Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for CVE-2022-35737 vulne ...

 Business

In October 2022, researchers at Trail of Bits published a detailed breakdown of an SQLite DBMS vulnerability. The article discusses possible attacks via CVE-2022-35737, with consequences ranging from a simple application crash to arbitrary code execution. The rather trivial bug in the SQLite code is interesting and   show more ...  

potentially dangerous for two reasons. Firstly, it has been in SQLite since October 2000 –  from almost the very beginning of development of this open source software. Secondly, SQLites features make it theoretically possible to attack a wide range of programs with SQLite inside them. SQLite features SQLite is a compact, open-source, embedded DBMS – first released 22 years ago (in August 2000). Embedded is the key definition here. SQLite is not installed as separate software. Instead, its used as a library for software developers who need to work with databases. SQLite is by default built into, for example: the Google Chrome, Firefox and Safari browsers; Android; network applications; and many release packages of operating systems based on the Linux kernel. SQLite gained popularity for its open license, reliability and… security: few serious flaws have actually been found in the DBMSs code so far. CVE-2022-35737 details Experts detected a bug in the sqlite3_snprintf functions code, which is used to interact with the database in programs written in C/C++. If you pass a very large string input (more than 2GB) to that function, it will cause the program to crash; i.e., a denial of service (DoS) attack becomes possible. In the sqlite3_snprintf code, an integer variable was used to calculate the size of the passed string. If the string passed is too large, the variable can take a negative value. This then causes a memory buffer to be allocated thats too small to write the received string. A common buffer overflow error occurs. The error was most likely entered into the code 22 years ago, since passing gigabytes of function parameters was unlikely due to the resource limitations of the day. This is no longer the case. A separate point of interest in the Trail of Bits report is an assumption about why such an error was missed during standard code testing. The testing procedure is primarily aimed at checking newly added or modified code, while the code here hasnt been changed in more than two decades. Its quite difficult to detect such vulnerabilities with fuzzing – which is feeding random parameters as function inputs. Common fuzzing methods dont involve generating strings of such a large size. The authors of the research conclude that fuzzing cant fully replace static code analysis, including that performed manually. Foggy implications Trail of Bits was able to modernize the original DoS attack so it could execute arbitrary code by carefully manipulating the content and size of the parameter passed. Although the authors of the paper have showed a working proof-of-concept demonstrating examples of attacks, those are a purely theoretical exercise in attacking SQLite itself. However, as mentioned above, SQLite is an embedded DBMS, so to do real harm someone would need to attack an application with embedded SQLite code. It turns out that there are quite a lot of assumptions in the research, and the practical possibility of actually exploiting the vulnerability has yet to be proven. There are other limitations. According to data from SQLite developers, the bug is only relevant to the interface for C applications, and only if the code is compiled with certain parameters. The Trail of Bits researchers themselves point to the impossibility of an attack if SQLite was compiled using stack canaries. This is essentially an additional method of buffer-overflow attack protection – preventing the execution of arbitrary code even when the overflow itself is possible. The vulnerability was closed in SQLite 3.39.2, released in July 2022. However, the patch has had little effect. Software developers using SQLite as part of their own code will most likely have to update their developments and distribute a new software version. Until then, the vulnerability will remain there. And dont forget that many programs with SQLite inside are no longer supported. Its not yet clear how dangerous this vulnerability is – or whether it can be exploited in practice. Judging by the definition from the SQLite developers, the chance of an actual attack is small – but not zero. In the meantime, the bugs been added to the collection of long-lived defects that could potentially cause headaches for software developers.

image for Hacker Charged With ...

 A Little Sunshine

A 25-year-old Finnish man has been charged with extorting a once popular and now-bankrupt online psychotherapy company and its patients. Finnish authorities rarely name suspects in an investigation, but they were willing to make an exception for Julius “Zeekill” Kivimaki, a notorious hacker who — at   show more ...  

