Security Boulevard

In today’s digital classroom, connectivity is key—but it comes with challenges. As technology becomes an integral part of teaching and learning, K-12 schools face the responsibility of supporting classroom technology while safeguarding sensitive student and staff data. The shift to cloud-based tools like Google Workspace and Microsoft 365 has opened up new possibilities for collaboration, ...

The post Discover the Benefits of Cloud Monitor’s Advanced Cloud Security appeared first on ManagedMethods Cybersecurity, Safety & Compliance for K-12.

The post Discover the Benefits of Cloud Monitor’s Advanced Cloud Security appeared first on Security Boulevard.

Authors/Presenters: Rob Joyce, The Dark Tangent

Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 32 – Changing Global Threat Landscape appeared first on Security Boulevard.

Auguria today at the Black Hat Europe conference, in addition to providing five additional integrations with other platforms, revealed it has added an explainability graph capability that makes it simple to understand why log data collected is either irrelevant or warrants further investigation.

The post Auguria Streamlines Management of Security Log Data appeared first on Security Boulevard.

1. 16Critical
2. 54Important
3. 0Moderate
4. 0Low

Microsoft addresses 70 CVEs with 16 rated critical, including one zero-day that was exploited in the wild.

Microsoft patched 70 CVEs in its December 2024 Patch Tuesday release, with 16 rated critical, and 54 rated as important.

This month’s update includes patches for:

• GitHub
• Microsoft Defender for Endpoint
• Microsoft Office
• Microsoft Office Access
• Microsoft Office Excel
• Microsoft Office Publisher
• Microsoft Office SharePoint
• Microsoft Office Word
• Remote Desktop Client
• Role: DNS Server
• Role: Windows Hyper-V
• System Center Operations Manager
• Windows Cloud Files Mini Filter Driver
• Windows Common Log File System Driver
• Windows File Explorer
• Windows IP Routing Management Snapin
• Windows Kernel
• Windows Kernel-Mode Drivers
• Windows LDAP - Lightweight Directory Access Protocol
• Windows Local Security Authority Subsystem Service (LSASS)
• Windows Message Queuing
• Windows Mobile Broadband
• Windows PrintWorkflowUserSvc
• Windows Remote Desktop
• Windows Remote Desktop Services
• Windows Resilient File System (ReFS)
• Windows Routing and Remote Access Service (RRAS)
• Windows Task Scheduler
• Windows Virtualization-Based Security (VBS) Enclave
• Windows Wireless Wide Area Network Service
• WmsRepair Service

Remote code execution (RCE) vulnerabilities accounted for 42.9% of the vulnerabilities patched this month, followed by elevation of privilege (EoP) vulnerabilities at 38.6%.

Important CVE-2024-49138 | Windows Common Log File System Driver Elevation of Privilege Vulnerability

CVE-2024-49138 is an EoP vulnerability in the Windows Common Log File System (CLFS) Driver. It was assigned a CVSSv3 score of 7.8 and is rated as important. It was exploited in the wild as a zero-day, though no details about the in-the-wild exploitation were known at the time this blog post was published.

In addition to CVE-2024-49138, Microsoft patched two other CLFS driver EoP vulnerabilities: CVE-2024-49090, CVE-2024-49088, both assigned a CVSSv3 score of 7.8, were rated as important and assessed as “Exploitation More Likely” according to Microsoft’s Exploitability Index.

This is the ninth vulnerability in the Windows CLFS driver patched in 2024, and the first that was exploited in the wild as a zero-day this year. In 2023, there were 10 CLFS vulnerabilities patched, including two zero-day vulnerabilities in the CLFS driver that were exploited (CVE-2023-28252, CVE-2023-23376). CLFS driver vulnerabilities have been a popular attack vector and exploited in the wild by ransomware operators in the last few years according to researchers.

Important CVE-2024-49070 | Microsoft SharePoint Remote Code Execution Vulnerability

CVE-2024-49070 is a RCE vulnerability in Microsoft SharePoint. It was assigned a CVSSv3 score of 7.4 and is rated as important. Microsoft’s advisory notes that complexity is high and successful exploitation requires the attacker to first prepare the target in order to improve reliability of an exploit. While no details have been provided, Microsoft assessed this vulnerability as “Exploitation More Likely.”

In addition to CVE-2024-49070, Microsoft patched two information disclosure vulnerabilities (CVE-2024-49062, CVE-2024-49064) and an EoP vulnerability (CVE-2024-49068) in Microsoft SharePoint.

