Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for How a Spook.js attac ...

 Threats

By comparison, a phishing attack makes sense: Click a link, land on a malicious page, enter some details, and an attacker steals them. Try this one on for size, instead: Click a link and an attacker steals your data. That’s right, today we’re talking about malicious pages that exploit a fundamental CPU   show more ...  

feature to steal data without requiring a victim to enter anything. And the vulnerability in question is very difficult, if not impossible, to fix. In 2018, researchers proved the scenario was theoretically possible, unveiling the first two variants of the Spectre vulnerability. Three years later, September 2021 saw the first real-life attack using Spectre v1. Known as Spook.js, the attack concept is complicated, but we will try to strip it down. Spectre v1 background News of the first two attacks of this family — Spectre and Meltdown — broke in 2018. The attacks exploited the branch prediction mechanism, which is designed to speed up command execution, found in all modern CPUs. When a user enters a password to log in to a website, if the password is correct, one set of instructions is executed. If not, another set is executed. However — and this is where the branch prediction kicks in — before receiving the answer, the CPU starts executing the set of instructions it thinks it will most likely need. In our example, if the password has been entered correctly a hundred times before, the CPU will assume that this time will be no different. If it guesses correctly, the user gets a performance boost. If not, the CPU discards the speculatively executed instructions and runs the other set. In a Spectre-vulnerability attack, an attempt is made to read a data area to which the program does not have access. In the first stage of the attack, multiple calls are made to open-access data areas, whereby the branch prediction system is “trained” to perform the forbidden read operation as well. Using branch prediction, the CPU performs the operation in advance because it is used to the program asking to read data that it is actually allowed to read. But a check reveals that the program is prohibited from accessing the data, so the speculatively executed computations are discarded. So far, so good — but the data read by the CPU is stored for some time in the cache, the CPU’s own memory. Next comes the most interesting part: With no way to read the confidential data from the CPU’s cache directly, the malicious process deploys a so-called side-channel attack to steal it. That involves measuring the speed of access to certain information. If it’s relatively small, that means the data is located in the cache. If large, it is loaded from regular RAM. A set sequence of read attempts results in a leak of the secret information. The result is a fundamental CPU flaw whose only fix is to disable branch prediction completely, thus seriously affecting performance. That said, Specter attacks do have many limitations: The attacker must be able to execute program code on the target computer or mobile device; The attack requires a specific target program coded so as to create the conditions for a successful attack; Even if the attack is successful, data extraction is extremely slow — tens or hundreds of bytes per second — and read errors are far from impossible; In general, stealing the intended secret data, such as passwords, encryption keys, and so forth, requires a combination of conditions. Spook.js — real-life application of Spectre v1 We might conclude that Spectre isn’t all that dangerous. After all, if an attacker can execute code on a target computer, exploiting one of the many vulnerabilities in the operating system or installed programs to escalate privileges and steal data would be far simpler. That is true, but modern Web pages also contain large amounts of program code that gets executed on the user’s computer, in the browser. That’s how Spook.js attacks exploit the Spectre v1 vulnerability: An infected page loads, the browser executes the code, and the cybercriminal steals confidential data. The authors of the report demonstrated some practical attacks. First, they stole a user password from Tumblr. Second, they stole data from Lastpass. Third, they intercepted a user-uploaded image from private storage on a Google server. A feature of the Google Chrome browser made it all possible. Since the release of information about Spectre, Chrome’s developers have taken measures to ward off potential attacks by forcing websites to load in isolation. Because each website creates its own process, malicious code on one page cannot be used to steal data from another resource. But there is one exception: Multiple pages from the same site or domain are grouped together in a common browser