says it mitigated a distributed denial-of-service (DDoS) attack that peaked at almost 2 terabytes per second (Tbps). The multi-vector assault was launched by a botnet of approximately 15,000 machines infected with a variant of the original Mirai malware. The bots included Internet of Things (IoT) devices and GitLab instances, Cloudflare said in a new report. GitLab instances ensnared into the botnet are affected by CVE-2021-22205, a critical (CVSS score of 10) vulnerability that was patched more than six months ago, but which continues to expose tens of thousands of systems.
https://www.securityweek.com/cloudflare-mitigates-2-tbps-ddos-attack-launched-mirai-botnet
Fake Emails Sent From FBI Address via Compromised Law Enforcement Portal
Thousands of fake emails coming from an FBI email address were sent out on Friday by someone who exploited a vulnerability in a law enforcement portal. The FBI has confirmed the breach, but said impact was limited. Threat intelligence organization Spamhaus reported seeing more than 100,000 fake emails being sent out in two waves. The hoax emails, coming from “[email protected],” carried the subject line “Urgent: Threat actor in systems.” The message appeared to come from the DHS and it informed recipients about “exfiltration of several of your virtualized clusters in a sophisticated chain attack.”
https://www.securityweek.com/fake-emails-sent-fbi-address-compromised-law-enforcement-portal
MALWARE:
Linux has a serious security problem that once again enables DNS cache poisoning
As much as 38 percent of the Internet’s domain name lookup servers are vulnerable to a new attack that allows hackers to send victims to maliciously spoofed addresses masquerading as legitimate domains, like bankofamerica.com or gmail.com. The exploit, unveiled in research presented today, revives the DNS cache-poisoning attack that researcher Dan Kaminsky disclosed in 2008. He showed that, by masquerading as an authoritative DNS server and using it to flood a DNS resolver with fake lookup results for a trusted domain, an attacker could poison the resolver cache with the spoofed IP address. From then on, anyone relying on the same resolver would be diverted to the same imposter site.
Fake Ransomware Infection Hits WordPress Sites
WordPress sites have been splashed with ransomware warnings that are as real as dime-store cobwebs made out of spun polyester. Fake red-on-black warnings have been plastered to hundreds of WordPress sites, warning that they’ve been encrypted. The warnings have at least one ransomware accoutrement that might look convincing at first blush: a countdown clock tick-tick-ticking away, warning site owners that they’ve got seven days, 10 hours, 21 minutes and 9 seconds to fork over 0.1 Bitcoin – about USD $6,000 at the time this story was posted – before the files are encrypted and go up in an irretrievable puff of e-smoke.
VULNERABILITIES:
Microsoft addresses a high-severity vulnerability in Azure AD
Microsoft has recently addressed an information disclosure vulnerability, tracked as CVE-2021-42306, affecting Azure AD. The vulnerability was discovered by Karl Fosaaen from NetSPI, it received a CVSS score of 8.1. Fosaaen explained that due to a misconfiguration in Azure, Automation Account “Run as” credentials (PFX certificates) ended up being stored in clear text in Azure AD and anyone with access to information on App Registrations can access them. An attacker could use these credentials to authenticate as the App Registration, typically as a Contributor on the subscription containing the Automation Account.
https://securityaffairs.co/wordpress/124755/security/microsoft-azure-ad-flaw.html
Netgear fixes code execution flaw in many SOHO devices
Netgear addressed a code execution vulnerability, tracked as CVE-2021-34991, in its small office/home office (SOHO) devices. Netgear addressed a pre-authentication buffer overflow issue in its small office/home office (SOHO) devices that can be exploited by an attacker on the local area network (LAN) to execute code remotely with root privileges. The flaw, tracked as CVE-2021-34991 (CVSS score of 8.8), resides in the device’s Universal Plug-and-Play (UPnP) upnpd daemon functions related to the handling of “unauthenticated HTTP SUBSCRIBE and UNSUBSCRIBE requests from clients that wish to receive updates whenever the network’s UPnP configuration changes.”
https://securityaffairs.co/wordpress/124716/security/netgear-cve-2021-34991-soho-devices.html
Exchange Exploit Leads to Domain Wide Ransomware
ProxyShell is a name given to a combination of three vulnerabilities: CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. An attacker chaining the exploitation of these vulnerabilities could execute arbitrary code with SYSTEM privileges on Exchange servers. Here’s some more information on ProxyShell : CISA Alert, NCSC Alert, Mandiant, Zero Day Initiative. ProxyShell was used to deploy multiple web shells which lead to discovery actions, dumping of LSASS, use of Plink and Fast Reverse Proxy to proxy RDP connections into the environment. Furthermore, the actors encrypted systems domain wide, using BitLocker on servers and DiskCryptor on workstations, rather than affiliating with Ransomware as a Service (RaaS) programs or building an encryptor from scratch.
Cyber4Dev collates data from Open Source websites, any opinions or attributions expressed in the articles are not those of Cyber4Dev and are not endorsed by the project or the EU.
