Cybersecurity Weekly Briefing October 10-16

ElevenPaths    16 October, 2020

Coalition of IT Companies Tries to Eliminate TrickBot Botnet

A technology business conglomerate including Microsoft, FS-ISAC, ESET, Lumen’s Black Lotus Labs, NTT, and Symantec, have participated in the removal of TrickBot botnet. Over the past few months, these companies have been conducting research on the infrastructure, including all Command & Control servers, that the botnet used to control the infected devices and the various TrickBot malware modules in order to understand the internal functioning. To this effect, they managed to collect more than 125,000 samples. Based on this evidence, Microsoft has summited a claim to Court to disable the IP addresses, make the C2 servers inaccessible and suspend all services to the operators of the botnet. Consequently, the request was approved, and ISPs and CERTs are currently being contacted around the world to inform all affected users. According to the companies involved in this investigation, the TrickBot botnet is said to have infected over one million computers, including IoT devices.

After knowing about the claim, several sources would indicate that the Command & Control (C2) servers and the domains removed from this botnet have been replaced by a new infrastructure. Security researchers from ESET, Microsoft and Symantec have reported that the complete removal of the Trickbot would not be possible and estimated that the effects of the actions taken would be temporary and limited. This would highlight the complex infrastructure of the botnet, because it runs on hosting systems that do not collaborate, or act slowly. Likewise, they indicated that the events carried out had direct effects such as increased costs for the maintenance of the TrickBot botnet or delays in active malware operations. Another objective was to try to damage TrickBot’s reputation in the field of Crime as a Service. Finally, it should be noted that Microsoft has managed to set a new legal precedent because it proved that the TrickBot malware used the Windows code for malicious purposes, against the terms of service of the software development kit (SDK).

More information: https://blogs.microsoft.com/on-the-issues/2020/10/12/trickbot-ransomware-cyberthreat-us-elections/

https://www.zdnet.com/article/trickbot-botnet-survives-takedown-attempt-but-microsoft-sets-new-legal-precedent/

BazarLoader Used to Deploy Ryuk Ransomware

Operators of TrickBot Group are increasingly targeting the new BazarLoader stealth Trojan before the deployment of Ryuk ransomware. The malware group Bazaar seeks to go unnoticed through the signature of malware and only initially loads minimal functionality from the malicious code. This approach improves the possibility of malware persisting over the long term within the most secure networks. A compromise to BazarLoader begins with a targeted phishing attack. After the infection of the computer, BazarLoader will use the emptying process to inject the BazarBackdoor component into legitimate Windows processes, creating a scheduled task to load BazarLoader every time a user logs into the system. Finally, BazarBackdoor will deploy a Cobalt Strike beacon, which provides remote access to threat agents who install post-exploitation tools. Some researchers have developed YARA rules for the detection of BazarBackdoor.

More details: https://www.advanced-intel.com/post/front-door-into-bazarbackdoor-stealthy-cybercrime-weapon

Microsoft Security Newsletter

Microsoft has published its monthly update newsletter, known as Patch Tuesday, in which the company has fixed 87 vulnerabilities in several of its products, 12 of which have been classified as critical. The most serious bug (CVE-2020-16898, CVSS 9.8) is an RCE vulnerability in the Windows TCP/IP stack due to the way it handles ICMPv6 Router Advertisement (RA) messages. This flaw could be exploited by sending malicious ICMPv6 Router Advertisement packets. The CVE-2020-16947 bug, with CVSS 8.1, is a remote code execution (RCE) vulnerability in Microsoft Outlook, which could be exploited by tricking the victim into opening a specially designed file with a vulnerable version of Outlook. Both of these flaws are expected to detect imminent exploitation attempts. Other vulnerabilities to be considered are another RCE flaw in SharePoint, CVE-2020-16952(CVSS 8.6), which has a PoC available, and the CVE-2020-16938  (CVSS 5.5) for which information has been disclosed that could ease its exploitation. It is recommended to apply the patches as soon as possible.

Learn more: https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/2020-Oct

BleedingTooth: Vulnerability in BlueZ

Both Google and Intel are warning users of a high severity vulnerability in BlueZ, the Bluetooth protocol stack for Linux-based devices. The flaw (CVE-2020-12351, CVSS 8.3), called BleedingTooth by Google, can be exploited in a Zero-Click attack by an unauthenticated attacker. A remote attacker located at a short distance who knows the Bluetooth address (BD_ADDR) of the victim could send a malicious l2cap packet and cause a denial of service or even elevate their privileges to kernel level and achieve the execution of arbitrary code. Both companies urge users to upgrade the Linux kernel to a 5.9 version or even higher.