the tender age of 17 — had been convicted of more than 50,000 cybercrimes, including data breaches, payment fraud, operating botnets, and calling in bomb threats. In late October 2022, Kivimaki was charged (and arrested in absentia, according to the Finns) with attempting to extort money from the Vastaamo Psychotherapy Center.  On October 21, 2020, Vastaamo became the target of blackmail when a tormentor identified as “ransom_man” demanded payment of 40 bitcoins (~450,000 euros at the time) in return for a promise not to publish highly sensitive therapy session notes Vastaamo had exposed online. In a series of posts over the ensuing days on a Finnish-language dark net discussion board, ransom_man said Vastaamo appeared unwilling to negotiate a payment, and that he would start publishing 100 patient profiles every 24 hours “to provide further incentive for the company to continue communicating with us.” “We’re not asking for much, approximately 450,000 euros which is less than 10 euros per patient and only a small fraction of the around 20 million yearly revenues of this company,” ransom_man wrote. When Vastaamo declined to pay, ransom_man shifted to extorting individual patients. According to Finnish police, some 22,000 victims reported extortion attempts targeting them personally, targeted emails that threatened to publish their therapy notes online unless paid a 500 euro ransom. The extortion message targeted Vastaamo patients. On Oct. 23, 2020, ransom_man uploaded to the dark web a large compressed file that included all of the stolen Vastaamo patient records. But investigators found the file also contained an entire copy of ransom_man’s home folder, a likely mistake that exposed a number of clues that they say point to Kivimaki. Ransom_man quickly deleted the large file (accompanied by a “whoops” notation), but not before it had been downloaded a number of times. The entire archive has since been made into a searchable website on the Dark Web. Among those who grabbed a copy of the database was Antti Kurittu, a former criminal investigator at the Helsinki Police Department. In 2013, Kurittu worked on investigation involving Kivimaki’s use of the Zbot botnet, among other activities Kivimaki engaged in as a member of the hacker group Hack the Planet. “It was a huge opsec [operational security] fail, because they had a lot of stuff in there — including the user’s private SSH folder, and a lot of known hosts that we could take a very good look at,” Kurittu told KrebsOnSecurity, declining to discuss specifics of the evidence investigators seized. “There were also other projects and databases.” Kurittu said he and others who worked on the investigation into Kivimaki’s previous cybercrimes couldn’t shake the suspicion that the infamous cybercriminal was also behind the Vastaamo extortion. “I couldn’t find anything that would link that data directly to one individual, but there were enough indicators in there that put the name in my head and I couldn’t shake it,” Kurittu said. “I told the police this back in 2020, and when they named him as the prime suspect I was not surprised.” A handful of individually extorted victims paid a ransom, but when news broke that the entire Vastaamo database had been leaked online, the extortion threats no longer held their sting. However, someone would soon set up a site on the dark web where anyone could search this sensitive data. Kivimaki stopped using his middle name Julius in favor of his given first name Aleksanteri when he moved abroad several years ago. A Twitter account by that name was verified by Kivimaki’s attorney as his, and through that account he denied being involved in the Vastaamo extortion. “I believe [the Finnish authorities] brought this to the public in order to influence the decision-making of my old case from my teenage years, which was just processed in the Court of Appeal, both cases are investigated by the same persons,” Kivimaki tweeted on Oct. 28. Kivimaki is appealing a 2020 district court decision sentencing him to “one year of conditional imprisonment for two counts of fraud committed as a young person, and one of gross fraud, interference with telecommunications as a young person, aggravated data breach as a young person and incitement to fraud as a young person,” according to the Finnish tabloid Ilta-Sanomat. “Now in the Court of Appeal, the prosecutor is demanding a harsher punishment for the man, i.e. unconditional imprisonment,” reads the Ilta-Sanomat story. “The prosecutor notes in his complaint that the young man has been committing cybercrimes from Espoo since he was 15 years old, and the actions have had to be painstakingly investigated through international legal aid.” As described in this Wired story last year, Vastaamo filled an urgent demand for psychological counseling, and it won accolades from Finnish health authorities and others for its services. “Vastaamo was a private company, but it seemed to operate in the same spirit of tech-enabled ease and accessibility: You booked a therapist with a few clicks, wait times were tolerable, and Finland’s Social Insurance Institution reimbursed a big chunk of the session fee (provided you had a diagnosed mental disorder),” William Ralston wrote for Wired. “The company was run by Ville Tapio, a 39-year-old coder and entrepreneur with sharp eyebrows, slicked-back brown hair, and a heavy jawline. He’d cofounded the company with his parents. They pitched ­Vastaamo as a humble family-run enterprise committed to improving the mental health of all Finns.” But for all the good it brought, the healthcare records management system that Vastaamo used relied on little more than a MySQL database that was left dangerously exposed to the web for 16 months, guarded by nothing more than an administrator account with a blank password. The Finnish daily Iltalehti said Tapio was relieved of his duties as CEO of Vastaamo in October 2020, and that in September, prosecutors brought charges against Tapio for a data protection offense in connection with Vastaamo’s information leak. “According to Vastaamo, the data breach in Vastaamo’s customer databases took place in November 2018,” Iltalehti reported last month. “According to Vastaamo, Tapio concealed information about the data breach for more than a year and a half.”

