Archive for December 19, 2023

« Older Entries

Comcast Pwned Via Citrix Bleed Vulnerability… And We’re Talking Epic Pwnage

Posted in Commentary with tags , on December 19, 2023 by itnerd

Comcast’s disclosure is the latest damage from the Citrix Bleed vulnerability. If you’re not familiar with Citrix Bleed, this will get you up to speed. Now back to Comcast getting pwned.

Comcast just disclosed that a breach in their network between October 16 and October 19 disclosed the PII of over 35 million customers.  A reading of the Comcast Customer Notice appears to show the breach was just two weeks after Citrix had released a patch for the critical zero-day Citrix Bleed vulnerability  (CVE-2023-4966) and before they had applied the patch. 

The company said “Xfinity concluded on December 6, 2023, that the customer information in scope included” the following

  • Usernames
  • hashed passwords
  • names
  • contact information
  • last four digits of social security numbers
  • dates of birth
  • secret questions and answers

 HYAS CEO David Ratner said:

   “The criminals are literally waiting for each new zero-day to be discovered because they can pounce faster than patches can be applied.  While an efficient and effective patch strategy is critical for any organization today, it’s also quite simply not enough — operational resiliency must be added at all layers, which includes having the visibility to detect anomalies inside the organization and discover breaches in near real time, so they can be shut down and stopped before data is stolen and damage ensues.”

This is not Comcastic, it’s craptastic. And the thing is that you can expect a lot more of this over the holidays and into the new year. And that’s frightening.

UPDATE: Darren Williams, CEO and Founder, BlackFog had this comment:  

“Third-party vulnerabilities can often result in delayed patching for the company which holds customer data. While Comcast is insisting that no customers have been directly affected or ‘attacked’, this is unlikely as customer data was actively exfiltrated. This breach highlights that any company – small, medium or large – can quickly become a victim of a cyber incident. The key consideration is not “if” a breach will happen, but “when.” This makes it essential to have the proper safeguards in place to prevent data exfiltration. Stopping cybercriminals in their tracks and preventing them from obtaining the one thing they are there for: your data, is the only way to prevent a breach. Additionally, this attack brings emphasis on the need for businesses to strongly consider and assess the security measures of the vendors they work with.  With this mindset, companies can better prepare for the inevitable attack.”

Leave a comment »

Zero-Click Outlook RCE Exploits Are Being Exploited If You Haven’t Patched All The Things

Posted in Commentary with tags on December 19, 2023 by itnerd

Here’s a great reason why you should always apply patches when they come out. There are two now-patched security flaws in Microsoft Windows that could be chained by threat actors to achieve remote code execution on the Outlook email service sans any user interaction:

  • Akamai researcher Ben Barnea found two vulnerabilities in Microsoft Windows, which were assigned CVE-2023-35384 and CVE-2023-36710.
  • An attacker on the internet can chain the vulnerabilities together to create a full, zero-click remote code execution (RCE) exploit against Outlook clients.
  • The first vulnerability lies in the parsing of a path by the MapUrlToZone function. Exploiting this vulnerability requires sending a crafted email to an Outlook client, which in turn will download a special sound file from an attacker-controlled server.
  • The second vulnerability lies in the Audio Compression Manager (ACM). This vulnerability is exploited when the downloaded sound file is autoplayed, and it can lead to code execution on the victim machine. This vulnerability is described in detail in part 2 of this blog post.
  • The vulnerabilities were responsibly disclosed to Microsoft and addressed on the August 2023 and October 2023 Patch Tuesdays.
  • Windows machines with the October 2023 software update installed are protected from these vulnerabilities. Additionally, Outlook clients that use Exchange servers patched with March 2023 software update are protected against the abused feature.

Ariel Ropek, Principal Threat Researcher, Panther Labs had this comment:

Zero-click vulnerabilities are especially dangerous because they do not require any interaction from the user to be successful, bypassing the need to trick an unsuspecting human as is normally the case with phishing attacks.  The complexity of chaining multiple vulnerabilities plus the high probability of success means that zero-click vulnerabilities have historically been exploited by nation-state actors.  In September 2023, a similar zero-click vulnerability in iOS dubbed BLASTPASS was reportedly used to install Pegasus spyware targeting activists, government officials, and journalists.

Zero clicks are the worst type of exploit. Developers really need to test their code to see if there’s anything that could be used in attacks like this one.

Leave a comment »

Fubo Canada Becomes First Live TV Streaming Platform To Offer NBA TV

Posted in Commentary with tags on December 19, 2023 by itnerd

Fubo has announced the launch of NBA TV Canada through a multi-year partnership with Maple Leaf Sports and Entertainment (MLSE). The launch marks the first time NBA TV Canada is available on a live TV streaming platform. 