Critical CVE-2024-49118, CVE-2024-49122 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

CVE-2024-49118 and CVE-2024-49122 are RCE vulnerabilities in Microsoft Message Queuing (MSMQ). Both were assigned a CVSSv3 score of 8.1 and are rated as critical. According to both of the Microsoft advisories, successful exploitation requires an attacker winning a race condition. Despite this requirement, Microsoft assessed CVE-2024-49122 as “Exploitation More Likely” while CVE-2024-49118 was assessed as “Exploitation Less Likely” as the winning the race condition must occur “during the execution of a specific operation that recurs in a low frequency on the target system.”

In order for a system to be vulnerable, the MSMQ service must be added and enabled. According to Microsoft, if the service is enabled on a Windows installation, a service named “Message Queueing” will be running on TCP port 1801. Tenable customers can use Plugin ID 174933 to identify systems that have this service running.

CVE-2024-49118 and CVE-2024-49122 brings the total to six RCE’s affecting MSMQ that were patched in 2024. One was addressed in the June Patch Tuesday (CVE-2024-30080) release, two addressed in the April Patch Tuesday (CVE-2024-26232, CVE-2024-26208) release and one in February's Patch Tuesday (CVE-2024-21363) release.

Critical CVE-2024-49106, CVE-2024-49108, CVE-2024-49115, CVE-2024-49116, CVE-2024-49119, CVE-2024-49120, CVE-2024-49123, CVE-2024-49128 and CVE-2024-49132 | Windows Remote Desktop Services Remote Code Execution Vulnerability

CVE-2024-49106, CVE-2024-49108, CVE-2024-49115, CVE-2024-49116, CVE-2024-49119, CVE-2024-49120, CVE-2024-49123, CVE-2024-49128 and CVE-2024-49132 are RCE vulnerabilities affecting Windows Remote Desktop Services. All nine of these vulnerabilities were rated as critical and received CVSSv3 scores of 8.1. Successful exploitation is complex and requires an attacker to trigger a race condition in order to “create a use-after-free scenario” which could lead to arbitrary code execution. With a high complexity for exploitation, Microsoft assessed these vulnerabilities as “Exploitation Less Likely.”

In addition to these nine RCE’s, Microsoft addressed CVE-2024-49075, a DoS vulnerability affecting Remote Desktop Services.

Tenable Solutions

A list of all the plugins released for Microsoft’s December 2024 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.

For more specific guidance on best practices for vulnerability assessments, please refer to our blog post on How to Perform Efficient Vulnerability Assessments with Tenable.

Get more information

• Microsoft's December 2024 Security Updates
• Tenable plugins for Microsoft December 2024 Patch Tuesday Security Updates

Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.

The post Microsoft’s December 2024 Patch Tuesday Addresses 70 CVEs (CVE-2024-49138) appeared first on Security Boulevard.

via the respected Software Engineering expertise of Mikkel Noe-Nygaard and the lauded Software Engineering / Enterprise Agile Coaching work of Luxshan Ratnaravi at Comic Agilé!

The post Comic Agilé – Mikkel Noe-Nygaard, Luxshan Ratnaravi – #315 – Stickies appeared first on Security Boulevard.

GitGuardian today extended the reach of its ability to manage applications secrets into the realm of non-human identities (NHI) associated with machines and software components.

The post GitGuardian Extends Reach to Manage Non-Human Identities appeared first on Security Boulevard.

Microsoft is calling out to researchers to participate in a competition that is aimed at testing the latest protections in LLMs against prompt injection attacks, which OWASP is calling the top security risk facing the AI models as the industry rolls into 2025.

The post Microsoft Challenge Will Test LLM Defenses Against Prompt Injections appeared first on Security Boulevard.

ASU 48-bit trash hash: Open source router firmware project fixes dusty old code.

The post Critical OpenWrt Bug: Update Your Gear! appeared first on Security Boulevard.

