Privilege escalation vulnerability in Western Digital

Independent security researcher Xavier Danest has reported a privilege escalation vulnerability in EdgeRover. It should be mentioned that EdgeRover is a software developed by storage products manufacturer Western Digital for content management by unifying multiple storage devices under a single interface. Identified as CVE-2022-22988, the vulnerability has been rated as critical with a CVSSv3 of 9.1 as, due to a directory traversal flaw, it would allow an attacker who has previously compromised the target system to gain unauthorised access to restricted directories and files. This could additionally lead to local privilege escalation, disclosure of confidential information or denial of service (DoS) attacks. The flaw affects the desktop versions of EdgeRover for Windows and Mac, and it is currently unknown whether it is being actively exploited on the network. Western Digital has already fixed file and directory permissions to prevent unauthorised access and modification and recommends upgrading EdgeRover to version 1.5.1-594 or later, which addresses this vulnerability.​ 

For more: https://www.westerndigital.com/support/product-security/wdc-22004-edgerover-desktop-app-version-1-5-1-594

Serpent: new backdoor targeting French organisations

Researchers at Proofpoint have discovered a new backdoor that would target French organisations in the construction and government sectors. The detected campaign makes use of macro-enabled Microsoft Word documents under the guise of GDPR-related information in order to distribute Chocolatey, a legitimate, open-source package installer that, after various stealth techniques such as steganography and scheduled task bypass, would implement the backdoor that Proofpoint has named “Serpent”. Once the infection chain is successfully completed, the attacker would be able to manage the target host from its Command & Control (C2) server, exfiltrate sensitive information or even distribute additional payloads. Proofpoint highlights the possibility that Serpent is an advanced, targeted threat, based on its unique targeted behaviors such as steganography, although there is currently no evidence to attribute it to any specific known group.

All the details: https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain

Critical vulnerabilities in HP printer models

HP has recently published two security bulletins reporting critical vulnerabilities affecting hundreds of the company’s LaserJet Pro, Pagewide Pro, OfficeJet, Enterprise, Large Format and DeskJet printer models. On the one hand, on March 21st HP published a security advisory (HPSBPI03780) identifying a security flaw catalogued as CVE-2022-3942, CVSS 8.4. According to them, this is a buffer overflow flaw that could lead to remote code execution. The second bulletin (HPSBPI03781) contains three other vulnerabilities, two of which are classified as critical, namely VE-2022-24292 and CVE-2022-24293, CVSS 9.8. Exploitation of these vulnerabilities could allow malicious actors to cause information disclosure, remote code execution or denial of service. All of these security flaws were discovered by Trend Micro’s Zero Day Initiative team. It should be noted that HP has released firmware security updates for most of the affected products, although not all models are patched yet.​

Discover more: https://support.hp.com/us-en/document/ish_5948778-5949142-16/hpsbpi03780

Spying campaign using new variant of Korplug malware

ESET security researchers have detected a malicious campaign that has been active for at least eight months and is distributing a new variant of the Korplug remote access trojan (RAT). According to the investigation, the distribution of this malware would be carried out by sending emails under lures associated with current events such as COVID-19 or related to European institutional themes. Among the targets detected, ESET mentions that the campaign targets European diplomats, internet service providers and research institutes in countries such as Greece, Cyprus, and South Africa, among others. Korplug is a trojan previously associated with similar variants of PlugX malware that, depending on the campaign or threat actor using it in its operations, can have the ability to enumerate drives and directories, read and write files, execute commands on a hidden desktop, initiate remote sessions and communicate with the attackers’ Command & Control (C2) server. However, we do not rule out the possibility that Korplug is in the midst of development, adding new stealth functionality. ESET attributes this campaign to the China-linked threat actor Mustang Panda (aka TA416), known to be primarily motivated by political espionage.