process. If the malicious code (written in JavaScript, hence the .js in the name of the attack) is run on one of them, data on other pages can be stolen. Spectre.js attack on Tumblr As a collective blog, Tumblr can host malicious code, at least in theory. That way, with a malicious page open in one tab, if a user tries to log in to their account on the service in another tab, the browser saves and automatically fills in the username and password — which the malicious code can then steal. By exploiting the Spectre vulnerability, an attack can interact tangentially with another tab from the same site and steal data by indirect means. A successful attack using this approach leaves almost no traces. Specter.js attack on LastPass The attack on the LastPass password manager was different in that the code to steal data using Spectre v1 was embedded in a malicious extension for Google Chrome. The LastPass extension was also running in the browser. In some cases, the extensions are also executed in a common browser process, making data theft possible. Specter.js attack on Google Cloud Storage Another example uses attacks on Google cloud storage: One browser tab contains a malicious page hosted on sites.google.com; another lets users upload images to their private storage in the G Suite service. In this scenario, an attacker can use malicious code to gain access to the images. Original image (left) and the one stolen from Google cloud storage using a Spook.js attack. Source Method limitations Researchers have shown how the attack can be carried out on different CPUs, including several modern ones from Intel and even the new ARM-based Apple M1. In all cases, the attack was accomplished in Google Chrome. In principle, several unique features of the browser make Spook.js possible. Other Chromium-based browsers, such as Microsoft Edge, are also vulnerable to this attack. However, there are certain limitations. First is the low speed of data theft (400–600 bytes per second, depending on the CPU), which is why the target file in the last demo is very small. Second is the large number of errors when stealing data from the CPU cache. Up to 4% of the data is erroneous; hence the artifacts in the stolen copy of the image. The attack doesn’t work on AMD processors or in Mozilla Firefox, whose JavaScript engine works differently. The researchers aren’t ruling out the possibility of a successful attack on AMD chips and Firefox browser, but verifying that will require more study. Finally, an attack requires uploading malicious code to a page with the same domain name, such as in the case of collective blogs or hosting. Applying this method to, say, a bank’s website is probably not going to work. No reason to panic The study of Spook.js is important because researchers have, for the first time, been able to demonstrate a fairly realistic scenario for the exploitation of one of the Spectre vulnerabilities. Nevertheless, the chances of a real-world attack are low. First, the developers of Google Chrome, on the back of this research, have beefed up the mechanism for isolating loaded sites from one another. Second, cybercriminals have many easier ways to steal user data, from traditional malware to social engineering, and this one requires serious knowledge of the low-level workings of modern CPUs. As a scientific work, Spook.js is set to alter the software landscape through the introduction of new recommendations for website security (for example, the authors propose moving authorization pages to a separate domain name). Subsequent studies may find ways to make attacks a little easier, but most likely they will lead to more rounds of security enhancements. Even if Spectre-type vulnerabilities can be exploited en masse, the protection means will be the same as for any malware. Security vendors will simply add the new types of attacks to the list of those to be monitored and blocked before execution. It’s also possible that one day researchers will stumble upon a feature of Spectre-like vulnerabilities that necessitates a major reworking of the entire modern IT ecosystem. That, however, remains unlikely. Let’s not forget that it took three years to move from a theoretical vulnerability to the first practical attack (and even then, it’s an attack with many limitations). Spectre may also be used for targeted attacks in which the potential benefit from the stolen data exceeds the costs of the operation. Even if that scenario is relevant to your organization, you can easily make attacks more difficult by using different browsers for different content. For example, do not open pages and Web services with sensitive information in the same browser where you get your online entertainment. Ideally, handle confidential information in an isolated environment, in a virtual machine, or simply on a separate device.