Author: Lance B. Cain

Overview

Microsoft Azure is a leading cloud provider offering technology solutions to companies, governments, and other organizations around the globe. As such, many entitles have begun adopting Azure for their technology needs to include identity, authentication, storage, application management, and web services. One of the most common methods for organizations to begin experimenting with and adopting Azure is by deploying web applications and an increasingly popular method for creating web applications is by designing Single-Page Applications (SPAs). Katie Lawson of bloomreach.com defines SPAs as, “a website or web application that dynamically rewrites a current web page with new data from the web server, instead of the default method of a web browser loading entire new pages”. SPAs typically utilize JavaScript integrations with API calls to dynamically update for a seamless user experience. Microsoft has multiple walkthroughs, guides, and documentation to aid organizations in deploying SPAs on Azure:

• Single-page application (SPA) documentation — https://learn.microsoft.com/en-us/entra/identity-platform/index-spa
• Single-page application: App registration — https://learn.microsoft.com/en-us/entra/identity-platform/scenario-spa-app-registration
• Configure authentication in a sample single-page application by using Azure AD B2C — https://learn.microsoft.com/en-us/azure/active-directory-b2c/configure-authentication-sample-spa-app

As a result, there are many new publicly hosted SPAs that communicate with Azure backend resources.

This blog post is intended to share insights learned from a prior security assessment about the attack surface of Single-Page Applications integrated with Azure, aid technology professionals in securing their Azure environments, and serve as a guide for enumerating Azure tenants using the additions of the pull request I submitted to Dirk-Jan’s ROADTools repository. This blog is not a comprehensive analysis of every SPA hosted on Azure, so your mileage may vary. Due to the widespread adoption of Microsoft’s Office products and web integrations for Azure, I will focus on two popular SPAs that Microsoft offers (i.e., WWW.OFFICE.COM and PORTAL.AZURE.COM); however, the workflow translates to many other SPAs as well.

A Brief Origin Story

My team and I were working on a collaborative cloud assessment for one of our clients targeting their Azure tenant. We were tasked with identifying methods of escalating privileges, assisting defenders in improving detections, and documenting attack paths in the client Azure environment using a compromised non-privileged user account on a Windows Virtual Desktop Image (VDI). We began by enumerating the available applications, Azure resources, Microsoft technologies, and client subscriptions. During the assessment, we learned that the client Azure environment was hardened with enforced multi-factor authentication (MFA), allow-listed MFA conditional access policies (CAPs), administrator restrictions on internal and external application enrollments, administrator approval for external invitations, continuous access evaluation, blocked access to Entra ID in the Azure portal, browser extension host security checks, blocked command-line interface (CLI) and PowerShell access, and time limitations on issued tokens forcing expiration after one hour.

The defensive configurations in the client environment impeded our work obtaining access and refresh tokens to enumerate the target tenant. The team began looking at the resources our user account had access to. We had successfully authenticated as the non-privileged user to the Azure portal and administrator pre-approved Microsoft Office web applications like Excel or Word on HTTPS://WWW.MICROSOFT365.COM. Within the Azure portal, we discovered that the user account had access to the Azure cloud shell which the team used to obtain an access token using the built-in PowerShell cmdlet Get-AzAccessToken and initiate some cursory enumeration.

Pro-Tip: If the cloud shell is available, it is possible to install pip Python modules, including ROADTools, in the Bash shell.

Figure 1 — Installing ROADTools in the Azure Cloud Shell

The team started collections to enumerate the client tenant using ROADTools and AzureHound with our initial access token; however, an hour later, we discovered that the tools had failed when the acquired token expired prior to completing their tasks. With the knowledge that the client tenant was so large that automated enumeration would exceed the one-hour lifetime for access tokens, we began looking into methods to update the access token for collections. After some research, we learned one of the likely intentional limitations of Get-AzAccessTokens for the Azure cloud shell that it would obtain access tokens, but it would not return a refresh token. My teammates started working on methods to script out obtaining a new access token in the cloud console, meanwhile I began looking at the access we had to authorized Microsoft web applications.

While investigating the Azure portal, I remembered something that Andy Robbins mentioned at SpecterOps’ Azure Security Fundamentals training; specifically, that the Azure portal was essentially a web application frontend which communicates with the Azure Graph APIs. Thinking about the ROADTools implemented authentication flow to obtain tokens with a Selenium browser; despite not being an option during the assessment due to the required extensions, I opened the inspector panel in the VDI client Google Chrome web browser to look for any type of token exchanges that occurred during authentication. While reviewing the network traffic in the inspector panel, I observed some requests named “token”. I discovered when filtering and inspecting traffic for the term “token” that there were multiple access and refresh tokens contained in the request payloads for resources like MANAGEMENT.CORE.WINDOWS.NET, GRAPH.MICROSOFT.COM, and most interesting GRAPH.MICROSOFT.NET. The access tokens for the client environment still had the one-hour expiration limit, but the refresh tokens were valid for up to four hours. I also discovered that upon selecting the payload tab the client-id used for the request was also captured.