More information: https://github.com/google/security-research/security/advisories/GHSA-h637-c88j-47wq

New Emotet Distribution Campaign

Security researchers have detected a new Emotet distribution campaign in which the threat agents claim to be from the Windows Update service, and tell users that Microsoft Office needs to be updated. With this new way of distribution, Emotet operators are showing a new template, the third since it reappeared last July. As usual in these cases, users who receive these malicious emails, usually from legitimate spoofed or compromised addresses, have to manually allow the macros in the attached .doc document to be executed. To do this, the victim must click on the “Enable editing” button. According to some cases analysed, the TrickBot Trojan would be installed after the Emotet is displayed on the victim’s computer. For this campaign, the distribution would be massive, affecting users all over the world.

Learn more: https://www.zdnet.com/article/new-emotet-attacks-use-fake-windows-update-lures/

The increasing importance of Big Data in eCommerce

Patrick Buckley    16 October, 2020

It would be fair to say that 2020 has not been a great year for retailers around the world. As many high street stores have been forced to temporarily close their doors due to government-imposed restrictions, many retailers have had to turn to e-commerce to maintain revenues. In this piece, I will outline the three main ways in which Big Data is vital for the success of e-commerce.

According to a recent study carried out by the United Nations Conference of Trade and Development, e-commerce activity has increased across most industries in the wake of the COVID-19 outbreak. 

% of active online shoppers conducting at least one online purchase every 2 months
Figure 1: % of active online shoppers conducting at least one online purchase every 2 months(UNCTAD and NetComm Suisse eCommerce Association)

Product Personalisation

Product personalisation in e-commerce is the process of displaying appropriate content based on the profile of the individual consumer. This anonymous profile is generated by an algorithm through the compilation of data based on, for example, previous searches and purchase history.

Imagine you enter a store and the employee already knows what you like the most, what suits your budget and what you have been excited about buying

Marketing consultants Epsilon published a report In January 2018 stating that 80% of consumers are willing to pay more for a personalised shopping experience. This is the case as it saves the consumer valuable time and effort in seeking out desired products. Product personalisation makes sure that the offer of sale is relevant to the wants of the consumer, efficiently inducing sales and boosting the revenue of retailers.  

Optimised Pricing

Pricing is, perhaps, the most important factor which induces a sale. Whilst traditionally, a retailer would price goods based on common ‘cost + mark-up’ model, Big Data allows for a much more tailored and targeted approach. Through the use of Big Data extensions, retailers can constantly track the pricing patterns of competitors and adjust their pricing strategy accordingly, always making sure that their pricing aligns appropriately with their specific vision and business model. This is especially beneficial to those retailers who target the price-sensitive consumer as they can maintain a competitive position in the market without having to manually track the pricing strategies of competitors.

Targeted Marketing

Traditionally, targeting the correct consumer is the hardest part of the marketing process. Once the appropriate segment of the market has been identified, a retailer must employ strategies appropriate to the specific type of consumer. For example, a social-media based marketing strategy on Instagram unlikely to be effective when targeting the Baby Boomer, as this cohort is statistically less likely to use the platform. Whilst this concept is obvious, Big Data extensions allow the retailer to understand on a more intricate level and dynamic basis the types of consumers that are interested in a particular product, allowing for a more considered, appropriate and targeted marketing strategy to be implemented.

Conclusion

Big Data technology in e-commerce is increasingly important and influential to retailers as consumers engage more in e-commerce activity. Retailers must offer the consumer a personalised online experience to optimise sales.  Big Data extensions allow for a far more considered pricing and marketing strategy, leading to revenue optimisation and enhanced visibility to the targeted consumer.

To keep up to date with LUCA visit our website, subscribe to LUCA Data Speaks or follow us on Twitter, LinkedIn or YouTube .

Thinking About Attacks on WAFs Based on Machine Learning

Franco Piergallini Guida    15 October, 2020

One of the fundamental pieces for the correct implementation of machine and deep learning is data. This type of algorithm needs to consume, in some cases, a large amount of data in order to find a combination of internal “parameters” that allow it to generalise or learn, with a view to predict new entries. If you are familiar with computer security, what you have probably noticed is that data is what is left over, security is about data, and we find it represented in different forms: files, logs, network packets, etc.

Typically, this data is analysed in a manually, for example, using file hashes, custom rules such as signatures and manually defined heuristics. These types of techniques require too much manual work to keep up to date with the changing picture of cyber threats, which has a dramatically exponential daily growth. In 2016, there were around 597 million unique malware executables known to the security community according to AVTEST, and in 2020 we are already over a billion so far.

Picture 1: source: https://www.av-test.org/en/statistics/malware/
Picture 1: source: https://www.av-test.org/en/statistics/malware/

For this volume of data, a manual analysis of all attacks is humanly impossible. For this reason, deep and machine learning algorithms are widely used in security, for example: anti-virus to detect malware, firewall detecting suspicious activity on the network, SIEMs to identify suspicious trends in data, among others.

