Oktacron - Cyber Security RSS Feeds History

How long does it take to close serious vulnerabilities?

kaspersky Feb 07, 2023 Business

In the summer of 2022, cybersecurity expert David Schutz was returning home after a long day on the road. His Google Pixel 6 smartphone was running out of juice: by the time David finally got home, it was down to 1%. And as luck would have it, the phone turned off in the middle of messaging. Schutz found his charger show more ...

and turned the phone back on, but couldnt carry on texting — he had to enter the SIM PIN code. Worn out after the trip, David entered the wrong PIN three times. This meant entering another secret code — the PUK. Having done that, David was invited to unlock the phone with a fingerprint. But after the fingerprint was recognized, it froze. After restarting your phone, fingerprint unlocking is not usually an option. An unlock code is required. Source. Anyone else would probably have put these strange happenings down to software glitches, restarted the phone again, and got on with their life. But David, a researcher with a good nose for weird-behaving software and devices, decided to get to the bottom of why his phone no longer wanted an unlock code after restarting. After several unsuccessful attempts, David realized that a restart in this case is unnecessary. Take a locked smartphone, remove the SIM card, reinsert it, enter a wrong PIN code three times, enter the PUK code What happens? Turns out you can completely bypass the phones lock screen! Schutz detailed the discovery on his blog, but if you assume that Google quickly fixed it, think again. This gaping security hole threatened a huge number of smartphones running Android (versions 11 to 13) for almost half a year — from June to November! Practical demonstration of bypassing the lock screen using a SIM card. What?! In essence, the vulnerability lets someone bypass the lock screen and get access to all data on the phone without knowing the secret code. No sophisticated attack mechanism is required at all. Theres no need to connect any external devices to the smartphone or search for new vulnerabilities in the software. You just take out and reinsert the SIM card (the attacker can use their own), enter a wrong PIN three times, enter the PUK code, change the PIN — and you get access to the phone. The only condition is that the phone must be turned on and have been previously unlocked by the owner at least once. The vulnerable software is located in the freely distributed part of Android — where anyone can see the source code. That let us find out how such a fairly simple bug could have appeared. In fact, Android smartphones have several lock screens, including the screen for entering a secret code, a prompt to scan your fingerprint, or a window for entering the SIM PIN code. Successfully passing one of the verifications would originally trigger next lock screen to appear, no matter which one. The whole system worked fine, except for the PUK code lock screen. Entering the PUK caused the dismiss lock screen function to be called up twice. Instead of showing the fingerprint scan screen, the phone was unlocked. The issue was resolved with some fairly major modifications of the Android code, which resulted in each lock screen being controlled independently. Bureaucracy versus security So, why did it take almost six months to eliminate this serious vulnerability? Schutz sent a description of the vulnerability through Googles bug bounty service. According to the program rules, a discovered vulnerability for bypassing the lock screen on multiple (or even all) devices can earn the researcher up to US$100,000. But instead of cash, David received several weeks of silence, and then his submission was rejected as a duplicate — someone else already had informed Google about the vulnerability. David resigned himself to losing out on a well-deserved payout. In the meantime, September came (it was getting on for three months since his report), and he was sure the vulnerability would be fixed in the next set of patches. But no. With the September update installed, his phone still allowed him to bypass the lock using the SIM card trick. Coincidentally, in September there was a Google event for security researchers. There, David personally demonstrated the bug to company developers. That was the lightbulb moment for them at last, and the vulnerability was patched in the November update of Android. Even if an earlier bug report had existed, Google hadnt reacted at all. Nor was there any response to Davids message in June 2022. Only a face-to-face with the developers got the vulnerability closed. In the end, Schutz received a US$70,000 payout for his efforts. The price of security As smartphone users, we expect at least critical bugs to be prioritized by the developers and closed quickly. This story of the lock screen bypass on Android smartphones shows that this isnt always the case. It all started well: the vulnerability was found, luckily, by a white-hat researcher who did not sell it on the darknet where it could have been used for nefarious purposes; instead, he informed the company. Google simply had to close the hole promptly, but thats where the problems began. For organizations that collaborate with external security experts through bug bounty programs, it gives food for thought: are enough resources allocated internally to fixing bugs in good time?

