11th December – Threat Intelligence Report

/in

For the latest discoveries in cyber research for the week of 11th December, please download our Threat_Intelligence Bulletin.

TOP ATTACKS AND BREACHES

The American Greater Richmond Transit Company (GRTC), which provides services for millions of people, has been a victim of cyber-attack that impacted certain applications and parts of the GRTC network. The Play ransomware gang claimed responsibility for the attack.

Check Point Harmony Endpoint and Threat Emulation provide protection against this threat (Ransomware.Win.Play; Ransomware.Wins.PLAY)

Multinational retailer Aldo has acknowledged a ransomware attack that impacted the systems of an unspecified franchise partner. The LockBit ransomware gang has claimed responsibility for the attack.

Check Point Harmony Endpoint and Threat Emulation provide protection against this threat (Ransomware.Wins.LockBit.ta*; Ransomware.Win.Lockbit; Gen.Win.Crypter.Lockbit.AI, Ransomware_Linux_Lockbit)

AlphV (aka BlackCat) ransomware gang claimed responsibility for cyber-attacks on three victims: American medical provider Norton Healthcare; IT services and business consulting company HTC Global Services; and Tipalti, an Israeli fintech software provider startup with headquarters in Canada. The attack on Tipalti has allegedly resulted in the compromise of over 265GB of confidential information belonging to the company and its customers, including the video game Roblox and streaming platform Twitch. According to AlphV, an insider from Tipalti was and is still actively involved in the attack.

Check Point Harmony Endpoint and Threat Emulation provide protection against this threat (Ransomware.Win.BlackCat; Ransomware.Wins.BlackCat.ta*, Ransomware_Linux_BlackCat,)

American multinational confectionery company Hershey has disclosed a data breach that affected more than 2,200 people as the result of a successful email phishing attack against the company. The stolen data potentially includes full names, health and medical details, debit and credit card data, financial account information and more.
Japanese car manufacturer Nissan has confirmed a cyber-attack that affected Nissan Oceania, its Australian and New Zealand regional division, and took systems offline as a precaution. The company did not share specific information on the type or extent of the breach.
The Hunters International ransomware group claimed responsibility for cyber-attacks on the Australian shipbuilder Austal USA and Florida water agency, St. Johns River Water Management District. The attacks affected Florida water agency’s information technology environment and potentially impacted Austal’s USA documents, recruiting information, finance details, certifications, and engineering data.

VULNERABILITIES AND PATCHES

Google’s December 2023 Android security update addresses 85 vulnerabilities, notably including a critical zero-click remote code execution flaw (CVE-2023-40088) in the Android System component. The update addresses 84 other security vulnerabilities, with three critical ones related to privilege escalation and information disclosure in Android Framework and System components (CVE-2023-40077, CVE-2023-40076, and CVE-2023-45866), and another critical flaw in Qualcomm’s closed-source components (CVE-2022-40507).
Atlassian has released software fixes to address four critical vulnerabilities that could lead to remote code execution (RCE). These flaws include a deserialization vulnerability in the SnakeYAML library (CVE-2022-1471), and RCE vulnerabilities in Confluence Data Center and Confluence Server, Assets Discovery for Jira Service Management and in Atlassian Companion app for macOS (CVE-2023-22522, CVE-2023-22524, CVE-2023-22523).

THREAT INTELLIGENCE REPORTS

Check Point Research has examined various attack vectors in modern Outlook and compared the user interoperability required for each scenario when attackers use Outlook to deliver their exploits. The attack vectors have been observed in three categories: the “obvious” Hyperlink attack vector, the “normal” attachment attack vector, and the “advanced” attack vector.

Check Point Threat Emulation and IPS provide protection against this threat.

Check Point Research has identified a shift in the targeting of the Iranian hacktivist proxies which are now extending their cyber operations to include targets in other countries besides Israel, with a particular emphasis on the United States. Moreover, groups such as CyberAv3ngers and Cyber Toufan appear to be adopting a narrative of retaliation in their cyberattacks. They claim to target US entities using Israeli technology, suggesting a strategy of simultaneously targeting both Israeli and US interests.
Check Point Research exposes a troubling trend in the cryptocurrency landscape. Deceptive actors are manipulating pool liquidity, sending token prices soaring by 22,000%. The manipulation of pool liquidity resulted in a swift and calculated theft of $80,000 from unsuspecting token holders. This incident sheds light on the evolving strategies scammers employ to exploit decentralized finance platforms.
The Russia-based actor Star Blizzard (aka COLDRIVER/Callisto Group) persistently employs spear-phishing attack techniques for information-gathering purposes. The threat actor has been observed targeting individuals and organizations in the UK and US that involved in international affairs, defense, and logistics support to Ukraine.

The post 11th December – Threat Intelligence Report appeared first on Check Point Research.

Check Point Research – ​Read More

Accelerating security outcomes with a cloud-native SIEM

/in

As organizations modernize their IT infrastructure and increase adoption of cloud services, security teams face new challenges in terms of staffing, budgets and technologies. To keep pace, security programs must evolve to secure modern IT environments against fast-evolving threats with constrained resources. This will require rethinking traditional security strategies and focusing investments on capabilities like cloud security, AI-powered defense and skills development. The path forward calls on security teams to be agile, innovative and strategic amidst the changes in technology and cyber risks.

To meet these security demands, security teams must focus on three critical transformations:

Evolution from closed vendor ecosystems to open, collaborative, community-powered defense
Scaling security expertise with AI and automation
Evolution from tool-focused defense to analyst-powered outcomes

One of the most effective steps toward modernizing a security operations program is upgrading the core SIEM platform. As the central nervous system for SOC teams, the SIEM collects, correlates and analyzes data from across the IT environment to detect threats. Optimizing this capability by implementing a cloud-native SIEM or augmenting an on-premises system lays the digital foundation needed to scale security efforts.

With a high-fidelity view of security alerts and events via an upgraded SIEM, organizations gain the visibility and context required to identify and respond to cyber risks no matter the source. Prioritizing improvements here accelerates the transformation of siloed security practices into an integrated, intelligence-driven function poised to address both current and emerging challenges.

Open defense: Finding the real “threat needles” hidden in the “security-data haystack”

The explosion of data has increased the attack surface—a most significant side effect that has costly ripple effects. More data. More alerts. More time needed to sift through alerts.

The SIEM plays a critical role in analyzing this data—however, the reality of sending this volume of data to the SIEM for analysis is becoming increasingly challenging, particularly across multiple clouds. In some cases, sending all of the data is not necessary. With the evolution of cloud, and identity and data security tools in the cloud, there is often only a need to collect alerts from these systems and import those into the SIEM, as opposed to ingesting all data.

Today’s SIEMs should be designed around open standards and technologies so they can easily collect only key insights, while still providing the security team with access to the underlying telemetry data when needed.

In many cases, no such detection is required; in other cases, a security team only needs to collect data to do further specific threat analysis. In these cases, a SIEM with real-time data collection, data warehousing capabilities designed for analysis of cloud-scale data, optimized for real-time analytics and sub-second search times is the solution. Organizations need access to their data on-premises and in the cloud without dealing with vendor and data locking.

This open approach to SIEM helps organizations leverage existing investments in data lakes, logging platforms and detection technologies. It also ensures that organizations have the flexibility they need to choose the right data retention and security tools as their security infrastructure matures.

However, increased visibility into the data is only one part of the solution. Security teams need accurate and current detection logic to find threats because security teams are currently facing challenges in their skills to detect threats in a timely manner. Incorporating regularly updated threat intelligence enables the analyst to accelerate their threat detection. And, leveraging a common, shared language for detection rules like SIGMA, allows clients to quickly import new, validated detections directly crowdsourced from the security community as threats evolve.

