LAS VEGAS — Ransomware attacks are escalating in scale and frequency. But one recent payout, a record $75 million by a victimized Fortune 50 company, trumped a surge in extortion attacks that are likely to only increase, according to a new report from Zscaler Inc.’s ThreatLabz research. “Stolen data and extortion is going up exponentially,”..
The post Ransomware Attack Fetched A Record $75 Million appeared first on Security Boulevard.
Authors/Presenters:Kevin Morio, Ilkan Esiyok, Dennis Jackson, Mozilla; Robert Künnemann
Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.
The post USENIX Security ’23 – Automated Security Analysis of Exposure Notification Systems appeared first on Security Boulevard.
The DOJ shut down another "laptop farm" link to a North Korean fake IT worker scam that the country uses to illegally bring in money for its nuclear and ballistic weapons program and to steal information from unsuspecting companies in the United States and elsewhere.
The post DOJ Shuts Down Another North Korean ‘Laptop Farm’ appeared first on Security Boulevard.
IntroductionOn August 5, 2024, researchers at SonicWall discovered a zero-day security flaw in Apache OFBiz tracked as CVE-2024-38856. The vulnerability, which has been assigned a CVSS score of 9.8, allows threat actors to perform pre-authentication remote code execution (RCE). While testing a patch for CVE-2024-36104, SonicWall researchers discovered that unauthenticated access was permitted to the ProgramExport endpoint, potentially enabling the execution of arbitrary code. These vulnerabilities arise from a flaw in the override view functionality, which can be exploited by unauthorized threat actors through maliciously crafted requests, leading to the remote code execution.
RecommendationsZscaler ThreatLabz strongly advises users of the Apache OFBiz application to promptly upgrade to version 18.12.15, as this version contains fixes to mitigate the security vulnerabilities identified in CVE-2024-38856 and CVE-2024-36104.
Affected VersionsThe following versions of Apache OFBiz are affected by the disclosed vulnerabilities and should be updated immediately:
All versions 18.12.13 and below are impacted by CVE-2024-36104
All versions 18.12.14 and below are impacted by CVE-2024-38856
BackgroundApache OFBiz is an open-source Enterprise Resource Planning (ERP) system that provides business solutions for various industries. This includes tools to manage operations like customer relationships, order processing, human resource functions, warehouse management, and more.
During the analysis of CVE-2024-36104, a vulnerability disclosed on June 3, 2024, SonicWall researchers discovered the ControlServlet and RequestHandler functions received different endpoints when handling the same request. Ideally, both functions should process the same endpoint. CVE-2024-38856 allows unauthenticated access to the ProgramExport endpoint, which should have been restricted.
How It WorksIn the previous vulnerability, CVE-2024-36104, Apache OFBiz was found to have a flaw that enabled remote attackers to access system directories due to inadequate validation of user requests. Exploiting this flaw involved sending a malformed URL containing '..' sequences, which could result in the execution of arbitrary code on the system.
An example of a malformed POST request and request-body is shown below.
POST /webtools/control/forgotPassword/;%2e%2e/ProgramExport
POST-Body: groovyProgram=throw new Exception('whoami'.execute().text);
In the figure below, the example malformed request is shown. This request includes a command 'whoami' that is being executed, and the resulting output of the command is displayed in the error message. The output of the command is highlighted in the green box.
Figure 1: An example of a POST request related to CVE-2024-36104. The request includes an encoded request body, along with its corresponding output.
The most recent vulnerability, CVE-2024-38856, permits unauthorized access to the ProgramExport endpoint without the need for a path traversal vector. This means that access is granted even when it should have been restricted.
The figure below shows an attack chain exploiting CVE-2024-38856.
Figure 2: The attack chain depicting an attacker exploiting CVE-2024-38856.
The figure below shows the malformed request, without a path traversal vector, being executed, and the resulting output of the command is displayed in the error message.
Figure 3: An example of a POST request related to CVE-2024-38856. The request includes an encoded request body, and the output associated with it.