KrebsOnSecurity in Upcoming Hulu Series on Ashley Madison Breach

krebsonsecurity Feb 07, 2023 A Little Sunshine

KrebsOnSecurity will likely have a decent amount of screen time in an upcoming Hulu documentary series about the 2015 megabreach at marital infidelity site Ashley Madison. While I can’t predict what the producers will do with the video interviews we shot, it’s fair to say the series will explore compelling show more ...

new clues as to who may have been responsible for the attack. The new docuseries produced by ABC News Studios and Wall to Wall Media is tentatively titled, “The Ashley Madison Affair,” and is slated for release on Hulu in late Spring 2023. Wall to Wall Media is part of the Warner Bros. International Television Production group. “Featuring exclusive footage and untold firsthand interviews from those involved, the series will explore infidelity, morality, cyber-shaming and blackmail and tell the story of ordinary people with big secrets and a mystery that remains unsolved to this day,” reads a Jan. 12, 2023 scoop from The Wrap. There are several other studios pursuing documentaries on the Ashley Madison breach, and it’s not hard to see why. On July 19, 2015, a hacker group calling itself The Impact Team leaked Ashley Madison internal company data, and announced it would leak all user data in a month unless Ashley Madison voluntarily shut down before then. A month later, The Impact Team published more than 60 gigabytes of data, including user names, home addresses, search history, and credit card transaction records. The leak led to the public shaming and extortion of many Ashley Madison users, and to at least two suicides. It’s impossible to say how many users lost their jobs or marriages as a result of the breach. I’m aware that there are multiple studios working on Ashley Madison documentaries because I broke the story of the breach in 2015, and all of those production houses approached me with essentially the same pitch: It would be a shame if your voice wasn’t included in our project. What stood out about the inquiry from Wall to Wall was that their researchers had already gathered piles of clues about the breach that I’d never seen before. I’d assumed that participating in their documentary would involve sitting for a few interviews about known historical facts related to the breach. But when Wall to Wall shared what they’d found, I was hooked, and spent several weeks investigating those leads further. The result was a collaborative research effort revealing key aspects of the breach that have somehow escaped public notice over the years. I won’t go into detail on what we discovered until the Hulu series is ready for release. Also, I am not privy to what they will produce with the interviews I gave. I can’t say that what we found untangles everything about the breach that was previously unknown, but it sure explains a lot.

DPRK Using Unpatched Zimbra Devices to Spy on Researchers

darkreading Feb 07, 2023 Feed

Lazarus Group used a known Zimbra bug to steal data from medical and energy researchers.

Fresh, Buggy Clop Ransomware Variant Targets Linux Systems

darkreading Feb 07, 2023 Feed

For the moment, victims can decrypt data without paying a ransom. But Clop is a ransomware variant that has caused havoc on Windows systems, so that's bound to change.

Backdoor in Dingo Cryptocurrency Allows Creator to Steal (Nearly) Everything

darkreading Feb 07, 2023 Feed

A tax variable in the software implementing the Dingo Token allows the creators to charge 99% in fees per transaction, essentially stealing funds, an analysis finds.

A Fool With a Tool Is Still a Fool: A Cyber Take

darkreading Feb 07, 2023 Feed

New tech often requires new thinking — but that's harder to install.

5 Ways to Survive Scam Season — or Rather, Tax Season

darkreading Feb 07, 2023 Feed

Security pros need to look beyond user education to find and disarm fraudulent actors.

Optimizing Cybersecurity Investments in a Constrained Spending Environment

darkreading Feb 07, 2023 Feed

Three ways to stay safe in an economically uncertain 2023.

Keeping KillNet at Bay: Use the IP Address Blocklist

darkreading Feb 07, 2023 Feed

Security teams should use a blocklist containing tens of thousands of proxy IP addresses used by the pro-Russian hacktivist group to defend their organizations from DDoS attacks.

