Archive for January 13, 2024

SentinelOne Comes Across A New Python-Based Hacking Tool Known As FBot

Posted in Commentary with tags on January 13, 2024 by itnerd

There’s new research by SentinelOne about a Python-based hacking tool known as FBot capable of credential harvesting for spamming attacks, and AWS, PayPal and SaaS account hijacking:

FBot is unique in that it does not apparently adapt the Androxgh0st code so common among similar hacktools, though the earliest reference to FBot is one year more recent than the first sighting of Androxgh0st. However, there are several connections to the Legion cloud infostealer, making it likely the Legion maintainer adapted code from FBot into their tool.

FBot is primarily designed for actors to hijack cloud, SaaS, and web services. There is a secondary focus on obtaining accounts to conduct spamming attacks. Actors can use the credential harvesting features to obtain initial access, which they can sell to other parties.

The tool contains assorted utilities, including an IP address generator and port scanner. There is also an email validator function, which uses an Indonesian technology service provider to validate email addresses.

 Ken Westin, Field CISO, Panther Labs had this comment:

Many organizations rely on the vendors to provide security for their cloud platforms and often do not have full visibility into what is happening in their cloud environments. We will continue to see threat groups focus on attacking cloud applications and services, as this is where most corporate data resides, these tools will continue to evolve in maturity and leverage APIs to compromise cloud assets.

The fact that “the cloud” is still a bit of a black box where you have to trust the provider is a problem. But unless there’s full transparency about what goes on behind the curtain, it will allow threats like these to exist, and affect end customers.

Leave a comment »

POC Exploit Released On NextGen Mirth Connect Pre-Auth RCE Vulnerability

Posted in Commentary with tags on January 13, 2024 by itnerd

Horizon3.ai Chief Architect Naveen Sunkavally has just released “Writeup for CVE-2023-43208: NextGen Mirth Connect Pre-Auth RCE” (linked below), which includes a proof of concept exploiting the vulnerability. 

Mirth Connect is considered the Swiss Army knife of healthcare integration engines, specifically designed for HL7 message integration. It provides the necessary tools for developing, testing, deploying, and monitoring interfaces, and supports data exchange and communications across various systems.

Sunkavally said: “In Oct. 2023, we released an advisory for CVE-2023-43208, a pre-authenticated remote code execution vulnerability affecting NextGen Mirth Connect. Mirth Connect is an open source data integration platform widely used by healthcare companies. This post dives into the technical details behind this vulnerability, which is ultimately related to insecure usage of the Java XStream library for unmarshalling XML payloads. If you’re a user of Mirth Connect and haven’t patched yet, we strongly encourage you to upgrade to the 4.4.1 patch release or later. This is an easily exploitable vulnerability that our own pentesting product, NodeZero, has exploited successfully against a number of healthcare organizations.

CVE-2023-37679: CVE-2023-43208 arises from an incomplete patch for CVE-2023-37679, also a pre-auth RCE, reported by IHTeam. CVE-2023-37679 was reportedly patched in Mirth Connect 4.4.0, which was released on Aug 2, 2023. In the release notes for 4.4.0, we found it odd that this vulnerability was reported to affect only Mirth Connect versions running Java 8.

Naveen added: “At the time of our advisory in October, there were ~1300 Internet-facing installs of Mirth Connect. Attackers would most likely exploit this vulnerability for initial access or to compromise sensitive healthcare data. On Windows systems, where Mirth Connect appears to be most commonly deployed, it typically runs as the SYSTEM user.”

Links:

CVE-2023-43208: NextGen Mirth Connect Pre-Auth RCE: https://www.horizon3.ai/writeup-for-cve-2023-43208-nextgen-mirth-connect-pre-auth-rce/ (includes proof of concept, dated January 12, 2024)

NextGen Mirth Connect Remote Code Execution Vulnerability (CVE-2023-43208): https://www.horizon3.ai/nextgen-mirth-connect-remote-code-execution-vulnerability-cve-2023-43208/

Leave a comment »

Canada’s Cyber Centre Contracts Grading Platform For Critical Infrastructure

Posted in Commentary with tags , on January 13, 2024 by itnerd

Yesterday, The Canadian Centre for Cyber Security said it contracted SecurityScorecard and intends to use its rating platform to rank cyber threats for the country’s critical infrastructure.
 
