New privilege escalation flaw in Linux

Security researchers at Qualys have discovered seven flaws in Canonical’s Snap software packaging and deployment system used in operating systems that use the Linux kernel. The most severe of these vulnerabilities, listed as CVE-2021-44731 and reportedly receiving a CVSSv3 of 7.8, is a privilege escalation flaw in the snap-confine function, used internally by the snapd tool to build the execution environment for snap applications. Successful exploitation could allow any unprivileged user to gain root privileges on the vulnerable host. The flaw was communicated to vendors and open-source distributions as soon as it was discovered last October, leading to a coordinated patch release process on 17 February. Qualys technicians have also developed an exploit for this issue that allows full root privileges to be obtained on default Ubuntu installations. The other six vulnerabilities identified are: CVE-2021-3995, CVE-2021-3996, CVE-2021-3997, CVE-2021-3998, CVE-2021-3999, CVE-2021-44730.

All the details:https://blog.qualys.com/vulnerabilities-threat-research/2022/02/17/oh-snap-more-lemmings-local-privilege-escalation-vulnerability-discovered-in-snap-confine-cve-2021-44731

Conti ransomware operators take over TrickBot operations

Researchers at Advanced Intelligence have published a report indicating that the TrickBot malware has transferred its management to the Conti ransomware operators. AdvIntel’s experts have analysed the background of TrickBot, noting a historically close relationship with the ransomware and its subsequent rise to prominence. Conti has relied, among other factors, on maintaining a code of conduct among its operators, which has allowed it to thrive and remain active in the face of other ransomware groups that have been dismantled by various law enforcement operations. Experts suggest that TrickBot gradually became a subsidiary of Conti’s operators, as they were the only ones to use it in their operations. Also, by the end of 2021, Conti finally absorbed multiple TrickBot developers and operators. However, it is worth noting that since TrickBot’s networks are reportedly being easily detected, Conti operators have begun to replace it with the BazarBackDoor malware, which is under its development and is used to gain initial access to its victims’ networks.

More: https://www.advintel.io/post/the-trickbot-saga-s-finale-has-aired-but-a-spinoff-is-already-in-the-works

Cobalt Strike distributed on vulnerable MS-SQL servers

Analysts at ASEC have discovered a new campaign where vulnerable Microsoft SQL (MS-SQL) servers that are exposed to the internet are being attacked by malicious actors with the goal of distributing Cobalt Strike on compromised hosts. The attacks targeting MS-SQL servers include attacks on the environment where the vulnerability has not been patched, brute-force attacks and dictionary attacks against mismanaged servers. First, the malicious actor scans port 1433 to check if MS-SQL servers are open to the public, and then carries out brute-force or dictionary attacks against the administrator account to try to log in. Different malware such as Lemon Duck allow scanning of this port and propagate in order to move laterally in the internal network. The attacks culminate in the decryption of the Cobalt Strike executable, followed by its injection into the legitimate Microsoft Build Engine (MSBuild) process, which has been exploited in the past by malicious actors to deploy remote access trojans and credential-stealing malware. Finally, it is worth noting that the version of Cobalt Strike running on MSBuild.exe comes with additional settings to evade detection by security software.

All the details: https://asec.ahnlab.com/en/31811/

Businesses have become aware of the need to have mechanisms in place to ensure the protection of their information and how important it is to understand their weaknesses in order to improve their resilience in the event of a cyber incident. Although many managers continue to see security as the need to have elements designed to protect and minimise the possibility of an attack, this is no longer the case. Cybersecurity is an ongoing process that requires understanding the adversaries and the risks in the environment.

MITRE’s ATT&CK, which we have talked about on previous occasions in our blog, was born with this philosophy in 2013, seeking to compile in a matrix the techniques, tactics and procedures used by attackers in real actions against business, mobile and industrial environments, where its evolution has led to the creation of a matrix of defensive capabilities and countermeasures, called D3fend.

Mitre states that, “cyber threat intelligence is about knowing what adversaries are doing and then using that information to improve decision making”, so regardless of the size of the cybersecurity team, this tool is vital in the process of ensuring information security. In this way, it is possible to associate techniques of the main criminal groups, iconic cases of incidents in different industries, validate which are the common adversaries, know the software used in each of the phases of the attack, among many other tools that are provided.

