Oktacron - Cyber Security RSS Feeds History

What is Log4Shell and why is it still dangerous a year later?

kaspersky Dec 08, 2022 Business

A year ago, in December 2021, the Log4Shell vulnerability (CVE-2021-44228) in the Apache Log4j library caused a sensation. Although by the spring it was no longer on the front pages of IT media outlets, in November 2022 it reemerged when it was reported that cybercriminals had exploited the vulnerability to attack a show more ...

US federal agency and install a cryptocurrency miner in its systems. Thats a good reason to explain what Log4Shell actually is, why its too early to write it off, and how to protect your infrastructure. What is the Apache Log4j library? Because the Java SDK did not initially support logging, developers had to write their own solutions, and by the time the official Java Logging API appeared, there were already quite a few of them. One is Apache Log4j, a popular open-source Java library in development since 2001. Its by no means the only logging solution in Java, but certainly one of the most popular. Many alternative solutions are essentially offshoots of Log4j that appeared at different stages of the librarys development. What is the Log4Shell vulnerability? The Log4j library allows to log all system events automatically. It uses a standard set of interfaces for accessing Java Naming and Directory Interface (JNDI) data. In November 2021, it turned out that during logging its able to run JNDI commands passed to it by an event, for example, in the Header field of a request, in a chat message, or in the description of a 404 error on a web page. The vulnerability allows cybercriminals, at least theoretically, to do whatever they like on the victims system (if no additional security measures kick in). In practice, most often attackers used Log4Shell to install illegal miners and carry out ransomware attacks. But there have been more exotic uses for it too, including targeted attacks, spreading the Mirai botnet, and even RickRolling — playing the (annoyingly addictive) Never Gonna Give You Up hit by 80s crooner Rick Astley. Why is it so dangerous and still a threat? Java is one of the main programming languages; its used for many backend systems — from small corporate servers to industrial automation systems and IoT devices. Most of these systems implement logging in one way or another. For years, the easiest way to do this was to use the Log4j library. When, in December 2021, it was reported to contain a vulnerability, experts declared it would be a huge problem for many years to come. Heres why: Log4j is used in a vast array of Java applications. At the time of discovery, the vulnerability was present in more than 35,000 packages (artifacts) in Maven Central (the largest Java package repository), which represents 8% of their total number. According to experts, around 40% of networks worldwide were at risk from Log4Shell. Besides conventional computers and servers, Java is also used in industrial, medical, and other specialized equipment. That equipment, too, is known to make use of the Log4j library. End users of solutions with Log4j inside, if blissfully unaware that the software contains a vulnerability, may put off updating it. Developers of solutions that use the Log4j library could well have gone bust long ago, left the market, or otherwise pulled support for their programs. Even if end users wanted to update, that option might no longer be there, while switching to other software may not be so easy. Log4j is an open-source library, which means that programmers can copy, modify, and use it in their projects. Unfortunately, not all developers strictly adhere to licensing rules, and do not always indicate code authorship. So, in theory, the same vulnerability could be found in a third-party project where officially theres no Log4j. Log4Shell was a zero-day vulnerability, meaning that cybercriminals exploited it before information about it was published. Theres evidence to suggest that attackers first tried it out at least nine days before it was made public. Among the affected programs were VMware products, in particular the popular virtual desktop infrastructure solution VMware Horizon. Many registered attacks penetrated the system through this very software. Program updates will have little effect in the event that intruders are already inside the system. By no means all attacks begin immediately after penetration, and its quite possible that many systems contain backdoors to this day. Actual damage In fairness, we should note that so far no catastrophic consequences of Log4Shell exploitation have been recorded — or, at least none that the general public has been made aware of. All the same, the vulnerability caused a major headache for developers and security experts, including ruined Christmas holidays for thousands of IT staff worldwide. Companies that are serious about security (both theirs and their clients) have had to fork out considerable sums to locate the vulnerability in their systems and software, and eliminate it. Below, we spotlight some of the most notable Log4Shell incidents known: On December 20, 2021, the Belgian Ministry of Defense confirmed an attack on its infrastructure using the vulnerability. Understandably, the details were not disclosed. On December 29, 2021, media reports said that a certain scientific institution in the United States had been attacked through Log4Shell. According to CrowdStrike, the APT group, Aquatic Panda, exploited an unpatched VMware Horizon. The suspicious activity was stopped in time, but the incident itself indicates that serious hacker groups have embraced the vulnerability. Also in December 2021, news broke about a Log4Shell exploitation on the servers of Minecraft: Java Edition, hosted not by the game publisher (Microsoft). The company confirmed the report and drew attention to the simplicity of the attacks implementation: the cybercriminals transmitted malicious code in a regular in-game chat, which was enough to run it both on the server side and on the vulnerable client. This case is of interest less from the victims perspective and more in terms of the technical implementation: under certain conditions, an attack can be carried out simply through an internal chat. This is worrying, since chats now reach far beyond the world of gaming: for many companies, they are the preferred method of communicating with customers. In many fintech and other applications, this is how customer support is delivered. In June 2022, the US Cybersecurity and Infrastructure Security Agency (CISA) and the US Coast Guard Cyber Command (CGCYBER) issued an alert that the vulnerability was still being actively exploited. The advisory stated that cybercriminals used a loophole in the same VMware Horizon to penetrate the internal networks of two unnamed government agencies. On top of that, the attackers were said to have gained access to 130GB of sensitive data related to law enforcement. In November 2022, CISA, jointly with the FBI, issued another advisory about a Log4Shell attack on one more government agency. The attackers penetrated the system back in February, were detected in April, and remained active in June–July. During this period, they created an account with administrator privileges, changed a legitimate administrators password, and uploaded mining software to the server. The attack is believed to be the work of Iranian government-sponsored hackers, so some experts consider the mining to be just a smokescreen to hide their real motives. How to protect your infrastructure Any company can fall victim to Log4Shell, often simply due to not knowing about vulnerabilities in their systems and software. If youre unsure whether your systems, tools, products, or services use the Log4j library, it makes sense to conduct a [security assessment services placeholder]thorough security audit[/security assessment services placeholder]. Other than that, to stay safe, follow these tips from our experts. If Log4j features in your software you make, use the latest version of the library available on the project page. Read the official guide from Apache Logging Services and follow it where necessary. If Log4j is used in third-party products, update all vulnerable software. Use robust security solutions able to detect attempts to exploit vulnerabilities on servers and workstations. Monitor suspicious activity inside the corporate perimeter using [EDREDR-class[/KEDR placeholder]] solutions or external services like managed detection and response. This will allow you to find and kill attacks in the early stages.

