webkitgtk-2.42.1-1.fc39
Fix enable-html5-database setting to properly enable/disable IndexedDB API.
Fix the build with GBM disabled.
Fix several crashes and rendering issues.
Security fixes: CVE-2023-41993
webkitgtk-2.42.1-1.fc38
Fix enable-html5-database setting to properly enable/disable IndexedDB API.
Fix the build with GBM disabled.
Fix several crashes and rendering issues.
Security fixes: CVE-2023-41993
If the US government shutdown occurs, it is expected that 80% of CISA employees will be furloughed
Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Google Chrome is a web browser used to access the internet. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article.
Many threat actors tend to gravitate towards using some type of remote access trojan (RAT) in their campaigns. RATs are a type of malware that is designed to allow the attacker to have control over an infected device. RATs are a popular choice for hackers to use due to their many capabilities from reconnaissance and data exfiltration to long-term persistence. Throughout the last couple of months, a new Android banking trojan has been making headlines. This trojan, known as MMRat, has been seen targeting mobile users in Asia and has been linked to bank fraud.
Currently, there is not much information available on the history of malware or who created the RAT, but the first sighting of this malware was in late June 2023. The name MMRat comes from the com.mm.user package that the malware uses for different activities. Some of the things that this package is capable of are capturing user input and screen content, as well as command and control (C2). In addition, as of right now, the targets of this malware are countries in Southeast Asia. This conclusion was made based on the languages detected on the phishing pages such as Indonesian, Vietnamese, Singaporean, and Filipino.
The primary method of infection for MMRat is through phishing. At this time, it is still unclear how these phishing links are spread, but it is safe to assume that email and forums might be two common ways that these links are distributed. Specifically, it is a network of phishing sites that duplicate the qualities of official app stores. In these fake app stores, MMRat disguises itself as an official government application or a dating application.
From beginning to end, this malware attack completes a 7-step process which begins with its installation. At the end of the process, it uninstalls itself after a successful fraudulent transaction has taken place. This RAT possesses the ability to collect vast amounts of device data and personal information. These two fields of data, along with stolen credentials that they could have captured through the MMRat or other means, could help assist them in committing banking fraud.
Like many other types of malware and RATs, the best way to protect against MMRat is through proper phishing training. With proper training, you can help keep your organization and employees better protected against the constantly emerging threats in the cyber landscape. Other steps that can be taken to protect against MMRat include, not downloading apps from unofficial app stores, carefully reading app reviews, and in the case of this trojan especially, reading all of the permissions an application is requesting access to. Reading permissions for any application is never fun and seems pointless, but it is important to read these as they explain exactly what features need to be used for the application to function. It can be assumed that in many of the reported cases of MMRat, the consumer did not properly read the permissions, and thus allowed the hacker access to their system.
Although there have not yet been any reports of MMRat being discovered in countries outside of Southeast Asia, it does not mean we should keep our guard down. This RAT has proven to be a problem in Asia where it has been connected with banking fraud. Its many functionalities make this RAT extremely dangerous. We must take the measures needed to be ready for if and when this strain of malware begins to spread outside of Asia.
The author of this blog works at www.perimeterwatch.com.
https://thehackernews.com/2023/08/mmrat-android-trojan-executes-remote.html
https://www.trendmicro.com/en_us/research/23/h/mmrat-carries-out-bank-fraud-via-fake-app-stores.html
https://www.hackread.com/mmrat-android-trojan-fake-app-store-bank-fraud/
thunderbird-115.3.0-1.fc39
Update to 115.3.0 ;
https://www.thunderbird.net/en-US/thunderbird/115.3.0/releasenotes/ ;
https://www.mozilla.org/en-US/security/advisories/mfsa2023-43/
This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to target a nested Python object, relative to the original source object. These paths can be used to target internal class attributes and dict items, to retrieve, modify or invoke nested Python objects.
**Note:**
The pydash.objects.invoke() method is vulnerable to Command Injection when the following prerequisites are satisfied:
1) The source object (argument 1) is not a built-in object such as list/dict (otherwise, the __init__.__globals__ path is not accessible)
2) The attacker has control over argument 2 (the path string) and argument 3 (the argument to pass to the invoked method)
The pydash.collections.invoke_map() method is also vulnerable, but is harder to exploit as the attacker does not have direct control over the argument to be passed to the invoked function.