image for The Rise of One-Time ...

 Latest Warnings

In February, KrebsOnSecurity wrote about a novel cybercrime service that helped attackers intercept the one-time passwords (OTPs) that many websites require as a second authentication factor in addition to passwords. That service quickly went offline, but new research reveals a number of competitors have since   show more ...  

launched bot-based services that make it relatively easy for crooks to phish OTPs from targets. An ad for the OTP interception service/bot “SMSRanger.” Many websites now require users to supply both a password and a numeric code/OTP token sent via text message, or one generated by mobile apps like Authy and Google Authenticator. The idea is that even if the user’s password gets stolen, the attacker still can’t access the user’s account without that second factor — i.e. without access to the victim’s mobile device or phone number. The OTP interception service featured earlier this year — Otp[.]agency — advertised a web-based bot designed to trick targets into giving up OTP tokens. This service (and all others mentioned in this story) assumes the customer already has the target’s login credentials through some means. OTP Agency customers would enter a target’s phone number and name, and then the service would initiate an automated phone call that alerts that person about unauthorized activity on their account. The call would prompt the target to enter an OTP token generated by their phone’s mobile app (“for authentication purposes”), and that code would then get relayed back to the bad guy customers’ panel at the OTP Agency website. OTP Agency took itself offline within hours of that story. But according to research from cyber intelligence firm Intel 471, multiple new OTP interception services have emerged to fill that void. And all of them operate via Telegram, a cloud-based instant messaging system. “Intel 471 has seen an uptick in services on the cybercrime underground that allow attackers to intercept one-time password (OTP) tokens,” the company wrote in a blog post today. “Over the past few months, we’ve seen actors provide access to services that call victims, appear as a legitimate call from a specific bank and deceive victims into typing an OTP or other verification code into a mobile phone in order to capture and deliver the codes to the operator. Some services also target other popular social media platforms or financial services, providing email phishing and SIM swapping capabilities.” Intel471 says one new Telegram OTP bot called “SMSRanger” is popular because it’s remarkably easy to use, and probably because of the many testimonials posted by customers who seem happy with its frequent rate of success in extracting OTP tokens when the attacker already has the target’s “fullz,” personal information such as Social Security number and date of birth. From their analysis: “Those who pay for access can use the bot by entering commands similar to how bots are used on popular workforce collaboration tool Slack. A simple slash command allows a user to enable various ‘modes’ — scripts aimed as various services — that can target specific banks, as well as PayPal, Apple Pay, Google Pay, or a wireless carrier. Once a target’s phone number has been entered, the bot does the rest of the work, ultimately granting access to whatever account has been targeted. Users claim that SMSRanger has an efficacy rate of about 80% if the victim answered the call and the full information (fullz) the user provided was accurate and updated.” Another OTP interception service called SMS Buster requires a tad more effort from a customer, Intel 471 explains: “The bot provides options to disguise a call to make it appear as a legitimate contact from a specific bank while letting the attackers choose to dial from any phone number. From there, an attacker could follow a script to trick a victim into providing sensitive details such as an ATM personal identification number (PIN), card verification value (CVV) and OTP, which could then be sent to an individual’s Telegram account. The bot, which was used by attackers targeting Canadian victims, gives users the chance to launch attacks in French and English.”  These services are springing up because they work and they’re profitable. And they’re profitable because far too many websites and services funnel users toward multi-factor authentication methods that can be intercepted, spoofed, or misdirected — like SMS-based one-time codes, or even app-generated OTP tokens. The idea behind true “two-factor authentication” is that the user is required to present two out of three of the following: Something they have (mobile devices); something they know (passwords); or something they are (biometrics). For example, you present your credentials to a website, and the site prompts you to approve the login via a prompt that pops up on your registered mobile device. That is true two-factor authentication: Something you have, and something you know (and maybe also even something you are). The 2fa SMS Buster bot on Telegram. Image: Intel 471. In addition, these so-called “push notification” methods include important time-based contexts that add security: They happen directly after the user submits their credentials; and the opportunity to approve the push notification expires after a short period. But in so many instances, what sites request is basically two things you know (a password and a one-time code) to be submitted through the same channel (a web browser). This is usually still better than no multi-factor authentication at all, but as these services show there are now plenty of options of circumventing this protection. I hope these OTP interception services make clear that you should never provide any information in response to an unsolicited phone call. It doesn’t matter who claims to be calling: If you didn’t initiate the contact, hang up. Don’t put them on hold while you call your bank; the scammers can get around that, too. Just hang up. Then you can call your bank or whoever else you need. Unfortunately, those most likely to fall for these OTP interception schemes are people who are less experienced with technology. If you’re the resident or family IT geek and have the ability to update or improve the multi-factor authentication profiles for your less tech-savvy friends and loved ones, that would be a fabulous way to show you care — and to help them head off a potential disaster at the hands of one of these bot services. When was the last time you reviewed your multi-factor settings and options at the various websites entrusted with your most precious personal and financial information? It might be worth paying a visit to 2fa.directory (formerly twofactorauth[.]org) for a checkup.

 Trends, Reports, Analysis

Google researchers highlighted a new threat in the form of OpenSUpdater used by cybercriminals who are targeting people prone to downloading cracked versions of games and other popular software in the U.S. However, Microsoft thinks attackers wouldn't be infecting devices via this technique and underlined that Microsoft Defender Antivirus detects and removes OpenSUpdater.

 Malware and Vulnerabilities

In a tactic to pressure victims into paying up, the lesser-known Karma ransomware group was discovered communicating with journalists about the victims. The attackers claimed to have stolen a few terabytes of internal data from a medical device-making firm. Organizations are recommended to increase staff awareness about phishing attacks, create offline backups, and monitor large file uploads.

 Malware and Vulnerabilities

Several recent phishing campaigns have attempted to deliver a variant of the Dridex banking trojan that is named as DoppelDridex, via payloads staged on Slack and Discord CDNs.