More: https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/

New North Korean APT campaigns exploiting 0-day Chrome exploits

Google researchers have identified new campaigns attributed to two North Korean-linked cybercriminal groups that would have exploited remote code execution vulnerabilities in Chrome. The activity of these groups has previously been referred to as Operation Dream Job on the one hand, and Operation AppleJesus on the other. These APTs would have exploited the vulnerability CVE-2022-0609 for just over a month, before the patch was made available on 14 February. The activity is said to have targeted US entities, including media outlets, organisations in the technology sector, cryptocurrencies and the financial technology industry; however, it is possible that other sectors and geographies have also been targeted.  The published analysis details the tactics, techniques and procedures (TTPs), indicators of compromise and details about the exploit used by the attackers, which could be exploited by other groups linked to North Korea. 

All of the details: https://blog.google/threat-analysis-group/countering-threats-north-korea/

Vishing by impersonating Microsoft

The Office of Internet Security (OSI) has issued a security advisory to report an increase, in recent weeks, of fraudulent calls in which a supposed Microsoft employee indicates that the user’s device is infected. In this type of fraud, known as vishing, the attacker urges the victim to install a remote access application, which will supposedly disinfect the device. Once the cybercriminal has gained access to the user’s computer, they can steal all kinds of files stored on the device, get hold of the passwords stored in the browser, and even install malware that locks the computer and then asks for payment to unlock it. If the user has answered the call and installed the programme mentioned by the cybercriminal, the OSI recommends disconnecting the device from the network, uninstalling the installed programme and using an antivirus.

More info: https://www.osi.es/es/actualidad/avisos/2022/03/vuelven-las-llamadas-fraudulentas-del-supuesto-soporte-tecnico-de

Linux kernel Netfilter vulnerability

Security researcher Nick Gregory has discovered a new vulnerability in the Linux kernel. This flaw, identified as CVE-2022-25636 and with a CVSSv3 of 7.8, involves an out-of-bounds write vulnerability in Netfilter, a Linux kernel framework that allows various network operations like packet filtering, address and port translation (NATP), connection tracing and other packet manipulation operations. A local attacker could exploit this vulnerability to escalate privileges and execute arbitrary code on the vulnerable system. It should be noted that the flaw affects Linux kernel versions 5.4 to 5.6.10, so it is recommended to upgrade to the new version as soon as possible, since there is a PoC available.

More info: https://nickgregory.me/linux/security/2022/03/12/cve-2022-25636/

Brazilian trojan variant Maxtrilha targets Portuguese users

Researcher Pedro Tavares of Segurança Informática has detected a possible new variant of the Brazilian Trojan known as Maxtrilha. This variant has been detected being distributed via phishing templates impersonating the Portuguese tax services (Autoridade Tributária e Aduaneira), targeting banking users in Portugal. Researchers consider this malware to be a new variant of the Brazilian trojan Maxtrilha due to the similarity of the samples, and the fact that it uses the same templates to attack users. In the distributed malicious emails, there is a URL that downloads an HTML file called “Dividas 2021.html” or “Financas.htm”, which then downloads a ZIP file, ultimately downloading the malware. This new variant can install or modify trusted Windows certificates, perform a banking window overlay with the aim of stealing credentials, and can deploy additional payloads executed via the DLL injection technique.

More info: https://seguranca-informatica.pt/brazilian-trojan-impacting-portuguese-users-and-using-the-same-capabilities-seen-in-other-latin-american-threats/

Apple fixes 87 vulnerabilities

Apple has published 10 security bulletins that fix a total of 87 vulnerabilities in its different products and platforms: iOS 15.4 y iPadOS 15.4, watchOS 8.5, tvOS 15.4, macOS Monterey 12.3, macOS Big Sur 11.6.5, Actualización de seguridad 2022-003 Catalina, Xcode 13.3, Logic Pro X 10.7.3, GarageBand 10.4.6 e iTunes 12.12.3 para Windows. The vulnerabilities detected include flaws in WebKit (web browser engine used by Safari, Mail or App Store) that could lead to remote code execution (CVE-2022-22610, CVE-2022-22624, CVE-2022-22628 and CVE-2022-22629). There are also four other vulnerabilities in document, audio and video viewing components on iPhone and iPad that could allow malware deployment or privilege escalation (CVE-2022-22633, CVE-2022-22634, CVE-2022-22635 and CVE-2022-22636). Finally, it is worth noting that macOS includes updates for both the current version and the two previous versions, but only the most current versions of iOS, watchOS, iPadOS, and tvOS support these updates.

