Cybersecurity Weekly Briefing September 19-25

ElevenPaths    25 September, 2020

New attack vector for vulnerability in Citrix Workspace

Pen Test Partners security researcher Ceri Coburn has discovered a new attack vector for the CVE-2020-8207 vulnerability in Citrix Workspace corrected in July this year. The problem lies in a command line remote injection vulnerability that would allow attackers evade Citrix signed MSI installers by means of a malicious MSI transformation. These MSI transformations allow the database of the MSI file to be altered before it is installed. By being able to control the command arguments that are passed to msiexec, the path could be inserted in a malicious transformation, but using a legitimate Citrix MSI. An update has been published by Citrix to correct this new case study.

More details: https://www.pentestpartners.com/security-blog/the-return-of-raining-system-shells-with-citrix-workspace-app/

Exploits for Zerologon vulnerability used in attacks

Microsoft has warned in a number of Tweets that attackers would be actively using the Windows Server vulnerability listed as CVE-2020-1472 in attacks and advises all Windows administrators to install the necessary security updates. This vulnerability was named ‘Zerologon’ after the cybersecurity firm Secura and, when exploited, allows attackers to elevate their privileges to a domain administrator and take control of a domain. These tweets include three examples that, according to Microsoft, were used in attacks to exploit the privilege elevation vulnerability Netlogon CVE-2020-1472. The examples are .NET executables with the file name ‘SharpZeroLogon.exe’ and can be found at VirusTotal. All Windows Server administrators are strongly recommended to install the security update for the CVE-2020-1472 following the instructions in the Microsoft support newsletter.

All the info: https://www.bleepingcomputer.com/news/microsoft/microsoft-hackers-using-zerologon-exploits-in-attacks-patch-now/

Firefox flaw allows hijacking of browsers via WiFi

Mozilla has fixed a flaw in the Firefox browser for Android devices that would allow to hijack all vulnerable browsers on the same WiFi network and force users to access malicious websites. The vulnerability lies in the implementation of Firefox’s Simple Service Discovery Protocol (SSDP), which allows other devices on the same network to be found in order to share or receive content. In vulnerable versions of Firefox, this protocol could be exploited to send malicious commands to the victim’s browser. The flaw was fixed in Firefox 79, so it is recommended to update the browser as soon as possible.

More information: https://gitlab.com/gitlab-com/gl-security/security-operations/gl-redteam/red-team-tech-notes/-/tree/master/firefox-android-2020

Increase in LokiBot malware activity

The US Cybersecurity and Infrastructure Security Agency (CISA) has warned both government institutions and the private sector about an increase in LokiBot malware activity. The increase in detections related to this malware began last July, in campaigns where LokiBot is used for its functionalities such as: exfiltering credentials, obtaining data, keylogger and screen capture. It also has the ability to function as a backdoor, allowing threat agents to run other types of malware. The entry vector is usually compromise by sending emails, malicious executables or through torrent files. CISA warns users and/or system administrators to take the corresponding mitigating measures proposed by the organisation in order to minimise the risks of possible infection.

More: https://us-cert.cisa.gov/ncas/alerts/aa20-266a

Alien, the malware heir to Cerberus

Researchers at Threat Fabric have identified a new malware close to Cerberus as responsible for the latest campaigns this year that had been attributed to this malware. Alien, as the banking Trojan that attacks Android devices has been called, has an advanced ability to circumvent dual-factor authentication security measures to steal credentials. According to the research carried out, Alien would be capable of stealing passwords from 226 mobile applications, including those of Spanish banks such as BBVA, Bankia, UnicajaMovil and Kutxabank, among others, as well as other applications such as Telegram, Netflix, Intagram and Twitter. According to the research carried out, the main target country would be Spain, followed by Turkey, Germany, the USA, Italy and France. It is also expected that Cerberus-based malware variants will continue to appear during the rest of the year, as it happened with Alien.

All the details: https://www.threatfabric.com/blogs/alien_the_story_of_cerberus_demise.html

Blockchain, Cryptocurrencies, zkSTARKs and the Future of Privacy in a Decentralised World

Gonzalo Álvarez Marañón    25 September, 2020

In the Renaissance Italy, duels between mathematicians were common, but not by crossing steels, but by solving difficult problems. One of the hardest bones to crack at the time was the cubic equations. Knowing the method for their resolution conferred an enormous advantage in these duels, in which the two mathematicians played not only their prestige but also juicy rewards and sometimes even the professorship.