Further investigation revealed that unauthenticated access to the ProgramExport endpoint was possible by combining it with any other endpoint that does not require authentication. Examples of such endpoints include:
forgotPassword
showDateTime
TestService
view
main
URLs that could be used to exploit this vulnerability are:
POST /webtools/control/forgotPassword/ProgramExport
POST /webtools/control/showDateTime/ProgramExport
POST /webtools/control/TestService/ProgramExport
POST /webtools/control/view/ProgramExport
POST /webtools/control/main/ProgramExport
ConclusionTo protect against CVE-2024-38856, it is important to update Apache OFBiz systems to version 18.12.15 as soon as possible. Neglecting to upgrade promptly exposes systems to significant security risks, which could enable threat actors to manipulate login parameters and execute arbitrary code on the target server.
Zscaler CoverageThe Zscaler ThreatLabz team has deployed the following.
Zscaler Advanced Threat Protection
App.Exploit.CVE-2024-38856
App.Exploit.CVE-2024-36104
Zscaler Private Access AppProtection
HTML.Exploit.CommandInjection:6000004
For more details, visit the Zscaler Threat Library.
The post CVE-2024-38856: Pre-Auth RCE Vulnerability in Apache OFBiz appeared first on Security Boulevard.
via the comic & dry wit of Randall Munroe, creator of XKCD
The post Randall Munroe’s XKCD ‘Vice President First Names’ appeared first on Security Boulevard.
Torrance, Calif., Aug. 12, 2024, CyberNewsWire — Criminal IP, an expanding Cyber Threat Intelligence (CTI) search engine from AI SPERA, has recently completed its technology integration with Maltego, a global all-in-one investigation platform that specializes in visualized analysis … (more…)
The post News alert: Criminal IP and Maltego team up to broaden threat intelligence data search first appeared on The Last Watchdog.
The post News alert: Criminal IP and Maltego team up to broaden threat intelligence data search appeared first on Security Boulevard.
In today’s rapidly evolving digital landscape, ensuring the security of web applications is essential to ensure revenue growth and a positive business reputation. One critical aspect of this security is the management of SSL/TLS certificates. The AppViewX AVX ONE platform is a comprehensive solution designed to automate and streamline the end-to-end lifecycle of digital certificates […]
The post AppViewX Automated Certificate Management for PingAccess appeared first on Security Boulevard.
Authors/Presenters:Feng Dong, Liu Wang Xu Nie, Fei Shao, Haoyu Wang, Ding Li, Xiapu Luo, Xusheng Xiao
Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.
The post USENIX Security ’23 – DISTDET: A Cost-Effective Distributed Cyber Threat Detection System appeared first on Security Boulevard.
Threat Intelligence Report
Date: August 12, 2024
Prepared by: David Brunsdon, Threat Intelligence - Security Engineer, HYAS
Threat Actors Exploiting Legitimate Services to Disguise Traffic
Recently, the HYAS Threat Intelligence team has noticed an increase in malware communicating with subdomains under the ply.gg domain. The domain is a part of Playit.gg’s infrastructure, which is a service for computer gamers used to facilitate online play. Although intended for games like Minecraft, it provides a free domain name and a reverse proxy, which is a tool a threat actor can use to hide their malicious infrastructure.
This article demonstrates how threat actors will use legitimate services to disguise their traffic and hide their true location from investigators. It also draws attention to the ply.gg domain as a potential threat vector for malware-based attacks on organizations and individuals.
About Reverse ProxiesA reverse proxy is a server that sits between client devices and a server, intercepting requests from clients and forwarding them to the intended server. It functions as an intermediary that enhances the performance, security, and reliability of services.
Typical Uses of Reverse Proxies1. Load Balancing:
2. Enhanced Security:
3. SSL Termination:
4. Web Acceleration:
5. Content Filtering:
6. Compression:
While reverse proxies serve many legitimate purposes, they can also be exploited by threat actors to conceal malicious activities. Cybercriminals use reverse proxies to:
By leveraging services like Playit.gg, threat actors can blend their traffic with legitimate gaming traffic, complicating efforts to detect and block malicious communications. Recognizing and understanding the use of reverse proxies is crucial for enhancing cybersecurity measures and thwarting such threats.
