OpenSSL Announces “Critical” Fix Slated For Next Week

Posted in Commentary with tags on October 28, 2022 by itnerd

The OpenSSL project team put out an announcement earlier this week that a “critical” fix was coming next week: 

The OpenSSL project team would like to announce the forthcoming release 
of OpenSSL version 3.0.7.

This release will be made available on Tuesday 1st November 2022 between 
1300-1700 UTC.

OpenSSL 3.0.7 is a security-fix release. The highest severity issue 
fixed in this release is CRITICAL:

Now of course OpenSSL isn’t going to say what the issue is before the fix is available. But the fact that they called it “critical” means that it is not good and that if you use OpenSSL, you should upgrade to this release ASAP. Another data point, the last time that OpenSSL issued a critical vulnerability patch was in 2016, and this is just the second patch to be assigned a critical rating. So you know it’s bad. Whatever it is.

Mattias Gees, Container Product Lead at Venafi had this comment:

The announcement of the new OpenSSL critical vulnerability immediately brought back not-so-fond memories of Heartbleed or – more recently – the Log4J vulnerability. Heartbleed had a significant impact on all operations teams worldwide, and since then IT infrastructure has become 10 times more complicated. When Heartbleed was discovered, the majority of IT organizations were using dedicated hardware or virtual machines (VMs). But now we are in the Cloud Native era, which has created advanced containers and serverless architectures.

The attack vector has become a lot larger, and rather than just having to examine their VMs,  organizations need to start preparing to patch all their container images in response to this announcement. Hopefully, the Log4J vulnerability triggered a lot of teams to audit their dependencies. If this is the case, these steps will help teams quickly roll out a targeted fix on their infrastructure. SBOMs (Software Bill of Materials) of all container images are a great start to gaining those insights into the dependencies in your applications and infrastructure.

We also now know that OpenSSL versions prior to 3.0 are not impacted, and a lot of operating systems use OpenSSL 1.1, so these environments won’t be impacted. This knowledge will allow cybersecurity and operations teams to dismiss large sections of their infrastructure, and hopefully make the impact of this vulnerability smaller than initially expected. But platform engineering teams should keep investing in better auditing of their environments and their dependencies for the next threat, which is always just around the corner.

If this applies to you, I would keep an eye out on November 1st for this release and be prepared to apply patches as it is a safe bet that the bad guys are going to reverse engineer what this patch addresses and use it to launch attacks. I say that because if this was an active attack vector, I suspect that the patch would be out immediately. Thus while sysadmins have some time, it likely will not be a lot of time to patch this once the patch is out.

1 Comment »

Kayne West Punted From Apple Music

Posted in Commentary with tags on October 28, 2022 by itnerd

It seems that the anti-semite Kayne West has more issues than being dropped by a whole lot of companies. Now it seems that he’s been quietly pulled from Apple Music:

While West’s discography remains intact, a search for the platform-generated playlist — which features a comprehensive, career-spanning collection of an artist’s music — garners no results beyond a blank loading screen. A search for the separate visual playlist, Kanye West Video Essentials, yields the same results. 

A rep for Apple Music did not immediately respond to Rolling Stone’s request for comment. 

That’s going to ratchet up pressure on Spotify to do the same thing. But I am not holding my breath because if they didn’t pull Joe Rogan over COVID vaccine misinformation, there’s zero chance that they will do so with Kayne West. In fact their CEO said as much. Which if you care about making racism of all forms completely unacceptable, that should guide you as to which streaming platform that you should be paying on a monthly basis.

Leave a comment »

New OT/ICS Cybersecurity Report Finds Defences Getting Stronger & Postures Maturing As Risks Remain High

Posted in Commentary with tags on October 28, 2022 by itnerd

Nozomi Networks has released its new report, The State of OT/ICS Cybersecurity in 2022 and Beyond, which uncovers that ICS cybersecurity threats remain high as adversaries set their sights on control system components. 

In response, organizations have significantly matured their security postures since last year. Despite the progress, more than a third don’t know whether their organizations had been compromised, and attacks on engineering workstations doubled in the last 12 months. 

Here’s a geographical breakout of the survey respondents:

And here’s an infographic with top level details:  

You can see the full results here.

The 2022 SANS ICS/OT survey received 332 responses representing various industry verticals from energy, chemical, critical manufacturing, nuclear, water management, and several others. Of the 63 subcategories across these verticals, many respondents are sub-classified in electricity, oil and gas, equipment manufacturing, specialty chemicals, transportation equipment manufacturing, drinking water, and engineering services. 