One of the most famous confrontations was between the mathematicians Niccolo Fontana, nicknamed Tartaglia because of his stutter, and Girolamo Cardano. In 1535, Tartaglia, in a duel against another mathematician, Antonio Maria del Fiore, crushed his rival after solving 30 questions related to cubic equations, while del Fiore did not solve a single one of his 30 problems. It was clear beyond all reasonable doubt, that Tartaglia knew a method for solving cubic equations without having revealed the method itself. Impressed by his victory, Cardano offered Tartaglia to find him a patron if he would reveal the precious method of solving cubic equations. Tartaglia agreed in 1539, under the promise that he would never publish it. Six years later, Cardano published it in his work Ars Magna, claiming that he had learned it from another mathematician, Scipione del Ferro, and triggering Tartaglia’s anger. He then challenged Cardano to a mathematical duel, which was attended by his disciple, Lodovico Ferrari, who defeated Tartaglia. As a result, Tartaglia ended up with no prestige and completely broke.

In the world of information security, a multitude of similar scenarios arise in which one entity knows a secret and needs to prove to another entity that it knows it, but it is not appropriate for it to reveal the secret or any partial information about the secret:

  • Who earns more money, you or your brother-in-law? How can you prove it to the satisfaction of the whole family without either of you revealing the amount?
  • How to prove the legitimacy of a transaction in a public Blockchain without revealing either the sender, the receiver or the value transferred?
  • How can you prove to an app installed on your smartphone that you know the password to authenticate yourself to a website without providing the password itself to that app, to your smartphone, or even to the website?
  • How can you prove that you are not underage to access an adult service without revealing your age?
  • How can you prove that you are an EU citizen to access an EU health service without disclosing your nationality?
  • How can you convince a payment app that you have sufficient funds in your account for a transaction without disclosing your balance?
  • How can a country convince others that it has destroyed its nuclear military arsenal without letting neutral inspectors into their facilities?
  • How do you vote electronically so that your vote is counted without knowing who you voted for?
  • How do you prove that a theorem is correct without providing its mathematical proof?
  • How to prove that you know the solution to the most complicated sudoku in the world without revealing it?

Fortunately, cryptography provides an answer to these and many other similar dilemmas: the Zero-Knowledge Proof (ZKP). Let’s see with two mundane examples how these proof work.

Interactive and Non-Interactive Zero­-Knowledge Proof

Your brother-in-law claims to be able to distinguish Lourdes’ holy water from tap water at a glance, but the truth is that you don’t trust his mystical powers very much. Imagine that you have two glasses full of water, one from Lourdes and one from the tap. How can your brother-in-law prove to you that he knows which is which without even revealing which is which? Very easy! Just follow these steps:

  1. You blindfold him and flip a coin. If it comes out heads, you exchange the position of the glasses; if it comes out tails, you leave them as they are.
  2. You remove the blinders and ask him if the glasses have been exchanged or are still in the same place.

Obviously, it’s not enough to challenge your brother-in-law just once, as he might get it right by pure chance 50% of the time. But if he is truly clairvoyant, he will be right 100% of the time. Therefore, if you repeat the two steps of the test n times, the probability that your brother-in-law always gets it right by pure chance is reduced to p = (1/2)n. For example, if it’s New Year’s Eve and there’s nothing on TV, you could repeat the test 100 times, what it would be p = 7,38×10‒31 practically zero.

This protocol for identifying the glasses is an example of an interactive proving system: a tester (your brother-in-law) and a verifier (you) exchange multiple messages (challenges and answers), typically dependent on random numbers (ideally, the results of untricked coin tosses), until the tester convinces (tests the verifier) of the truth of a statement, with an overwhelming probability.

One problem (or advantage, depending on how you look at it) with these interactive proofs is that only the verifier is convinced by the proof. Your sister may think that you and your brother-in-law have conspired to cheer the New Year’s Eve dinner up and have agreed in advance on the exchange of glasses. The only way for the tester to proof another person who knows the secret is for that other person to act as a tester, proposing random glass exchanges. And so on with each and every person your brother-in-law wants to convince that he knows the secret. That sounds exhausting, right? So, how to convince everyone at once in one step?

There are other, more efficient protocols that allow the proving of knowledge of secrecy in a single step and to the satisfaction of an arbitrary number of observers. These are known as non-interactive zero-knowledge proofs.

For example, imagine that a million-dollar prize is offered for solving a sudoku and you have solved it already! But your brother-in-law, who is after glory more than money, is willing to pay you double for the solution. How can you prove to him and all his relatives that you know the solution without showing them before paying? Do you have some deck of cards? Then it’s easy!

In a sudoku there are nine rows, nine columns and nine boxes. In each of these groups the nine values from 1 to 9 must appear. In total, each number appears 9 times. If you have seven identical decks you can select 27 cards for each number, regardless of suit: 27 aces, 27 twos, …, 27 nines, a total of 243 cards.

  1. You draw with indelible marker on the grandmother’s tablecloth the sudoku of the competition, so that on each given number (they are the clues or known numbers) you place three cards face up of the corresponding value.
  2. You ask everyone to leave the room and secretly place three cards with the appropriate value face down on each square to be solved. Once all the piles of three cards have been laid, you ask everyone to come in again and the magic begins!
  3. First, you remove one card from each row and make nine piles with the nine cards in each row.
  4. Then you take a card from each column and make nine piles with the nine cards in each column.
  5. Finally, you make nine piles with the nine cards in each box.
  6. You shuffle each of the 27 piles separately and lay the cards from each pile face up on the table. If you knew the solution to sudoku, each of the 27 piles will contain nine cards from 1 to 9!