Figure 2— Access and Refresh Tokens in SPA Network Traffic

Excited to have obtained a refresh token for our client environment, I attempted authentication over a proxied connection to the VDI with ROADTools using the refresh token, which resulted in the below error response from Azure regarding cross-origin requests.

Figure 3— Cross-Origin Error Response

I began researching the error message and quickly stumbled upon this Stack Overflow post where one of CajunCoding’s comments referenced a Microsoft page stating, “Microsoft identity platform returns an error if you attempt to use a spa redirect URI without an Origin header.”

Upon reviewing the Microsoft documentation, I spent the next hour issuing multiple web API requests to HTTPS://LOGIN.MICROSOFTONLINE.COM/{TENANT}/OAUTH2/V2.0/AUTHORIZE using Burp Suite and curl commands with varying origin HTTP headers. An access token was eventually returned for the supplied refresh token when entering the originating application URL in the request origin header. Upon successfully obtaining a new access token by hand, I updated my local instance of ROADTools to accommodate supplying an origin value when performing authentication with refresh tokens, which resulted in the addition of the origin parameter. Afterwards, my team and I successfully enumerated the client tenant using the available SPA refresh tokens and continued with the assessment. Our client was pleased to learn about the attack path where users with granted access to SPAs like the Azure Portal and Microsoft Online Office Applications could potentially obtain new tokens to enumerate their Azure tenant.

SPA Token Enumeration Workflow

Now with the origin argument added to the latest version of ROADTools, the most basic process of using SPA tokens to enumerate an Azure tenant is:

1. On an Azure client workstation, open the inspector panel in a web browser and filter network traffic for “tokens”
2. Authenticate to a SPA or re-open an existing browser session to an authenticated SPA

Note: Take notice of the origin URL

3. View exchanged tokens to obtain the refresh token contained in one of the MICROSOFT.NET, MICROSOFT.COM, or other Microsoft integrated resource token requests

Pro-Tip: For small tenants or tenants without short token expirations, access tokens for GRAPH.MICROSOFT.NET can be used from the browser instead of refresh tokens.

Pro-Tip: Some resource tokens have been found to provide only partial collections and will generate HTTP 403 errors like MANAGEMENT.CORE.WINDOWS.NET as demonstrated in the examples. I recommend targeting GRAPH.WINDOWS.NET or SharePoint resource tokens which have yielded the best results

4. Take note of the application client-id used to request tokens

Pro-Tip: For first-party Microsoft Azure applications like HTTPS://PORTAL.AZURE.COM, bookmark this page to quickly lookup the client-id: https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/governance/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications

5. Authenticate to the Microsoft graph API by supplying all the captured values to ROADTools

roadrecon auth -c <Client-ID> --origin <SPA Base URL> --refresh-token <Browser Refresh Token>

Pro-Tip: If Azure continuous access evaluation is enforced, execute the ROADTools authentication from the original workstation or SOCKs proxy the request through the workstation.

6. Execute your collection

roadrecon gather

7. Review the information

roadrecon gui Azure Portal Example — Partial Collection with MANAGEMENT.CORE.WINDOWS.NET Token

1. Inspect

Figure 4— Web Inspection and Network Filtering

2. Authenticate

Figure 5— Azure Portal Authentication to Testing Tenant

3. Obtain Tokens

Figure 6— Access and Refresh Tokens for MANAGEMENT.CORE.WINDOWS.NET

4. Note Client ID

Figure 7— Client ID in Request Payload

5. Authenticate with ROADRecon

Figure 8— Successful Authentication with Refresh Token

6. Gather — 403 Errors = Partial Collection

Figure 9— Gather with HTTP 403 Errors

7. Review — roadrecon gui and browse to HTTP://127.0.0.1:5000

Figure 10— Partial Data Collection Office 365 Example — Full Collection with SharePoint Token

1. Inspect

Figure 11— Web Inspection and Network Filtering

2. Authenticate

Figure 12— Office 365 Authentication for Testing Account

3. Obtain Tokens

Figure 13— Access and Refresh Tokens for SPECTERDEV.SHAREPOINT.COM

4. Note Client ID

Figure 14— Client ID in Request Payload

5. Authenticate with ROADRecon

Figure 15— Successful Authentication with Refresh Token

6. Gather

Figure 16— Successful Tenant Enumeration

7. Review — roadrecon gui and browse to HTTP://127.0.0.1:5000

Figure 17 — Full Data Collection About

Lance Cain is a Senior Consultant in Adversary Simulation at SpecterOps Inc. He has over eight years of experience in information technology with six of those focused on Red Teaming and Penetration Testing. Lance formerly served as the Engineering Cell Lead of the Marine Corps’ Red Team tasked with payload and command and control (C2) channel development. He now performs a variety of security assessments for SpecterOps clients and specializes in cloud and macOS technologies.

