VMWARE ESXi,Workstation and Fusion out-of-bounds read vulnerability in SVGA device – 16thOct2018

Malware authors constantly seek new methods to obfuscate their code so as to evade detection by virus scanners. Have you heard shader code?
In order to avoid the vulnerability occurs, VMware Releases Security Updates on October 16, 2018.
ESXi has an out-of-bounds read vulnerability in the SVGA device that might allow a guest to execute code on the host (CVE-2018-6974).
The side effect of the Out-of-bounds read is serious. It allocates uninitialized Buffers when number is passed in input. An attacker could exploit this vulnerability to take control of an affected system.
Official announcement is shown as below:

https://www.vmware.com/security/advisories/VMSA-2018-0026.html

Buzz Lightyear slogan – To Infinity… and Beyond!

TIBCO Spotfire Statistics Services remote execution vulnerabilities – Oct 2018

Theoretically, big data analytics is the often complex process of examining large and varied data sets to uncover information including hidden patterns and unknown correlation. Basically it can help organizations make informed business decisions. Since you can use the URL API to send administration, expression, or function requests to the TIBCO web server. Use the URL API for testing the health of the server, rather than for creating web-based applications.

As a result, without needing to authenticate, an attacker may be able to remotely execute code with the permissions of the system account used to run the web server component. Meanwhile the web server component ( Spotfire Statistics Services) hits multiple vulnerabilities that may allow the remote execution of code. In order to maintain your operation without any interruption. It is suggest to follow the vendor advisory to do the remediation. Below URL for your reference.

https://www.tibco.com/support/advisories/2018/10/tibco-security-advisory-october-10-2018-tibco-spotfire-statistics

Reflections – New 5G network edge server design

NSA Senior Cybersecurity Advisor questions Bloomberg Businessweek’s China iCloud spy chip claim (see below url)

http://macdailynews.com/2018/10/10/nsa-senior-cybersecurity-advisor-questions-bloomberg-businessweeks-china-icloud-spy-chip-claim/

Now we take a quick discussion but do not related to conspiracy. From technical point of view, if hardware is polluted (spy feature). It is hard to imagine what the impact was?

In the SD-branch, routing, firewall, and WAN optimization are provided as virtual functions in a cloud-like NaaS model, replacing expensive hardware. As a result, the telephone company will use SD-branch to provide virtual CPE and unversal CPE services.

Meanwhile uCPE consists of software virtual network functions (VNFs) running on a standard operating system hosted on an open server. So uCPE in reposible of very import role in future technology. What if there is vulnerability occurs in this place. It make the problem worst, complicated!

Supermicro Designs New Open Software-Defined Networking (SDN) Platform Optimized for 5G and Telco Applications and Launches verified Intel® Select Solution for uCPE

http://ir.supermicro.com/news-releases/news-release-details/supermicro-designs-new-open-software-defined-networking-sdn

Advisory on PHP Vulnerabilities – 12th Oct 2018

The Multi-State Information Sharing & Analysis Center (MS-ISAC) has released an advisory on multiple Hypertext Preprocessor (PHP) vulnerabilities today (refer below url):

https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-php-could-allow-for-arbitrary-code-execution_2018-113/

Perhaps PHP program version will make you frustrated. Why? The vulnerabilities addressed by MS-ISAC only for Version 7.2.11 & Version 7.1.23. However there is another fix coming soon (see below):

PHP 7.1.24

Core:

Fixed bug #76946 (Cyclic reference in generator not detected)

Date: unknown

Fixed bug #75851 (Year component overflow with date formats “c”, “o”, “r” and “y”). (Adam Saponara)

FCGI:

Fixed bug #76948 (Failed shutdown/reboot or end session in Windows).

(Anatol)

Fixed bug #76954 (apache_response_headers removes last character from header

name). (stodorovic)

FTP:

. Fixed bug #76972 (Data truncation due to forceful ssl socket shutdown).

(Manuel Mausz)

intl:

. Fixed bug #76942 (U_ARGUMENT_TYPE_MISMATCH). (anthrax at unixuser dot org)

Standard:

. Fixed bug #76965 (INI_SCANNER_RAW doesn’t strip trailing whitespace).

(Pierrick)

XML:

. Fixed bug #30875 (xml_parse_into_struct() does not resolve entities).

Should you have interested, please review above diagram. PHP look likes a game.

Five publicly available tools, which have been used for malicious purposes – Oct 2018

US-Cert urge that there are total five publicly available tools, which have been used for malicious purposes in recent cyber incidents around the world (see below):

Remote Access Trojan: JBiFrost
Webshell: China Chopper
Credential Stealer: Mimikatz
Lateral Movement Framework: PowerShell Empire
C2 Obfuscation and Exfiltration: HUC Packet Transmitter

RSA found a malware in 2017 and explore remote access Trojan (RAT) feature with advanced invisible feature.

In this short discussion, I am going to focus the RAT (JBiFrost). Adzok is famous in dark web.

We seen malware exploits the Java archives.

A JAR (Java archive) is a package file format. It can be used as Java library or as standalone application. He is easy to change the shape to evade the detection.

Adzok proviced free download version. Some antivirus vendor already has defensive to avoid the infiltration.

Friendly reminder that still have some vendor do not have this malware signature.

Auto-Maskin DCU 210E RP 210E and Marine Pro Observer App design limitation – Oct 2018

Sometimes, vulnerabilities open to public but the response of vendor not as expected efficiency. Still remember that a announcement issued by US Cert on 6th Oct 2018. The details shown that the electronic manufacture product by Auto-Maskin has encountered four different vulnerabilities. Perhaps the remediation not release from manufacture in the moment because the firmware image store in the download repository is not recently.

