Read Time:7 Second
The th_read() function doesn’t free a variable t->th_buf.gnu_longlink after allocating memory, which may cause a memory leak.
Daily Archives: August 10, 2022
CVE-2021-33644 (libtar, openeuler)
Read Time:11 Second
An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read.
CVE-2021-33643 (libtar, openeuler)
Read Time:11 Second
An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.
Sensitive data in the cloud gets new automated remediation tool from BigID
Read Time:34 Second
Data intelligence company BigID announced this week at the Black Hat conference in Las Vegas that it has rolled out new features for its privacy and data protection platform, allowing users to programmatically restrict access to sensitive cloud-based information when it’s under threat.
BigID’s core product, its Data Intelligence platform, already boasts numerous capabilities focused on the privacy, organization and discovery of a company’s data. The new features announced this week build on that framework, allowing IT staff to automatically lock down access to sensitive information tagged as having open or overprivileged access in the big three public cloud platforms.
Microsoft Patch Tuesday Fixed 0-day Arbitrary Code Execution Vulnerability (CVE-2022-34713)
Read Time:2 Minute, 12 Second
Microsoft has released 141 security fixes for this month’s August 2022 release. Besides the usual security fixes, there was a zero-day of note:CVE-2022-34713: This is a vulnerability in Microsoft Support Diagnostic Tool (MSDT). Microsoft confirmed in their advisory that the vulnerability was exploited in the wild as a zero-day. CVE-2022-34713 is an arbitrary code execution (ACE) vulnerability, which requires user interaction. As such an user need to open a specifically crafted file or visit a specially designed Web site to be exploited. This has a CVSS score of 7.8 and is rated important.Why is this Significant?This is significant as Microsoft observed CVE-2022-34713 was exploited as a 0-day in the wild. Because the exploitation requires user interaction, an attacker likely uses social engineering to get users to open a specifically crafted file or visit a specially designed Web site for exploitation.How Widespread is the Attack that Leverages CVE-2022-34713?At this time, there is no information available as to how widespread the attack is. However, since the vulnerability was publicly disclosed, attacks that leverage CVE-2022-34713 may increase.Also, a similar vulnerability in MSDT (CVE-2022-30190, also known as Follina) that was patched in June 2022 by Microsoft is widely exploited in the wild. This is another indicator that likelihood of CVE-2022-34713 exploitation will likely increase.FortiGuard Labs previously released a Threat Signal for CVE-2022-30190 (Follina). See the Appendix for a link to “Follina: 0-day Windows MSDT Vulnerability (CVE-2022-30190) Exploited In The Wild”.Is there Any Other Vulnerability in the August Patch Tuesday that Requires Attention?Microsoft also released a patch for another vulnerability in MSDT (CVE-2022-35743). While the vulnerability was not reported nor observed to have been exploited in the wild, the Microsoft advisory states that exploitation is likely to occur. As such a patch for CVE-2022-35743 should also be applied as soon as possible. This has a CVSS score of 7.8 and is rated important.Has Microsoft Released Security Advisories for CVE-2022-34713?Yes, Microsoft has issued an advisory for the vulnerability. See the Appendix for a link to “CVE-2022-34713: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability”.Has Microsoft Released a Patch for CVE-2022-34713?Yes, Microsoft has released a patch for CVE-2022-34713 on August 9th, 2022 as part of regular MS Tuesday for the month.What is the Status of Coverage?FortiGuard Labs is investigating coverage, and will update this threat signal once any relevant updates are available.