SPA is for Single-Page Abuse! - Using Single-Page Application Tokens to Enumerate Azure was originally published in Posts By SpecterOps Team Members on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post SPA is for Single-Page Abuse! – Using Single-Page Application Tokens to Enumerate Azure appeared first on Security Boulevard.

Authors/Presenters: Anne Neuberger

Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

The post DEF CON 32 – Fireside Chat – The Dark Tangent and DNSA appeared first on Security Boulevard.

CORS misconfigurations are often overlooked, but they can have severe consequences. We demonstrate how reflecting the origin header leads to code execution in Whistle.

The post Never Underestimate CSRF: Why Origin Reflection is a Bad Idea appeared first on Security Boulevard.

4 min readAI workloads operate at machine speed – but their identities risk being exploited, turning innovation into vulnerability.

The post How to Secure Non-Human Identities for AI Workloads appeared first on Aembit.

The post How to Secure Non-Human Identities for AI Workloads appeared first on Security Boulevard.

For too long, architecting for cyber recovery and resiliency was on the vision board for a distant future. Unfortunately, that “distant future” is here, but many companies have not started this critical effort.

The post Given Today’s Data Complexity, a Platform Mindset is Crucial for Cyber Recovery appeared first on Security Boulevard.

Although AI can enhance threat detection and response capabilities, it also introduces sophisticated attack vectors that require a rethink of traditional security models.

The post Defending Against AI-Powered Attacks in a “Spy vs. Spy” World appeared first on Security Boulevard.

Cybersecurity companies — traditionally considered pioneers of data innovation — are often the ones struggling to unlock the full potential of the data they collect within their own organizations.

The post Cybersecurity Companies Must Practice What They Preach to Avoid the Data Paradox appeared first on Security Boulevard.

After years of quiet growth, the electric vehicle (EV) market has kicked into high gear, powered by sustainability trends, technology advances and increased consumer enthusiasm. Earlier this year, a team from Cornell created a new lithium battery that can charge in under five minutes, while maintaining stable performance over extended cycles of charging and discharging...

The post Balancing Security and Convenience With EV Charging appeared first on Security Boulevard.

The rise in android users has transformed how individuals and businesses access financial services, offering convenience and speed like never before. However, this rapid digitalization has also made these platforms a prime target for hackers. SpyLoan malware is a threat specifically engineered to exploit vulnerabilities in digital lending ecosystems. By stealing sensitive customer data, manipulating […]

The post SpyLoan Malware: A Growing Threat to Android Users appeared first on Kratikal Blogs.

The post SpyLoan Malware: A Growing Threat to Android Users appeared first on Security Boulevard.

Simplify DNS management with PowerDMARC's One-Click Auto DNS Publishing powered by Entri. Publish DNS records like DMARC, SPF, DKIM, and more in just one click.

The post PowerDMARC One-Click Auto DNS Publishing with Entri appeared first on Security Boulevard.

What is OSCAL? OSCAL provides a traceable and machine-readable data format for capturing and sharing security information. A standardized, continuous representation of an organization’s security controls helps prove compliance with NIST’s risk management framework for mandated federal agencies. FedRAMP joined with NIST to create the Open Security Controls Assessment Language (OSCAL), a standard that can […]

The post Leveraging NIST OSCAL to Provide Compliance Automation: The Complete Guide appeared first on Centraleyes.

The post Leveraging NIST OSCAL to Provide Compliance Automation: The Complete Guide appeared first on Security Boulevard.

In Q4 of 2024, NSFOCUS observed and successfully mitigated the largest DDoS attack ever recorded under the cloud-based DDoS Protection Service (DPS). This massive DDoS attack targeted a telecommunications service provider, one of NSFOCUS’s global clients. The telecommunications industry frequently faces such cyber threats. However, the scale of this attack was unprecedented, with peak traffic […]

The post NSFOCUS DDoS Protection Service Neutralized a Terabit-Scale DDoS Attack appeared first on NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks..

The post NSFOCUS DDoS Protection Service Neutralized a Terabit-Scale DDoS Attack appeared first on Security Boulevard.