Read Time:3 Second
February Patch Tuesday contains updates for over 70 CVEs
Yearly Archives: 2023
Defending against attacks on Azure AD: Goodbye firewall, hello identity protection
Read Time:39 Second
Not too long ago, guarding access to the network was the focal point of defense for security teams. Powerful firewalls ensured that attackers were blocked on the outside while on the inside things might get “squishy,” allowing users fairly free rein within. Those firewalls were the ultimate defense—no one undesirable got access.
Until they did. With the advent of cloud computing, the edge of a network is no longer protected by a firewall. In fact, the network no longer has an edge: in our work-from-anywhere environment in which any data center is now a boundary, we can no longer rely on traditional protection mechanisms. Security has become more about protecting identity rather than the network itself.
SAS App and Website Hit as Attacks Target Swedish Firms
SideWinder APT Attacks Regional Targets in New Campaign
Read Time:4 Second
Indian threat group conducts hundreds of operations in a short time-span
php-8.1.16-1.fc36
Read Time:23 Second
FEDORA-2023-d12ff09d38
Packages in this update:
php-8.1.16-1.fc36
Update description:
PHP version 8.1.16 (14 Feb 2023)
Core:
Fixed bug php#81744 (Password_verify() always return true with some hash). (CVE-2023-0567). (Tim Düsterhus)
Fixed bug php#81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568). (Niels Dossche)
Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662) (Jakub Zelenka)
php-8.1.16-1.fc37
Read Time:23 Second
FEDORA-2023-452714dbc6
Packages in this update:
php-8.1.16-1.fc37
Update description:
PHP version 8.1.16 (14 Feb 2023)
Core:
Fixed bug php#81744 (Password_verify() always return true with some hash). (CVE-2023-0567). (Tim Düsterhus)
Fixed bug php#81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568). (Niels Dossche)
Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662) (Jakub Zelenka)
Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution.
Read Time:1 Minute, 5 Second
Multiple vulnerabilities have been discovered in Adobe products, the most severe of which could allow for arbitrary code execution.
Adobe After Effects is a digital visual effects, motion graphics, and compositing application
Adobe Connect is a suite of software for remote training, web conferencing, presentation, and desktop sharing.
Adobe FrameMaker is a document processor designed for writing and editing large or complex documents, including structured documents.
Adobe Bridge is a free digital asset management app.
Adobe Photoshop is a raster graphics editor
Adobe InDesign is a desktop publishing and page layout designing software.
Adobe Premiere Rush is a free mobile and desktop video editing software.
Adobe Animate is a multimedia authoring and computer animation program.
Adobe Substance 3D Stager is a state-of-the-art staging tool to create 3D scenes with real-time 3D visualization and high-quality renders.
Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights
Multiple Vulnerabilities in Mozilla Firefox and Firefox ESR Could Allow for Arbitrary Code Execution
Read Time:37 Second
Multiple vulnerabilities have been discovered in Mozilla Firefox and Firefox Extended Support Release (ESR), the most severe of which could allow for arbitrary code execution.
Mozilla Firefox is a web browser used to access the Internet.
Mozilla Firefox ESR is a version of the web browser that is intended to be deployed in large organizations.
Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
Critical Patches Issued for Microsoft Products, February 14, 2023
Read Time:28 Second
Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution in the context of the affected service account. Depending on the privileges associated with the account, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Service accounts that are configured to have fewer user rights on the system could be less impacted than those that operate with administrative user rights.
Alert (AA23-040A) #StopRansomware: Ransomware Activities Related to DPRK
Read Time:2 Minute, 27 Second
FortiGuard Labs is aware of a joint advisory on ransomware activities against organizations in healthcare and critical infrastructure performed by threat actors related to the Democratic People’s Republic of Korea (DPRK). The advisory was issued by multiple agencies in the United States and the Republic of Korea (ROK) and contains information that helps organizations fortify their cyber defense for known tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs).Why is this Significant?This is significant because the advisory is part of the #StopRansomware effort and provides tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) that belong to ransomware activities related to threat actors associated with DPRK. The information in the advisory helps organizations review and strengthen cyber defenses.The advisory was issued by the United States National Security Agency (NSA), the U.S. Federal Bureau of Investigation (FBI), the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the U.S. Department of Health and Human Services (HHS), the Republic of Korea (ROK) National Intelligence Service (NIS), and the ROK Defense Security Agency (DSA).What are the TTPs Covered in the Advisory?Threat actors were observed to have leveraged the following vulnerabilities to gain access to the victims’ network:CVE 2021-44228 (Apache log4j remote code execution vulnerability)CVE-2021-20038 (SonicWall SMA100 buffer overflow vulnerability)CVE-2022-24990 (TerraMaster OS unauthenticated remote command execution vulnerability)Threat actors also hide malware in the X-Popup instant messenger app as initial infection vector.Ransomware used by DPRK threat actors include Maui, H0lyGh0st, BitLocker, Deadbolt, ech0raix, GonnaCry, Hidden Tear, Jigsaw, LockBit 2.0, My Little Ransomware, NxRansomware, Ryuk, and YourRansom.What is Mitigation?The advisory provides mitigation methods. For details, see the Appendix for a link to “Alert (AA23-040A): #StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities”.What is the Status of Protection?FortiGuard Labs has the following AV signatures in place for the available samples referenced in the IOC section in the advisory:Java/Webshell.V!trPHP/Webshell.NIJ!trPHP/Webshell.NOK!trVBA/Agent.BSL!trW32/Agent.C5C2!trW32/Agent.FD!trW32/Agent.GT!trW32/Agent.QCD!tr.spyW32/Agent.SRR!trW32/DTrack!tr.bdrW32/Filecoder.AX!trW32/Filecoder.OLY!trW32/KeyLogger.RKT!trW32/MagicRAT.B!trW32/MagicRAT.C!trW32/MagicRAT.D!trW32/MagicRAT.E!trW32/MAUICRYPT.YACC5!tr.ransomW32/MulDrop19.28718!trW32/NukeSped.HD!trW32/NukeSped.JF!trW32/PossibleThreatW32/Scar.JEV!trW64/Agent.ACBX!trW64/Filecoder.788A!tr.ransomW64/GenKryptik.FTAR!trW64/NukeSped.HA!trW64/NukeSped.HD!trW64/NukeSped.IF!trW64/NukeSped.LC!trW64/NukeSped.LE!trW64/NukeSped.LT!trRiskware/XpopupMalicious_Behavior.SBW32/Malicious_Behavior.VEXPossibleThreat.PALLASHFortiGuard Labs has the following IPS signatures in place for the exploited vulnerabilities in the advisory:Apache.Log4j.Error.Log.Remote.Code.Execution (CVE-2021-44228)SonicWall.SMA100.mod_cgi.Buffer.Overflow (CVE-2021-20038)FortiGuard Labs is currently investigating IPS protection for CVE-2022-24990. The Threat Signal will be updated when new information becomes available.