How Threat Actors Could Utilize Playit.ggThreat actors could exploit the Playit.gg service to hide their malicious infrastructure and facilitate Command and Control (C2) operations. Here's a step-by-step breakdown of how this can be achieved:
1. Account Creation and Verification:
2. Download and Setup:
3. Establishing and Hardening the C2 Server:
4. Configuring the Malware:
5. Routing Malware Communications:
By leveraging Playit.gg, threat actors can seamlessly integrate their C2 infrastructure within legitimate gaming traffic. This not only obfuscates their activities but also complicates detection efforts by cybersecurity professionals, as the traffic appears to come from a well-known and trusted service.
(Image: Warning during configuration of playit.gg service)
Playit.gg clearly recognizes the potential for misuse on the platform and expressly forbids it from being used in such a way.
Recommendations1. Restrict Access to the ply.gg Domain:
Organizations should consider blocking access to the ply.gg domain at the network level. This can be achieved through protective DNS solutions, or firewall rules to prevent potential malware communications from reaching their command-and-control (C2) servers.
2. Monitor Network Traffic for Anomalies:
Regularly monitor network traffic for any unusual or unauthorized connections to the ply.gg domain. Implementing advanced threat detection systems can help identify and alert on suspicious traffic patterns associated with C2 communication.
3. Implement Threat Intelligence Feeds:
Incorporate threat intelligence feeds that include indicators of compromise (IoCs) related to ply.gg and other similar domains. This can help in detecting and blocking known malicious activities associated with these services.
4. Educate Employees on Potential Threats:
Raise awareness among employees about the risks of accessing unauthorized or suspicious domains, including those related to gaming services like Playit.gg. Training should focus on recognizing phishing attempts and avoiding the installation of unauthorized software.
5. Enhance Endpoint Security:
Ensure that endpoint protection solutions are up-to-date and capable of detecting and blocking malware that may attempt to use ply.gg for C2 communication. Advanced endpoint detection and response (EDR) solutions can provide additional layers of protection.
6. Engage in Regular Security Audits:
Conduct regular security audits and vulnerability assessments to identify any weaknesses in your network that could be exploited by threat actors using reverse proxies like those provided by Playit.gg.
7. Collaborate with Threat Intelligence Providers:
Work closely with threat intelligence providers like HYAS, to stay informed about emerging threats and to receive timely updates on domains and services being exploited by cybercriminals.
By implementing these measures, organizations can significantly reduce the risk of malware using the ply.gg domain as a vector for attacks, thereby enhancing their overall cybersecurity posture.
Recent Example IOCsDomain: ads-jeremy.gl.at.ply[.]gg
MD5: 36a75d896d48d43a54a8792fd92f3912
Family: asyncrat
Domain: paris-itself.gl.at.ply[.]gg
MD5: 9b2b8770c462d91bcf4d915cbea54202
Family: asyncrat
Domain: tax-sri.gl.at.ply[.]gg
MD5: b0198f2d25536cb8efb928857f696c1b
Family: nanocore
Domain: dead-he.gl.at.ply[.]gg
MD5:ad0314c9588f196a9a752b6732cf9612
Family: xworm
Domain: western-requires.gl.at.ply[.]gg
MD5:553326c1417f4220586311bae847d37b
Family: xworm
Domain: to-reconstruction.gl.at.ply[.]gg
MD5: ca312e982c9e4e5664ef45e8cb2be9cf
Family: xworm
Disclaimer: This Threat Intelligence Report is provided “as is” and for informational purposes only. HYAS disclaims all warranties, express or implied, regarding the report’s completeness, accuracy, or reliability. You are solely responsible for exercising your own due diligence when accessing and using this Report's information. The analyses expressed in this Report reflect our current understanding of available information based on our independent research using the HYAS Insight platform. The Report’s inclusion of any companies, organizations, or ASNs does not imply any wrongdoing on their part; it is simply an indication of where digital threat activities have been observed. HYAS reserves the right to update the Report as additional information is made known to us.
Learn More About HYAS InsightAn efficient and expedient investigation is the best way to protect your enterprise. HYAS Insight provides threat and fraud response teams with unparalleled visibility into everything you need to know about the attack.This includes the origin, current infrastructure being used and any infrastructure.
Read how the HYAS Threat Intelligence team uncovered and mitigated a Russian-based cyber attack targeting financial organizations worldwide.
Want more threat intel on a weekly basis?