https://nakedsecurity.sophos.com/2022/03/15/apple-patches-87-security-holes-from-iphones-and-macs-to-windows/

LokiLocker: new RaaS with wiper functionality

BlackBerry’s research team has identified a new Ransomware as a Service (RaaS) targeting computers running the Windows operating system. According to experts, this malware was first discovered in mid-August 2021, and would have affected victims worldwide, although most of these would be located in Europe and Asia. Among the most notable features of LokiLocker is that it is written in .NET and protected with NETGuard, and it also uses KoiVM, a virtualisation plugin that makes it difficult to analyse malware and is not commonly used. In addition, LokiLocker sets a time limit for paying the ransom if the victim does not agree to the ransomware’s blackmail, uses a file-wiping function on the computer, except for system files, and overwrites the master boot record (MBR) of the system drive to render it unusable.

More info: https://blogs.blackberry.com/en/2022/03/lokilocker-ransomware

There are many reports on security trends and security summaries, but Telefónica Tech wants to make a difference. The Innovation and Lab team has just launched our own report on cybersecurity that summarises the highlights of the second half of 2021. The philosophy behind, is to offer a global, accurate and useful overview of the most relevant facts and data on cybersecurity and is designed to be easily used by both professionals and amateurs in a simple and visually appealing way.

The aim of this report is to summarise the cyber security information of the last few months, adopting a perspective that covers most aspects of the discipline, in order to help the reader, understand the risks of the current landscape. The information gathered is largely based on the compilation and synthesis of internal data, cross-checked with public information from sources we consider to be of high quality. Here are a few points that we believe to be particularly important.

News highlights

One of the most remarkable news not only for the second half of the year, but for the whole year, came in December. The bug in the Java log processing software, log4j, suffered a critical vulnerability that was not patched. From this point on, there was a relentless search for projects containing this library, new forms of exploitation, patches that were not complete, new vulnerabilities found… It was an obstacle course as attackers incorporated these vulnerabilities into their set of attack tools.

This failure opened up an interesting debate: up to what point can such widely used, ubiquitous and relevant software be maintained on the free time of a single person? This incident made us think about the role of open-source software in the industry, how vendors use it freely but do not all provide support to its creators in return, which creates a very unbalanced dependency that can later turn against them: the software will inherit potential bugs introduced by the developer.

Mobile Security

The second half of 2021 ended with 250 CVEs or vulnerabilities fixed for Android, 29 of them critical, very similar figures to previous semesters.

However, many of these flaws affect the software or firmware of particular manufacturers, which means that the same vulnerability does not necessarily affect the entire Android device fleet, but only those with the affected components.

For Apple iOS, the second half of 2021 closed with 120 patched vulnerabilities, 40 of which are considered high-risk, with the possibility of executing arbitrary code. Some of them affect the core of the system itself.

In this report you will find a summary of the main conclusions that can be drawn from the report that Apple publishes on the data requested by governments, which ones and to what extent the requests are met by 2020.

We can highlight that Spain is the country that has made the most requests for account information due to fraud in 2020.

OT Security

Telefónica Tech believes that it is essential to have a holistic vision of security that incorporates industrial environments. For this reason, we have internally developed the Aristeo project: a network of industrial decoys that use real OT devices to confuse attackers and extract the necessary information to generate intelligence that strengthens our clients’ defences.

In our OT threat analysis, we have been able to verify the truth of the statement that criminals are the ones who know the legislation and the reality of society best. As an example of this reality, we can see in the following graphic how, as soon as the omicron variant appeared, certain types of attacks in the OT area related to the increase in teleworking increased.

Access full report