New Ransom Payment Schemes Target Executives, Telemedicine

krebsonsecurity Dec 08, 2022 Ransomware

Ransomware groups are constantly devising new methods for infecting victims and convincing them to pay up, but a couple of strategies tested recently seem especially devious. The first centers on targeting healthcare organizations that offer consultations over the Internet and sending them booby-trapped medical show more ...

records for the “patient.” The other involves carefully editing email inboxes of public company executives to make it appear that some were involved in insider trading. Alex Holden is founder of Hold Security, a Milwaukee-based cybersecurity firm. Holden’s team gained visibility into discussions among members of two different ransom groups: CLOP (a.k.a. “Cl0p” a.k.a. “TA505“), and a newer ransom group known as Venus. Last month, the U.S. Department of Health and Human Services (HHS) warned that Venus ransomware attacks were targeting a number of U.S. healthcare organizations. First spotted in mid-August 2022, Venus is known for hacking into victims’ publicly-exposed Remote Desktop services to encrypt Windows devices. Holden said the internal discussions among the Venus group members indicate this gang has no problem gaining access to victim organizations. “The Venus group has problems getting paid,” Holden said. “They are targeting a lot of U.S. companies, but nobody wants to pay them.” Which might explain why their latest scheme centers on trying to frame executives at public companies for insider trading charges. Venus indicated it recently had success with a method that involves carefully editing one or more email inbox files at a victim firm — to insert messages discussing plans to trade large volumes of the company’s stock based on non-public information. “We imitate correspondence of the [CEO] with a certain insider who shares financial reports of his companies through which your victim allegedly trades in the stock market, which naturally is a criminal offense and — according to US federal laws [includes the possibility of up to] 20 years in prison,” one Venus member wrote to an underling. “You need to create this file and inject into the machine(s) like this so that metadata would say that they were created on his computer,” they continued. “One of my clients did it, I don’t know how. In addition to pst, you need to decompose several files into different places, so that metadata says the files are native from a certain date and time rather than created yesterday on an unknown machine.” Holden said it’s not easy to plant emails into an inbox, but it can be done with Microsoft Outlook .pst files, which the attackers may also have access to if they’d already compromised a victim network. “It’s not going to be forensically solid, but that’s not what they care about,” he said. “It still has the potential to be a huge scandal — at least for a while — when a victim is being threatened with the publication or release of these records.” The Venus ransom group’s extortion note. Image: Tripwire.com Holden said the CLOP ransomware gang has a different problem of late: Not enough victims. The intercepted CLOP communication seen by KrebsOnSecurity shows the group bragged about twice having success infiltrating new victims in the healthcare industry by sending them infected files disguised as ultrasound images or other medical documents for a patient seeking a remote consultation. The CLOP members said one tried-and-true method of infecting healthcare providers involved gathering healthcare insurance and payment data to use in submitting requests for a remote consultation on a patient who has cirrhosis of the liver. “Basically, they’re counting on doctors or nurses reviewing the patient’s chart and scans just before the appointment,” Holden said. “They initially discussed going in with cardiovascular issues, but decided cirrhosis or fibrosis of the liver would be more likely to be diagnosable remotely from existing test results and scans.” While CLOP as a money making