Just as a cybercriminal could exploit a vulnerability in a firewall to gain access to a web server, machine learning algorithms are also susceptible to possible attack as we saw in these two previous instalments: Adversarial Attacks: the Enemy of Artificial Intelligence I and Adversarial Attacks: the Enemy of Artificial intelligence (II). Therefore, before putting such solutions in the front line, it is crucial to consider their weaknesses and understand how malleable they are under pressure.

Examples of Attacks on WAF

Let’s have a look at a couple of examples of attacks on two WAFs, where each one fulfils a simple objective: to detect XSS and malicious sites by analysing the text of a specific URL. From large data sets, where XSS and malicious sites were correctly labelled, a logistic regression type algorithm was trained with which to predict whether it is malicious or not.

The data sets for XSS and for malicious sites used to train these two logistic regression algorithms are basically a collection of URLs classified as “good” and “bad”:

Picture 2: Malicious URLs
Picture 2: Malicious URLs
Picture 3: XSS

Where the data set of malicious sites contains about 420,000 URLs between good and bad. And, on the XSS side, 1,310,000.

As it is a white box type attack, we have access to all the data processing and manipulation for the training of the algorithms. Therefore, we can see that the first step in both scenarios is to apply a technique called TF-IDF (Term frequency – Inverse document frequency), which will give us an importance to each of the terms given their frequency of appearance in each of the URLs in our data sets.

From our TF-IDF object we can obtain the vocabulary generated for both cases, and once the algorithm is trained, we can easily access and see which of these terms gave it more weight. At the same time, from these terms we can easily manipulate the output of the algorithm. Let’s have a look at the case of malicious site rating.

Malicious Site Rating

According to the algorithm, if any of these terms appears in a URL there is a high probability that it is a non-malicious site:

Picture 4: weight of terms to be considered NOT malicious
Picture 4: weight of terms to be considered NOT malicious

This means that, by simply adding some of these terms to my malicious URL, I will be able to influence the algorithm at my mercy as much as possible. I have my malicious URL that the algorithm detects with enough certainty, which indeed, is a malicious site:

Picture 5: malicious URL
Picture 5: malicious URL

With a 90% confidence, it classifies the URL as malicious. But if we add the term ‘photobucket’ to the URL, the algorithm already classifies it as “good”:

Picture 6: Malicious URL with a trustworthy term
Picture 6: Malicious URL with a trustworthy term

We could even push that probability further by simply adding another term to the URL, for example “2011”:

Picture 7: Malicious URL with two trustworthy terms
Picture 7: Malicious URL with two trustworthy terms

Let’s move on to the XSS scenario. We have a payload which the algorithm correctly classifies as XSS and with a 99% confidence (in this example label 1 corresponds to XSS and the 0 to non-XSS):

Picture 8: Payload of detectable XSS
Picture 8: Payload of detectable XSS

Let’s take a look at the terms with the least weight to reverse that prediction:

Picture 9: weight of the terms to lower the prediction of XSS attack
Picture 9: weight of the terms to lower the prediction of XSS attack

As we did before, we added some of these terms to manipulate the output of the algorithm. After some tests, we find the payload that inverts the prediction, we had to add the term “t/s” about 700 times to achieve the objective:

Picture 10: payload capable of reversing the XSS prediction
Picture 10: payload capable of reversing the XSS prediction

And, indeed, our algorithm predicts it as NO XSS:

Picture 11: No detection of XSS by the payload used
Picture 11: No detection of XSS by the payload used

In case anyone is interested in the subject, we leave some links to the WAF Malicious Sites and the WAF of XSS projects. Some references were taken from the Malware Data Science book.

Having access to the pre-processing steps data and models facilitates the creation of these types of attacks. If the attacker did not have access to these, it would imply a greater effort to find the right pre-processing of the data and the architecture or algorithm of the predictive model. However, it is still possible to recreate these attacks through other techniques such as transferability, where adverse samples that are specifically designed to cause a misrating in one model can also cause misrating in other independently trained models. Even when the two models are supported by clearly different algorithms or infrastructures.

Zerologon, Patch or Die!

Nacho Brihuega    14 October, 2020

Zerologon. If you are in the IT world and haven’t heard this name yet, you should be worried. Keep reading.

Zerologon is possibly the vulnerability of this “special” year and certainly of the last ones. It is one of those vulnerabilities that leaves no one indifferent. First of all, is this vulnerability that critical? Yes, yes and a thousand times yes. Personally, I would say that it is the most critical vulnerability I have known since I entered the cybersecurity world.

Let’s start from the beginning: Zerologon (CVE-2020-1472) was discovered in August 2020 by the company Secura, it was directly reported to Microsoft, who assigned a CVSS of 10.0 (out of 10, the highest possible criticality). Subsequently, on September 11, Secura published an advisory and a paper on the vulnerability, which included a tool to detect vulnerable machines. After this, numerous PoCs and tools have been published that allow the vulnerability to be exploited.

