Roblox Prison, 3DS RCE, Puckungfu, Google Home Wiretaps, & Lastpass Hack – PSW #768

Crazy insights: "Roblox, to reiterate, is one of the largest sources of children's entertainment in the world. Forty-three million players log into it everyday, and countless kids rely on the servers to keep them connected with their friends during the dog days of the pandemic. So it's strange to hear a parent compare the game to a prison yard. After talking to the flippers, gamblers, and hustlers of the Roblox underworld, I do wonder if Roblox Corporation understands the responsibility that comes when your player base is composed of innocents."

Very interesting: "If you want to use an online password manager, I would recommend using the one already built into your browser. They provide the same functionality, and can sidestep these fundamental problems with extensions. I use Chrome, but the other major browsers like Edge or Firefox are fine too. They can isolate their trusted UI from websites, they don’t break the sandbox security model, they have world-class security teams, and they couldn’t be easier to use. No doubt there will be many people reading this who don’t like this advice. All I can say is I’ve heard all the arguments, and stand by my conclusions." - Should we ditch all the fancy password managers and just use the one built into Chrome?

I feel like this is a solvable problem. - "At around 4:40pm GMT on December 30 (Friday), we learned about a malicious dependency package (torchtriton) that was uploaded to the Python Package Index (PyPI) code repository with the same package name as the one we ship on the PyTorch nightly package index. Since the PyPI index takes precedence, this malicious package was being installed instead of the version from our official repository. This design enables somebody to register a package by the same name as one that exists in a third party index, and pip will install their version by default."

"Nearly 70 years after having his security clearance revoked by the Atomic Energy Commission (AEC) due to suspicion of being a Soviet spy, Manhattan Project physicist J. Robert Oppenheimer has finally received some form of justice just in time for Christmas, according to a December 16 article in the New York Times. US Secretary of Energy Jennifer M. Granholm released a statement nullifying the controversial decision that badly tarnished the late physicist's reputation, declaring it to be the result of a "flawed process" that violated the AEC's own regulations."

It looks like the automated update process has a command injection vulnerability, the irony is not lost here. Also, this was interesting: "We initially did this research to use it for Pwn2Own 2022 Toronto but Netgear released firmware version 1.0.9.90 one day prior to the competition and therefore this vulnerability was no longer eligible. However, we managed to find an alternative Netgear WAN vulnerability after the patch in time as seen on Twitter."

There is a lot of reading to do on this one: "Using backdoored plugins/addins/extensions as persistence method is one of my favorite techniques to keep a door open after compromising a web server (indeed I wrote about this topic in multiple times in last years: Backdoors in XAMPP stack (part I): PHP extensions, Backdoors in XAMP stack (part II): UDF in MySQL, Backdoors in XAMP stack (part III): Apache Modules and Improving PHP extensions as a persistence method. Today’s article is a direct continuation of the PHP extensions saga, serving as the end of the trilogy. It is therefore MANDATORY to read the two previous articles"

Great post, amazing research, boils down this: "Putting it all together, I had a Python script that takes your Google credentials and an IP address as input and uses them to link your account to the Google Home device at the provided IP." And this: "Rather than making a local API request to control the device, you instead make a local API request to retrieve innocuous-looking device info, and use that info along with cloud APIs to control the device."

"ENLBufferPwn is a vulnerability in the common network code of several first party Nintendo games since the Nintendo 3DS that allows an attacker to execute code remotely in the victim's console by just having an online game with them (remote code execution). It was dicovered by multiple people independently during 2021 and reported to Nintendo during 2021 and 2022. Since the initial report, Nintendo has patched the vulnerability in many vulnerable games." Classic: "The ENLBufferPwn vulnerability exploits a buffer overflow in the C++ class NetworkBuffer present in the network library enl (Net in Mario Kart 7) used by many first party Nintendo games. This class contains two methods Add and Set which fill a network buffer with data coming from other players. However, none of those methods check that the input data actually fits in the network buffer. "

Lots of hacking, lots of vulnerabilities!