collective is a fairly young organization, security experts say CLOP members hail from a group of Threat Actors (TA) known as “TA505,” which MITRE’s ATT&CK database says is a financially motivated cybercrime group that has been active since at least 2014. “This group is known for frequently changing malware and driving global trends in criminal malware distribution,” MITRE assessed. In April, 2021, KrebsOnSecurity detailed how CLOP helped pioneer another innovation aimed at pushing more victims into paying an extortion demand: Emailing the ransomware victim’s customers and partners directly and warning that their data would be leaked to the dark web unless they can convince the victim firm to pay up. Security firm Tripwire points out that the HHS advisory on Venus says multiple threat actor groups are likely distributing the Venus ransomware. Tripwire’s tips for all organizations on avoiding ransomware attacks include: Making secure offsite backups. Running up-to-date security solutions and ensuring that your computers are protected with the latest security patches against vulnerabilities. Using hard-to-crack unique passwords to protect sensitive data and accounts, as well as enabling multi-factor authentication. Encrypting sensitive data wherever possible. Continuously educating and informing staff about the risks and methods used by cybercriminals to launch attacks and steal data. While the above tips are important and useful, one critical area of ransomware preparedness overlooked by too many organizations is the need to develop — and then periodically rehearse — a plan for how everyone in the organization should respond in the event of a ransomware or data ransom incident. Drilling this breach response plan is key because it helps expose weaknesses in those plans that could be exploited by the intruders. As noted in last year’s story Don’t Wanna Pay Ransom Gangs? Test Your Backups, experts say the biggest reason ransomware targets and/or their insurance providers still pay when they already have reliable backups of their systems and data is that nobody at the victim organization bothered to test in advance how long this data restoration process might take. “Suddenly the victim notices they have a couple of petabytes of data to restore over the Internet, and they realize that even with their fast connections it’s going to take three months to download all these backup files,” said Fabian Wosar, chief technology officer at Emsisoft. “A lot of IT teams never actually make even a back-of-the-napkin calculation of how long it would take them to restore from a data rate perspective.”

Agrius Iranian APT Group Cuts Into Diamond Industry

darkreading Dec 08, 2022 Feed

The supply chain attack is piggybacking off an earlier breach to deploy new wiper malware.

Single Sign-on: It's Only as Good as Your Ability to Use It

darkreading Dec 08, 2022 Feed

Increased federal cybersecurity regulations provide a pivot point for manufacturers to reconsider their access management strategy.

APT37 Uses Internet Explorer Zero-Day to Spread Malware

darkreading Dec 08, 2022 Feed

IE is still a vector: South Koreans lured in with references to the deadly Halloween celebration crowd crush in Seoul last October.

Where to Find the Best Open Source Security Technology

darkreading Dec 08, 2022 Feed

A free resource, updated monthly, lists the most-popular, highly rated OSS projects.

Lack of Cybersecurity Expertise Poses Threat for Public-Safety Orgs

darkreading Dec 08, 2022 Feed

More than three-quarters of police and emergency responders worry about ransomware attacks and data leaks, while their organizations lag behind in technology adoption.

Phishing in the Cloud: We're Gonna Need a Bigger Boat

darkreading Dec 08, 2022 Feed

SasS security is everyone's problem.

Fraudsters Siphon $360M from Retailers Using 50M Fake Shoppers

darkreading Dec 08, 2022 Feed

Cyberattackers focused on ad fraud and clickjacking stole millions during Black Friday by hijacking shopper accounts and tying up transactions.