Follow HYAS on LinkedIn
Follow HYAS on X
Sign up for the (free!) HYAS Insight Intel Feed
Read Recent HYAS Threat Reports:The Prevalence of DarkComet In Dynamic DNS
Caught in the Act: StealC, the Cyber Thief in C
HYAS Protects Against Polyfill.io Supply Chain Attack with DNS Safeguards
StealC & Vidar Malware Campaign Identified
Polymorphic Malware Is No Longer Theoretical: BlackMamba PoC.
Polymporphic, Intelligent and Fully Autonomous Malware: EyeSpy PoC.
The post HYAS Investigates Threat Actors Hidden In Gaming Services appeared first on Security Boulevard.
Get the essential checklist for POPIA compliance. Learn key requirements and steps to meet South Africa's data protection law.
The post How to Achieve POPIA Compliance: Complete Checklist appeared first on Scytale.
The post How to Achieve POPIA Compliance: Complete Checklist appeared first on Security Boulevard.
The Trump campaign is claiming a hack is the work of Iranian operatives, adding to expanding election-interference campaigns that also include China and Russia, which the federal government calls the "predominant threat to U.S. elections."
The post Trump Campaign Hack Points to Growing U.S. Election Threats appeared first on Security Boulevard.
Identifying and addressing underlying issues and their root causes can lead to risk reduction, cost savings and better overall performance of a vulnerability management program.
The post The Value in Root Cause Analysis for Vulnerability Management appeared first on Security Boulevard.
Torrance, United States / California, 12th August 2024, CyberNewsWire
The post Criminal IP and Maltego Collaborate to Broaden Threat Intelligence Data Search appeared first on Security Boulevard.
A global survey of 300 IT and security professionals suggests that while security budgets are increasing the way funding is being allocated is shifting as organizations look to automate workflows.
The post Survey: Cybersecurity Teams Investing in Automation to Reduce Noise Levels appeared first on Security Boulevard.
Chief information security officers (CISOs) are struggling to manage cybersecurity effectively due to a lack of strategic support from other C-suite executives, according to a LevelBlue survey of 1,050 C-suite and senior executives.
The post AI Integration, Budget Pressures Challenge CISOs appeared first on Security Boulevard.
In today’s digital world, data exfiltration is a stealthy threat that often flies under the radar.
The post How Outdated Security Measures Can Devastate Your Organization appeared first on Seceon.
The post How Outdated Security Measures Can Devastate Your Organization appeared first on Security Boulevard.
Apache Tomcat is a widely used open-source web server and servlet container, but like any software, it is not immune to vulnerabilities. Canonical has released security updates to address multiple Tomcat vulnerabilities across different releases, including Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 ESM, and Ubuntu 16.04 ESM. These vulnerabilities, if exploited could lead […]
The post Addressing Tomcat Vulnerabilities in End-of-Life Ubuntu Systems appeared first on TuxCare.
The post Addressing Tomcat Vulnerabilities in End-of-Life Ubuntu Systems appeared first on Security Boulevard.
I recently wrote about reliable software. I also usually write about cybersecurity and major incidents. Today’s story intertwines both, in a situation so far reaching that, if you tried to write it as the script of the next Bond movie with a villain scheming to cause worldwide chaos, it would fit perfectly. Let’s look at […]
The post Crowdstrike, or “How to Own the Planet” appeared first on TuxCare.
The post Crowdstrike, or “How to Own the Planet” appeared first on Security Boulevard.
LAS VEGAS – Here’s what I discovered last week here at Black Hat USA 2024: GenAI is very much in the mix as a potent X-factor in cybersecurity.
Related: Prioritizing digital resiliency
I spoke with over three dozen cybersecurity … (more…)
The post MY TAKE: Black Hat USA 2024’s big takeaway – GenAI factors into the quest for digital resiliency first appeared on The Last Watchdog.
The post MY TAKE: Black Hat USA 2024’s big takeaway – GenAI factors into the quest for digital resiliency appeared first on Security Boulevard.
Authors/Presenters:Yisroel Mirsky, George Macon, Michael Brown, Carter Yagemann, Matthew Pruett, Evan Downing, Sukarno Mertoguno, Wenke Lee
Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.
The post USENIX Security ’23 – VulChecker: Graph-based Vulnerability Localization in Source Code appeared first on Security Boulevard.