AI and automation to accelerate threat detection and response

Most organizations are detecting malicious behaviors in a SIEM or other threat-detection technologies such as EDR, but in fact, SOC professionals get to less than half (49%) of the alerts that they’re supposed to review within a typical workday, according to a recent global survey. Leveraging automation and AI ensures transparency and provenance in recommendations and insights that can help security teams address high-priority alerts and deliver desired outcomes.

To do this, a SIEM needs to employ innovative risk-based analytics and automated investigation powered by graph analytics, threat intelligence and insights, federated search, and artificial intelligence. Effective SIEM platforms must leverage artificial intelligence to augment human cognition. Self-tuning capabilities reduce noisy alerts to focus analyst attention where it’s needed most. Virtual assistance can help handle routine triage to allow security experts to pursue strategic initiatives and robust machine learning models can uncover hidden attack patterns and incidents that rules-based systems miss. Some of the most advanced SIEMs enrich and correlate findings from across an organization’s environment so analytics are automatically focused on the attacks that matter most.

In order to build the required trust with security teams, a SIEM needs to provide transparency and provenance in its recommendations and insights. By including explainability into how each assessment was made, security analysts can have the confidence to trust recommendations and act more quickly and decisively on threats in their environment.

Another aspect vendors need to consider when developing a SIEM for today is the shift of moving the decisions and response actions to the analysts performing initial alert analysis from the responder. In many cases, they are looking to fully automate where balance of risk is right for the organization. Such processes and decisions are traditionally coordinated and tailored appropriately in a separate SOAR system, and in some cases with a different team. Today’s SIEM needs to be able to enable a more agile shift left to incorporate full SOAR capabilities in the SIEM workflow and UX. This approach enables organizations to almost fully automate response processes based on their balance of risk and, where needed, introduce the security team into the process to verify the recommended actions.

Evolving from tool-focused to analyst-focused defense

Early SIEM platforms centered on collecting and correlating vast streams of security data. These first-generation systems excelled at log aggregation but overloaded analysts with excessive alerts rife with false positives. Attempting to keep pace, teams added new tools to manage incidents, track threats and automate tasks. But this tech-driven approach created complex, fragmented environments that diminished productivity.

Modern SIEM solutions shift focus to the human analyst’s experience throughout the threat lifecycle. Rather than produce more data points, next-generation platforms leverage AI to find signals in the noise. Cloud-based analytics uncover hard-to-identify attack patterns to feed predictive capabilities and enrich findings from across an organization’s environment so analysts can focus on the attacks that matter most. To effectively work inside the analyst workflow, open architectures and integrated system visibility must be embedded in every SIEM.

In the instance of a modern SIEM, the tools and technologies work to serve the analyst—and not the other way around.

Introducing the new cloud-native IBM QRadar SIEM— thoughtfully engineered to help analysts succeed

At IBM, we recognize that having the most powerful technology means nothing if it burdens the analyst with complexity. We also recognize that SIEM technologies have often promised to be the “single pane of glass” into an organization’s environment—a promise that our industry needs fulfilled.

That’s why we built the new cloud-native QRadar SIEM with the analyst in mind. QRadar SIEM leverages a new user interface that fuses the primary workflows from threat intelligence, SIEM, SOAR and EDR into a single, seamless workflow. Not only does this deliver significant productivity improvements but it also removes the burden of switching between tools, dealing with false positives and inefficient workflows. When analysts have the right tools and context, they can move with speed and precision to stop sophisticated attacks.

This new cloud-native edition of QRadar SIEM not only builds on the data collection and threat detection of the current QRadar SIEM edition, but it also includes all the elasticity, scalability and resiliency properties of a cloud-native architecture. With openness, enterprise-grade AI and automation, and a focus on the analyst, QRadar SIEM (Cloud-Native SaaS) can help maximize your security team’s time and talent, ultimately delivering better security outcomes.

Explore the new cloud-native QRadar SIEM

The post Accelerating security outcomes with a cloud-native SIEM appeared first on Security Intelligence.

Security Intelligence – ​Read More

Best practices for cloud configuration security

/in

Cloud computing has become an integral part of IT infrastructure for businesses of all sizes, providing on-demand access to a wide range of services and resources. The evolution of cloud computing has been driven by the need for more efficient, scalable and cost-effective ways to deliver computing resources.

Cloud computing enables on-demand access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications and services) over the internet. Instead of owning and maintaining physical hardware and infrastructure, users can leverage cloud computing services provided by third-party providers.

Cloud service and deployment models

Cloud computing is commonly categorized into service and deployment models:

Service models

Infrastructure as a Service (IaaS): Provides virtualized computing resources over the internet. Users can rent virtual machines and storage and networking components.
Platform as a Service (PaaS): Offers a platform that includes tools and services for application development, testing and deployment. Users can focus on building applications without managing the underlying infrastructure.
Software as a Service (SaaS): Delivers software applications over the internet on a subscription basis. Users access the software through a web browser without worrying about installation or maintenance.

Deployment models

Public cloud: A third-party cloud service provider owns and operates resources and makes them available to the general public. Some providers include Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform.
Private cloud: A single organization exclusively uses resources. Either the organization or a third-party provider can manage the infrastructure, which can be located on-premises or off-site.
Hybrid cloud: Combines public and private cloud models to allow data and applications to be shared between them. This provides greater flexibility and optimization of existing resources and infrastructure.

4 common cloud attack scenarios

Unfortunately, every rapidly growing industry attracts not only enthusiastic entrepreneurs but also malicious actors whose goal is to take advantage of any security holes that would be unable to defend against various attacks. Here are some examples of common attack scenarios in the cloud.

1. DDoS attacks

A distributed denial of service (DDoS) attack occurs when a web application is overloaded with a high volume of traffic. DDoS protection services, like AWS Shield, can mitigate such attacks.

AWS Shield uses machine learning algorithms to analyze incoming traffic, identify patterns indicative of a DDoS attack and take action to stop the attack.

2. Data breaches

A data breach involves exploiting vulnerabilities to access and exfiltrate sensitive data. But regularly updating software, encrypting sensitive data, monitoring for unusual activity and building a good incident response can help prevent data breaches.

Below is an incident response example code (AWS Lambda for Incident Response) in Python (Boto3 is a Python software development kit [SDK] for AWS).

3. Man-in-the-middle attacks

A man-in-the-middle (MitM) attack occurs when communication between two parties is intercepted for malicious intent. The use of encryption (SSL/TLS) and implementing secure communication protocols can help prevent a MitM attack. Without encryption, data transmitted over the network can be intercepted.

The code below is an example of encrypting S3 Objects with AWS SDK for Python-Boto3.

4. Brute force attacks

A brute force attack is a hacking method that uses trial and error to crack passwords, login credentials and encryption keys. It is a simple yet reliable tactic for gaining unauthorized access to individual accounts and organizational systems and networks.

AWS CloudWatch Alarms can provide logging and monitoring services where repeated login attempts might go unnoticed.

Cloud configuration security best practices

Security in cloud computing involves implementing measures to protect data, applications and infrastructure in a cloud environment from potential threats. Here are some best practices in key areas of cloud configurations in AWS and Azure associated with securing cloud environments.

 AWS

 Identity and access management (IAM):

Use the principle of least privilege when assigning permissions to users, roles and groups
Regularly review and audit IAM policies to align with business requirements
Enable multi-factor authentication (MFA) for enhanced user authentication.

Example AWS IAM policy:

If IAM policies are not properly configured, an attacker might gain access to sensitive resources.

VPC (virtual private cloud) configuration:

Utilize separate subnets for public and private resources.

 Example code (AWS CloudFormation):

S3 Bucket Security:

Regularly audit and review access controls for S3 buckets
Enable versioning and logging to track changes and access to objects
Consider using S3 bucket policies to control access at the bucket level
Enforce server-side encryption for S3 buckets.

Example code (AWS CLI):

Azure

Azure role-based access control (RBAC):

Assign the principle of least privilege using Azure RBAC.