Ongoing VMware ESXi Ransomware Attack Highlights Inherent Virtualization Risks

darkreading Feb 07, 2023 Feed

The global assault on vulnerable VMware hypervisors may have been mitigated by updating to the latest version of the product, but patch management is only part of the story.

'Money Lover' Finance App Exposes User Data

darkreading Feb 07, 2023 Feed

A broken access control vulnerability could have led to dangerous follow-on attacks for users of the money-management app.

With TikTok Bans, the Time for Operational Governance Is Now

darkreading Feb 07, 2023 Feed

Emerging risks and trends need to be monitored, but cybersecurity challenges can be fixed with a focus on the fundamentals.

New Banking Trojan Targeting 100M Pix Payment Platform Accounts

darkreading Feb 07, 2023 Feed

New malware demonstrates how threat actors are pivoting toward payment platform attacks, researchers say.

Critical Baicells Device Vulnerability Can Expose Telecoms Networks to Snooping

cyware Feb 07, 2023 Malware and Vulnerabilities

A critical vulnerability affecting wireless communication base stations from Baicells Technologies can be exploited to cause disruption in telecom networks or take complete control of data and voice traffic, according to a researcher.

Lazarus Group Exploits Unpatched Zimbra Devices

cyware Feb 07, 2023 Breaches and Incidents

WithSecure researchers spotted a new campaign, dubbed No Pineapple, by North Korean Lazarus hackers targeting energy and medical research sectors with the Acres RAT. Lazarus gains access to a flawed Zimbra mail server by abusing RCE flaws tracked as CVE-2022-27925 and CVE-2022-37042.

Hackers backdoor Windows devices in Sliver and BYOVD attacks

cyware Feb 07, 2023 Malware and Vulnerabilities

A new hacking campaign exploits Sunlogin flaws to deploy the Sliver post-exploitation toolkit and launch Windows Bring Your Own Vulnerable Driver (BYOVD) attacks to disable security software.

OpenSSH Releases Patch for New Pre-Auth Double Free Vulnerability

cyware Feb 07, 2023 Malware and Vulnerabilities

"This is not believed to be exploitable, and it occurs in the unprivileged pre-auth process that is subject to chroot(2) and is further sandboxed on most major platforms," OpenSSH disclosed in its release notes on February 2, 2023.

AveMaria Info-stealer Changes its Strategy to Infect More Users

cyware Feb 07, 2023 Malware and Vulnerabilities

Zscaler’s ThreatLabz disclosed details about a new infostealer AveMaria RAT that targets sensitive data with added capabilities of remote camera control and privilege escalation. Over the past six months, the operators behind the info-stealer have been making significant additions to the execution stages to infect show more ...

more users. Organizations are advised to have a better email security solution in place to thwart such threats in the initial stages.

Massachusetts-Based MKS Instruments Falls Victim to Ransomware Attack

cyware Feb 07, 2023 Breaches and Incidents

The company said it has notified law enforcement authorities while it investigates and assesses the impact of the incident by engaging “appropriate incident response professionals.”

Hive takedown puts ‘small dent’ in ransomware problem

cyware Feb 07, 2023 Expert Blogs and Opinion

The takedown did not result in criminal arrests of any individuals involved or affiliated with Hive, and the predominant assumption is that the Hive members will regroup or splinter to join other ransomware groups.

Banking Trojan TgToxic Targets Android Users in Southeast Asia

cyware Feb 07, 2023 Malware and Vulnerabilities

Trend Micro experts took the wraps off of an ongoing campaign that has been targeting Android users in Southeast Asia since July 2022. It involves embedding a trojan they named TgToxic for harvesting user data from multiple fake finance and banking apps, including cryptocurrency wallets. The samples of the malware have been identified in Taiwan, with its phishing lures detected in Thailand and Indonesia as well.

GuLoader Malware Using Malicious NSIS Executables to Target E-Commerce Industry

cyware Feb 07, 2023 Malware and Vulnerabilities

Over the course of 2022, the NSIS scripts used to deliver GuLoader are said to have grown in sophistication, packing in additional obfuscation and encryption layers to conceal the shellcode.