Why is this vulnerability so critical?

Because it allows any user (it doesn’t even require to be in the domain) with connectivity to the DC to reset the password of the admin domain. I encourage you to read the article written by hackplayers on this subject.

Zerologon Practical Analysis

Once we have seen the theory, let’s get in practice. To test the vulnerability, a DC has been created in a virtual machine, in my case the victim machine has the following IP: 192.168.0.21

First, once you have connectivity to the DC, you can use the Secura script to test whether the DC is vulnerable.

However, one of the parameters of the script is the hostname. For this, we can use nma:

Or you can use an SMB listing with Crackmapexec

And, as you can see by passing that parameter together with the IP, the script gives us as a result if the DC is vulnerable to Zerologon.

Once checked that it is in fact vulnerable, making use of this repository it has two scripts:

  • CVE-2020-14-72-exploit.py: allows the exploitation of the vulnerability to be automated.
  • Restorepassword.py allows to reset the password.

However, if we run it as it is, we will encounter this problem of impacket:

To solve this, we can choose from the following options:

Now running it again, it works:

Likewise, the author of Mimikatz has already updated the tool to take advantage of this vulnerability. In this link you can see the GIF he has prepared with the PoC

How can this functionality be used? By taking advantage of this resource we have the command like this:

secretsdump.py -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 'DOMAIN/DC_NETBIOS_NAME$@dc_ip_addr'

In our case:

Obtaining a list of all the hashes of the domain users

You could then either crack the hashes or use the Pass the Hash technique to authenticate yourself in DC. To do this, you can use pth-winexe o evil-winrm with the administrator hash:

To reset your password, you will need to use the z“restorepassword” script:

python restorepassword.py <DOMAIN><hostname>@<hostname> -target-ip IP -hexpass 54656d706f7………etc

or use this functionality.

zpython3 reinstall_original_pw.py DC_NETBIOS_NAME DC_IP_ADDR ORIG_NT_HASH

Remember to reset your password if you try it in an intrusion test.

And above all… Patch, patch, patch!

Recommendations

Identify vulnerable machines with the Secura check script and apply the patch:

References

The Future of Digital Signatures to Protect Your Money Lies in Threshold Cryptography

Gonzalo Álvarez Marañón    13 October, 2020

Imagine you were such a modern person, that all your money was in cryptocurrency instead of in a traditional bank. If you have ever handled cryptocurrencies, you will know that they are usually managed through cryptocurrency wallet apps. Their mission is to facilitate the typical operations of making transactions and consulting balances, but they do not store cryptocurrencies. Above all, they have the crucial mission of signing with your private key. So basically, what is a cryptocurrency wallet? An interface to your private key! 

Yes, that private key is like the keys to the Kingdom: it gives access to all your money. Anyone who knows it will be able to pick in your pockets. If you lose it, you will not be able to get your capital back. Therefore, you will have to protect it very well, and that is not an easy task! In this article, I will review traditional and new alternatives that are emerging to ensure the security of digital signatures. 

Now, to avoid getting into mathematical detail, I will use a simple analogy throughout the article. Imagine that each cryptocurrency unit is protected inside a strong-box with a lock that can only be opened with the key of the owner of that cryptocurrency. Cryptocurrencies do not actually move between boxes but is always in its own strong-box. When you transfer coins from one to another, instead of sending them, what it actually happens is that you only swap the locks from one box to another. For example, when Alice transfers money to Bob, she only removes her lock from the box by opening it with her key and puts Bob’s lock in its place. Bob can remove it later with his key and so on. Imagine that each person has an infinite number of locks, so that anyone can put anyone else’s lock on a box, but only the owner of the lock can open it with his or her key. Got it? 

Here we go! 

Me, Myself and I: Duplicate of Keys 

The simplest and most widespread solution to secure your key today is to make many copies of your key and store them in many different places, so you can be sure you won’t lose them. The obvious problem is that the more copies you make of your key, the greater the chance that an attacker will get hold of one of them. 

You could entrust copies of your key to other people, I’m sure your brother-in-law will offer to keep it for you. But if you think about it, the only thing you are doing is to move the problem. First, how much can you trust their honesty? Second, no matter how well intentioned he is, how much can you trust his good practices? 

No, it seems like duplication it not a good idea after all.

Picture 1: Traditional strong-box: one lock, one key
Picture 1: Traditional strong-box: one lock, one key

Sharing Is Caring: Multisig

Another, more promising approach is to share responsibility for holding the key and unlocking the lock among several people. Instead of the box having a single lock, the new box will have several locks and each authorized person will receive a different key, each for their lock. From now on, several keys will be needed to open the various locks of the box. This is known as multi-signature or Multisig.