Overjoyed, your brother-in-law pays his debt and Grandma forgets the mishap with the tablecloth.

This example shows how a non-interactive zero-knowledge proof works in practice. Crucial when you want a large number of testers to efficiently verify a proof.

All this is good fun for entertaining the family on New Year’s Eve, but how can we apply it in the real world?

The idea of ZKP was proposed more than 30 years ago by the cryptographers Goldwasser, Micali and Rackoff of MIT. It was considered so revolutionary that it won the first Gödel Prize in 1993 and the Turing Prize in 2012. However, it saw no practical application in industry – until today! ZKP was for decades a powerful hammer in search of nails and finally nails are appearing with the progressive decentralisation of services thanks to block chains (blockchain).

Block Chains and Zero-Knowledge Proofs in the Real World

No, Bitcoin, Litecoin, Ethereum, even Monero, are not anonymous like cash, but pseudo-anonymous, meaning that the transactions leave a trail in the public block chain. However, not all cryptocurrencies are pseudo-anonymous: the most prominent use of ZKP so far is ZCash, one of the most popular cryptocurrencies, which allows anonymous transactions. Specifically, ZCash uses Zero-Knowledge Succinct Non-Interactive ARguments of Knowledge (zkSNARK) which allows the knowledge of a secret to be proofed in milliseconds by means of a single message sent by the tester to the verifier. Thanks to zkSNARK, the only information recorded in ZCash after a payment, is that a valid transaction has been made: no information remains about the sender, the recipient or the amount.

Ethereum has also begun to integrate the zkSNARK, specifically in the form of pre-compiled contracts. A smart contract is basically a deposit of funds that is activated once a certain task is performed. For example, your brother-in-law puts 100 ETH into a smart contract with you, so that when you complete the agreed task, you get the 100 ETH from the smart contract. But what if the task you have to do is confidential and you don’t want to reveal its details to your brother-in-law? Thanks to zkSNARK, Ethereum proves that the smart contract task has been completed without revealing its details.

For a start, zkSNARK can be applied to any type of blockchain, in a security layer of zero-knowledge (ZSL), useful in many cases for any company. One of the most interesting ones is the decentralised identity.

Blockchain, Decentralized Identity and Zero-Knowledge Proof

Our personal data has become a commodity for the technological giants to trade with in order to manipulate our behaviour through advertising and social networks. The zkSNARK and Blockchain can work very well together, providing privacy, security and transparency when exchanging and verifying information, in areas such as health care, communications and finance

The trick is identity solutions based on block chains. Traditionally, a myriad of servers belonging to public or private organisations store and share your data, such as your ID card, date of birth, bank account balance, password (or hash), degree of disability, nationality, contacts, phone number, etc

In a decentralised solution, on the other hand, verifiable credentials are stored: they allow simple operations to be carried out on them, but without seeing their value. For example: Are you an adult? Can you park in the disabled parking space? Do you have funds for this payment? Can you fly to this country? Do you know the password to log in? And so on. In this way, the service does not gain any knowledge about yourself, because your personal information is not sent at any time!

Therefore, it cannot be stolen, it cannot be illegally shared, it cannot be traded. You are the owner and master of your data. Corda by R3 is a good example of the work being done in this line.

Consolidating the Future of the ZKP

Don’t think that all that glitters is gold. The zkSNARK also have their weaknesses, among them, the three biggest are the following ones:

  1. They depend on an initial configuration of trust between tester and verifier: a set of public parameters is required to build the zero-knowledge proofs and, therefore, private transactions. These parameters are so critical that they are usually generated by a very small group in which absolute trust is placed, creating a potential centralisation problem. For example, in Zcash this initial configuration phase is known as The Ceremony.
  2. The scalability of zkSNARK can be improved: as the execution time increases, the time needed to generate increases does too, especially for verifying the proofs.
  3. The underlying cryptography is based on elliptic curves, which makes them vulnerable to quantum computing.

These weaknesses were overcome in 2018 by cryptographer Eli-Ben Sasson, the inventor of the Zero-Knowledge Scalable Transparent ARguments of Knowledge (zkSTARK). These proofs are transparent in the sense that they do not require an initial configuration of confidence because they are based on simpler cryptography through collision-resistant hash functions. This approach is also computationally less expensive and therefore more scalable. And it is also resistant to attacks from future quantum computers because it relies on post-quantum cryptography. One of its drawbacks is that the size of the prooft is larger, which could be limiting depending on which applications. Sasson has founded a company around the zkSTARK, STARKWARE, to improve the scalability and privacy of block chain technologies.

Of course, block chains are not the only scope of application of the zero-knowledge proof. ZKProof, an open initiative bringing together academia and industry, was recently established to promote the safe, efficient and interoperable use of zero-knowledge proving technologies. Its main mission is to standardise protocols to facilitate their implementation by industry.