Eurocops shut down Exclu encrypted messaging app

cyware Feb 07, 2023 Incident Response, Learnings

An encrypted messaging service that has been on law enforcement's radar since a 2019 raid on an old NATO bunker has been shut down after a sweeping series of raids across Europe last week.

America’s top cyber diplomat says his Twitter account was hacked

cyware Feb 07, 2023 Social Media Threats

There did not appear to be any broader fallout from the hacking incident. Nate Fick uses the account sparingly and instead promotes his work through an official State Department account.

Hackers Abuse RCE Vulnerability to Deploy Sliver Backdoor

cyware Feb 07, 2023 Malware and Vulnerabilities

Sunlogin security holes are being used by a new hacking effort to launch Windows Bring Your Own Vulnerable Driver (BYOVD) attacks and distribute the Sliver post-exploitation toolkit. The exploitation of the flaw leads to the installation of Gh0st RAT. However, in some cases, hackers installed XMRig CoinMiner instead of Gh0st RAT.

Italy, France and Singapore Warn of a Spike in ESXI Ransomware

cyware Feb 07, 2023 Threat Intel & Info Sharing

CERT-FR was the first to notice and send an alert about the attack. Italy’s National Cybersecurity Agency (ACN) and Cyber Security Agency of Singapore have also issued warnings for organizations to take immediate action to protect their systems.

Biden Announces New Appointees for Telecommunications Advisory Committee

cyware Feb 07, 2023 Govt., Critical Infrastructure

Biden’s announcement also included new leadership for NSTAC. Scott Charney, VP for Security Policy at Microsoft, will chair the committee, while Jeffrey Storey, former President and CEO at Lumen Technologies will serve as vice-chair.

British Steel Industry Supplier Vesuvius Suffers Cyber Incident

cyware Feb 07, 2023 Breaches and Incidents

The British manufacturer confirmed that the incident “involved unauthorized access to our systems,” although it did not provide further details on what the access was or what kind of cyber actor may have been responsible.

Cyberattack Gives 19,000 Students A Day Off School at Berkeley County Schools

cyware Feb 07, 2023 Breaches and Incidents

The Berkeley County Schools suffered a network outage which affected IT operations across the school system, WV Metro News reported. Personal data on the students may have been harvested in the cyberattack.

Actively exploited GoAnywhere MFT zero-day gets emergency patch

cyware Feb 07, 2023 Malware and Vulnerabilities

The zero-day vulnerability allows attackers to perform remote code execution attacks on vulnerable GoAnywhere MFT instances whose administrative console is exposed online.

Sharp HealthCare Notifies Nearly 63,000 Patients of Data Breach

cyware Feb 07, 2023 Breaches and Incidents

Sharp HealthCare, San Diego’s largest health provider, announced Monday that it has begun notifying 62,777 of its patients that some of their personal information was compromised during an attack on the computers that run its website, sharp.com.

Update: LockBit ransomware gang claims Royal Mail cyberattack

cyware Feb 07, 2023 Breaches and Incidents

The LockBit ransomware operation has claimed the cyberattack on UK's leading mail delivery service Royal Mail that forced the company to halt its international shipping services due to "severe service disruption."

Linux Variant of Clop Ransomware Spotted But Uses Faulty Encryption Algorithm

cyware Feb 07, 2023 Malware and Vulnerabilities

The first-ever Linux variant of the Clop ransomware has been detected in the wild, but with a faulty encryption algorithm that has made it possible to reverse engineer the process.

Here's A List Of Proxy IPs To Help Block KillNet's DDoS Bots

packetstormsecurity Feb 07, 2023 headline,hacker,government,russia,denial

Lawsuit Blast GoodRx, Meta Over Egregious Privacy Practices

packetstormsecurity Feb 07, 2023 headline,privacy,data loss,facebook

QNAP Backtracks On Scope Of Critical NAS Bug

packetstormsecurity Feb 07, 2023 headline,flaw