New Ransomware “Roadsweep” Used Against Albania
Read Time:2 Minute, 25 Second
FortiGuard Labs is aware of a report that Roadsweep ransomware was used against the Albanian government. Other malware Chimneysweep backdoor and ZeroCleare wiper malware were potentially used in the attack.Why is this Significant?This is significant because a new ransomware was reportedly used against the Albanian government, a member of the North Atlantic Treaty Organization (NATO). A security vendor Mandiant, with moderate confidence, attributed the attack to an unknown threat actor who supports Iran.The attack potentially involved Chimneysweep backdoor and ZeroCleare wiper malware. The former provides backdoor access to the attacker and the latter enables the threat actor to overwrite specified files, making the affected files unrecoverable.An alleged threat actor claimed responsibility for the attack on web site and telegram channel and released information supposedly belonging to the victims in Albanian government organizations on them.What is Roadsweep Malware?Roadseep is a new ransomware that encrypts files that do not have a “.exe”, “.dll”, “.sys”, “.lnk” and “.lckon” file extension on a compromised machine and adds a “.lck” file extension to them. It drops a ransom note that contains a politically inclined message and asks the victim to make a phone call to the attacker in order to decrypt the affected files. The ransom note also includes private recovery keys. What is Chimneysweep Malware?Chimneysweep is a malware that provides the attacker a backdoor access to a compromised machine. The malware connects to its C2 server and enables the remote attacker to execute commands. Such commands include capturing screenshots, downloading and executing files, downloading and installing plugins and collecting information from the compromised machine.According to Manidant, Chimneysweeper was dropped along with non-malicious Microsoft Office files or a video file by a digitally signed Self-Extracting cab file.What is ZeroCleare Malware?ZeroCleare is a destructive malware that was previously used against Middle Eastern energy companies in mid-2019. ZeroCleare is known to abuse a legitimate third-party driver for data wiping activity and is believed to have some semblance with another wiper malware “Shamoon”. According to Mandiant, a new ZeroCleare variant is capable of wiping drives specified by the attacker as opposed only wiping the system drive. That was not seen in the previous variant.This year, FortiGuard Labs published a blog on history of wiper malware that includes ZeroCleare. See the Appendix for a link to “An Overview of the Increasing Wiper Malware Threat”.What is the Status of Coverage?FortiGuard Labs detect known Ransomsweep samples with the following AV signatures:W32/Filecoder.OLZ!tr.ransomW32/Filecoder.OLZ!trFortiGuard Labs provide the following AV signatures against Chimneysweep malware:W32/Chimneysweep.A!trW32/Agent.PEI!tr.spyW32/Agent.PTQ!tr.spyW32/Generic.AC.3F197DW32/PossibleThreatPossibleThreat.MU FortiGuard Labs provide the following AV signatures against ZeroCleare malware:W32/Trojan_Win64_ZEROCLEARE.SMAW32/Trojan_Win64_ZEROCLEARE.SMBW32/Agent.XACVYS!trW32/Distrack!trW32/PossibleThreatAll network IOCs are blocked by the WebFiltering client.
DeathStalker’s VileRAT Continues to Target Foreign and Crypto Exchanges
Read Time:5 Second
The campaign is not only ongoing, the threat actors increased its efforts to compromise targets using VileRAT
Cyber-criminals Shift From Macros to Shortcut Files to Hack Business PCs, HP Report
Read Time:4 Second
The report shows an 11% rise in archive files containing malware, including LNK files
The Security Pros and Cons of Using Email Aliases
Read Time:5 Minute, 9 Second
One way to tame your email inbox is to get in the habit of using unique email aliases when signing up for new accounts online. Adding a “+” character after the username portion of your email address — followed by a notation specific to the site you’re signing up at — lets you create an infinite number of unique email addresses tied to the same account. Aliases can help users detect breaches and fight spam. But not all websites allow aliases, and they can complicate account recovery. Here’s a look at the pros and cons of adopting a unique alias for each website.
What is an email alias? When you sign up at a site that requires an email address, think of a word or phrase that represents that site for you, and then add that prefaced by a “+” sign just to the left of the “@” sign in your email address. For instance, if I were signing up at example.com, I might give my email address as krebsonsecurity+example@gmail.com. Then, I simply go back to my inbox and create a corresponding folder called “Example,” along with a new filter that sends any email addressed to that alias to the Example folder.