 Example code (Azure PowerShell):

Azure Blob storage security:

Enable Blob storage encryption.

 Example code (Azure PowerShell):

 Azure virtual network:

Implement network security groups (NSGs) for access control.

 Example code (Azure Resource Manager Template):

Keeping digital assets secure in the cloud

Securing cloud configurations is essential to safeguard digital assets and maintain a resilient cybersecurity posture. Organizations should focus on continuous monitoring, compliance checks and proactive incident response planning to address the dynamic nature of cyber threats in the cloud.

In addition, implementing the principles of least privilege, encryption, identity and access management and network security best practices not only protects the cloud environment against potential vulnerabilities but also contributes to a culture of security awareness and responsiveness within the organization.

As cloud computing continues to evolve, organizations should commit to staying ahead of emerging security challenges and adapting configurations to maintain a resilient and secure digital presence.

Not sure how to start? IBM Security has a range of cloud security services to protect your cloud environment.

The post Best practices for cloud configuration security appeared first on Security Intelligence.

Security Intelligence – ​Read More

   Best practices for cloud configuration security

/in

Cloud computing has become an integral part of IT infrastructure for businesses of all sizes, providing on-demand access to a wide range of services and resources. The evolution of cloud computing has been driven by the need for more efficient, scalable and cost-effective ways to deliver computing resources.

Cloud computing enables on-demand access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications and services) over the internet. Instead of owning and maintaining physical hardware and infrastructure, users can leverage cloud computing services provided by third-party providers.

Cloud service and deployment models

Cloud computing is commonly categorized into service and deployment models:

Service models

Infrastructure as a Service (IaaS): Provides virtualized computing resources over the internet. Users can rent virtual machines and storage and networking components.
Platform as a Service (PaaS): Offers a platform that includes tools and services for application development, testing and deployment. Users can focus on building applications without managing the underlying infrastructure.
Software as a Service (SaaS): Delivers software applications over the internet on a subscription basis. Users access the software through a web browser without worrying about installation or maintenance.

Deployment models

Public cloud: A third-party cloud service provider owns and operates resources and makes them available to the general public. Some providers include Amazon Web Services (AWS), Microsoft Azure and Google Cloud Platform.
Private cloud: A single organization exclusively uses resources. Either the organization or a third-party provider can manage the infrastructure, which can be located on-premises or off-site.
Hybrid cloud: Combines public and private cloud models to allow data and applications to be shared between them. This provides greater flexibility and optimization of existing resources and infrastructure.

4 common cloud attack scenarios

Unfortunately, every rapidly growing industry attracts not only enthusiastic entrepreneurs but also malicious actors whose goal is to take advantage of any security holes that would be unable to defend against various attacks. Here are some examples of common attack scenarios in the cloud.

1. DDoS attacks

A distributed denial of service (DDoS) attack occurs when a web application is overloaded with a high volume of traffic. DDoS protection services, like AWS Shield, can mitigate such attacks.

AWS Shield uses machine learning algorithms to analyze incoming traffic, identify patterns indicative of a DDoS attack and take action to stop the attack.

2. Data breaches

A data breach involves exploiting vulnerabilities to access and exfiltrate sensitive data. But regularly updating software, encrypting sensitive data, monitoring for unusual activity and building a good incident response can help prevent data breaches.

Below is an incident response example code (AWS Lambda for Incident Response) in Python (Boto3 is a Python software development kit [SDK] for AWS).

3. Man-in-the-middle attacks

A man-in-the-middle (MitM) attack occurs when communication between two parties is intercepted for malicious intent. The use of encryption (SSL/TLS) and implementing secure communication protocols can help prevent a MitM attack. Without encryption, data transmitted over the network can be intercepted.

The code below is an example of encrypting S3 Objects with AWS SDK for Python-Boto3.

4. Brute force attacks

A brute force attack is a hacking method that uses trial and error to crack passwords, login credentials and encryption keys. It is a simple yet reliable tactic for gaining unauthorized access to individual accounts and organizational systems and networks.

AWS CloudWatch Alarms can provide logging and monitoring services where repeated login attempts might go unnoticed.

Cloud configuration security best practices

Security in cloud computing involves implementing measures to protect data, applications and infrastructure in a cloud environment from potential threats. Here are some best practices in key areas of cloud configurations in AWS and Azure associated with securing cloud environments.

 AWS

 Identity and access management (IAM):

Use the principle of least privilege when assigning permissions to users, roles and groups
Regularly review and audit IAM policies to align with business requirements
Enable multi-factor authentication (MFA) for enhanced user authentication.

Example AWS IAM policy:

If IAM policies are not properly configured, an attacker might gain access to sensitive resources.

VPC (virtual private cloud) configuration:

Utilize separate subnets for public and private resources.

 Example code (AWS CloudFormation):

S3 Bucket Security:

Regularly audit and review access controls for S3 buckets
Enable versioning and logging to track changes and access to objects
Consider using S3 bucket policies to control access at the bucket level
Enforce server-side encryption for S3 buckets.

Example code (AWS CLI):

Azure

Azure role-based access control (RBAC):

Assign the principle of least privilege using Azure RBAC.

 Example code (Azure PowerShell):

Azure Blob storage security:

Enable Blob storage encryption.

 Example code (Azure PowerShell):

 Azure virtual network:

Implement network security groups (NSGs) for access control.

 Example code (Azure Resource Manager Template):

Keeping digital assets secure in the cloud

Securing cloud configurations is essential to safeguard digital assets and maintain a resilient cybersecurity posture. Organizations should focus on continuous monitoring, compliance checks and proactive incident response planning to address the dynamic nature of cyber threats in the cloud.

In addition, implementing the principles of least privilege, encryption, identity and access management and network security best practices not only protects the cloud environment against potential vulnerabilities but also contributes to a culture of security awareness and responsiveness within the organization.

As cloud computing continues to evolve, organizations should commit to staying ahead of emerging security challenges and adapting configurations to maintain a resilient and secure digital presence.

Not sure how to start? IBM Security has a range of cloud security services to protect your cloud environment.

The post    Best practices for cloud configuration security appeared first on Security Intelligence.

Security Intelligence – ​Read More

How the White House sees the future of safeguarding AI

/in

On October 30, 2023, President Biden issued an executive order (EO) to set new standards for the safety and security of Artificial Intelligence (AI). The move sets out the government’s intentions to regulate and further advance the growth of AI technology in the years ahead.

Yet the question remains if it goes far enough to protect the American public from AI’s exponential development — and if it does, will this stance from the president’s office stifle the nation’s ability to remain the leading force in AI’s evolution?

What the executive order means for the future of AI

Since the middle of 2022, AI has quickly infiltrated almost every industry. The rapid evolution in AI technology has led to a huge boom in business opportunities and new jobs — early reports suggest AI could contribute nearly $16 trillion to the global economy by 2030.

But many fear the impact this evolving tech may have on individuals and industries alike. The executive order is the Biden administration’s first significant step in countering any negative repercussions of AI.

White House Deputy Chief of Staff Bruce Reed claims, “It’s the next step in an aggressive strategy to do everything on all fronts to harness the benefits of AI and mitigate the risks.”

Key inclusions of this executive order

The lengthy document provides a sweeping set of regulatory principles. This new executive order is ambitious, outlining the government’s intentions to use AI to achieve several key goals:

New standards for AI safety and security
Protecting the American public’s privacy
Advancing equity and civil rights
Supporting the American workforce
Promoting innovation and competition
Advancing American leadership abroad
Ensuring responsible and effective government use of AI.

Let’s take a closer look at some notable inclusions of Biden’s Executive Order:

Labeling AI-generated content

With more AI-generated content created by the day, it’s becoming more challenging for the general public to discern between what is real and what is not. This mandate offers guidance on watermarking and clearly labeling AI-generated content so Americans can easily understand which ads, content and communications are authentic.