Data Finally Under the Control of the User

Zero-knowledge proofs hold immense potential to put people back in control of their data, allowing others to verify certain attributes of that data without revealing the data itself. There is no doubt that current and future ZKPs will have a huge impact on finance, health care and other industries by allowing all types of transactions while safeguarding data privacy.

Redefining Cloud Security with SASE

Samuel Bonete    24 September, 2020

Stop for a moment and think: what percentage of your Internet traffic ends up on websites or traditional browsing and what proportion on SaaS services? If we analyse it in detail, more than 85% of the volume of traffic that moves on the Internet ends up in a SaaS service. Having said this, is a proxy or a traditional firewall, whether on-prem or in the cloud, able to understand what is happening to the cloud applications that are being consumed? Be honest with yourself…

Traditional or legacy model-based security solutions are aimed at protecting the user in order to safeguard navigation and prevent the user from accessing malicious sites, downloading malware or clicking on a phishing site. These solutions also follow an “allow/deny” model, authorising the use of certain applications and blocking many others. However, at a time when the web world and SaaS have converged, this pattern no longer makes sense. Proxies and cloud firewalls are not enough to protect our information.

A conventional cloud proxy is effective in crashing or enabling cloud applications and web pages, but it does not work to decode at a low level what is happening in the SaaS application. In other words, it can provide basic information (i.e. a user connecting to OneDrive and uploading X Gb of data) but not provide detailed reports such as: Which specific instance did the user connect to? Which document was uploaded to that instance? Were they protected with IRM? Were the files subsequently shared with a third party? And so on.

The current situation forces us to protect not only the user’s web browsing, but also the data and, above all, to be aware of where the corporate information ends up. Beyond regulated SaaS applications, corporate information can end up on any website, unregulated SaaS service or IaaS instance. This is why the concept of the Next Generation Proxy Cloud, or NextGen Secure Web Gateway start to make their way.

First Step Towards a SASE Strategy

And what is this NextGen Secure Web Gateway about? Basically, it is a web browsing proxy service offered from the cloud, but unlike traditional services, it is capable of protecting browsing and controlling what users do in SaaS applications, in order to be able to read the information being transferred to them and apply controls within a context.

In short, we are talking about providing intelligence to the proxy, combining proxy, CASB, DLP and Threat Protection capabilities in a 100% cloud platform through which we will pass our users’ browsing traffic, when they are in the office, in an SD-WAN connected location or on the move.

In this way, the first thing that will happen when an employee opens his laptop is that he will be transparently connected to a control point on the Internet and, from there – after validation of the team’s security posture – all his SaaS activity will be monitored and his web browsing will be protected. Furthermore, if the user needs to access corporate resources located on the internal network in a safe way, this can be done through a Zero Trust Network Access model, which will provide secure remote access from that interconnected network to the internal resources. This approach of uploading security features to a new 100% cloud perimeter matches with the SASE “Secure Access Service Edge” model that is trend nowadays. But in order to provide cloud security services, it is necessary to have an Edge that supports it.

Nowasays, NewEdge operates with present points in 40 regions (including Madrid, São Paulo, Buenos Aires, Santiago de Chile, Bogotá, among others), and new datacenters are added every month. NewEdge is designed to scale to over two terabits per second at each present point and is capable of handling online traffic of hundreds of millions of users. With extensive peering with cloud services, CDN, Software as a Service (SaaS), as well as Infrastructure as a Service (IaaS) representing over 300 network adjacencies, NewEdge is now the world’s best-connected network for delivering data security with a native cloud platform.

Cybersecurity for Industrial Digitalisation: Keys to a Successful Approach

ElevenPaths    24 September, 2020

Digital technologies, and in particular what has been agreed to be called IoT (Internet of Things), bring a world of possibilities that organisations of any sector cannot fail to exploit in order to increase their flexibility and capacity to adapt to the tastes and habits of their customers, improve the services they provide through continuous monitoring or become more efficient.

All these technologies have the need for greater connectivity in the environment of organizations in, both externally, that is to say, with their customers and suppliers, and internally. Therefore, achieving greater coordination and integration between different organizations and departments.

This increased interconnection between areas that were recently isolated (i.e. information systems and operating systems) as well as between organisations that up to date have used less digital and automated interoperation processes means that, in parallel with the digital transformation process, there is an increase in their attack surface and, consequently, in the cybersecurity risks they are exposed to.

This time, unlike previous waves of digital transformation (TI systems explosion, personal devices, cloud), changes are taking place in the core of industrial organisations, that is, in their operational systems. These are responsible for supervising and controlling production processes, which traditionally had been more isolated.

Telefónica has been supporting its customers in this process of digital
transformation since its very origins, offering them specialised solutions and services to deal with cybersecurity risks. Likewise, we continue to adapt and improve our offer to remain at the cutting edge.