This is the nuclear option: "In the end, the maintainers of the Gorilla framework did the right thing: they decommissioned a widely used project that was at risk of rotting from the inside out. And instead of let it live in disarray or potentially fall into the hands of bad actors, it is simply gone. Its link on the chain of software has been purposefully broken to force anyone using it to choose a better, and hopefully, more secure option."

"The SMB2 TREE DISCONNECT command processing is where the specific flaw is found. The problem arises from failing to validate an object’s existence before performing operations. Using this flaw, an attacker might run code within the kernel." - Ref: All You Need to Know About the Linux Kernel ksmbd Remote Code Execution (ZDI-22-1690) Vulnerability

General advice: Move away from LastPass...

We talked about this in a previous episode, Fedora is making it happen, neat!

Hence, by implementing the following five-step process, Yair could delete files in a directory he didn't have modification privileges.

Create a special path with the malicious file at C:tempWindowsSystem32driversndis.sys Hold its handle and force the EDR or AV to postpone the deletion until after the next reboot Delete the C:temp directory Create a junction C:temp → C: Reboot when prompted.

"Moore’s video gives a detailed demonstration of the problem, which he detected quite easily. Having installed a Eufy video doorbell, Paul logged in to the device’s web interface, where he analyzed the source code in the browser and showed that the camera sends a picture to the vendor’s server every time someone appears in the frame. This means that at least one of Eufy’s guarantees (“no clouds”) isn’t true."

US Transportation Secretary Pete Buttigieg says his agency will investigate what caused the unusually large number of flight cancellations over the holiday weekend. The company’s pilot and flight attendant unions said that Southwest ignored the need to upgrade its outdated computer systems, which contributed to the airline’s troubles in the face of winter storms.

Southwest has historically under staffed IT positions and not kept IT systems current. Will this change?

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability, but only systems with ksmbd enabled are vulnerable. The bug affects the in-kernel SMB server designed to augment Samba, on systems running the Linux 5.15 kernel, such as Ubuntu 22.04.

New York state governor Kathy Hochul has signed the Digital Fair Repair Act into law , months after it had passed both chambers of the state's legislature. The law will require companies to provide the same diagnostic tools, repair manuals, and parts to the public that they provide to their own repair technicians.

The bill as signed contains even more conditions and exceptions, ostensibly added to address the governor's concerns about "technical issues that could put safety and security at risk, as well as heighten the risk of injury from physical repair projects."

A critical arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium WordPress plug-in is being actively exploited. The exploit leverages a flaw in the importactionsfromsettingsfrompanel which runs admininit hook meaning the flaw is running as admin, without authentication, so you can pretty much impact anything in the /wp-admin/ directory. The function was lacking a CSRF and capacity/type check.

There are two exploits, the first: Linux.BackDoor.WordPressExploit.1 has remote C&C, targets 32 bit Linux, but will run on 64 bit variants as well; the second: Linux.BackDoor.WordPressExploit.2 appears to be an updated version, with different C&C servers, and has exploits for additional plugins. The Doctor Web blog lists the plugins each targets and has links to IOCs you can ingest. https://news.drweb.com/show/?i=14646&lng=en&c=23

The US Cybersecurity and Infrastructure Security Agency (CISA) has added two JasperReports flaws to its Known Exploited Vulnerabilities Catalog. CVE-2018-5430 and CVE-2018-18809 have patches from TIBCO, also released in 2018.

The LockBit ransomware gang has released a free decryptor for the Hospital for Sick Children (SickKids), saying one of its members violated rules by attacking a hospital. The attack violated LockBit's code of ethics, and they removed the affiliate who executed the attack from their network. But they still took long enough to release the decryptor that the hospital was able to restore over 50% of systems to operational status.

Okta Workforce Identity Cloud service source code stolen. The question: do you believe Okta claim that they are not dependent on the source code for service?