Should you have interest in above topic? Below details are the vendor homepage and vulnerability notes articles for your reference.

Vulnerability Notes – Auto-Maskin DCU 210E RP 210E and Marine Pro Observer App  https://www.kb.cert.org/vuls/id/176301

Vendor Home page https://www.auto-maskin.com/news

 

 

Juniper Networks Releases Security Update – 10th Oct 2018

Junos OS is the FreeBSD-based operating system used in Juniper Networks routing, switching and security devices. Starting in Junos OS Release 16.1, It did not maintain the SDK programming function. But  alternative feature provides a rich set of APIs to program the Junos OS control plane. JET allows users to build applications on top of Junos OS and hence, replaces the legacy Junos SDK.

From security point of view, it is a good decision. Although the new approach will be reduced potential risk given by custom SDK development. However it is hard to avoid vulnerability occurs in product itself!

For more details, please see below details for reference.

https://kb.juniper.net/InfoCenter/index?page=content&channel=SECURITY_ADVISORIES&cat=SIRT_1&&actp=&sort=datemodified&dir=descending&max=1000&batch=15&rss=true&itData.offset=15

 

Microsoft October 2018 Security Updates (9th Oct 2018)

 

When my dreams end, as dream always do. Seems cyber technology world similar. Microsoft Patch Tuesday just released. It lure my interest of Microsoft Exchange Server design limitation. The Microsoft Foundation Class Library design weakness may let Microsfot headache. As a matter of fact, C and C++ programming products encountered overflow attack so far. The notorious case is OpenSSL “heartbleed” buffer overflow. OpenSSL contains an open-source implementation of the SSL and TLS protocols. The core library, written in the C programming language, implements basic cryptographic functions and provides various utility functions. However such design contains fundamental weakness and mentioned.  Should you have interest of this matter. Please refer to following url – https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2010-3190

Apart from that, you are able to walkthrough the Patch Tuesday Release Notes (October 2018 Security Updates)

https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/aa99ba28-e99f-e811-a978-000d3a33c573

Security update deployment information: October 9, 2018

https://support.microsoft.com/en-us/help/20181009/security-update-deployment-information-october-9-2018

Could ring 2 have the same momentum as a IoT backdoor?

Preface:

In x86 protected mode, the CPU is always in one of 4 rings. The Linux kernel only uses 0 and 3:

  • 0 for kernel
  • 3 for users

Hidden janitor living in your computer

SMM is triggered through a System Management Interrupt (SMI), a signal sent from the chipset to the CPU. During platform initialization, the firmware configures the chipset to cause a System Management Interrupt for various events that the firmware developer would like the firmware to be made aware of.

Whether you remember the Intel chipsets for some years have included a Management Engine?

On May 2017, an official announcement by Intel, design found a design limitation on their product. The problem is that Intel Active Management Technology, Intel Small Business Technology, and Intel Standard Manageability encountered vulnerability (escalation of Privilege). Reference url shown as below:

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00075.html

If we are not talking about conspiracy, it looks that backdoor appear in the chipset not a rumour. It is a true statement.

Why Ring 2 isn’t used?

Rings 1 and 2 is for the OS to put device drivers at that level, so they are privileged, but somewhat separated from the rest of the kernel code.

An exploitation on Ring 2

We strongly believe that the person who familiar of code for the UEFI kernel and SMM half kernel is the CPU manufacturer. Both components are run on Ring 2. Above mentioned Intel design flaw run in Ring -2 OS (UEFI). UEFI can run in 32-bit or 64-bit mode and has more addressable address space than BIOS, which means your boot process is faster. Unified Extensible Firmware Interface (UEFI) is a specification for a software program that connects a computer’s firmware to its operating system (OS). UEFI is expected to eventually replace BIOS. Like BIOS, UEFI is installed at the time of manufacturing and is the first program that runs when a computer is turned on. Dual boot computer with Windows and Linux conducted by UEFI firmware. But UEFI firmware has become a target for hackers.

Refer to above diagram, we notice that the condition of Ring 2 will be depends on operation mode. So, if virtualization assist by hardware will let Ring 2 and Ring 3 work together. As a result, an attacker with write access to flash can inject malware into the firmware.

Remark: Malware injected into the firmware flash regions is persistent and will run on every subsequent boot.

SPI Flash Exploit – Malicious DXE drivers can disable security settings and install malicious code into the OS.

Additional:

Refer to above information. When a computer was installed and switched on, the microchip altered the operating system’s core so it could accept modifications. The chip could also contact computers controlled by the attackers in search of further instructions and code.

But who is the culprit, no further indicator proof. Perhaps it can shift the blame onto someone else. If you do not mind to read the articles announced by Bloomberg once more. Please refer below:

https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies

About cyber security threats in aero industry – Oct 2018

DHS has few critical cyber security announcement few days ago. Some technical articles may bring the practitioner attentions. Do you read technical article “Threats to Precision Agriculture” yet? My personal opinion is that the prediction of cyber attack scenario not only happen in agriculture. It may have happen in aero industry. Real-time kinematic (RTK) positioning is a technique used to enhance the precision of position data derived from satellite -based systems. The GPS system is now considered a “crosssector dependency” for the Department of Homeland Security’s (DHS) 16 designated critical infrastructure sectors. GNSS is vulnerable to jamming and natural interference. When GNSS is denied, PNT information can be seriously affected in ways that increase risks to the safety of navigation. It is hard to avoid Microsoft operating system integrate to critical system infrastructure nowadays. Microsoft formalized Patch Tuesday schedule and zero day are the concerns of the world includes airline industry. What do you think? It looks that virtual patching service is the first choice in all IT industry coming year.

antihackingonline.com