This document starts by explaining the forces driving the industry towards
digital transformation and the associated cybersecurity risks. Then it introduces the methodology followed by ElevenPaths to help our clients address this challenge, highlighting the differential aspects of the proposal. Finally, two model scenarios are put forward that exemplify two different types of cybersecurity projects: organisations with traditional factories that must adapt to the new environment and organisations that are building new factories where cellular connectivity is a key element.

Click to access elevenpaths-cybersecurity-industrial-digitalisation-en.pdf

When Preventing a Cyberattack Becomes a Vital Decision

Diego Samuel Espitia    23 September, 2020

In recent years, the number of incidents in critical infrastructure networks and industrial systems has increased significantly. There have been attacks with a high degree of complexity and knowledge about the elements affected and about how to take advantage of the historical deficiency in security implementations that these types of networks have. This generates a high risk on the lives of the people who work in these industries or who depend on them, as well as on the critical infrastructures of the countries.

In previous articles we have talked about how industrial networks base their safety on keeping industrial systems isolated. This is what we know as AirGap, but it is increasingly unlikely and inefficient. The false security confidence generated by this isolation has allowed cyberattackers to take advantage of remote control tools (RAT) to filter into IT networks and reach OT networks. From where they exploit the vulnerabilities of industrial systems without being detected.

Security measures have been somehow delayed in reaching these types of environments due to a lack of knowledge in OT cybersecurity, to the isolation that is generated in companies between IT and OT equipment or simply because of the erroneous assumption that these devices cannot be reached by criminals. However, earlier this year, MITRE published the framework known as ATT&CK (Adversarial Tactics, Techniques and Common Knowledge), which specialises in industrial control systems.

This image has an empty alt attribute; its file name is image-26.png
Source: https://collaborate.mitre.org/attackics/index.php/Main_Page

This matrix has been very important in the investigations of incidents that have occurred in the last six months, as our partner Nozomi Networks indicates in its report for the first half of 2020. This report points out how the COVID-19 pandemic is being used to carry out ransomware and botnet expansion attacks on OT and IoT systems, as well as analysing the tactics and techniques used for this purpose.

Case Study with MITRE ATT&CK Step by Step

To understand how this matrix is applied, it is best to analyse an attack with it. In this case we will take an advanced persistent threat (APT) called GreyEnergy, which was made public in November 2018 but whose first detections are in incidents on Poland’s electricity grid in 2015 and later in incidents in the financial sector during 2018.

The initial attack used a technique that is well known to all of us who work in security and to which all Internet users are permanently exposed, which is phishing. It is also a technique whose use has increased significantly in this time of pandemic. Therefore, the initial access on the ATT&CK map is in the SpearPhishing Attachment, as the attack begins with a Word document containing a malicious macro with the necessary commands for the following execution, evasion and persistence phases.

Since the malicious load is in a macro, which requires user interaction, the User Execution section on the ATT&CK map must be marked. In order to achieve persistence, the malware searches for web servers with a vulnerability in order to hide, managing to camouflage itself in the network. Therefore, the Hooking in Persistence and Masquerading in Evasion are marked in the ATT&CK map, due to the packer it uses to hide the real malicious code.

To detect targets within the affected network, the malware uses several widely known tools that can be grouped within the discovery in the ATT&CK map, such as Network Service Scanning and Network Sniffing. Therefore,managing to detect the vulnerable services mentioned above for lateral movement, which in the ATT&CK map would be Exploitation of Remote Services.

For command execution it uses a known technique among C&C systems, which is to deploy proxy within the network to redirect requests to external network equipment, hiding the traffic of the network security monitoring systems among the internal traffic. Therefore, in the phase of inhibiting the response functions, Program Download and Alarm Suppression are marked on the ATT&CK map, since they use an external program such as procy and suppress the alarm after hiding in internal traffic.

The last two phases within the ATT&CK map are more complex to analyse because, as it is a modular malware, it is possible that the control process that wants to damage changes according to the case and, therefore, its final impact. However, in the samples collected, it was found that they sought to stop services by generating wipes on the hard disks of the human machine interface (HMI), so the final impact would be damage to property or denial of control. Thus, what we should mark would be Service Stop and Damage to Property.

In industrial networks this impact is very critical, because when control or visibility of operation is lost, there is no other way out than to stop the service at an emergency stop to mitigate the possibility of human loss, environmental damage or physical damage. Which usually generates very serious economic and reputational losses for the companies affected.

Conclusions

As can be seen, MITRE ATT&CK makes it possible to clearly identify the tactics and techniques used by cybercriminals in cyberattacks aimed at industrial environments. As well as providing the possibility of obtaining common information gathered in other incidents that help in the deployment of specialised monitoring systems and the application of threat intelligence systems to minimise the impact of an incident.

In each of the phases there are possible indicators of compromise, such as the hash of the file used in phishing (f50ee030224bf617ba71d88422c25d7e489571bc1aba9e65dc122a45122c9321) where, as seen below, the macro contains the malware. This would have been detected with our DIARIO tool and the control systems would have made it possible to avoid the start of the incident.