 Feed

Red Hat Security Advisory 2021-3642-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

 Feed

Ubuntu Security Notice 5092-2 - Valentina Palmiotti discovered that the io_uring subsystem in the Linux kernel could be coerced to free adjacent memory. A local attacker could use this to execute arbitrary code. Ofek Kirzner, Adam Morrison, Benedict Schlueter, and Piotr Krysiuk discovered that the BPF verifier in the   show more ...  

Linux kernel missed possible mispredicted branches due to type confusion, allowing a side-channel attack. An attacker could use this to expose sensitive information. Various other issues were also addressed.

 Feed

Ubuntu Security Notice 5094-1 - It was discovered that the KVM hypervisor implementation in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. An attacker who could start and control a VM could possibly use this to expose sensitive information or   show more ...  

execute arbitrary code. It was discovered that the tracing subsystem in the Linux kernel did not properly keep track of per-cpu ring buffer state. A privileged attacker could use this to cause a denial of service. Various other issues were also addressed.

 Feed

Ubuntu Security Notice 5090-4 - USN-5090-1 fixed vulnerabilities in Apache HTTP Server. One of the upstream fixes introduced a regression in UDS URIs. This update fixes the problem. James Kettle discovered that the Apache HTTP Server HTTP/2 module incorrectly handled certain crafted methods. A remote attacker could   show more ...  

possibly use this issue to perform request splitting or cache poisoning attacks. It was discovered that the Apache HTTP Server incorrectly handled certain malformed requests. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. Li Zhi Xin discovered that the Apache mod_proxy_uwsgi module incorrectly handled certain request uri-paths. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 21.04. It was discovered that the Apache HTTP Server incorrectly handled escaping quotes. If the server was configured with third-party modules, a remote attacker could use this issue to cause the server to crash, resulting in a denial of service, or possibly execute arbitrary code. It was discovered that the Apache mod_proxy module incorrectly handled certain request uri-paths. A remote attacker could possibly use this issue to cause the server to forward requests to arbitrary origin servers. Various other issues were also addressed.

 Feed

Tsunami is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence. It was originally written by Google and open sourced in July of 2020.

 Feed

Commercially developed FinFisher surveillanceware has been upgraded to infect Windows devices using a UEFI (Unified Extensible Firmware Interface) bootkit using a trojanized Windows Boot Manager, marking a shift in infection vectors that allow it to elude discovery and analysis. Detected in the wild since 2011, FinFisher (aka FinSpy or Wingbird) is a spyware toolset for Windows, macOS, and Linux

 Feed

A newly discovered "aggressive" mobile campaign has infected north of 10 million users from over 70 countries via seemingly innocuous Android apps that subscribe the individuals to premium services costing €36 (~$42) per month without their knowledge. Zimperium zLabs dubbed the malicious trojan "GriftHorse." The money-making scheme is believed to have been under active development starting from

 Feed

Chief Information Security Officers (CISOs) are an essential pillar of an organization’s defense, and they must account for a lot. Especially for new CISOs, this can be a daunting task. The first 90 days for a new CISO are crucial in setting up their security team, so there is little time to waste, and much to accomplish.  Fortunately. A new guide by XDR provider Cynet (download here) looks to

 Feed

Two newly discovered malicious Android applications on Google Play Store have been used to target users of Brazil's instant payment ecosystem in a likely attempt to lure victims into fraudulently transferring their entire account balances into another bank account under cybercriminals' control. "The attackers distributed two different variants of banking malware, named PixStealer and MalRhino,

 Feed

Facebook on Wednesday announced it's open-sourcing Mariana Trench, an Android-focused static analysis platform the company uses to detect and prevent security and privacy bugs in applications created for the mobile operating system at scale. "[Mariana Trench] is designed to be able to scan large mobile codebases and flag potential issues on pull requests before they make it into production," the

 Feed only

Graham Cluley Security News is sponsored this week by the folks at 1Password. Thanks to the great team there for their support! Infrastructure secrets are a major security liability for today’s businesses. Learn the scope and complexity of the secrets management problem with 1Password’s free research report.   show more ...  

Growing complexities have turned secrets management into a … Continue reading "How secrets (mis)management is the next big cybersecurity threat – download the 1Password report"

2021-09
Aggregator history
Wednesday, September 29
WED
THU
FRI
SAT
SUN
MON
TUE
SeptemberOctoberNovember