Supporting the American workforce

This executive order places great emphasis on recruiting AI talent, ensuring America becomes the leading destination for the most skilled leaders in their field. From changes to visas and green cards to investments in resources, tools and infrastructure, there’s a clear focus on making America a leader in the AI revolution.

Promoting innovation and competition

Although the EO places potential restrictions on developers and companies alike, it encourages investment in the space. There is immense potential to democratize AI advancements, giving people and private companies more autonomy rather than relying on major tech companies. Moreover, with proper regulations, the government can drive more innovation with AI technology to prioritize societal benefits.

Explore AI solutions

What the executive order is missing

While there is a lot of optimism around this announcement from the Biden administration, there are skeptics. Senator Ted Cruz argues these guidelines place “barriers to innovation disguised as safety measures” and that the order “undermines exactly what AI technologies promise to do: create efficiencies, spur economic growth and improve our lives.”

It leads us to wonder what is missing and the potential obstacles the EO faces.

A Forrester senior analyst, Alla Valente, states, “We don’t need more ‘voluntary’ frameworks for regulating AI — we need clear direction and mandated requirements.”

Many analysts fear the EO will become nothing more than words that appear strong but have no practical merit. Lloyd Whitman echoes this sentiment: “An executive order can only do so much, limited by the existing authorities and appropriations of the executive branch agencies.”

Currently, the EO provides an alarming lack of repercussions to those who don’t follow the guidelines. There is also little clarity on how the rules will be enforced — especially compared to the European Union AI Act, which enforces significant fines for those failing to meet standards.

The first steps of a longer journey

As AI continues to advance, there’s a fine line for legislators to protect the people without stifling innovation. The jury is out on whether these guiding principles from the president will achieve this balance.

The consensus is that although this EO provides positive steps forward, it lacks enough detail to achieve its ambitious goals.

There’s no doubt that the exponential rise of AI is set to continue. But although it will lead to massive opportunities, this technology is an area that needs clear and significant regulation. The executive order from the Biden administration is the first meaningful step, although one that is very much a work in progress.

The post How the White House sees the future of safeguarding AI appeared first on Security Intelligence.

Security Intelligence – ​Read More

Transatlantic Cable podcast, episode 327 | Kaspersky official blog

/in

The latest episode of the Transatlantic Cable podcast kicks off with news that hackers are paying to gain access to hotel booking[.]com portals. The hack is apparently so lucrative, they’re now advertising for access on the dark web. Additionally, the team discuss new content restriction laws being discussed in the U.K, with news that photo I.D may be required to access certain sites.

Additionally, this week the team sat down with Vidit Gujrathi, Chess grandmaster and Maher Yamout, Lead Security Researcher at Kaspersky to talk about Chess, cyber-security and how the two are more connected than you might think.

If you liked what you heard, please consider subscribing.

Booking[.]com hackers increase attacks on customers
UK porn watchers could have faces scanned

Kaspersky official blog – ​Read More

Exploiting GOG Galaxy XPC service for privilege escalation in macOS

/in

Being part of the Adversary Services team at IBM, it is important to keep your skills up to date and learn new things constantly. macOS security was one field where I decided to put more effort this year to further improve my exploitation and operation skills in macOS environments.

During my research, I decided to try and discover vulnerabilities in software that I had pre-installed on my laptop, which resulted in the discovery of this vulnerability. In this article, I will go through the analysis of the vulnerability, how I discovered it, and the exploitation and disclosure process. Although we made several efforts to get the vendor to fix the vulnerability, it remains unpatched at the time of writing this blog post.

Vulnerability details

CVE-2023-40713
Affected version: Version 2.0.65 (11)
Impact: Privilege Escalation
CVSS: 7.8 — HIGH

When GOG Galaxy is installed, it creates a new file in the /Library/LaunchDaemons directory with the name of com.galaxy.ClientService.plist. This behavior results in the creation of a Launch Daemon, which is a background process running with high privileges. Usually, these processes are used as helper tools to perform privileged actions by a low privileged application.

Inspecting the PLIST file created by GOG Galaxy, it shows that an XPC service named com.gog.galaxy.ClientService is exposed by the Privileged Helper tool located in /Library/PrivilegedHelperTools/com.gog.galaxy.ClientService.

These are highlighted in the contents of the PLIST file below:

?xml version=”1.0″ encoding=”UTF-8″?>

<!DOCTYPE plist PUBLIC “-//Apple//DTD PLIST 1.0//EN”

“http://www.apple.com/DTDs/PropertyList-1.0.dtd”>

<plist version=”1.0″>

<dict>

  <key>Label</key>

  <string>com.gog.galaxy.ClientService</string>

  <key>MachServices</key>

  <dict>

    <key>com.gog.galaxy.ClientService</key>

    <true/>

  </dict>

  <key>Program</key>

  <string>/Library/PrivilegedHelperTools/com.gog.galaxy.ClientService<

/string>

  <key>ProgramArguments</key>

  <array>

  

<string>/Library/PrivilegedHelperTools/com.gog.galaxy.ClientService</string>

  </array>

</dict>

</plist>

Quick intro to XPC service

An XPC service is an inter-process communication mechanism heavily used in macOS. It allows you to create helper tools that can perform certain tasks on behalf of an application. This is typically used for tasks that run in the background or tasks that require elevated privileges. It is usually composed of the XPC service acting as a server and an application that connects to the XPC service.

The following diagram shows a connection between the application and the XPC service:

Figure 1: NSXPC architecture (Source: Apple Developer)

I will not go into details of XPC as it is a complex topic but just think of it as the usual inter-process communication where a client can call methods that are exposed by the XPC service.

Connection validation in GOG Galaxy

The ability to call methods exposed by a service running with high privileges sounds like a bad idea. An application can just connect to the XPC service, call exposed methods, and perform actions on behalf of the XPC service. Although this is possible, most applications verify the client application and only allow specific applications to call the exposed methods.

For example, in the GOG Galaxy Privileged Helper tool, the function responsible for checking if a connection is valid (shouldAcceptNewConnection) is shown below:

-(char)listener:(void *)arg2 shouldAcceptNewConnection:(void *)arg3 {

    r14 = self;

    rax = [arg3 retain];

    r15 = rax;

    if ([r14 areRequirementsValidForProcessId:[rax processIdentifier]] !=

0x0) {

            rax = [NSXPCInterface

interfaceWithProtocol:@protocol(ClientServiceProtocol)];

            rax = [rax retain];

            [r15 setExportedInterface:rax];

            [rax release];

            [r15 setExportedObject:r14];

            rbx = 0x1;

            [r15 resume];

            

  [REDACTED]

The application calls the areRequirementsValidForProcessId function with the processIdentifier parameter which is the PID of the connecting process. If this function returns 0, it will export the object and allow the connection, otherwise, it will exit.

Reviewing the areRequirementsValidForProcessId function, it receives the processID as a parameter, copies the security attributes of the process using the PID and checks them against the following security requirements:

[REDACTED]


void galaxy::service_library::Logger::Info<char const*>(“Validating
signature of calling process at path {}.”, 0x33);

rax = SecRequirementCreateWithString(@”identifier ”com.gog.galaxy” and
anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /*
exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */
and certificate leaf[subject.OU] = ”9WS36Q8886”“, 0x0, &var_48);

[REDACTED]

The security check itself is valid as it checks if the package identifier is com.gog.galaxy, if the certification is a valid Apple certificate, and if the team identifier is 9WS36Q8886 (which is the team identifier for GOG Galaxy).

The PID re-use problem

The problem exists because all these checks are performed against a PID which is not safe. In macOS, PIDs can be reused and we can even replace current executables with a different process with posix_spawn() while keeping the old PID. This was originally published on Warcon 18 in the presentation, Don’t Trust the PID (PDF).