Instantly, any critical infrastructure entity can be graded with a rating from “A” through “F” using continuously monitored threat intelligence data. The scoring platform’s intention is to help the Cyber Centre educate critical infrastructure organization operators on the risks they face and assist them in remediating and measuring cybersecurity risks.

“According to the World Economic Forum, critical infrastructure remains the prime target for threat actors. Our partnership with SecurityScorecard provides us with authoritative and trusted data on critical infrastructure and insight to manage such risks at scale. […] This will help the Cyber Centre ensure we can provide tailored support to critical infrastructure owner-operators vital to the security of Canada,” Cyber Centre head Sami Khoury said in a statement.

The partnership “serves as a model for other governments to collaborate with the private sector to achieve real-time visibility into the cyber threats facing critical infrastructure,” said Sachin Bansal, SecurityScorecard’s chief business officer.
 
The scoring platform is only for critical infrastructure operators and won’t be made public.

Troy Batterberry, CEO and Founder, EchoMark:

   “Cyber threats in today’s digital landscape are becoming increasingly sophisticated and pervasive. The importance of implementing cybersecurity measures cannot be overstated. The Canadian Cyber Centre’s decision to leverage SecurityScorecard’s tools is a testament to the growing need for dynamic and data-driven approaches in protecting critical national infrastructure.

   “This partnership between the Canadian Cyber Centre and SecurityScorecard exemplifies the type of collaboration and commitment to cybersecurity excellence that we strive for in our own operations. By prioritizing the identification and mitigation of cyber risks, we not only protect our own assets but also contribute to the broader security and resilience of the industries and communities we serve.”

David Ratner, CEO, HYAS Infosec:

   “The protection of critical infrastructure is, not ironically, increasingly critical as we see cyber intrusions cross the chasm from simple financial damage and harm to significant impact on human life. Having the ability to grade critical infrastructure is a great start and paves the way for programs that standardize not just cyber protection but real operational resiliency.  Only by shifting the conversation from one around pure prevention to one focused on resiliency and continuity of service will we be able to truly protect critical infrastructure and, in doing so, reduce the potential for impact on human life.”

While the Canadian citizen in me wishes that a Canadian company could have been found for this, I do applaud this move. One of the best ways we make ourselves safer is to work together to secure as much as possible. So if this move helps to achieve a positive outcome, I am all for this.

Leave a comment »

PaperCut Vulnerability Deep Dive: Seemingly Minor Issues When Chained Together Enable Pwnage Says Horizon3.ai

Posted in Commentary with tags on January 13, 2024 by itnerd

Horizon3.ai Chief Architect Naveen Sunkavally has just published “Writeup for CVE-2023-39143: PaperCut WebDAV Vulnerability,” a deep dive into the technical details behind a critical vulnerability that affects Windows installs of the PaperCut NG/MF print management software, and brute force explanation. The vuln can be exploited to download and delete arbitrary files, and in certain configurations upload files, leading to remote code execution.

Naveen notes that the vuln is “something that a patient determined attacker may choose to exploit in certain targeted scenarios and an interesting case study of how a bunch of seemingly minor issues can be chained together to achieve total compromise.”

The deep dive details brute forcing, and notes that CVE-2023-39143 is made possible by a series of seemingly minor issues:

  • Weak authentication to the WebDAV endpoint
  • Lack of rate limiting of authentication attempts to the WebDAV endpoint
  • Not limiting HTTP methods invoked over WebDAV
  • Path traversal in the third party net.sf.webdav package
  • Path traversal in the CustomReportExample servlet
  • Using UUIDs to authenticate a site server to a PaperCut server
  • Hardcoded credentials to access the External Device XMLRPC API

PaperCut users exposing it to the Internet that haven’t yet updated to 22.1.3+ are urged to do so, and the deep dive also recommends mitigation steps if upgrading is not immediately possible.