Starting today, subscribers can enjoy extensive basketball coverage, including games and shoulder programming, through NBA TV Canada, available in Fubo’s Premium channel plan.  

The launch further expands Fubo’s positioning as one of Canada’s leading streaming platforms. With multiple content options available at different price points, Fubo appeals to the entire family. Fubo offers consumers exclusive soccer content, including English Premier League and Italy’s Serie A and Coppa Italia, and expansive sports coverage through partners like MLB Network, OneSoccer and Fox Sports Racing. Fubo’s growing entertainment and news offering includes dozens of live TV channels and over 12,000 TV shows and movies on demand. 

Subscribers can stream Fubo programming in Canada anywhere and at any time, from their mobile device, connected TV or web browser. The Fubo app is available on Amazon Fire TV, Android, GoogleTV, Apple TV, Chromecast, Hisense, iOS, LG TV, Roku and Xbox One.  

Leave a comment »

Beeper Has A Fix For Their Latest Issues …. But It Requires A Mac

Posted in Commentary with tags on December 19, 2023 by itnerd

Earlier this week, Beeper Minin was having issues, again, with their iMessage on Android service. As I type this, at least 60% of their users are affected. And like their last outage, you can thank Apple for Beeper’s issues.

Now fast forward to today. This Reddit post says that the company has a fix that is coming tomorrow. But the Devil is in the detail:

The fact that you need a Mac needs that you have to hop through a bunch of hoops to make it work. It’s not worth it if it were me. But if you really want iMessage on your Android phone, I guess you have to do what you need to do to get your fix.

I have to wonder how long it would take before Apple shuts them down again seeing as Beeper has basically telegraphed what they are doing so that Apple can figure out how to kill it. I also wonder how long Apple is going to play cat and mouse with these guys before sending in the iLawyers.

1 Comment »

Retailers Brace For ‘Returns Tsunami’ As Salesforce Anticipates 131B Holiday Orders Returned In New Year

Posted in Commentary with tags on December 19, 2023 by itnerd

As we enter the final countdown to the festive period, Salesforce has shared a snapshot of post-Cyber Cyber Week momentum (Nov 29 – Dec 18) through data across commerce, marketing, and service from over 1.5 billion consumers shopping on retail sites:

  • Canadian sales continue to grow YoY: Over this period, Canada bucked the trend and saw 5% YoY growth in online sales
    • Meanwhile, global online sales remained flat year-over-year.
  • Retailers in for a ‘Return Tsunami’: The post-Cyber Week period saw a ‘returns tsunami’ globally. The percentage of returns more than doubled during the week following Cyber Week and has remained high since. 
    • As consumers become more discerning about discretionary spending, this increase in returns indicates the consumers may be thinking twice about their purchases and returning those that don’t provide the value they’re looking for.
    • Salesforce now predicts over US$131 billion in orders purchased this holiday season will be returned in the new year.
  • BOPIS on the rise for last-minute shoppers: In addition, shoppers are turning to the benefits of Buy Online and Pick Up In Store (BOPIS) for convenience as they look to avoid in-store lines and shipping deadlines ahead of peak holidays. BOPIS accounted for 25% of online orders during the first three weeks of December.

Please find the full mid-December moment newsroom post that provides more details here.

Leave a comment »

Real Estate & PII Data Exposed In Major Data Breach Says VPN Mentor

Posted in Commentary with tags on December 19, 2023 by itnerd

Over 1.5 Billion records belonging to New York-based Real Estate Wealth Network were exposed according to cybersecurity researcher Jeremiah Fowler, putting its users and customers at risk of many online and physical threats.The key findings are the following:

  • A total 1,523,776,691 records with a size of 1.16 TB
  • Documents revealed information about property owners, sellers, investors, and user logging data that included PII, and more.
  • Real estate-related details include famous people such as Kylie Jenner, Blake Shelton, Britney Spears, Floyd Mayweather, Dave Chappelle, Elon Musk and many others.

If you want to know more about Jeremiah’s findings, you will find all the details here: https://www.vpnmentor.com/news/report-realestatewealthnetwork-breach/

We believe it is important to share this report to raise awareness to your readers about the dangers of leaving such data open to the public, but also to notify people who may have been affected. In this specific case, if it had been discovered by ill-intentioned hackers, the data exposed could pose potential risks such as threats to the personal safety or an invasion of the privacy of the people exposed. Famous people and politicians could face potential stalking or harassment by fans or even individuals with malicious intent and the people exposed in general could face risks of phishing scams, financial fraud, identity theft and more.