 Malware and Vulnerabilities

RomCom RAT is reportedly being used in attacks against Ukraine's military institutions to distribute trojanized packages using a fake website for the PDF Filler app. In addition, the group has upgraded evasion techniques with string obfuscation and execution as a COM object, among others. All these tactics point out that the group is actively evolving, and can become a potential threat in the future.

 Malware and Vulnerabilities

Researchers from FortiGuard Labs observed new malware variants, namely FBI ransomware, Wise Guys ransomware, and Pyschedelic ransomware extorting victims. The tactics used by these malware have nothing new, however, it cites an example of how hackers trick victims into paying a ransom, even for unrecoverable files. 

 Malware and Vulnerabilities

Fortinet on Tuesday informed customers about 16 vulnerabilities discovered in the company’s products, including six flaws that have been assigned a ‘high’ severity rating.

 Malware and Vulnerabilities

Malwarebytes uncovered a set of four Android apps—created by the same developer—redirecting victims to infectious websites as part of an adware and information-stealing campaign. Altogether, these apps had over 1 million downloads. Hackers would wait for nearly four days before opening the first phishing site in the Chrome browser.

 Trends, Reports, Analysis

Threat actors are able to attack companies after having a physical presence on-site using card skimmers, unsecured PoS systems, unsecured Wi-Fi networks, USB drives, vulnerable IoT devices, social engineering, and insider threats.

 Incident Response, Learnings

The United States Department of Justice this week announced charges against eight individuals for their participation in a racketeering (RICO) conspiracy that involved hacking and tax fraud.

 Identity Theft, Fraud, Scams

A number of Twitter users claim to have received phishing emails that use the lure of losing their verified status to try to fool them into supplying their credentials. The scam works via a Google doc made to look like a Twitter help page.

 Breaches and Incidents

These are the same pro-Kremlin miscreants that claimed responsibility for knocking more than a dozen US airports' websites offline on October 10 in similar network-traffic flooding incidents.

 Companies to Watch

The company intends to use the funds to expand customer acquisition efforts with accelerated sales and marketing efforts and expand machine learning to enhance its technology-enabled service capabilities as it creates a Managed Open XDR solution.

 Malware and Vulnerabilities

A high-risk bug in the Gatsby Cloud Image CDN service allowed attackers to stage server-side request forgery (SSRF) and cross-site scripting (XSS) attacks against some cloud-hosted Gatsby websites.

 Trends, Reports, Analysis

Up to 100,000 people from across Asia have been lured to Cambodia by Chinese crime syndicates with the promise of good jobs. When they arrive, their passports are seized and they are put to work in modern-day sweatshops, running cybercrime campaigns.

 Threat Actors

Chinese hacking group Cicada, aka APT10, was found abusing antivirus software to deploy a new variant of the LODEINFO malware against Japanese organizations. LODEINFO operators have been updating the malware very frequently and continuously, to make it leaner and more efficient. Through LODEINFO, APT10 could be targeting other countries in the near future.

 Malware and Vulnerabilities

Cyble researchers found a new version of the Drinik Android trojan targeting 18 Indian banks while posing as the country’s official tax management app. It attempts to steal victims’ banking credentials and personal information. Since 2016, Drinik has been circulating in India and operating as an SMS stealer.

 Feed

Red Hat Security Advisory 2022-7216-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.9.51. Issues addressed include code execution and memory leak vulnerabilities.

 Feed

Red Hat Security Advisory 2022-7384-01 - The ubi9/openssl image provides provides an openssl command-line tool for using the various functions of the OpenSSL crypto library. Issues addressed include a buffer overflow vulnerability.

 Feed

Red Hat Security Advisory 2022-7323-01 - Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Issues addressed include a denial of service vulnerability.

 Feed

Red Hat Security Advisory 2022-7338-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Issues addressed include code execution, privilege escalation, and use-after-free vulnerabilities.

 Feed

Red Hat Security Advisory 2022-7329-01 - The lua packages provide support for Lua, a powerful light-weight programming language designed for extending applications. Lua is also frequently used as a general-purpose, stand-alone language. Issues addressed include a buffer overflow vulnerability.

 Feed

Red Hat Security Advisory 2022-7343-01 - The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Issues addressed include code execution and denial of service vulnerabilities.

 Feed

Red Hat Security Advisory 2022-7318-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include privilege escalation and use-after-free vulnerabilities.

 Feed

Red Hat Security Advisory 2022-7313-01 - Red Hat Advanced Cluster Management for Kubernetes 2.6.2 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private   show more ...  

cloud environments. Issues addressed include denial of service and remote SQL injection vulnerabilities.