Multisig avoids the previous single point of failure because, by protecting the box with several locks, it will be more difficult to be compromised: one key is no longer enough, several are needed to open the box.

To make operations more flexible, M-of-N schemes are usually used: N locks are placed on the box with the peculiarity that to unlock it you only need to open M, where M is less than or equal to N. It is magic, isn’t it? For example:

  • Together with your partner you can use a 1-of-2 multisig so that either of you can open the box. If one loses the key, the other can still open the box. But if an attacker steals either key, he or she can also open it. And if your partner is a spendthrift, there is nothing to stop him/her from emptying the account!
  • With a 2-of-2 multisig, now both of you have to open the box. This protects you from each other and an attacker will have to steal both keys, as one key will not open the box. These Multisigs also work for multifactor authentication: you could have one key on your computer and another on your smartphone. Without access to both devices, the box will not open.
  • With 2-of-3 multisig, if you have a child, you can give him/her a key and the parents keep the other two. The child will need either of you to open the box, since with his or her key alone the box will not open.
  • With a 4-of-7 scheme, several people in a team or committee will have to cooperate to open the box. They are very suitable for deploying corporate policies.
  • And all the possible scenarios you can imagine.

The problem with Multisig is that it requires a larger box to accommodate several locks and also anyone passing by will notice unusual protection measures: “Hmm, what could it be inside? Let’s track it down”. On the other hand, the cost of transactions also increases because the information of each signatory must be added to the block chain.

Picture 2: Multisig strong-box: two locks, two keys

Picture 2: Multisig strong-box: two locks, two keys

Little by Little: Shamir’s Secret Sharing Scheme (SSSS)

Here too, the responsibility for the custody of the keys and for opening the boxes is shared, but instead of creating several locks that are each opened with their own key, a single, normal lock is created and it is the key that is divided into parts that are given to each of the participants. In addition, the lock has a peculiarity: it can be opened with a number M of parts of the key lower than the total number N of parts into which it was divided when it was forged.

Technically, it uses what is known as Shamir’s Secret Sharing Scheme (SSSS). Shamir’s Secret Sharing Scheme is also used to operate M-de-N schemes, to make access more flexible, as with Multisig. The box now looks normal from the outside, as it is protected by a single lock.

The problem is that, before opening the box, the participants reconstruct the key by putting each part together. At this point, just as the key has been reconstructed, it becomes vulnerable of theft. On the other hand, in SSSS someone has to create the key first and then break it into small pieces and hand it out. There appears another window of opportunity for an attacker to steal the key before it is divided. Moreover, this third party must be trusted, because who can guarantee that he/she does not keep a copy of the whole key?

Picture 3: SSSS strong-box: one lock, one key divided in two
Picture 3: SSSS strong-box: one lock, one key divided in two

Signing on the threshold

And couldn’t it be a single lock with multiple different keys? Doesn´t it exist some method that combines the best thing of Multisig with the virtues of SSSS? Yes, it does. They are called Threshold Signature Schemes (TSS), based on threshold cryptography, a sub-discipline of secure multi-part computing.

In the threshold signature scheme, each user creates their own key (which no one else knows) and then they get together to forge a completely normal looking lock. The trick is that this special lock can be opened when each of the N keys (or a subset M of them) turns the lock a little at a time, until they all manage to turn it completely around.

A big advantage of TSS is that the keys are never put together, so SSSS theft opportunity windows are avoided. Another additional security feature is “refreshing”: every now and again, the keys are refreshed to prevent an attacker from stealing one by one of the N keys created and with the M’s opening the lock. Another advantage of threshold signature is that keys can be revoked or new ones created without changing the lock, for those situations where new participants enter or leave the group, a typical situation in corporate environments.

As a counterpart, TSS requires all parties to be present when the lock is forged and opened, so this protocol cannot be executed asynchronously. It is also still very green, cryptographic proposals are still being made and there has even been a successful attack on one of the proposals.

Picture 4: TSS strong-box: one lock, two keys
Picture 4: TSS strong-box: one lock, two keys

The Future in Digital Signatures Is Already Here

The discipline of threshold signatures is a recent field, with numerous proposals, still far from reaching the maturity of conventional signature schemes, such as ECDSA.

TSS is currently providing users with two-factor security for access to private keys or sharing the ability to sign between several devices so that a single compromised device does not put all your money at risk. In the case of companies, TSS makes it possible to implement access control policies that prevent both insiders and outsiders from stealing corporate funds.

Thanks to threshold signatures, the private key will no longer be a single flaw point.