Importantly, you don’t ever use this alias anywhere else. That way, if anyone other than example.com starts sending email to it, it is reasonable to assume that example.com either shared your address with others or that it got hacked and relieved of that information. Indeed, security-minded readers have often alerted KrebsOnSecurity about spam to specific aliases that suggested a breach at some website, and usually they were right, even if the company that got hacked didn’t realize it at the time.
Alex Holden, founder of the Milwaukee-based cybersecurity consultancy Hold Security, said many threat actors will scrub their distribution lists of any aliases because there is a perception that these users are more security- and privacy-focused than normal users, and are thus more likely to report spam to their aliased addresses.
Holden said freshly-hacked databases also are often scrubbed of aliases before being sold in the underground, meaning the hackers will simply remove the aliased portion of the email address.
“I can tell you that certain threat groups have rules on ‘+*@’ email address deletion,” Holden said. “We just got the largest credentials cache ever — 1 billion new credentials to us — and most of that data is altered, with aliases removed. Modifying credential data for some threat groups is normal. They spend time trying to understand the database structure and removing any red flags.”
Why might spamming aliases be a bad idea? According to the breach tracking site HaveIBeenPwned.com, only about .03 percent of the breached records in circulation today include an alias.
Email aliases are rare enough that seeing just a few email addresses with the same alias in a breached database can make it trivial to identify which company likely got hacked and leaked said database. That’s because the most common aliases are simply the name of the website where the signup takes place, or some abbreviation or shorthand for it.
Hence, for a given database, if there are more than a handful of email addresses that have the same alias, the chances are good that whatever company or website corresponds to that alias has been hacked.
That might explain the actions of Allekabels, a large Dutch electronics web shop that suffered a data breach in 2021. Allekabels said a former employee had stolen data on 5,000 customers, and that those customers were then informed about the data breach by Allekabels.
But Dutch publication RTL Nieuws said it obtained a copy of the Allekabels user database from a hacker who was selling information on 3.6 million customers at the time, and found that the 5,000 number cited by the retailer corresponded to the number of customers who’d signed up using an alias. In essence, RTL argued, the company had notified only those most likely to notice and complain that their aliased addresses were suddenly receiving spam.
“RTL Nieuws has called more than thirty people from the database to check the leaked data,” the publication explained. “The customers with such a unique email address have all received a message from Allekabels that their data has been leaked – according to Allekabels they all happened to be among the 5000 data that this ex-employee had stolen.”
HaveIBeenPwned’s Hunt arrived at the conclusion that aliases account for about .03 percent of registered email addresses by studying the data leaked in the 2013 breach at Adobe, which affected at least 38 million users. Allekabels’s ratio of aliased users was considerably higher than Adobe’s — .14 percent — but then again European Internet users tend to be more privacy-conscious.
While overall adoption of email aliases is still quite low, that may be changing. Apple customers who use iCloud to sign up for new accounts online automatically are prompted to use Apple’s Hide My Email feature, which creates the account using a unique email address that automatically forwards to a personal inbox.
What are the downsides to using email aliases, apart from the hassle of setting them up? The biggest downer is that many sites won’t let you use a “+” sign in your email address, even though this functionality is clearly spelled out in the email standard.
Also, if you use aliases, it helps to have a reliable mnemonic to remember the alias used for each account (this is a non-issue if you create a new folder or rule for each alias). That’s because knowing the email address for an account is generally a prerequisite for resetting the account’s password, and if you can’t remember the alias you added way back when you signed up, you may have limited options for recovering access to that account if you at some point forget your password.
What about you, Dear Reader? Do you rely on email aliases? If so, have they been useful? Did I neglect to mention any pros or cons? Feel free to sound off in the comments below.
Microsoft urges Windows users to run patch for DogWalk zero-day exploit
Read Time:8 Second
Despite previously claiming the DogWalk vulnerability did not constitute a security issue, Microsoft has now released a patch to stop attackers from actively exploiting the vulnerability.