Horizon3.ai Writeup for CVE-2023-39143: PaperCut WebDAV Vulnerability: https://www.horizon3.ai/writeup-for-cve-2023-39143-papercut-webdav-vulnerability/

Horizon3.ai August 4, 2023 Advisory: CVE-2023-39143: PaperCut Path Traversal/File Upload RCE Vulnerability: https://www.horizon3.ai/cve-2023-39143-papercut-path-traversal-file-upload-rce-vulnerability/

PaperCut NG/MF Security Bulletin (July 2023): https://www.papercut.com/kb/Main/securitybulletinjuly2023/

Leave a comment »

BullWall names Steen Lomholt-Thomsen CEO, Kerry Grimes as EVP/Chief Partner Officer

Posted in Commentary on January 13, 2024 by itnerd

BullWall have announced the appointments of Steen Lomholt-Thomsen as Chief Executive Officer and Kerry Grimes as EVP and Chief Partner Officer, and recognized several 2023 benchmarks and growth indicators, marking the company’s most aggressive growth year since its launch in 2017.

Steen most recently served as BullWall Chairman of the Board and Chief Revenue Officer of Clarivate, a frontrunner in advanced analytics software, and was previously Chief Revenue Officer of Aveva, a global leader in industrial software. Steen also brings extensive experience in enterprise software, SaaS sales, and general management gained from roles at IBM, HP, and IHS (now S&P Global). With a robust track record in commercial scaling, business growth, sales transformation, and M&A, Steen has consistently demonstrated his ability to drive success and commercially scale companies across various sectors of the technology industry.

Kerry brings to BullWall a proven track record of leading large-scale transformations and managing change at the enterprise level. He was most recently Global Head of Partners for Aveva, where he managed relationships with over 5,000 partners, and aided customers of all sizes in achieving effective, profitable digital transformations. He was previously Divisional Vice President of Global Partners for PTC Inc. and drove a highly partner-driven market and operations expansion. Kerry is also a recognized global channel executive within the channel community and brings over 20 years of international experience including being President of PTC China.

In addition to the North American launch of its award-winning ransomware containment solution, Steen noted other major product benchmarks BullWall achieved in 2023. In particular, the global launch of BullWall Server Intrusion Protection (SIP), which brings multi-factor authentication (MFA) behind the firewall to protect servers and thwart breach attempts. SIP protects RDP sessions – the entry point for 50 percent of all ransomware deployments — with MFA that detects and entraps unauthorized users, preventing their ability to install ransomware or perform other nefarious actions while also identifying and isolating any compromised device or credentials. This innovative approach to MFA does not require a second device, resulting in a user experience so frictionless that users are happy to fully deploy it for every server login, a requirement most are unaware is mandatory to be compliant with most cybersecurity insurance policies.

BullWall also announced several financial benchmarks for 2023 including:

  • 50 percent growth in ARR in just one year, reflecting both the increasing demand for BullWall worldwide and the Company’s successful entry into the North American market.
  • A 40 percent increase in headcount (FTEs), with particular emphasis in building out sales and marketing.
  • 32 percent growth in new customer acquisition – BullWall now serves more than 1,000 customers.
  • A 135 percent growth in partners over the last two years, further broadening BullWall’s market reach.

Recent research conducted by market researchers at Cybersecurity Insiders underscores the need for BullWall. It reveals that 79 percent of cybersecurity professionals surveyed believe their organization is likely to be targeted by a malware/ransomware attack in the next 12 months, and 77 percent incorrectly believe their endpoint security solution (EDR) can sufficiently protect their servers against malware attacks. Moreover, only 35 percent were confident in the organization’s current ability to remediate ransomware after it locks or encrypts data within their systems, and 35 percent mistakenly believe they can recover from an attack in a few days, despite research showing that recovery averages months.

Leave a comment »