Cybersecurity Weekly Briefing October 3-9

ElevenPaths    9 October, 2020

New botnet detected that deletes data from the infected device

A group of researchers from the company Netlab 360 published yesterday their latest findings on a new botnet that specialises in deleting all partitions and data from infected devices. Called HEH, it is a botnet that spreads through brute force attacks against any type of device connected to the network and which has the SSH ports (23 and 2323) exposed. Once the access keys (normally weak or default) have been undermined, up to seven binaries are downloaded to carry out the malicious activities, which mainly consist of continuing propagation via brute force and the execution of commands in Shell to delete the data from the device. While the botnet has the ability to infect any exposed device with unsafe SSH ports, its malware only works on *NIX platforms. Researchers believe that both the botnet and the malware are still under development, so the adding of new capabilities soon would not be discarded.

More: https://blog.netlab.360.com/heh-an-iot-p2p-botnet/

Impersonation of banks on social networks

ESET researchers have reported a campaign of impersonation of financial institutions in social networks in order to obtain personal information from customers and to carry out telephone scams afterwards. The investigation started after Instagram received a private message from an account pretending to be Banco de Galicia (an entity that operates in Argentina). This generic message attempted to establish a first contact with the victims to obtain their telephone number to be attended by customer service in the event of a complaint or query. When observing the account from which it was sent, which made use of the name and logo of the entity, it was observed that it was in fact a false account. This case has also been detected in other social networks such as Facebook and Twitter, as well as with other banking entities. For the moment, Banco de Galicia decided to close its accounts in Instagram in order to avoid deceiving its customers. ESET recommends extreme caution and never provide personal information to accounts that appear to be suspicious or unverified.

More information: https://www.welivesecurity.com/la-es/2020/10/05/falsas-cuentas-instagram-atencion-cliente-bancos/

Multiple vulnerabilities in HP Device Manager

The technology firm HP has issued a security alert to report three critical vulnerabilities in the HP Device Manager whose exploitation could compromise the affected systems. The errors identified have been catalogued as CVE-2020-6925, CVE-2020-6926 and CVE-2020-6927. In addition, according to HP, two of the three vulnerabilities (CVE-2020-6925, CVE-2020-6926) affect all versions of HP Device Manager. To mitigate the exploitation risk of the CVE-2020-6927, users can download HP Device Manager version 5.0.4. Regarding the other two flaws, the company has not yet released updates, although it has issued some recommendations for partial mitigation:

  • Limit incoming access to Device Manager ports 1099 and 40002 to trusted IPs or localhost only.
  • Remove the dm_postgres account from the Postgres database.
  • Update the dm_postgres account password within HP Device Manager Configuration Manager.

All the details: https://es-la.tenable.com/blog/cve-2020-6925-cve-2020-6926-cve-2020-6927-multiple-vulnerabilities-in-hp-device-manager

Critical Vulnerabilities in QNAP Helpdesk

QNAP has corrected two critical vulnerabilities (CVE-2020-2506 and CVE-2020-2507) in the Helpdesk application. This tool is integrated into QNAP’s NAS devices and allows for remote support, which enables remote connection to the device with the owner’s permission. Both vulnerabilities are due to inadequate access control which, if successfully exploited, could allow attackers to gain control of a QNAP device. QNAP recommends updating the Helpdesk to the latest version as soon as possible. QNAP recently issued a security warning about an increase in AgeLocker ransomware attacks against exposed NAS devices.

More: https://www.qnap.com/en/security-advisory/QSA-20-08

COVID-19 Shines a light on the huge possibilities of AI in Education

Patrick Buckley    9 October, 2020

In 2020 remote learning platforms have become essential for students around the world as a result the COVID-19 pandemic. Many of these platforms incorporate Artificial Intelligence (AI) technology which continues to improve the outcomes of students and educators. In this piece, I will share with you the three main ways AI continues to revolutionise the way in which students learn.

Enhanced personal development

The main benefit of AI in education is that it allows for students to experience personalised learning experiences. The Personalisation of learning acts as a catalyst for individual growth and development. Through the compilation of personal performance data, platforms can adjust material suggested to the user in accordance with their individual ability. This not only allows for high performing students to develop a more advanced understanding, but it also allows for less able students to consolidate information at an appropriate pace, maximising the potential of each student.

This concept is illustrated by the language learning app ‘Duolingo’ which tailors its suggested material to each user depending on their pre-existing knowledge.

Given the positive impact Personalised Learning has on personal development, it is no surprise that education tools which incorporate AI  have experienced exponential growth in recent years. Duolingo saw its number of uses increase from just 125,000 people in 2012 to over 30 million in 2019.

Improved Engagement Amongst Students

It is often argued that students are becoming increasingly uninspired by existing learning techniques. This is, in part, due to the lack of interaction and personal attention offered in a traditional classroom setting. Interactive so-called ‘Classroom Management Tools’ aim to motivate students by offering an increased level of personal attention that cannot be feasibly given by a class teacher.