This attack is based on a race condition where an exploit is going to send several messages to the XPC service and just after that, execute posix_spawn with the binary that fulfills all the security requirements to replace the malicious binary PID. By queuing a lot of messages, the time between the message processing and process validation will allow the exploit to replace the exploit PID with the real application validating the connection.

The following image shows a graphical representation of the attack:

Figure 2: Race condition when queuing XPC messages (Source: IBM)

Exposed methods of the Privileged Helper tool

Although we can manipulate the Privileged Helper and invoke any exposed methods, it is not useful unless these methods offer an opportunity for exploitation. The protocol used between the XPC service and client was called ClientServiceProtocol.

This protocol exposed the following methods:

 

– (void)requestShutdown; – (void)removeOldClientService; 


– (void)fillProcessInformationForPids:(NSArray *)arg1 authorization: (NSData
*)arg2 withReply:(void (^)(NSArray *))arg3; 


– (void)createFolderAtPath:(NSString *)arg1 authorization:(NSData *)arg2
withReply:(void (^)(NSError *))arg3; 

– (void)renameClientBundleAtPath:(NSString *)arg1 withReply:(void (^)
(NSError *))arg2; 

– (void)changeFolderPermissionsAtPath:(NSString *)arg1 authorization:
(NSData *)arg2 withReply:(void (^)(NSError *))arg3; 

– (void)getVersionWithReply:(void (^)(NSString *))arg1;

While multiple methods were exposed, the most interesting one was changeFolderPermissionsAtPath, which required three arguments.

Arg1 – Authorization data
Arg2 – The path to change permissions to
Arg3 – An array for the response

The function first checks the authorization data which can be bypassed by creating an authorization structure without any rights. After authorization is checked, the function performs a variety of actions, but the most important is calling the chmod function. The chmod function is called with the path provided in arg2 and 0x1ff, which makes any targeted file globally readable, writable, and executable.

-(void)changeFolderPermissionsAtPath:(void *)arg2 authorization:(void *)arg3

withReply:(void *)arg4 {

    r13 = [arg2 retain];

    r14 = [arg3 retain];

    var_C8 = [arg4 retain];

    rax = objc_retainAutorelease(r13); <—- RAX is initated from r13, which

is initiated from arg2

    

    var_F8 = rax;

 

[REDACTED]

    rax = [NSFileManager defaultManager];

    rax = [rax retain];

    r13 = rax;

    var_E8 = [[rax subpathsAtPath:var_F8] retain];

    rax = objc_retainAutorelease(var_F8);

    var_E0 = rax;

    rax = [rax UTF8String];

    rax = chmod(rax, 0x1ff); <— Permissions are changed using chmod

    var_B4 = rax;

    

    if (rax == 0x0) goto loc_1000c1be9;

 

 [REDACTED]

As a low-privileged user, we can communicate with the XPC service and change the permissions of any file in the system. This can be used to abuse the system in several ways, such as by modifying a Launch Daemon to execute a malicious binary when the daemon is loaded. However, this method requires a restart, so a better alternative is to modify the /etc/pam.d/login file.

The /etc/pam.d/login file is a configuration file for the Pluggable Authentication Modules (PAM) system on macOS. It contains the default authentication configuration for all services that use PAM. Modifying the auth entries to use the pam_permit.so module will allow any authentication attempt to succeed. This means that we will be able to run sudo on the target machine without entering a password.

Original File:

sh-3.2# cat /etc/pam.d/login

# login: auth account password session

auth       optional       pam_krb5.so use_kcminit

auth       optional       pam_ntlm.so try_first_pass

auth       optional       pam_mount.so try_first_pass

auth       required       pam_opendirectory.so try_first_pass

account    required       pam_nologin.so

account    required       pam_opendirectory.so

password   required       pam_opendirectory.so

session    required       pam_launchd.so
session    required       pam_uwtmp.so
session    optional       pam_mount.so
sh-3.2#

Replaced File:

sh-3.2# cat /etc/pam.d/login

# login: auth account password session

auth       optional       pam_permit.so

auth       optional       pam_permit.so

auth       optional       pam_permit.so

auth       required       pam_permit.so

account    required       pam_nologin.so

account    required       pam_opendirectory.so

password   required       pam_opendirectory.so

session    required       pam_launchd.so

session    required       pam_uwtmp.so

session    optional       pam_mount.so

sh-3.2#

Exploitation steps

Here are the required steps to successfully exploit the vulnerability:

Connect to the XPC through forked processes and replace the child processes with the legitimate binary.
Call the changeFolderPermissionsAtPath method that is exposed by the XPC modifying permissions of the /etc/pam.d/login file.
Replace the login file with one that allows authentication without password.
Escalate to root running sudo su.

We chose not to release the exploit code for this vulnerability, as it is still a 0-day. However, we have provided all the information needed to reproduce the vulnerability.

Defensive considerations

Adversaries abuse XPC services to execute malicious code, perform application white-listing bypass, and escalate privileges. On macOS, applications can leverage XPC services to send messages to the XPC service daemon, which runs with root privileges on the system. These attacks often take advantage of improper XPC client validation and poor input validation to allow code to be executed with elevated privileges.

Securing XPC can be challenging as it requires secure coding practices from the application vendor such as enabling the hardened runtime for XPC services and notarizing the application. Organizations can and should look for unsigned XPC client services and understand the risks associated with their operation in the environment. Additionally, monitoring for processes that make suspicious calls to processes with elevated privileges could be an early indication of this type of attack.

Disclosure timeline

Below is the disclosure timeline:

25 November 2022 — Vulnerability reported to GOG Galaxy
25 November 2022 — GOG Galaxy Support team responds saying details have been passed to the security team.
01 December 2022 — Asking for an update
01 December 2022 — GOG Galaxy Support team responds saying no updates were received from the security team.
09 December 2022 — Asking for update
09 December 2022 — GOG Galaxy Support team responds saying no updates were received from the security team.
12 January 2023 — Asking for an update, no response from GOG Galaxy Support team 08 February 2023 — Asking for an update
16 February 2023 — GOG Galaxy Support team responds saying no updates were received from the security team
06 March 2023 — Vendor was notified that we plan on publishing and advisory as 90 days have passed since reporting the vulnerability.
June 2023 — Disclosure

To learn how IBM X-Force can help you with anything regarding cybersecurity including incident response, threat intelligence, or offensive security services schedule a meeting here.

If you are experiencing cybersecurity issues or an incident, contact X-Force to help: US hotline 1-888-241-9812 | Global hotline (+001) 312-212-8034.

The post Exploiting GOG Galaxy XPC service for privilege escalation in macOS appeared first on Security Intelligence.

Security Intelligence – ​Read More

Iran’s Most Advanced Cyber Attack Yet

/in

For years now, Iran’s state-sponsored hackers have been some of the most prolific in the world. But prolific does not necessarily mean sophisticated — its attacks haven’t quite impressed in the way that the U.S., Russia, and China’s do. But in a campaign recently uncovered by CheckPoint, one Iranian APT unleashed tools and tactics unlike anything we’ve seen from the country before. If before they were at the kids’ table, this latest campaign suggests that they might have just moved up.

The post Iran’s Most Advanced Cyber Attack Yet appeared first on Check Point Research.

Check Point Research – ​Read More

The Obvious, the Normal, and the Advanced: A Comprehensive Analysis of Outlook Attack Vectors

/in

Research by: Haifei Li, Check Point Research

Introduction

Outlook, the desktop app in the Microsoft Office suite, has become one of the world’s most popular apps for organizations worldwide for sending and receiving emails, scheduling conferences, and more. From the security perspective, the app is one of the critical “gateways” responsible for introducing various cyber threats into organizations. Even a minor security problem in this app could cause severe damage and undermine the overall enterprise security.

Therefore, it is essential to examine the attack vectors on Outlook for typical enterprise environments, which Check Point Research will do in this paper. We assume the position of an average user – we click and double-click on things on Outlook – as our daily work requires, and we examine the security risks they may introduce from a security research perspective.