Leave a comment »

Sustainable Tech Gift Ideas For The Conscious Consumer From HP

Posted in Commentary with tags on October 28, 2022 by itnerd

Every year consumers are becoming more mindful of a gift’s journey they give to their loved ones, such as where the gifts are made, who they’re made by and what impact they have on the environment. This year, Canadians can take it one step further by purchasing gifts that are built with sustainability in mind and give back to the planet, too.

Listed below are a few gift ideas from HP for everyone on your list:

HP ENVY Inspire: For the family who is always on the go

Whether it’s printing a holiday recipe or making a festive craft, this versatile printer is designed for every kind of family fun. The HP ENVY Inspire delivers one-of-a-kind printing capabilities with custom two-sided printing and never lets you run out of ink with HP Instant Ink. This smart ink subscription automatically detects when your printer is running low and orders ink cartridges right to your door. The cartridges are smart for the planet too, as they require less packaging and fewer shipments – reducing energy usage by 69% and water usage by 70%.

Starting at $209.99

HP Laser Jet Pro: For the loved one with an entrepreneurial mind

Designed for small business owners, the HP LaserJet Pro Series printers have business-ready features that create a hassle-free printing experience and allow the entrepreneur in your life to focus on the things that matter most to their business. Combined with HP+, this secure and smart printing system is built with sustainability in mind, as for every page printed HP protects or restore forests through their Forest First initiative for the life of the printer.

Starting at $579.99

HP ENVY x360: For the student in need of a laptop upgrade 

The HP ENVY x360 is a portable 2-in-1 laptop with a flexible 360 design, so the student in your life can level up both their work and creativity no matter where they are. As part of the world’s most sustainable PC portfolio, this ENERGY STAR certified laptop is also made with sustainable materials like ocean-bound plastics and recycled aluminum.

Starting at $1399.99

OMEN Gaming Laptop: For the gamer who is looking for a dynamic gaming experience 

HP’s OMEN Gaming Laptops are the perfect gift for the gamer who works hard and plays harder on your holiday list. This high-performance laptop brings a dynamic experience to gaming and is designed with ocean-bound plastics as well as recycled plastic and aluminum.

Starting at $1999.99

Leave a comment »

Elon Musk Gets Called Out By The EU Commissioner On Twitter…. This Might Be Fun To Watch

Posted in Commentary with tags on October 28, 2022 by itnerd

Elon Musk hasn’t owned Twitter for 24 hours yet and already he’s getting called out by people because of his takeover of the social media platform. A reader pointed me towards this interesting Tweet from European Commissioner Thierry Breton with a response from Musk:

One thing to point out is that earlier this year, Breton had reminded Musk that his free-speech focus on Twitter would be limited by the EU’s own content-moderation laws. Something that I suspect didn’t go over well with Musk. Breton then traveled to Texas in May where the two said there was “no disagreement” over their approach to content. Here’s proof of what came out of that meeting:

But here’s the headwind that Musk is facing. The EU’s Digital Services Act gives the EU the power enforce rules governing how tech companies moderate content and to decide when they must take down illegal content. If Twitter under Musk’s control doesn’t comply, Twitter will face fines of as much as 6% of annual sales and could even be banned. Which would be expensive for Musk as the EU is a huge market that Musk cannot simply decide to ignore. And the EU decided to remind Musk of this, via a Tweet:

Thus I suspect this might be the start of a fight between Musk and the EU once Musk starts to push his free speech at all costs agenda. And if he gets into a fight with the EU, he’ll lose. Just ask Google and Microsoft who fought the EU and lost.

This might be fun to watch.

Leave a comment »

Guest Post: Analysis of malware exploiting Android accessibility services

Posted in Commentary with tags on October 28, 2022 by itnerd

On Android and iOS, accessibility features are available to help people use their smartphones: audio comments, subtitles, custom display… Some mobile applications designed with an inclusive approach are compatible with accessibility services.

To enable these services in an application, it requires the accessibility permission. But this permission gives applications full access to the user’s device. Today, more and more cybercriminals are leveraging it to take control of smartphones and tablets. When this happens, users find themselves in a bind, unable to uninstall the app or even reset their device.

Recently, the Pradeo Security solution neutralized an application using Android accessibility services for malicious purposes on a protected device. The identified malware was installed through a phishing link. It pretends to be a QR code scanning application but actually exploits the accessibility permission to perform fraudulent banking transactions.

The risks of mobile accessibility services

An application can use the android.permission.BIND_ACCESSIBILITY_SERVICE permission in order to benefit from advanced features facilitating accessibility to users with disabilities. With this permission, an application can control the whole screen (clicks, moves…) as well as the keyboard, read what is displayed and close or open applications.