Companies that are just starting out and have few resources in the area can begin by understanding the usual behaviour of the adversaries in their industry, and with this data validate whether the defences implemented detect and mitigate the actions of these groups. To understand how this analysis is done, let’s take the example of a logistics company, which has recently been the victim of several ransomware attacks around the world

1. Find your sector. Determine the sector of the industry that the business is focused on. For this purpose, the website provides a search engine at the top. Here we will enter logistics for the example

For the analysis we will take the Cuba ransomware, which we mark in the illustration. It is one of the most widely used against medium-sized companies in Latin America.

2. Adversary information. Once the software or group to be analysed is selected, access is gained to the information provided by the system, such as basic data on the platform being attacked, when it was detected, who detected it and the victim industries.

3. Know the techniques. This same adversary page shows the techniques that have been detected in attacks where this malware has been used in a list that enumerates the techniques and sub-techniques used.

Right there in the “Navigator Layers” it gives the possibility to see within the matrix what the tactics and their techniques are.

In this case, it can be seen that the techniques used by the adversary groups to initiate the attack are unknown or not reflected, which is called pre-attack in the matrix. This usually indicates that the techniques used are too varied to establish a specific one.

4. Know the defences. Each of the techniques has a section listing the possible forms of detection that should be implemented to mitigate this action. For the example we will look at a sub-technique used in the execution tactic, and which is usually the first step detected by incident response investigators in ransomware attacks.

Adversaries use the Windows command console to execute programmes inside the victim machine. In the specific case of Cuba, the cmd.exe /c command has been detected in several of the activities analysed.

By accessing the information on the technique, we have the basic data collected on how it has been used, some of the procedures where it has been detected, possible mitigations and ways of detecting its execution. For our example case we will look directly at the information and the possible ways to detect it.

With this information, the cybersecurity team can make decisions on how to act to prevent an incident that uses this software to affect their industry sector.

They can even reference the technique to search the defence matrix for more information on how to protect themselves. Go to https://d3fend.mitre.org/ and in the search engine called ATT&CK lookup enter the technique, for our example T1059.003.

This shows the map of the forms of defence and detection, and for our example these are as follows.

In short, this tool is invaluable for all types of businesses and cybersecurity teams, providing information and data to make decisions in the pursuit of better cyber resilience.

Microsoft disables macros and MSIX to prevent malware distribution

Microsoft has been actively mobilising against multiple malware attacks that use some of its technologies as an entry vector. The products affected in particular are the Office suite and the MSIX application installers that allow developers to distribute applications for different platforms. In the case of Office, the company will disable Visual Basic for Applications (VBA) macros by default in all its products, including Word, Excel, PowerPoint, Access and Visio, for documents downloaded from the web, although they can be enabled voluntarily by the user. According to Microsoft’s own publication, enabling macros in an Office file allows threat actors to deliver malicious payloads, deploy malware, compromise accounts, exfiltrate information and even gain remote access to targeted systems. The move comes just a month after the Windows vendor disabled Excel 4.0 (XLM) macros by default, another feature that is widely abused to distribute malware. Regarding MSIX application installers, Microsoft has announced that it will temporarily disable the MSIX ms-appinstaller protocol driver in Windows after evidence of active exploitation of vulnerability CVE-2021-43890, which allows the installation of unauthorised applications and is being used to deliver malware such as Emotet, TrickBot and Bazaloader. This move means that, until Microsoft fully fixes the bug, App Installer will not be able to install an app directly from a web server, so users must first download the app to their device and then install the package with the app installer.

More: https://docs.microsoft.com/es-es/DeployOffice/security/internet-macros-blocked

Possible exfiltration of information due to vulnerability in Argo CD

Researchers at Apiiro have disclosed a vulnerability in Argo CD, a widely used tool for deploying applications in Kubernetes, which could be exploited by attackers in order to obtain sensitive information from different organisations, especially passwords and API Keys. The vulnerability has been catalogued with the identifier CVE-2022-24348 – 7.7 CVSSv3 and consists of a Path-Traversal flaw that could lead to privilege escalation, information disclosure and lateral movement attacks. Exploitation is achieved by loading a YAML file specially crafted for Kubernetes Helm Chart on the target system, as long as you have permission to create and update applications and you know the full path to a file containing a valid YAML. For its part, Argo CD released version 2.3.0-rc4 last Friday, just 5 days after Apiiro researchers alerted them to the bug.