We will examine the attack vectors in three categories: the “obvious” Hyperlink attack vector, the “normal” attachment attack vector, and the “advanced” attack vector regarding Outlook email reading and ‘special object’. We use section numbers to mark the scenario for each attack vector.

Please note that the discussed research in this paper was performed on the latest Outlook 2021 (desktop version on Windows), with the latest security updates installed as of November 2023, in typical/default Outlook + Exchange Server environments.

I – The Obvious: the Hyperlink Attack Vector

1.1 – ONE Single-click: Web Links

If an attacker wants to attack someone via emails, an obvious method is for the attacker to send emails with malicious web hyperlinks to lure the victim to click on the links in these HTML emails. This is in fact the attack vector for all the phishing emails that the industry has been fighting against every day.

For example, the following is an email we received – the email body is written in HTML and has some links, such as “https://www.microsoft.com”. When the user clicks, Outlook calls the default browser on the OS to browse the website, which is just obvious.

Figure 1 – gif showing web links in Outlook email

For this attack vector, the attacker basically uses emails as a “bridge” to perform web-based attacks, whether they are social-engineering-based phishing attacks, browser exploits, or even highly technical browser zero-day exploits.

Please note that only a single click is needed to launch web links on Outlook. No additional confirmation is needed by the users. While this may sound scary (compared to the next attack vectors we will discuss), the security risks are not in Outlook, but in the browsers. If the browser is strong enough (against browser exploits) and the user is smart enough (against phishing attacks), there would be no problem. That is probably why Outlook considers usability as the first criteria here; another reason could be that email hyperlinks are just too common, you cannot let users confirm every click, because that would be too annoying and take too much time.

1.2 – Not all hyperlinks are web links

However, Outlook hyperlinks are not just web links, they could contain other types of hyperlinks, and those may introduce security risks. In fact, we at Check Point Research have discovered an Outlook bug in this attack vector. However, discussing particular bugs is not the goal of this paper. Therefore, we’d like to leave this topic for another publication. Please watch our blog site if you are interested. We will update here when the blog post is available.

II – The Normal: the Attachment Attack Vector

Here is the normal attack vector: the attacker sends the victim an email with a malicious attachment and lures the victim to open the attachment.

The “opening the attachment” on Outlook could mean two different types of actions. When the user double-clicks on the attachment, the system is trying to call the default registered application (for that attachment file type) on Windows to open the attachment in that application. When the user single-clicks on the attachment, it is trying to call the registered “previewer” application (for that attachment file type) to preview the attachment within the Outlook app. We will discuss both in detail.

The security risk introduced in the “attachment” scenarios depends on the security of the registered application for that attachment file type. If the application is robust enough with proper security measures, it would be less risky for the end user. On the other hand, if the application is insecure, it would be more risky for the end user.

2. 1 – Double-clicking: Opening the Attachment

If the user double-clicks on the attachment, Outlook will try to call the registered application (for the file type of the attachment) to open the attachment. Depending on the attachment’s extension name (the file type), there could be three scenarios.

2.1.1 – NO CLICK: The attachment’s extension name is marked as an “unsafe” file type.

The attachment could not be opened by Outlook (but it could be received, though).

The following figure shows a “.vbs” attachment is received but the user could not open it, because the “.vbs” file type is marked as “unsafe” by Outlook.

The blocked unsafe file types on Outlook are listed here by Microsoft.

Figure 2 – unsafe attachments are disabled on Outlook

2.1.2 – ONE DOUBLE-CLICK AND ONE SINGLE-CLICK: The attachment’s extension name is not marked as “unsafe” and not marked as “safe” either.

You may consider this as the “unclassified category”. In this scenario, there would be a promoted dialog shown to the user, asking the user for confirmation to open the file.

In this scenario, the user needs to perform two clicks in order to open the attachment. One is double-clicking on the attachment; the other is clicking the “Open” button on the promoted dialog (not the default button). After that, the default/registered app for this specific file type on the Windows OS would be used to open the attachment.

In Check Point Research’s recent blog post, we disclosed an interesting attacking technique (leaking NTLM information via common ports like 80/443) whereby the attacker delivers the .accdb exploit via emails; this would also fall into this scenario. The following gif shows this in an intuition way.

Figure 3 – gif showing double-clicking to open .accdb attachment on Outlook

In the real world, there are so many file types in this “unclassified” scenario. For an average Outlook user, it is impossible to know if every app/attachment you open is secure enough. Therefore, we recommend users stay cautious against this attack vector: do not easily click on the additional “Open” button for attachments from untrusted persons.

For application developers, while it is still rare in the real world, a good recommendation is to honor the Mark-of-the-Web (MotW). In this scenario, the attachment is marked as “from the Internet” when it’s sitting in the Outlook temporary directory prior to being opened by the third-party app. Therefore, if the third-party app checks and honors the MotW, like limiting the features and/or opening the app in an application sandbox when it detects that the file has the MotW flag, it would be a very good security practice.

Knowledge note: on default Outlook + Exchange Server environment, MotW is only set for attachments from email addresses outside the organization’s domain (the Internet), but not for email addresses inside the organization. Therefore, the MotW is very good for developers to balance security and usability for their apps.

For example, on February 2023 Patch Tuesday, Microsoft released a “defense in depth” feature via CVE-2023-21715 for Microsoft Publisher, a Microsoft 365 app. What the update does is simply disable Macros on Publisher totally when the .pub file has MotW. According to our research, when a .pub file with Macros embedded is opened by Publisher, in a “pre CVE-2023-21715” environment, if the .pub file has MotW (an external .pub attachment would fall in this attacking scenario), the following warning dialog is provided to the end user.

Figure 4 – In “pre CVE-2023-21715” environment, user could still choose “Enable Macros” when the .pub file has MotW

In the “post CVE-2023-21715” environment, the dialog is changed to:

Figure 5 – In “post CVE-2023-21715” environment, the “Enable Macros” button is removed when the .pub file has MotW

Note the difference, there’s now no option for the user to choose to run Macros inside the .pub file when the file comes with MotW (from the Internet), making it secure for the end user.

2.1.3 – ONE DOUBLE-CLICK: The attachment’s extension name is marked as a “safe” file type.

In this scenario, the attachment would be opened directly when the user double-clicks on the attachment.

Check out the following gif where the user opens a .docx file directly via one double-click because the .docx is marked as a “safe” file type.

Figure 6 – gif showing double-clicking to open .docx attachment on Outlook

Since there is no additional confirmation for users prior to opening the attachment in this scenario – one double-click is enough to call the application to open the attachment. Application developers should be extremely careful to register their file types/applications into this category.

A highly recommended security enhancement is developing an application sandbox for your application and processing the file in it, like Word, Excel, and PowerPoint’s “Protected View” mode. That said, the Word (.docx, .doc, .rtf, etc.), Excel (.xlsx, .xls, etc.), and PowerPoint (.pptx, .ppt, etc.) file types are all registered in this “safe” category, as well as the popular PDF file type for the latest Adobe Acrobat Reader (tested on version 2023.006.20360).

Figure 7 – Word running in Protected View mode (process integrity level “AppContainer”) when opening a document from external emails

The Protected View mode on Word/Excel/PowerPoint is not a typical application sandbox. In fact, beyond processing the file in the sandboxed process, it also limits the features that could run when the app is running in Protected View mode. For example, all OLE-related features are disabled when Protected View mode is activated. Therefore, the Protected Mode on Word/Excel/PowerPoint is much stronger than typical application sandboxes from a security point of view.

2.2 – Single-clicking: Previewing the Attachment

If the user single-clicks on the attachment (compared to double-clicking), Outlook will try to call the registered “previewer” app (for the file type of the attachment) to “preview” the attachment inside Outlook. Even though it’s called “preview”, the attachment file is still opened and processed from the technical point of view. The difference is that when previewing, the third-party app is running as a COM server in the background, and the attachment content is displayed in the Outlook window. As previously discussed, when “opening” the attachment via double-clicking, the third-party app is run directly, and the content is displayed in the application’s window.