These features are sensitive because they enable the control of almost all layers of a device. When a malicious application is granted the accessibility permission, it can send all the information displayed on the screen and typed on the keyboard to a remote server, prevent its own removal or a system reset, and even launch itself automatically when the device is rebooted. Unfortunately, the distribution channels used by hackers such as unofficial application stores and messaging services (SMS) do not provide any protection against this threat.

Case study: QR-Code Scanner

Name of the analyzed app: QR-Code Scanner

Package name: com.square.boss

OS: Android

The “QR-Code Scanner” application appears as a QR code scanning application. Its icon and name are not suspicious. However, when launched, no QR code scanning functionality is offered.

Immediately, the application sends a notification that urges to grant the accessibility option, which is necessary for the execution of its attack. As long as the user does not allow it, it continuously sends the same permission request.

Once authorized, the malware can silently approve its own permission requests in place of the user. Thus, it grants itself all the permissions that will allow it to carry out its attack.

In this case, our analysis of the malware suggests that the goal of the hacker behind the application is to commit fraud, by collecting data that the user types or displays on his screen (login, password, credit card numbers …) and intercepting the temporary authentication code sent.

First, the QR-Code Scanner application accesses the list of applications installed on the victim’s device to gauge interest. When banking or e-commerce applications are used, there is a greater chance that banking data is manipulated by the user. When it happens, the hacker collects them.

To enter the victim’s account or make a payment with his credit card, the hacker intercepts the one-time password contained in an SMS or a notification. Hence, he bypasses all security measures that authenticate payments and connections using a code. Only verification protocols that use biometric data are safe at this point.

Finally, the application uses the victim’s phone to spread to other devices. To do this, it sends an SMS containing a phishing link to the entire contact list. This way, the message comes from a known number and has a better chance of convincing the recipients to install the malware.

Throughout the attack, the malware exploits accessibility services to:

  • Spy on users activity
  • Grant and prevent the rejection of the permissions it needs
  • Prevent removal of the application, either from the homepage or from the settings
  • Prevent factory reset, even from a third-party device
  • Prevent sleep or shutdown of its process
  • Launch at startup

The permissions used by the malware are the following:

android.permission.QUERY_ALL_PACKAGES

android.permission.QUICKBOOT_POWERON

android.permission.RECEIVE_LAUNCH_BROADCASTS

android.permission.GET_TASKS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.RECEIVE_SMS

android.permission.READ_SMS

android.permission.WRITE_SMS

android.permission.SEND_SMS

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.intent.action.BOOT_COMPLETED

com.htc.intent.action.QUICKBOOT_POWERON

android.intent.action.QUICKBOOT_POWERON

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.QUICKBOOT_POWERON

Protective measures

Despite the undeniable need for accessibility services, the advanced rights they offer on the system mean that they must be used (on the developer side) and authorized (on the user side) with due consideration.

Today, only a few tools and remediation actions are effective to neutralize the analyzed malware:

  • Blocking the application before launching it with Pradeo Security
  • Forcing the uninstallation of the application with Pradeo Security for Samsung
  • Uninstalling via a device management solution (UEM, MDM)
  • Uninstalling via ADB command

Leave a comment »

Breaking: Musk Appears To Have Taken Over Twitter….. Many Top Execs Gone

Posted in Commentary with tags , on October 27, 2022 by itnerd

It appears to be official. Elon Musk appears to have taken over Twitter. And the bloodshed has begun:

Twitter CEO Parag Agrawal and chief financial officer Ned Segal have left the company’s San Francisco headquarters and will not be returning.

Musk had until Friday to complete his $44 billion acquisition of Twitter or face a court battle with the company.

Well, that didn’t take long. Expect more changes from Musk to come. Not all of them good. And expect unhappy users to flee the platform.

1 Comment »

Cybersixgill Finds Compromised Sports Streaming Credentials On the Underground

Posted in Commentary with tags on October 27, 2022 by itnerd

Cybersixgill has found that hackers are selling compromised sports streaming passwords on the underground. Specifically, over the past 2 years, Cybersixgill has found 31,324 posts sharing or selling streaming accounts on underground forums, markets, and messaging platforms and 17,978 posts in access markets that included credentials for a streaming service of pro sports leagues such as the NBA, NFL, MBL, and NHL.

Knowing that games have been increasingly broadcasted on cable television and subscription-only networks that cost hundreds of dollars, hackers are broadening their scope of techniques to harvest credentials. 

You can find out more about this here.

Leave a comment »

New CISA Cybersecurity Performance Goals For critical Infrastructure Announced By DHS

Posted in Commentary with tags , on October 27, 2022 by itnerd

This morning, the Department of Homeland Security released the new Cross-Sector Cybersecurity Performance Goals (CPGs) to provide baseline cybersecurity goals that are consistent across all critical infrastructure sectors. The CPGs identify and prioritize the most important cybersecurity practices for critical infrastructure operators and provide an approachable common set of IT and OT cybersecurity protections to improve cybersecurity across our nation’s critical infrastructure. 