Hacker Fails for the Win

darkreading Dec 08, 2022 Feed

Security researchers share their biggest initial screwups in some of their key vulnerability discoveries.

How Do I Use the Domain Score to Determine if a Domain Is a Threat?

darkreading Dec 08, 2022 Feed

To be most effective, protective DNS services need to constantly reassess and rescore domains as additional data comes in.

Report: Air-Gapped Networks Vulnerable to DNS Attacks

darkreading Dec 08, 2022 Feed

Common mistakes in network configuration can jeopardize the security of highly protected assets and allow attackers to steal critical data from the enterprise.

Google Warns of Internet Explorer Zero-Day Vulnerability Exploited by ScarCruft Hackers

cyware Dec 08, 2022 Malware and Vulnerabilities

An Internet Explorer zero-day vulnerability was actively exploited by a North Korean threat actor to target South Korean users by capitalizing on the recent Itaewon Halloween crowd crush to trick users into downloading malware.

Three Ways to Improve Defense Readiness Using MITRE D3FEND

cyware Dec 08, 2022 Expert Blogs and Opinion

Created and maintained by MITRE, MITRE D3FEND is a framework that provides a library of defensive cybersecurity countermeasures and technical components to help organizations improve their defensive cybersecurity posture.

CloudSEK claims it was hacked by another cybersecurity firm

cyware Dec 08, 2022 Breaches and Incidents

A threat actor named 'sedut' is now trying to sell what they claim is access to CloudSek's "networks, Xvigil, codebase, email, JIRA and social media accounts" on multiple hacking forums.

Security compliance and automation platform Drata nabs $200M at $2B valuation

cyware Dec 08, 2022 Companies to Watch

The security compliance and automation platform provider has raised $200 million in a Series C round of funding co-led by Iconiq Growth and GGV Capital, valuing the company at $2 billion.

Fortinet Patches High-Severity Authentication Bypass Vulnerability in FortiOS

cyware Dec 08, 2022 Malware and Vulnerabilities

Cybersecurity solutions provider Fortinet this week announced patches for multiple vulnerabilities across its products, including a high-severity authentication bypass impacting FortiOS and FortiProxy.

New Zerobot Botnet Abuses IoT Vulnerabilities

cyware Dec 08, 2022 Malware and Vulnerabilities

Researchers from FortiGuard Labs disclosed a unique botnet that abuses IoT vulnerabilities. Dubbed Zerobot, the malware contains several modules, such as self-replication and self-propagation. The malware, written in the Go language, can also communicate to its C2 server using the WebSocket protocol. The campaign allegedly began sometime post-mid-November.

Iran-linked APT42 Actively Targets Key Entities in Middle East

cyware Dec 08, 2022 Breaches and Incidents

An advanced cyberespionage campaign by Iranian APT42 was found targeting journalists, diplomats, politicians, and human rights activists working in the Middle East. Attackers gained access to the targets’ emails, cloud storage drives, calendars, and contacts, almost immediately after the compromise. This section of people needs to take extra security measures to safeguard against surveillance threats.

CryptosLabs ‘Pig Butchering’ Group Stole up to $505 Million Since 2018

cyware Dec 08, 2022 Threat Actors

The CryptosLabs investment scam targets French-speaking internet users, luring them into the fake investment sites via malicious advertising on Google Ads and social media platforms and posts on social media and investment sites.

Pwn2Own Toronto 2022, Day 1: Hackers Earn $400,000 for Galaxy S22, SOHO Exploits

cyware Dec 08, 2022 Malware and Vulnerabilities

On the first day of the Pwn2Own Toronto 2022 hacking competition, participants earned a total of $400,000 for new exploits targeting phones, printers, routers, and NAS devices.

Russian Hackers Spotted Targeting U.S. Military Weapons and Hardware Supplier

cyware Dec 08, 2022 Breaches and Incidents

A state-sponsored hacking group with links to Russia has been linked to attack infrastructure that spoofs the Microsoft login page of Global Ordnance, a legitimate U.S.-based military weapons and hardware supplier.

Rezonate emerges from stealth and raises $8.7 million

cyware Dec 08, 2022 Companies to Watch

Rezonate emerged from stealth with $8.7 million in funding for its cloud identity protection platform that prevents access risk and stops attackers’ actions to breach cloud infrastructure, where modern organizations’ critical data resides.