 Feed

Red Hat Security Advisory 2022-7330-01 - This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel. Issues addressed include privilege escalation and use-after-free vulnerabilities.

 Feed

Debian Linux Security Advisory 5269-1 - Nicky Mouha discovered a buffer overflow in the sha3 module of PyPy, a fast, compliant alternative implementation of the Python language.

 Feed

Red Hat Security Advisory 2022-7319-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Issues addressed include privilege escalation and use-after-free vulnerabilities.

 Feed

Red Hat Security Advisory 2022-7344-01 - This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel. Issues addressed include privilege escalation and use-after-free vulnerabilities.

 Feed

Red Hat Security Advisory 2022-7314-01 - The zlib packages provide a general-purpose lossless data compression library that is used by many different programs. Issues addressed include buffer over-read and buffer overflow vulnerabilities.

 Feed

Red Hat Security Advisory 2022-7340-01 - The php-pear package contains the PHP Extension and Application Repository, a framework and distribution system for reusable PHP components. Issues addressed include file overwrite and traversal vulnerabilities.

 Feed

Red Hat Security Advisory 2022-7337-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include code execution, privilege escalation, and use-after-free vulnerabilities.

 Feed

In 2015, HD Moore, the creator of Metasploit, published an article disclosing over 5,800 gas station Automated Tank Gauges (ATGs) which were publicly accessible. Besides monitoring for leakage, these systems are also instrumental in gauging fluid levels, tank temperature, and can alert operators when tank volumes are   show more ...  

too high or have reached a critical low. ATGs are utilized by nearly every fueling station in the United States and tens of thousands of systems internationally. They are most commonly manufactured by Veeder-Root, a supplier of fuel dispensers, payment systems, and forecourt merchandising. For remote monitoring of these fuel systems, operators will commonly configure the ATG serial interface to an internet-facing TCP port (generally set to TCP 10001). This script reads the Get In-Tank Inventory Report from TCP/10001 as a proof of concept to demonstrate the arbitrary access.

 Feed

Popular short-form video-sharing service TikTok is revising its privacy policy for European users to make it explicitly clear that user data can be accessed by some employees from across the world, including China. The ByteDance-owned platform, which currently stores European user data in the U.S. and Singapore, said the revision is part of its ongoing data governance efforts to limit employee

 Feed

The operators of RomCom RAT are continuing to evolve their campaigns with rogue versions of software such as SolarWinds Network Performance Monitor, KeePass password manager, and PDF Reader Pro. Targets of the operation consist of victims in Ukraine and select English-speaking countries like the U.K. "Given the geography of the targets and the current geopolitical situation, it's unlikely that

 Feed

Every SaaS app user and login is a potential threat; whether it's bad actors or potential disgruntled former associates, identity management and access control is crucial to prevent unwanted or mistaken entrances to the organization's data and systems.  Since enterprises have thousands to tens of thousands of users, and hundreds to thousands of different apps, ensuring each entrance point and

 Feed

A French-speaking threat actor dubbed OPERA1ER has been linked to a series of more than 30 successful cyber attacks aimed at banks, financial services, and telecom companies across Africa, Asia, and Latin America between 2018 and 2022. According to Singapore-headquartered cybersecurity company Group-IB, the attacks have led to thefts totaling $11 million, with actual damages estimated to be as

 Feed

A new analysis of tools put to use by the Black Basta ransomware operation has identified ties between the threat actor and the FIN7 (aka Carbanak) group. This link "could suggest either that Black Basta and FIN7 maintain a special relationship or that one or more individuals belong to both groups," cybersecurity firm SentinelOne said in a technical write-up shared with The Hacker News. Black

 Podcast

Twitter has a new chief twit in the form of Elon Musk and he’s causing problems, scientists say artificial intelligence may help us communicate with animals, and is the office of the future set in the metaverse? All this and much more is discussed in the latest edition of the award-winning “Smashing   show more ...  

Security” podcast by … Continue reading "Smashing Security podcast #296: Twitter turmoil, AI animal chatters, and metaverse at work"

 Guest blog

The world's richest man's plans for the news junkie's favourite social network inevitably get a great deal of attention. Not everyone will be aware of the details of what Elon Musk might be planning for Twitter, but they will certainly be aware that it's a hot topic. And so if a Twitter user receives a   show more ...  

message claiming to be about their verified account, they may very well believe it... and that makes them more susceptible to falling into a trap. Read more in my article on the Tripwire State of Security blog.

2022-11
Aggregator history
Thursday, November 03
TUE
WED
THU
FRI
SAT
SUN
MON
NovemberDecemberJanuary