Market leader, ‘Class Craft’, is a virtual learning platform which uses the principles of a typical computer game as a framework for lessons, rewarding good behaviour and performance with game points. Simultaneously, Class Craft is able to track each pupil’s ability in crucial skills such as critical thinking and empathy, allowing teachers to understand more about each pupil whilst encouraging the engagement of students.

Assessment Automation leads to increased learning opportunities

According to a study carried out in January 2020 by leading management consultancy McKinsey and Company, teachers spend just 49% of their working hours interacting directly with their students. The rest of their time is spent carrying out administrative and evaluative tasks.

As AI technologies develop, there is an enhanced potential for automation in these tasks, allowing the teacher to spend more time interacting directly with the students. This, ultimately will give students more opportunities to learn.

Online multiple-choice assessments are increasingly being used by institutions of all academic levels to cut down on the marking burden, but it is clear that there is a lot of potential for innovation here as emotional intelligence capabilities evolve.

Conclusion

The power of AI in education cannot be underestimated. Although we can clearly see the potential for personalised learning platforms to increase the performance and engagement of students, we must also consider the impact of AI on the role of educators. If the power of AI can be fully harnessed to significantly reduce the workload of teachers, increased learning opportunities for students will be a direct and significant consequence.

To stay up to date with LUCA, visit our Webpage, subscribe to LUCA Data Speaks and follow us on Twitter, LinkedIn o YouTube.

The Dark Side of WebAssembly

Carlos Ávila    8 October, 2020

Nowadays, the technologies for developing software for webs are multiplying rapidly, while introducing, in some cases, new ways of attack or unexpected advantages for attackers. Let’s see what WebAssembly (WASM) is and what potential benefits can have for attackers.

This relatively new open standard (announced in 2015 but started to be used in 2017) allows us to execute binary code, compiled with languages such as C, C++ or Rust in modern web browsers, with all the new functionalities and performance that it can involve.

General architecture of WebAssembly Application
General architecture of WebAssembly Application

WASM was not created as a replacement for JavaScript, but to complement it. In fact, it is the JavaScript engine that runs it. This standard enjoys multiple use cases, as indicated in its website: development/execution of games, CAD applications, simulation platforms, intelligent contracts (blockchain), among others. If you want to have a look at how they run a binary of a game in WASM you can visit this website that emulates the famous Gameboy or how AutoCAD starts running from any browser.

Just as new technologies and programming languages offer multiple improvements, it is a matter of time before attackers find the attack vectors and use them to their advantage, and WebAssembly applications are no exception. Let’s see, through the example below, how a simple malicious code could be compiled to simulate a social engineering cyberattack.

Example of WASM compilation and execution (PoC Fraude)

This type of simulated attack is known as a “tech support scam,” where a scammer impersonates a technician from a technology company using intimidation tactics and social engineering to trick people into paying for unnecessary support services. When the victim calls the tech support number, the scammers ask for money to fix the problem or request access to install malware (backdoor) on the victim’s device. This Twitter Thread by Sergio de los Santos is a good example of the sophistication achieved.

Technical Service Scam Case

In these cases, the benefit for the attacker would be the obfuscation of the code at the time of the analysis, more speed, etc. In fact, compiled WASM code has already been used for bitcoin mining campaigns by infecting browsers with malicious code on compromised sites. Among the best-known cases are Coinhive and  Cryptonight. Both attacks (using WASM-generated JavaScript) exploited the computational power to “mine” cryptocurrencies through the browser. In general, when we browse the Internet, we can find sites that have been compromised by scammers commonly with pure JavaScript or WASM code, and from here, if our browsers do not have adequate controls, the attack can be consummated.

If WebAssembly is being used to support cryptoattacks, attackers may continue to profit from other fronts. Other formulas for the malicious use of WASM are the following:

  • Redirection to malicious URLs: there are campaigns to infect devices by means of malicious redirects (via WebAssembly code) from compromised sites to the same technical support scams, mining of cryptocurrencies, etc.
  • Keyloggers, record keystrokes to steal passwords and other confidential information from visitors to compromised websites, taking advantage of the fact that WebAssembly is generating code that evades typical detections by external controls or browsers.
  • Browser Exploitation: Exploiting vulnerabilities in the browser almost always involves JavaScript. Therefore, WebAssembly can play an important role in exploiting the browser by obfuscating the exploitation code.

Technologies offer many possibilities, WebAssembly is no exception and could be an ally or an enemy. It is very clear that it has many advantages but can provide new ways to exploit weaknesses in different cases. While developers strive to integrate security features, we as users, must be cautious, having updated, for example, our browsers with plug-ins that block dynamic execution of JavaScript, such as NoScript. ElevenPaths have contributed with tools such as AMSIext to avoid unwanted executions in browsers.