Depending on the attachment’s extension name (the file type), there could be four scenarios when previewing the attachment.

2.2.1 – NO PREVIEW: The attachment’s extension name is marked as “unsafe”.

This is the same situation as we discussed in Scenario 2.1.1. Since the attachment is totally disabled, there are no opening or previewing options.

2.2.2 – NO PREVIEW: There’s no registered previewer app for the extension name.

In fact, most of the file types we have seen are in this category because most apps handling the file types are not registered as Outlook previewer apps. Check out the following gif where the user attempts to preview (via a single-click) a .wmv file (a media file type) but there is no registered app for that file type, so an error message is displayed.

Figure 8 – gif showing single-clicking trying to preview a .wmv attachment on Outlook but receiving an error message

2.2.3 – TWO SINGLE-CLICKS: The previewer app is registered but needs additional confirmation to preview the content

There are some file types, that have their previewer apps registered but Outlook doesn’t have much confidence that previewing the attachment is safe, so Outlook gives an additional warning dialog to the user – which requires another single click – to confirm to preview the attachment. Therefore, there are two single-clicks in this scenario, one for single-clicking on the attachment, and the other for clicking on the “Preview file” button on the warning window.

The following example previews a .pdf attachment – a popular file type- when Adobe Acrobat Reader is installed on the OS. When the user single clicks on the attachment, Outlook asks if the user wants to continue the previewing. Additionally, there’s an option letting the user choose if he/she wants to confirm this file type every time.

Figure 9 – gif showing single-clicking to preview a .pdf attachment on Outlook

Note that in the background, the PDF attachment is processed in the Adobe Acrobat Reader sandbox (one of the ”Acrobat.exe” processes with integrity level “Low”). The Adobe Acrobat Reader processes are started by the Windows process “prevhost.exe”. As shown in the following figures.

Figure 10 – Adobe Acrobat Reader runs in the background and processes the attachment in sandboxed environment, when user previews a PDF attachment on Outlook

Knowledge note: In Windows, standard/default users start processes with the “Medium” integrity level, so if a process is running with a lower integrity level (“Low” or “AppContainer”), it usually indicates that the process is running with a restricted application sandbox. Read more here.

2.2.4 – ONE SINGLE-CLICK: Previewer app is registered and marked as “safe”.

This scenario is the smoothest way to read the content of an attachment. When the user just single-clicks on the attachment, the attachment is previewed and the content is displayed in the Outlook window.

Because the process is very smooth, the potential security risk it may introduce is high. Therefore, from a security point of view, only the apps that have robust security enhancements should be registered into this “previewing safe list”.

For example, the Word, Excel, and PowerPoint file types are in this list. Following is a gif showing a .docx attachment being previewed on Outlook.

Figure 11 – gif showing single-clicking to preview a .docx attachment on Outlook

And, when previewing Word, Excel, or PowerPoint attachments on Outlook, the corresponding app is always run in the security-strong Protected View mode, as the following figure shows. So it protects users while also offering great usability.

Figure 12 – Microsoft Word runs in the background and processes the attachment in Protected View mode, when user previews a Word attachment on Outlook

Side note: Attentive readers may note that it is a bit different from the Adobe Acrobat Reader scenario we previously discussed, the sandboxed “WINWORD.EXE” process is started directly via Outlook process, not via “prehost.exe”, and there is only one “WINWORD.EXE” process, while in the Adobe Acrobat Reader scenario, there are two “Acrobat.exe” processes.

III – The Advanced: the Email Reading and Special Object Attack Vectors

3.1 – The Email Reading Attack Vector

The Email Reading attack vector is for the scenario in which the security problem is triggered as long as the victim reads the (attacking) email on Outlook. So this is a very powerful attack vector.

It is often referred to as the “Preview Pane” attack vector in the security domain, especially for Microsoft Security Update pages. For example, the following is a vulnerability patched by Microsoft which could be triggered when users read emails on Outlook but is referred to as the “Preview Pane” attack vector.

Figure 13 – A typical Microsoft Security Update webpage where Microsoft describes a vulnerability that could be triggered by “Preview Pane”

It is, in fact, a confusing name, as someone pointed out also. Anyway, when we read that Microsoft claims the Outlook Preview Pane is an attack vector, we can assume that the vulnerability could be triggered as long as the user reads emails on Outlook.

This lies in the core functions where Outlook processes emails or other objects that are delivered together with emails. From a vulnerability research point of view, that usually occurs when there is a vulnerability when Outlook parses or processes the email format. Outlook supports three types of email formats: the plain text email format, the HTML email format, and the TNEF email format (commonly known as the “Outlook Rich Text” format). The HTML and TNEF are complex formats so they produce more vulnerabilities, especially for the TNEF which is (basically) a binary format. The bug types could vary from memory corruptions to logical bugs.

Protip: configuring your Outlook only to read plain text email is the best for security, although you may lose the usability, of course since these links, inline pictures will not show up in the plain text email.

The following figure is an example of a piece of a TNEF format email, note the string “Content-Type: application/ms-tnef”, which specifies this email follows the TNEF format.

Figure 14 – the content of a typical TNEF (Outlook Rich Text) format email

Historically, many vulnerabilities have been found in this Outlook Email Reading attack vector, but working exploits were rare. That is because finding a scripting environment within or triggered by Outlook is not an easy job but some slips still can happen. Here is an example.

In 2015, the author of this paper discovered and reported a logical bug in Outlook, dubbed “BadWinmail”, which allows running any Flash exploit (at that time, Flash was installed by default on Windows 8/10) embedded in the TNEF format, via the OLE mechanism. Arbitrary and reliable code execution is achieved as long as the victim reads the email on Outlook – no need to click anything, so it was a very powerful zero-day exploit. Here is the paper and video demonstration if readers would like to see the impact of such an attack vector.

3.2 – The Outlook Special Object Attack Vector

For the previous Outlook Preview Pane (Email Reading) attack vector, although it is already very powerful, the victim still needs to read the email. However, there is a possibility that the victim doesn’t even need to read the email at all,- for as long as the victim opens Outlook and receives emails from the email server, he/she could still be pwned. That’s the attack vector we call the ‘Special Object’ attack vector.

Here is a real-world example, in March 2023, Microsoft disclosed that they detected a threat actor using a zero-day vulnerability (CVE-2023-23397) in Outlook to attack Ukrainian organizations. The zero-day allows local Windows to leak (Net)NTLM credential information to the attacker-controlled server. In detail, the root cause is a logical vulnerability when Outlook processes the so-called “reminder” object sent from the attacker. Please note that this attack doesn’t even need the victim to read the email on Outlook – it would be triggered automatically as long as the victim opens Outlook and connects to the email server. Here is a good analysis including a video demonstration, from MDSec .

Comparing the User Interoperability Required for Each Scenario

Now that we have reviewed all the attack vectors on Outlook, it would be interesting and valuable to compare each of them to see how easy (or hard) the attack scenario could be used for delivering exploits. Our methodology has us assuming the position of the attacker and we already have a working exploit for the targeted application, but we need Outlook as a “delivering method” to “deliver” that exploit “into” the targeted application.

We could use scores to mark the user interoperability required (or, the difficulty of delivering the exploit) for the attack scenario. For example, assuming we have a zero-day exploit for Microsoft Access – an app is usually installed with Outlook as part of the Office suite – and we need to use Outlook to deliver that Access exploit. We tested that when Microsoft Access is installed in the victim’s machine, a .accdb attachment would fall in Scenario 2.1.2 – The attachment’s extension name is not marked as “unsafe” and not marked as “safe” either. As we previously examined, that would require 1 double-click and 1 single-click.