The security directives were developed by CISA, in coordination with NIST, following the mandates set out in the Biden administration’s July 2021 national security memorandum to improve cybersecurity for critical infrastructure control systems.

Robert M. Lee, CEO and Co-Founder of Dragos had this commentary on these security directives:

“CISA has shown their commitment to working alongside the industrial cybersecurity community with the release of the common baseline Cross-Sector Cybersecurity Performance Goals (CPGs). CISA took extensive input and feedback from industry stakeholders and this updated guidance reflects that they were listening closely, providing actionable but not overly prescriptive guidance – exactly the type of support the community has been requesting. It allows asset owners and operators to work towards shared goals while giving them the flexibility and expertise to implement them in ways best suited to their organizations and risks. Most of the CPGs map closely to the critical controls needed for strong OT cybersecurity—namely, having an incident response plan, a defensible architecture, visibility and monitoring, secure remote access, and key vulnerability management. This guidance can help lift industrial cybersecurity standards across the board to better protect our nation’s critical infrastructure. CISA’s continued focus on OT cybersecurity as foundational to national security, and distinct from IT cybersecurity, is an important contribution to the community’s advancement.”

This is the sort of thing that will help to make us all safer and I hope that this is adopted widely so that things like ransomware and other sorts of attacks become less prevalent.

UPDATE: I have a second comment from Yotam Perkal, director of vulnerability research for software security firm, Rezilion:

General impression from the document:

I think the direction CISA chose to take with the CPG is very good. I hope that having the document written in an approachable language, easy to digest, and focused on the fundamentals, will help with adoption. The main underbelly in terms of cybersecurity risk are not the mature, modern enterprises with huge security budgets and an abundance of security controls. Rather, it is the long tail of organizations, without mature cyber programs or procedures in place. For these organizations, a resource such as the NIST Cybersecurity Framework might be overwhelming. If these organizations adopt and implement the bare-minimum recommendations in the GPG, it could go a long way in terms of improving the overall security posture across the US. I also like the fact that CISA is promoting discussion around the guidelines and soliciting for feedback using the discussion page on GitHub

Specifically regarding the Vulnerability Management section:

I think the recommendations are valid and are reasonably straightforward to implement. That said, in order to implement some of them (such as “mitigating known vulnerabilities” and “no exploitable services on the internet”) there is a preliminary stage that isn’t mentioned in the guidelines which is having visibility into your organization’s exploitable attack surface. Assuming that the long tail of less mature organizations have that visibility is a stretch.We have seen evidence to that when we did our Vintage Vulnerabilities research which found over 4.5 million internet-facing devices that are vulnerable to vulnerabilities discovered between 2010 to 2020 that are known to be actively exploited in-the-wild (on the CISA known exploited vulnerabilities catalog). Specifically in the critical infrastructure domain, Security professionals have to be also aware of the capabilities and limitations of their vulnerability scanning tools. As we have shown in our latest research both open-source and commercial scanners and SCA tools are prone to a significant amount of false-positive and false-negative results. For example, when scanning OT assets, a vulnerability scanner without the ability to identify vulnerable components within compiled code will have significant blindspots when it comes to the known vulnerabilities it will be able to identify.

UPDATE #2: Tyler Reguly, senior manager, security R&D at HelpSystems, says:

“The most important take away there is that these goals were selected to address risks to the nation as well as individual entities. This is a big shift from other well-known baseline documents, such as the CIS Benchmarks or the NIST Security Guidance. At the same time, this is not a complete guide, it is a starting point to ensure organizations are all starting on the same footing.”

Leave a comment »

New Research Finds 73% of Organizations will Increase AppSec investment in 2023 as Log4j Anniversary and Recession Looms

Posted in Commentary with tags on October 27, 2022 by itnerd

Invicti has released the firm’s latest research report, which found:

  • 73% of organizations anticipate that they’ll increase their AppSec investments in 2023.
  • 97% of DevSecOps teams say they ignore a real vulnerability at least once a month because they assume it is a false positive.
  • Developers are pushing code with known vulnerabilities due to pressure to deliver.

With the upcoming Log4j anniversary in early December, the 2 year anniversary of the SolarWinds attack and a recession pressuring security budgets, Frank has found that application security is a top priority for CISOs as nation-states, like China, scan for vulnerabilities as a prime attack vector.

You can read that research report here.

Leave a comment »

« Older Entries
Newer Entries »