This methodology makes it possible to ensure the three stages industrial systems control, as we explained in the articles on introduction to industrial systems a few years ago. Correct measurement of data must be ensured so that the evaluation and processing of the data guarantees compliance with safe working standards.

Due to the severity that an incident in industrial environments can cause, it is essential that these security frameworks are considered in such environments so that the monitoring and response to cyberincidents, as well as remote control systems, manage safety requirements more successfully and avoid literally putting lives at risk.

Analysis of APPs Related to COVID19 Using Tacyt (II)

Andrés Naranjo    Amador Aparicio    22 September, 2020

We continue with the research started in the previous entry in which we analysed these type of applications with our Tacyt tool. Regarding the application analysed, we can see that a quick glance at the permissions in Tacyt already makes it clear that we are not dealing with a conventional APP: permissions for calls, accounts, SMS, elimination of processes, NFC, audio recording and a long etcetera.

All this is much more typical of a malicious APP than a legitimate one, whatever its functionality is. The probability of a Trojan running in the background in order to access sensitive information generated via the mobile device is therefore quite high.

Official Apps in Spain accessible in Google Market (10 altogether)
Official Apps in Spain accessible in Google Market (10 altogether)

Nothing to do with the amount of applications found in any unofficial market:

Apps found in APTOIDE, an alternative market using the term: “coronavirus”
Apps found in APTOIDE, an alternative market using the term: “coronavirus”

As with other markets, Aptoide, for example, does not directly download the app we have requested but the “downloader” through which the actual download will be requested. This can easily be guessed by checking that the file size is exactly the same:

Downloaded Apps through APTOIDE
Downloaded Apps through APTOIDE

In fact, we easily check it out at Tacyt when uploading these applications. It detects them as one, with identical hash:

This is due to Tacyt not only including its own application discovery drivers and applications downloading, but also, using the upload function (either via web or API) the user can upload the applications to be analysed. These can be seen labelled as “userUpload” and can also be tagged with our own identification labels (as in the image: the author of the upload or the market from which it was downloaded).

This upload function can be very useful to detect altered versions of our legitimate applications in unofficial markets, for example, from a bank. Tacyt includes a button on the interface to compare applications.

In any case, we do not miss the opportunity to totally discourage the installation of applications from unofficial sources.

Google Play Search Using Tacyt for COVID19 Related Apps Since the Beginning of the Pandemic

We will focus the research on Google Play. The filters are used to form the next search in Tacyt. As you can see these usual composite queries (dorks) in Google search, for example, are easy to read:

((packageName:*covid19*) OR (packageName:*coronavirus*)) AND (origin:"GooglePlay") AND (createDate:"2020-03-14 00:00:00 - today")

“Dorking" to search using Tacyt apps in Google Play related to COVID-19 published since the beginning of the alarm state
“Dorking” to search using Tacyt apps in Google Play related to COVID-19 published since the beginning of the alarm state

 Tacyt’s respond to the previous search:

Apps related to COVID-19 published overseas in Google Play
Apps related to COVID-19 published overseas in Google Play

We now search for unofficial apps related to COVID19 using Tacyt from the official date of the start of the pandemic. For this task, we can use the parameter ORIGIN indicating the exclusion of all those whose origin is not the official one. For example -origin:GooglePlay.

((packageName:*covid19*) OR (packageName:*coronavirus*)) AND (-origin:GooglePlay) AND (createDate:"2020-03-14 00:00:00 - today")

Unofficial apps published since the beginning of the pandemic
Unofficial apps published since the beginning of the pandemic

For example we have a look at the permissions of the app with “coronavirus.tracker.news” package name and do a quick scan.

The following permissions are suspicious: (we only comment on permissions different to the “normal” official apps that violate privacy or security)

  • android.permission.CHANGE_WIFI_STATE: allows the APP to change the state of Wi-Fi connectivity.
  • android.permission.INTERNET: allows the APP to open network connections.
  • android.permission.WRITE_EXTERNAL_STORAGE: allows the APP to write in the external storage of the device.
  • android.permission.READ_EXTERNAL_STORAGE: allows the APP to read on the external storage of the device.
  • android.permission.WAKE_LOCK: allows you to use PowerManager WakeLocks to prevent the processor from going into sleep mode or the screen from getting dark.

For any research, we can load the apps in batches into Tacyt and then search for them using a custom label and locating, for example, as we said, suspicious permissions:

Likewise, we could have used the expiry date of the certificate (sometimes suspiciously long), apikeys, text or emails chains associated with malware, and a long etc…

We will see in the next part some more information about the findings.

Road safety and IoT

Beatriz Sanz Baños    21 September, 2020

Mobility is one of the key factors to consider in order to make cities more efficient, a necessity taking into account the millions of citizens travel to work or study centers in their vehicles. Taking into account that in our country there are about 492 vehicles per 1000 inhabitants, an effective management becomes essential to guarantee security. That improvement in management has arrived with Internet of Things, it will make daily transportation more efficient and secure.