If we set the score of a single-click to 1.0, because performing one double-click is a bit harder than performing one single-click, we could set the score of performing one double-click to 1.2 (plus 0.2, compared to single-clicking). The harder performing the action, the higher the score.

Thus, for the above Scenario 2.1.2, the total score is 1.2 (one double-click) + 1.0 (one single-click) = 2.2.

With this methodology, we could have the following table.

ScenarioDescriptionUser interoperabilityScore1.1Web links in email body1 single-click1.01.2Other hyperlinks in email body1 single-click1.02.1.1Attachment opened in third-party app, file type marked as unsafeN/AN/A2.1.2Attachment opened in third-party app, file type not marked as safe nor unsafe1 double-click and 1 single-click2.22.1.3Attachment opened in third-party app, file type marked as safe1 double-click1.22.2.1Attachment previewed in Outlook, file type marked as unsafeN/AN/A2.2.2Attachment previewed in Outlook, no registered previewer for file typeN/AN/A2.2.3Attachment previewed in Outlook, has registered previewer but not marked as safe2 single-clicks2.02.2.4Attachment previewed in Outlook, has registered previewer and marked as safe1 single-click1.03.1Email Reading / Preview Pane attack vectorNo click, just reading email is enough0.23.2Other Outlook special object exploitationNo click, just receiving email is enough0

Table 1 – a scoring system for various attack scenarios on Outlook

As you can see, we set the score of the Email Reading / Preview Pane attack vector to 0.2 (Scenario 3.1), as it requires a little more user interoperability compared to Scenario 3.2 – special object exploitation. For the special object exploitation, we set the score to 0, as this is the perfect scenario for attackers.

As we can find in the table, the most challenging scenario for attackers is Scenario 2.1.2 – the attachment’s extension name is not marked as “unsafe” and not marked as “safe” either, which has the highest score – 2.2. The perfect one is the Scenario 3.2 – the Outlook special object exploitation (score 0), or the Scenario 3.1 – the email reading attack vector (score 0.2).

However, we need to take note that we are only comparing the user interoperability here; we have a big prerequisite of having a working exploit for the targeted app. In fact, most of the time, when the score is low (easy for exploit delivering), the difficulty of finding and developing a working exploit for the targeted app is high.

For example, for the web browser exploit, the score is low (1.0) which means it is relatively easy to deliver the exploit, but finding and developing a working exploit for modern browsers, such as Google Chrome, is costly (as the attacker needs to bypass all the modern exploitation mitigations). So from a defense point of view, the risks for web links in Outlook emails are not completely unacceptable for average users.

For another example, for Scenario 2.1.3 (one double-click to open the attachment), if we assume the attacker has a Word exploit that works on the normal mode but not the “Protected View” mode of Microsoft Word – it is, in fact, the most common case of Word-based attacks. If the attacker sends the exploit (from an external source) as an email attachment, in order to gain successful exploitation, the victim needs to not only perform the one double-click in this scenario but also needs to perform an additional single-click on Microsoft Word (for the “Enable Editing” button, see the following figure), in order to exit the very strict Protected View mode. So, there are in total two user-clicks required for delivering a typical Word-based exploit, if we consider the full attack chain.

Figure 15 – user needs to click the “Enable Editing” button to exit Office Protected View mode

Therefore, when we assess the risk for an exploit delivered via the Outlook attack vectors, we need to assess the whole picture – we need not just consider the Outlook attack scenario discussed in this paper, but also the exploit itself, including the difficulty of developing the exploit.

Conclusion

In this paper, we examined various attack vectors in modern Outlook and compared the user interoperability required for each scenario when attackers use Outlook to deliver their exploits. We analyzed the scenarios by acting as an average Outlook user, using real-world examples, and with our own cutting-edge vulnerability research efforts. We hope this paper can help the security industry deeply understand the security threats that Outlook may pose.

All discussed attack vectors in this paper are monitored and protected by Check Point solutions including Check Point Email Security & Collaboration Security. Harmony Email & Collaboration provides complete protection for Microsoft 365, Google Workspace and all your collaboration and file-sharing apps. Harmony Email & Collaboration is designed specifically for cloud email environments and is the ONLY solution that prevents, not just detects or responds to, threats from entering the inbox.

Harmony Endpoint provides comprehensive endpoint protection at the highest security level while XDR/XPR quickly identifies the most sophisticated attacks by correlating events across your entire security estate and combining with behavioral analytics, real time proprietary threat intelligence from Check Point Research and ThreatCloud AI, and third-party intelligence.

Threat Emulation as well as Check Point gateways provide superior security beyond any Next Generation Firewall (NGFW). Best designed for Zero Day protection, these gateways are the best at preventing the fifth generation of cyber attacks with more than 60 innovative security services.
Check Point Research proactively hunts Outlook and email related attacks in the wild. As a leading security company, Check Point continues to develop innovative detection and protection technologies for customers around the world.

The post The Obvious, the Normal, and the Advanced: A Comprehensive Analysis of Outlook Attack Vectors appeared first on Check Point Research.

Check Point Research – ​Read More

Letters with Remcos RAT hosted in Discord | Kaspersky official blog

/in

Since the beginning of the summer, Kaspersky systems have been recording an increase in the detection of Remcos remote-access  trojan attacks. The probable reason for this is a wave of malicious emails in which attackers try to convince employees of various companies to click on a link for malware installation.

Malicious letters

The bait that the attackers are using in this mailout isn’t something extraordinary. They pose as a new client who wants to purchase some products or services and tries to clarify some information: the availability or prices of some merchandise, their compliance with some criteria, or something similar. What matters is that, in order to clarify the information, the recipient must click the link and read the list of these criteria or requirements. To make their letters more persuasive, cybercriminals often ask how quickly it will be possible to deliver the goods or ask about terms for international delivery. Of course, you shouldn’t follow the link — it doesn’t lead to a list, but to a malicious script.

The attackers store their malicious script in an interesting place. Links have the address that looks like https://cdn.discordapp.com/attachments/. Discord is a completely legitimate communication platform, which allows users to exchange instant messages, make audio and video calls, and, most importantly, send various files. A Discord user can click on any file sent through this application and get a link that will make it available to an external user (this is necessary, for example, to quickly share a file via another messenger). It is these links that look like https://cdn.discordapp.com/attachments/ with some set of numbers identifying a specific file.

Discord is actively used by various gaming communities, but it’s sometimes also used by companies to communicate within different teams and departments or even with customers. Therefore, systems that filter malicious content in emails often don’t consider links to files stored on Discord servers as suspicious.

Accordingly, if a recipient of the letter decides to follow such a link, he’ll in fact download malicious JavaScript that imitates a text file. When the victim opens this file, malicious script will launch powershell which, in turn, will download the Remcos RAT to the user’s computer.

What is Remcos RAT and how dangerous is it?

Theoretically, Remcos RAT — or Remote Control and Surveillance — is a program for remote administration, which was released by the company Breaking Security. But it has long been used by cybercriminals for espionage and taking control of computers running Windows. For example, in 2020, we wrote about the use of Remcos RAT in malicious mailings that exploited the common delays in deliveries of goods during the coronavirus pandemic.

Remcos RAT collects data about both the victim and their computer, and then serves as a backdoor through which attackers can take complete control of the system. They download additional malicious software and run it, collect account data, record logs of user activity, and so on.

How to stay safe

In order to ensure that the Remcos malware doesn’t harm your company, we recommend using reliable security solutions both at the level of the mail gateway and on all work devices that have access to the internet. Thus, the malicious emails will be detected before they reach the mailboxes of employees, but even if attackers come up with a new delivery method, our endpoint protection solutions won’t let to download it. Kaspersky Endpoint Security detects Remcos RAT as Backdoor.MSIL.Remcos or Backdoor.Win32.Remcos.

Kaspersky official blog – ​Read More