Leave a comment »

Approov Identifies & Addresses Apple Watch Security Issues

Posted in Commentary with tags on December 19, 2023 by itnerd

Approov, the leader in mobile security, today revealed new data indicating that watches, wearables and new devices are now the weakest link in the mobile app threat landscape.

Key findings include:

  • Watches and other wearables now communicate directly with backend APIs and services.
  • An Apple Watch “zero-day” vulnerability was uncovered in September 2023.
  • Unless protected, watches and wearables will become a rich attack vector for hackers.
  • Approov extends its mobile RASP to Watch OS to prevent exploitation of any new zero-day vulnerabilities.

The findings were released in today’s Approov blog “Approov Addresses Apple Watch Security Issues” at this link: https://approov.io/blog/apple-watch-security-issues

Apple and MIT recently published a study indicating that 2.6 billion personal records were exposed through data breaches over the last two years. These findings underscore the need for protecting data in the cloud through mobile attestations and improved API security.

Approov, a trailblazer in mobile app and API security, addresses this threat directly with Release 3.2. The release introduces groundbreaking features, including the first commercially available App Attestation Solution for Apple WatchOS to provide API Protection against emerging threats.

The release also includes Harmony OS support and deployment of extended global Points of Presence (PoPs), and improved ease of deployment and administration.

Approov’s Runtime Application Self Protection (RASP) defenses are also strengthened by extending threat detections to include the latest versions of tools used by hackers to attack apps and APIs.

The danger is real: In September, Citizen Lab found an actively exploited zero-click Apple vulnerability which was used to deliver NSO Group’s Pegasus mercenary spyware. Apple acknowledged the threat to all their devices, issuing a specific WatchOS Security briefing (https://support.apple.com/en-mide/106360) on November 9 concerning a vulnerability in Apple Wallet on WatchOS. Apple quickly released a fix but acknowledged that “A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited”.

Approov now extends all the protections available on mobile apps to WatchOS. Approov support of WatchOS allows direct registration of WatchOS apps and ensures API protection against malicious traffic that is communicating directly from the watch to the cloud. WatchOS support is added to the existing support for Android Wearable Devices (which has been available since Version 3.0)

Approov Adds Huawei HarmonyOS Support: A Global Imperative

As a widely adopted operating system in regions such as China, India, the Middle East, and Africa, HarmonyOS plays a crucial role in the global mobile ecosystem. Recognizing the prevalence of this platform, Approov now ensures that mobile applications operating on Huawei devices are seamlessly integrated into our attestation services.

Approov attestation services traditionally supported Android and iOS devices, but the inclusion of Huawei HarmonyOS significantly broadens our platform coverage. This expansion is vital to offering a truly global solution, as any unattested mobile application poses a potential risk to API security, regardless of its geographical origin.

In collaboration with Cylab-Africa, Approov reinforces its commitment to a global solution for mobile app security. Version 3.2 extends support for Huawei app store deployments, catering to developers worldwide.

Enhanced High-Performance Worldwide Coverage

Approov expands its global network with new Points of Presence in São Paulo, Brazil and Singapore. These additions, coupled with existing points of presence (PoPs) in Europe (Dublin) and North America (California), create a worldwide low-latency mobile attestation network.

This move bolsters Approov’s commitment to achieving new levels of security by mitigating bot attacks, Man-in-the-Middle (MitM) attacks, account takeover (ATO) and other threats to mobile APIs, thus ensuring optimal performance and reducing fraud and data breaches.

New Threats are Addressed

The new release also boosts Approov’s RASP feature set to include new countermeasures against emerging and evolving threats. This includes significant hardening improvements to the SDK, including static and dynamic anti-tamper measures. Additionally, Approov’s ThreatLabs have developed further Android based detections for DobbyHook, Magisk, Zygisk, and Zygisk-Frida to fortify defenses against these advanced hacker tools. These changes augment the comprehensive suite of detections that are already implemented. In addition, the dynamic security-policy update facility will be used to improve the detection capabilities of existing deployed apps that currently use Approov’s previous SDKs.

Increased Ease of Use for DevOps/Developers

Approov continues to focus on easing the security burden for developers, DevOps and DevSecOps teams. New features simplify app registration and management, providing an automated and streamlined integration experience. The elimination of the need for individual app registrations and the introduction of tools for managing different app versions reduce complexity. Approov also enhances the registration of developer devices for testing, ensuring a secure and efficient device farm testing process.