IoT is already working to ensure road safety in areas such as vehicle maintenance, improved circulation, navigation, and monitoring environmental conditions or the state of the roads. IoT obtains the majority of its data with the help of connected cars. These incorporate a large number of sensors that establish communication with the cloud, other vehicles and devices. Thanks to this it provides data and information of great utility for the improvement of road safety.

The connected cars allow the constant monitoring of basic aspects of the vehicle to ensure its maintenance. Drivers can, for example, have real time information about the pressure and temperature of tires or other parameters such as fluid levels, deterioration or the state of the battery. All this helps to avoid breakdowns and, therefore, the prevention of accidents.

The connected cars allow the constant monitoring of basic aspects of the vehicle to ensure its maintenance

Connectivity also allows monitoring the flow velocity in real time so you can warn drivers on the screen of their cars that they are exceeding the speed limit. They also warn the pilot parking in prohibited areas or other behaviors that do not comply with the law, thus avoiding penalties for drivers.

One or more of the fundamental data to guarantee road safety of the connected cars is the geolocation. Thanks to it, connected cars can communicate with each other, so that, depending on the speed and position of each vehicle, collisions are avoided, like maneuvers involving emergency braking.

The geolocation also provides a constant update of traffic conditions, which makes it possible to send notifications about incidents on the roads, as well as the proposing the most efficient route.

In addition to the state of the traffic, thanks to IoT drivers can receive updated information on the state of the roads (potholes, ice, grade changes, black spots, etc.).

Thanks to IoT drivers can receive updated information on the state of the roads

Other IoT devices like intelligent traffic lights communicate with the sensors of connected cars. Drivers and receive information about their status (color and when they will change), which reduces the number of accidents and improves circulation.

Also in case of emergency connected cars have automatic warning mechanisms for emergency services, providing rapid attention that can be decisive to save lives. In addition, some vehicles incorporate fatigue sensors capable of detecting deviations in the driver’s normal behavior pattern and emit an alarm if there is a danger that he will fall asleep.

As we have seen, IoT has a wide range of applications in the field of road safety, which will be progressively integrated into the streets in the coming years. By 2025, the market for advanced driver assistance systems (ADAS) is expected to grow to about 36 billion euros.

Cybersecurity Weekly Briefing September 12-18

ElevenPaths    18 September, 2020

PoC for Critical Vulnerability on Netlogon

Secura researchers have published a tool to check whether a domain controller is vulnerable to the CVE-2020-1472 vulnerability on Netlogon. Last month, Microsoft patched a critical vulnerability, with CVSS 10, on Netlogon Remote Protocol (MS-NRPC) that would allow an unauthenticated attacker to elevate privileges and become the Domain Admin of a vulnerable domain controller (DC). Right then, security researchers like Kevin Beaumont raised the need for patching. A few days ago, on 11 September, a script was published which tried to evade Netlogon authentication. This script ends when it succeeds or after several failed attempts. It is recommended to install the patch that mitigates this flaw as soon as possible.

More info: https://www.secura.com/blog/zero-logon

Exploit for vulnerability on Microsoft Exchange

Last Friday, an independent researcher published in open sources a valid proof of concept for the CVE-2020-16875 vulnerability in Microsoft Exchange mail servers which would allow remote code execution. This vulnerability, whose exploitation would allow self-propagation (“worm” capabilities), was fixed by Microsoft last week in its monthly September update newsletter. At first, the manufacturer considered it to be a critical risk (CVSSv3 of 9.1, which dropped to 8.4 when the need for authentication was revealed) and unlikely to be exploited. However, the appearance of this PoC contradicts this last estimate. As a mitigating factor, in order to carry out the exploitation, the attacker would have to commit an Exchange user to the “Data Loss Prevention” role. The products affected are Microsoft Exchange Server 2016 and 2019. It is recommended to update as soon as possible.  

All the details: https://twitter.com/steventseeley/status/1304095793809371137

URSA Trojan campaign against multiple countries

Since last June, a new campaign of infections with the URSA Trojan, also known as Mispadu, is affecting users in multiple countries, including Bolivia, Chile, Mexico, Argentina, Ecuador, Colombia, Paraguay, Costa Rica, Brazil, Spain, Italy and Portugal. URSA is a relatively recent malware whose objective is the theft of banking credentials through browsers, common software such as FTP and email services. As well as through the superimposition of false bank portals in which the victim would introduce the banking credentials. This Trojan is distributed through phishing or malspam campaigns, impersonating various entities. In Portugal, for example, it has recently impersonated Vodafone, EDP (Energias de Portugal), MEO (Serviços de Comunicações e Multimédia, S.A) and Policía Judiciaria. During this activity, according to data obtained from some Command & Control servers identified in this wave of attacks, URSA would have impacted 3,379 users. And yet, it is possible that the number of infections has been much higher. The country most affected was Mexico (1,977 infections), followed by Spain (631), Portugal (514) and Chile (331).