Apple rolls out end-to-end encryption for iCloud backups

cyware Dec 08, 2022 Security Products & Services

Apple introduced today Advanced Data Protection for iCloud, a new feature that uses end-to-end encryption to protect sensitive iCloud data, including backups, photos, notes, and more.

Kali Linux 2022.4 adds 6 new tools, Azure images, and desktop updates

cyware Dec 08, 2022 Security Products & Services

Offensive Security has released ?Kali Linux 2022.4, the fourth and final version of 2022, with new Azure and QEMU images, six new tools, and improved desktop experiences.

Security Risks Found in Millions of XIoT Devices

cyware Dec 08, 2022 Trends, Reports, Analysis

A vast number of common vulnerabilities and exposures (CVEs), default passwords, and other security risks have been found in millions of extended internet of things (XIoT) devices.

Cincinnati restaurants under attack by cyber hackers

cyware Dec 08, 2022 Breaches and Incidents

Multiple restaurants in Cincinnati, Ohio, are fighting cyber hackers who have stolen thousands of dollars, damaged their reputations, and shut down their social media pages.

Vaultree raises $12.8M to let companies more easily work with encrypted data

cyware Dec 08, 2022 Companies to Watch

Vaultree this week closed a $12.8 million Series A round co-led by Molten Ventures and Ten Eleven Ventures, with participation from SentinelOne, Elkstone Partners, CircleRock Capital, and Cyber Club London.

Update: Patients' Data at Seven More Hospitals Breached in CommonSpirit Ransomware Attack

cyware Dec 08, 2022 Breaches and Incidents

Patients of at least seven hospitals in Washington state affiliated with CommonSpirit have been affected by a data breach involving the hospital chain's October ransomware incident.

New Fantasy Wiper by Iranian Agrius APT Deployed Through a Supply‑Chain Attack

cyware Dec 08, 2022 Malware and Vulnerabilities

Victims include Israeli HR firms, IT consulting companies, and a diamond wholesaler; a South African organization working in the diamond industry; and a jeweler in Hong Kong.

EU Council moves to exclude software-as-a-service from new cybersecurity law

cyware Dec 08, 2022 Laws, Policy, Regulations

A new EU Council’s text puts Software-as-a-Service outside of the scope of the Cyber Resilience Act, while the European Commission clarified the legal basis would not allow for it.

Cybercriminals Attacking Each Other Gives Defenders Access to Inside Info

cyware Dec 08, 2022 Threat Actors

Researchers discovered a new sub-economy linked to cybercriminal activity: hackers scamming each other for millions of dollars. This practice led to the apparition of arbitration rooms in forums to settle conflicts.

Babuk Ransomware Variant in Major New Attack

cyware Dec 08, 2022 Malware and Vulnerabilities

Attackers used a new Babuk strain to target a multibillion-dollar manufacturing company with more than 10,000 workstations and server devices. The attackers had network access for two weeks of full reconnaissance prior to launching their attack.

Trojanized OneNote Document Leads to Formbook Malware

cyware Dec 08, 2022 Malware and Vulnerabilities

Trustwave SpiderLabs’ researchers uncovered threat actors using a OneNote document to move Formbook malware, an information stealing trojan sold on an underground hacking forum since mid-2016 as malware-as-a-service.

Direct Deposit Scams Around Holiday Scam

cyware Dec 08, 2022 Identity Theft, Fraud, Scams

Though this happens all the time, the fact that we're seeing an influx around the holiday is an interesting trend. It means that hackers are actively targeting people when they are likely to spend their money the most.

French Sporting Goods Retailer Intersport Hit by Hive Ransomware Group

cyware Dec 08, 2022 Breaches and Incidents

The breach allegedly happened in November, with details made available only on the dark web. Passports, paystubs, and other details on Intersport customers are included in a sample file that media outlet Numerama claims Hive leaked on the dark web.

Cyberattack Takes Down the Met Opera’s Website and Box Office

cyware Dec 08, 2022 Breaches and Incidents

The Metropolitan Opera has been the victim of a cyberattack that has kept its website and box office out of commission for more than 30 hours, the company’s general manager said on Wednesday.

Five British Companies Fined For Making Half A Million Nuisance Calls

packetstormsecurity Dec 08, 2022 headline,government,phone,britain,fraud

Jack To Elon: Can We Just Get The Doxxing Over With?

packetstormsecurity Dec 08, 2022 headline,privacy,data loss,twitter

Bad Software Cost US Businesses $2.1 Trillion In 2022

packetstormsecurity Dec 08, 2022 headline,data loss,flaw