Charitable Ransomware, Year of Linux Malware, Follina MSDT, Twitter Fines, & Bounties – PSW #743

The burning question here is, will consumers care?

This is a good hypothetical attack, however, barely mentioning the firmware aspect is disappointing. Also, in their example, there is a completely flat network, from IoT camera, to a workstation, to AD DC to another PC which then goes to the OT network, which is not, and should not, be common. I know it exists, but less frequently?

Some pretty good FUD in here! The evidence to support the rise in Linux malware is weak and does not take into account the increase or decrease in Linux hosts, define what represents a Linux machine, account for actual new malware or just variants, etc... The 6 types of attacks to look for are not really compelling, the end goal will be achieved regardless of OS. There is some mention of Linux-based firmware, but not a whole lot of meat, and little on defense.

Still curious why they chose ISO files: "He points out that the use of an ISO file to carry the script, which then drops a malicious extension, is not a new technique, but it remains effective because ISOs are still commonly used in business settings. While this campaign is relying on a ruse of pirated software, ISOs are also important in network and system management and are used for installing packages on servers and containers. Linux is installed via ISO, as are some Windows upgrades."

This article could have had a point, but instead it just rambled and wasted an opportunity with Chris: "But it’s not that simple and it never is. Wysopal argues that many enterprises simply do not check what they should. If that's true — and I sadly concede it likely is— then Google Assured is an improvement over what we had last month. In other words, if you’re already cutting too many corners and plan to continue doing so, Google’s move can be a good thing. If you’re strict about code-checking, it’s irrelevant." - I believe Google does a good job of helping secure OSS, so why not incorporate that into your security process?

As they should: "Twitter has agreed to pay a $150 million penalty for targeting ads at users with phone numbers and email addresses collected from those users when they enabled two-factor authentication. " - Facebook also got in trouble for this in 2019 and had to pay $5 billion (https://www.ftc.gov/news-events/news/press-releases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-privacy-restrictions-facebook), Twitter should have learned from Facebook's mistake.

Interesting exploit, manipulate HTTP Header values and returned from the server is a valid auth cookie! Nice: https://github.com/horizon3ai/CVE-2022-22972/blob/main/CVE-2022-22972.py Very nice...

I wonder how long it will take endpoint security to catch on to this one: "Additional functions in this variant include taking screenshots and grabbing user and system information (username, IP address, OS version), which helps the attacker determine what malware or utilities they can use in the next phase of the compromise. When Black Lotus Labs analyzed the sample, only two antivirus engines out of 57 on Virus Total flagged it as malicious, the researchers noted." - And if you have endpoint security, do you install the Linux version in WSL or does the Windows version also come with support for WSL, or is anyone protecting WSL at this point?

Great details here, using MSDT (Microsoft Support Diagnostic Tool) attackers, through a Word doc, load a file from a URL. Neat trick! No patch, but a workaround is available.

To "pay" this ransom you will have to: "1: Donate new clothes to the homeless, record the action, and post it on social media. 2: Take five less fortunate children to Dominos, Pizza Hut or KFC for a treat, take pictures and videos, and post them on social media. 3: Provide financial assistance to anyone who needs urgent medical attention but cannot afford it, at a nearby hospital, record audio, and share it with the operators." - Curious if there are healthier eating options, like could you take them to Sushi?

I believe this is a mistake: "We currently don’t pay bug bounties, and the reason for that is that we just don’t seem to need to – people are more than happy to come and tell government we’ve screwed up."

Like, when everyone else patches stuff you should too: "Eclypsium's accompanying video shows an attacker gaining access to the BMC after exploiting the vulnerability to modify its web server. The attacker then executes a publicly available tool that uses Pantsdown to read and write to the BMC firmware. The tool allows the attacker to supply the BMC with code that opens a reverse web shell whenever a legitimate administrator refreshes a webpage or connects to the server. The next time the admin tries to take either action, it will fail with a connection error. Behind the scenes, however, and unbeknownst to the admin, the attacker's reverse shell opens. From here on, the attacker has full control of the BMC and can do anything with it that a legitimate admin can, including establishing continued access or even permanently bricking the server."

Karakurt actors steal data and threaten to auction it off or release it to the public unless they receive payment of the demanded ransom. CISA, the FBI, Treasury, and FinCEN encourage organizations to review Karakurt Data Extortion Group to learn about Karakurt’s tactics, techniques, and procedures and to apply the recommended mitigations. https://www.cisa.gov/uscert/ncas/alerts/aa22-152a

Mozilla has released security updates to address vulnerabilities in Firefox, Firefox ESR, and Thunderbird. An attacker could exploit some of these Vulnerabilities to take control of an affected systems.

Work around - disable MS-DT Run Command Prompt as Administrator. Backup Registry key "reg export HKEY_CLASSES_ROOTms-msdt filename“ Delete the Registry key “reg delete HKEY_CLASSES_ROOTms-msdt /f”

Microsoft has released workaround guidance to address a remote code execution (RCE) vulnerability—CVE-2022-30190, known as "Follina"—affecting the Microsoft Support Diagnostic Tool (MSDT) in Windows.

Researchers say they uncovered a new zero-day vulnerability, which has been dubbed "Follina" by security researcher Kevin Beaumont, The document uses the Word remote template feature to retrieve a HTML file from a remote webserver, which in turn uses the ms-msdt MSProtocol URI scheme to load some code and execute some PowerShell." Uses bash on the Mac...

Kevin Beaumont's write-up of Follina.