Read more: https://seguranca-informatica.pt/threat-analysis-the-emergent-ursa-trojan-impacts-many-countries-using-a-sophisticated-loader/

Cerberus malware source code released

Security researcher has reported on the leakage of the source code for version 2 of the Cerberus malware, a banking trojan, which targets mobile devices using the Android operating system. This remote access (RAT) malware includes among its functionalities the following: interception of communications, manipulation of device functionality, exfiltration of data and banking credentials and reading of text messages that may contain one-time access codes (OTP) and two-factor authentication codes (2FA) – thus avoiding this security measure. Last July, regarding the filtering of the code, it was reported that the manager of the tool had revealed that the development team was dissolving, so he was looking for a new owner by creating an auction of the source code. In the absence of buyers, the code has been leaked. Following the release of the Cerberus source code, there has been an increase in mobile application infections in Europe and Russia, a country which hadn´t previously been affected by this threat.

Vulnerabilities in the Drupal core

Five cross-site scripting (XSS),  authentication bypass and information disclosure vulnerabilities in the Drupal core have been published. One of high severity and the rest of medium severity. The most serious vulnerability is the reflected XSS flaw that could allow an attacker to take advantage of the way HTML code is represented for the affected forms. The identifier CVE-2020-13668 has been reserved for this vulnerability, and the following ones for the less critical vulnerabilities: CVE-2020-13666, CVE-2020-13667, CVE-2020-13669 and CVE-2020-13670. It should also be noted that Drupal 8 versions prior to 8.8.x are at the end of their useful life and no longer receive security coverage. Sites in versions 8.7.x or earlier must be updated to 8.8.10.

All the details: https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/vulnerabilidades-el-core-drupal-1

FaceApp and Personal Data, Hadn´t We Talked About This Already?

Christian F. Espinosa Velarde    18 September, 2020

Hadn’t we already talked about this? The comeback of applications like FaceApp and the fuss caused by the photos generated, in which their users can appear as women being men, as men being women or change their age and other aspects of their appearance, is equal to the fuss they caused when they first showed up and became a worldwide trend.

Likewise, the alarm raised by experts in cybersecurity and privacy and personal data protection is nothing new. In regard to the risks of sharing our image for the immense technological machinery behind the application. Haven´t we learned anything then? Have the voices of all these specialists and experts fallen on deaf ears? It would seem so, because once again, thousands of users (if not more) are still using these applications.

To come clean about this, we should understand what happens to our data. While today it’s all fun, in the future, with advances in facial recognition and the use of biometrics, our faces will increasingly be used as passwords to access different devices and services, some with more sensitivity than others.

Associated Risks and Data Protection

The associated risks and attacks that can arise from the use of these applications are quite complex. Phishing can lead to much larger consequences, such as the theft of large amounts of confidential data. As well as money, in the case of many financial institutions that already use facial recognition for access to their mobile applications, for example. This problem would be even worse if the users who deliver their image held managing positions in companies or governments.

Now, is it really necessary to recall the problems encountered in the terms and conditions of use and privacy policies of these applications? Let’s say yes and no. These policies have changed, to some extent, for the better, but they are still not risk-free (nothing is, in fact). It is true that users are considering these documents more and more. However, these still use rather far-fetched language (even for a lawyer), which leaves a bad taste in the mouth when talking about applicable principles in the field of personal data protection. The principle of transparency establishes that legal notices must be simple and easy to understand, and even establishes that there must be a real informed, express and explicit consent. These principles we are talking about are not up from nowhere, they are actually established in the General Data Protection Regulation, the standard in terms of personal data protection.

Conclusion

While there are improvements in the legal aspects of this type of application, we need to consider the more practical aspects as well. The lesson to be learned is that we must be much more careful and responsible in the use of our personal data, since it is not a commodity that can be traded. Every piece of information form part of our identity, however small it may seem.

After this brief comment, I hope not to fall back into this cyberdéjà vu and I would love not to have this conversation again in the future.

ElevenPaths Radio English #3 – Why is Cybersecurity So Necessary Today?

ElevenPaths    16 September, 2020

In this episode, Gabriel Bergel, our CSA in Chile, explains that nowadays there is no excuse for not being interested in cybersecurity. At a personal level, the use of smartphones exposes us to a series of risks if we are not aware of the use of this technology and social networks. These risks increase when you have children and even more at a professional level.

In this podcast we address the need for cybersecurity from the personal to the professional level, explaining the threats and vulnerabilities in these environments and the controls that help mitigate the risks.

Third episode of ElevenPaths Radio English now available

Discover more episodes of ElevenPaths Radio English:

ElevenPaths Radio English #2 – Secure Homeworking
ElevenPaths Radio English #1 – Skills of a Cybersecurity Professional