All the details: https://apiiro.com/blog/malicious-kubernetes-helm-charts-can-be-used-to-steal-sensitive-information-from-argo-cd-deployments/

Critical vulnerabilities in SAP products

SAP has released its February security bulletin issuing 22 major updates, including fixes for the Log4j impact, as well as three critical memory corruption vulnerabilities affecting Internet Communication Manager (ICM), a core component of SAP’s business applications. These last three flaws were discovered by SAP’s product security response team, in collaboration with Onapsis Research Labs, who have named them ICMAD” (Internet Communication Manager Advanced Desync). The most critical vulnerability is already patched in SAP Security Note 3123396, identified as CVE-2022-22536 and with a CVSSv3 of 10.0, it would allow an unauthenticated attacker to prepend a victim’s request with arbitrary data and thereby execute functions impersonating the victim. The remaining two bugs have also been patched by SAP in its security advisory 3123427 and correspond to CVE-2022-22532 and CVE-2022-22533 with CVSSv3 of 8.0 and 7.5 respectively. Both of these would also be exploitable by an unauthenticated remote attacker, although they only affect SAP applications running on SAP NetWeaver AS Java. It should be noted that successful exploitation of these vulnerabilities could result in severe impacts such as: theft of confidential information, ransomware and disruption of business processes and operations. SAP recommends applying SAP’s February 2022 security updates as soon as possible, as well as making use of the open source tool provided by Onapsis that identifies whether a system is vulnerable and in need of patching.

Discover all: https://onapsis.com/blog/sap-security-patch-day-february-2022-severe-http-smuggling-vulnerabilities-sap-netweaver

Microsoft security updates

Microsoft has fixed a vulnerability in Microsoft Defender antivirus on Windows that allowed attackers to distribute and execute payloads unnoticed by the malware detection engine. The flaw is due to a loosely configured registry key containing the list of locations excluded from Microsoft Defender scanning that was visible to all users. After remediation this is visible only to users with administrator privileges. This security bug affected the latest versions of Windows 10 and would have been fixed with Microsoft’s latest security updates in February. It is also worth noting that Microsoft is removing the Windows Management Instrumentation (WMIC) command line tool, wmic.exe, from the development portal in the latest versions of Windows 11, in favour of Powershell. The removal would only affect the command tool, so WMI is not affected. WMI has been widely exploited by malicious actors and is even considered a LOLBin (living-off-the-land binaries). By removing the WMIC utility, multiple attacks and malware will no longer function properly, as they will no longer be able to execute some commands necessary to carry out their operations, although it is possible that attackers will replace WMIC with new methods.

More info: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-defender-flaw-letting-hackers-bypass-antivirus-scans/

Cybercriminals exploiting Windows Regsvr32 utility to distribute malware

Researchers at Uptycs have analysed a new campaign in which malicious actors are increasingly abusing a Windows LOLBin known as Regsvr32 to spread malware. LOLBins are legitimate, native utilities commonly used in computing environments that cybercriminals exploit to evade detection by blending in with normal traffic patterns. In this case, Regsvr32 is a Microsoft-signed utility in Windows that allows users to manage code libraries and register DLL files by adding information to the central directory (registry) so that it can be used by Windows and shared between programs. According to Uptycs, the utility is being abused through a technique known as Squiblydoo, where Regsvr32 is used to execute DLLs via COM scriptlets that do not make any changes to the registry. The research adds that malicious use of this utility has been on the rise lately, mainly in the registry of .OCX files hosted in various malicious Microsoft Office documents. Uptycs has analysed up to 500 malware samples that are reportedly being distributed, some of them belonging to Qbot and Lokibot.

All the details: https://www.uptycs.com/blog/attackers-increasingly-adopting-regsvr32-utility-execution-via-office-documents