In the past, the DEEPEND crew has discovered three new species of Bathyteuthids, a type of squid that lives in depths between 700 and 2,000 meters. The findings were validated and published in 2020. Another new squid species description is currently in review at the Bulletin of Marine Science.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
This advisory documents the impact of an internally found vulnerability in Arista EOS for security ACL bypass. The impact of this vulnerability is that the security ACL drop rule might be bypassed if a NAT ACL rule filter with permit action matches the packet flow. This could allow a host with an IP address in a range that matches the range allowed by a NAT ACL and a range denied by a Security ACL to be forwarded incorrectly as it should have been denied by the Security ACL. This can enable an ACL bypass.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
FortiGuard Labs is aware of a campaign targeting Iranian interests, specifically in the energy sector. Dubbed Green Stone, this malware is delivered through Microsoft Excel spreadsheets containing malicious macros. The Green Stone malware is obfuscated in Base64, where the macro code contains instructions to unpack Green Stone into a temporary directory where it is then executed.What is Green Stone?Green Stone is classified as an infostealer, is persistent and will steal information from the affected machine. It will look for specific registry entries in MicrosoftInternet ExplorerTypedURLs to look for websites that the targeted machine recently visited. Besides containing basic infostealer functionality, Green Stone also connects to Telegram to send C2 traffic through, which is likely a way to evade detection.The threat has the ability to collect information about the victim machine, take screenshots and send it to a predetermined URI. Green Stone can do the following:Scan directory hierarchiesDelete files and folders Run commandsLocate filesRename files and directoriesCopy filesand UnzipBased on our data, connections to the C2 server reveal the United States accounts for 30 percent, Brazil 15 percent and Argentina, Korea and Germany accounting for less than 2 percent of connections to the 185.162.235[.]184 IP address of the attacker. Who is Behind Green Stone?There is not enough information at this time to determine attribution.Any Other Suggested Mitigation?As it has been observed that Green Stone threat actors have used malicious Microsoft Office files, likely through social engineering and phishing techniques, it is recommended to never enable macro based documents, especially from a sender that is not recognized.Due to the ease of disruption and damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc. it is important to keep all AV and IPS signatures up to date.It is also important to ensure that all known vendor vulnerabilities are addressed, and updated to protect from attackers having a foothold within a network. Attackers are well aware of the difficulty of patching and if it is determined that patching is not feasible at this time, an assessment should be conducted to determine risk.Also – organizations are encouraged to conduct ongoing training sessions to educate and inform personnel about the latest phishing/spear phishing attacks. They also need to encourage employees to never open attachments from someone they don’t know, and to always treat emails from unrecognized/untrusted senders with caution. Since it has been reported that various phishing and spear phishing attacks have been delivered via social engineering distribution mechanisms, it is crucial that end users within an organization be made aware of the various types of attacks being delivered. This can be accomplished through regular training sessions and impromptu tests using predetermined templates by an organizations’ internal security department. Simple user awareness training on how to spot emails with malicious attachments or links could also help prevent initial access into the network.What is the Status of Coverage?Fortinet customers running the latest definitions are protected by the following (AV) signatures:WM/Agent!tr (Malicious Macro)W32/Agent.665F!tr (Green Stone)All network IOC’s are blocked by the WebFiltering Client.
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability in Brocade Fabric OS versions v7.4.1b and v7.3.1d could allow local users to conduct privileged directory transversal. Brocade Fabric OS versions v7.4.1.x and v7.3.x have reached end of life. Brocade Fabric OS Users should upgrade to supported versions as described in the Product End-of-Life Publish report.