New Version of Our SIEM Attack Framework, Now With 7 Manufacturers

Innovation and Laboratory Area in ElevenPaths    7 October, 2020

For some time now, the ElevenPaths Innovation and Laboratory team has been working on different projects and research related to the security aspects of SIEM (Security Information and Event Management).  One of the projects we have released is a free open source tool called SIEM Attack Framework aimed at the security analysis of these technologies, and which allows us to detect weaknesses in the configuration of some products such as Splunk, GrayLog and OSSIM.  Last year we presented it at BlackHat Arsenal 2019, 8dot8 and EkoLabs, where it won the award for best laboratory in EkoParty2019.

The tool is still alive and part of our toolkit available to the community. During this 2020 we have been talking about how the development structure is and how we have been attaching the discovery of new SIEMs within the framework in a chapter of our CodeTalks4Devs. In this talk we help the community to understand how the development was planned, how to contribute or modify modules for specific purposes, and also to anticipate that there would be many surprises soon.

What have we added in this update?

A few days ago, we launched an update of the tool in our repository by adding three more SIEMs to the attack framework to try to facilitate the work of the Red Team and Pentesting team.  In this last update we have incorporated the following manufacturers:

  • QRadar, for which we have implemented a brute force testing module to detect the administrator’s password. Since the user is always admin it is only necessary to obtain the password to access the web environment, despite being a very slow attack due to some protections. However, the API does not control the number of attempts, so it is possible to perform a brute force attack to detect the API-Key and then extract the complete configuration of the SIEM and user access to the internal database called ARIEL.
  • McAfee SIEM, in this one we have implemented a dictionary attack to detect the user’s password that it is called ” NGCP ” by default. Due to certain configuration restrictions this attack can be slow, and so this is why we looked for another way to obtain those credentials. Therefore, we implemented a new module taking advantage of the fact that the system enables the SSH service by default and that it is possible to access with the root user, but additionally shares the same password as the NGCP user. Once this data is obtained, it is possible to use three other attacks that allow us to obtain configuration information, services, configured protections as well as to extract the shadow file from the system. And with all this, the complete users of the system.
  • SIEMonster, where we implemented a dictionary attack module similar to the one mentioned in the previous case. Given that this SIEM has configured the same user for SSH access and for WEB access, called “deploy”, it is possible to obtain administrative access to both the web environment and the console. In addition, two attacks were generated to obtain system configuration data and the shadow file to have all the users of the system.
  • ElasticSIEM, we also implement a brute force module by SSH since the operating system that is recommended for its installation enables the service by default.  At the same time, for local implementations it does not generate a default web service access control and requires implementing a series of configurations so that an authentication mechanism can be integrated. Likewise, we generate a module that allows us to take advantage of this possible configuration and access the system through the console, to obtain more data from the configuration, although many times this SIEM only needs to be identified within the network.

In addition, in this new version, some changes were carried out:

  • The validation of the data entered by the analyst was modified
  • The possibility of specifying a port in a simple way different to the one detected in the installation of the SIEM was added. This way, it is possible to detect it even if it has been published in another port from the tool itself without having to resort to other tools to do so.
  • Test batteries were added to optimize operation.
  • Modifications were made to allow users to see which data can be obtained in some of the attacks and compare with their own results.

With all these changes and improvements, the tool´s 2.0 version offers the possibility of analysing seven different SIEMs in different ways. In some of them we can detect and take advantage of weaknesses in their default configuration, in others, in the use of the API management and in others, of the services exposed, but always offering a possibility to evaluate the security of the system.

Security Innovation Days 2020: The New Era

ElevenPaths    7 October, 2020

Cyber Security in the Digital Transformation Era

There is no doubt about it, we are living times of constant changes at all possible levels. There are so many that we are talking about a change of era. One of the fields that is evolving most rapidly and producing the most changes is technology, allowing companies to transform themselves digitally by leaps and bounds 

Within this digital transformation, which is necessary in all sectors, we find cyber security as one of the main pillars on which the new business ecosystem must be based. Without a solid strategy on security and the provision of adequate resources, it will not be possible to achieve it. 

At ElevenPaths, Telefónica’s cyber security company, we are working in that direction, enabling companies to transform themselves safely by taking them into The New Era. Those companies that bet on security as one of the bases of their transformation and adaptation to the new times, will be more and better prepared to succeed in a future that is already here. 

The New Era of Cyber Security

If you want to know all the details of what The New Era of cyber security is going to be like, you cannot miss our annual event aimed at innovation. This year, in a 100% online format, we are holding the 8th edition of the Security Innovation Days. Three days in which you will be able to find out first-hand about the projects we are working on, demos of what is coming next and, in short, a look at The New Era of Cyber Security from our experts. 

Do not miss Security Innovation Days 2020!  The New Era is here. 

REGISTER HERE