Approov Mobile App and API Security Software Release 3.2 reaffirms the Company’s commitment to continued innovation in order to ensure there are no weak links for its customers.

Upgrades to Approov Version 3.2 will be included as part of Approov’s Software-as-a-Service Mobile Security platform. New customers can embrace the future of mobile app and API security by starting a free 30-day trial by registering at Approov.io. 

Leave a comment »

New Report to Reveal QR Code Phishing Scams: Quishing You a Happy Holiday Season

Posted in Commentary with tags on December 19, 2023 by itnerd

Netcraft has releasee a new report, Quishing You a Happy Holiday Season, revealing QR Code phishing scams, looking at the threat from QR code-based phishing, why cybercriminals are adopting this technique, and how to detect and disrupt these attacks at scale.

From a cybercriminal’s perspective, there are several reasons to use QR codes for phishing, often dubbed quishing, including hiding URLs from users, bypassing security tools, and circumventing corporate controls.

Netctraft demonstrates the anatomy of a QR code scam with examples of phishing emails, including an email targeting Microsoft in which there’s a QR code, a phishing site designed to capture victims’ account credentials, and targeting DocuSign with a QR code that directs the victim to a malicious website. 

You can read the report here.

Leave a comment »

Jscrambler Serves Up Their Predictions For 2024

Posted in Commentary with tags on December 19, 2023 by itnerd

Pedro Fortuna, CTO and Co-Founder, Jscrambler has shared with me his predictions for 2024. He’s got three of them to share:

JavaScript Targeted Attacks Accelerates

“In 2024, we predict organizations will encounter persistent challenges concerning their JavaScript and its associated cybersecurity vulnerabilities. Driven by Large Language Models (LLMs), attacks will become more advanced and written with higher levels of speed and sophistication, enabling accelerated learning and control circumvention. Companies will have to evolve their security strategies and implement measures, such as JavaScript code protection, that prevent LLM-powered threats from leveraging early automated learning steps.”

3rd-Party Tag Leakage Fueled by LLM

“Additionally, we anticipate an exponential increase in the leakage and misuse of consumer data collected by 3rd-party tags. Marketing, analytics and payment tag vendors pressured to compete in the market will utilize LLM to improve customer experiences and differentiate services. This will require an increased amount of consumer PII data to be collected which will often go uncontrolled and unmonitored. This collection and processing of more consumer data will have direct and negative consequences on consumer privacy. Therefore, it is imperative for web owners to proactively prepare themselves for this shift and safeguard consumer data through the implementation of 3rd-party script and tag controls. Without proper controls on the collection of consumer data by LLM, it may be too late to prevent the data from being used to train the LLM models, resulting in irreversible consequences. Once done, there’s a risk of potential data leaks by the LLM, as the security of LLMs is still in its infancy.”

PCI v4.0 Moves to Action

“With the increase in JavaScript abuses and e-skimming attacks, we saw the evolution of standards including PCI v4.0 to improve payment page security. While 2023 was the year of preparation for the new PCI v4.0 requirements, 2024 will transition from education to action, as it brings us closer to PCI v4.0 taking mandatory effect in 2025. Companies will quickly move from standards research to vendor research, selection and implementation to effectively prepare for the new 6.4.3 and 11.6.1 payment page security requirements. The best-prepared companies will assess current 3rd-party tag usage and business authorization processes before implementing new technology.”

Leave a comment »

Abnormal Security Highlights Real-World Examples of AI Weaponized For Cyberattacks In 2023

Posted in Commentary with tags on December 19, 2023 by itnerd

Abnormal Security is reporting on real-world AI-generated malicious emails their customers have received in the last year, with the attack examples from 2023 pointing to threat actors who have embraced the malicious use of AI, including: 

  • A malware attack in which the threat actor poses as an insurance representative and informs the recipient that attached to the email contains benefits information and an enrollment form that must be completed/returned. If the recipient fails to do so, they are told they may lose coverage.
  • Netflix impersonator compromises a legitimate domain in a credential phishing attack, where the threat actor poses as a customer service representative from Netflix, claiming that the target’s subscription has expired. 
  • A cosmetics brand impersonator attempts invoice fraud in a billing account update attempt, posing as a business development manager for cosmetics company LYCON, and informs the recipient of irregularities in their balance sheet noticed during a mid-year audit. 

Even though generative AI has only been used widely for a year, it is evident that the potential is there for widespread abuse. The attacks shown here are well-executed but are only the beginning of what is possible. 

You can view the report here.

Leave a comment »

« Older Entries