Monthly Archives: December 2018

Cyber War, Under our observation, Virus & Malware

Analysis Reports by US Homeland Security – Legitimate open source remote administration tool re-engineer by threat actor as APT way of attack – Dec 2018

3 Comments

Preface: Quasar, a legitimate open-source remote administration tool. It is a fast and light-weight remote administration tool coded in C#.

Background: APT actors have adapted Quasar and created modified minor (1.3.4.0) and major (2.0.0.0 and 2.0.0.1) versions. Since the re-engineering Quasar client will be mimics a Mozilla Firefox 48 browser running on Windows 8.1 or mimics an Apple Safari 7.0.3 browser running on Mac OS X 10.9.3 in order to evade IDS monitoring. However there are way lets security operation center find their fingerprint. The distinctive first 4 bytes of the payload can be used to identify Quasar traffic.

As a result, below analytic way can be enforce the detective control:
Signature 1: TCP Payload Size Tracking

Signature 2: IP Lookup User-Agent String, HyperText Transfer Protocol Header Host, and HyperText Transfer Protocol Header URI

Signature 3: Hidden HTTP Request User-Agent String and Time-to-Live

More details can be found below url: https://unit42.paloaltonetworks.com/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments/

Potential Risk of CVE

Webroot BrightCloud SDK HTTP headers-parsing code execution vulnerability – 17th Dec 2018

Preface: Webroot delivers next-generation endpoint security and threat intelligence services to protect businesses and individuals in a connected world.

Technical background: The Webroot BrightCloud® Mobile Security SDK addresses mobile device vulnerabilities by enabling mobile management partners to offer enhanced security .

Vulnerability found on 17th Dec 2018:
CUJO Smart Firewall (ver 7003) provides services to avoid Home users IoT devices potentially connect to malicious websites. An library file (webroot.so) provides by webroot SDK has vulnerability occurs. A heap-based Buffer Overflow was found. In normal circumstances, CUJO accesses the BrightCloud API through bcap15.brightcloud.com over a plain HTTP connection. The function bc_http_read_header incorrectly handles overlong headers, leading to arbitrary code execution which let attacker could impersonate a remote BrightCloud server to trigger this vulnerability.

Reference: BrightCloud – about enquiry
https://www.brightcloud.com/faq

Potential Risk of CVE

Jenkins Stapler Web Framework Arbitrary Code Execution Vulnerability – 17th Dec 2018

Preface: Vulnerabilities are flaws in computer software that create weaknesses in your computer or network overall security.
Can you imagine that what is the actual situation before vulnerability found?

Background information: Jenkins is the leading open-source automation server. Built with Java, it provides over 1000 plugins to support automation.

Vulnerability announcement on 17th Dec 2018:
The vulnerability is due to improper handling of HTTP requests by the stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java code of the Stapler web framework used by the affected software. An attacker could exploit this vulnerability by persuading a user to access a link that submits malicious input to the targeted system. An exploit could allow the attacker to invoke certain methods that are not intended to be invoked, which the attacker could use to execute arbitrary code.

Official announcement (Remedy): https://jenkins.io/security/advisory/2018-12-05/#SECURITY-595

Cyber War

Fake apps embedded ultimate spyware are being infect smartphones especially Android – Dec 2018

Preface: Blackhat conference held 3rd to 6th December 2018 in London. A topic awaken people bring attention to the smartphone security awareness especially Android OS.

Technical details:
Cyber security expert observe that a malform type of counterfeit apps spreading via watering hole websites and phishing emails. Targets were likely approached directly and encouraged to visit the malicious websites to download the counterfeit apps.

My comments:
Regarding to the Android Security Bulletin announce on December 2018. It looks that there are more vulnerabilities found. The Critical vulnerability found could let local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. For my personal point of view, the variant of surveillance malware so called Silverhawk. It will embedded with existing Android vulnerabilities engage the cyber attack. For more details, please refer to attached diagram for reference.

Reference: Blackhat conference presentation – Electronic Army’s Mobile Tooling :  https://i.blackhat.com/eu-18/Wed-Dec-5/eu-18-DelRosso-Under-the-SEA.pdf

Potential Risk of CVE

CVE-2018-19966:Xen Union Data Structure Guest OS Users Privilege Escalation Vulnerability

Preface: Xen Project is a hypervisor using a microkernel design, providing services that allow multiple computer operating systems to execute on the same computer hardware concurrently.

Vulnerability description:
The vulnerability is due to an interpretation conflict for union data structure associated with shadow paging.The XSA-240 introduced a new field into the control structure
associated with each page of RAM. This field was added to a union data structure.Thus dirty bitmap tracking which is used when performing live migration of virtual machines. However a technical conflicts during migration, or L1TF mitigation for PV guests(L1 Terminal Fault speculative side channel mitigation – XSA-273).

Impact: All Xen versions from at least 3.2 onwards are vulnerable. Earlier versions have not been checked

Official remedy solution: https://xenbits.xen.org/xsa/advisory-280.html

IoT, Potential Risk of CVE

Cisco Security Advisory – Texas Instruments Bluetooth Low Energy Denial of Service and Remote Code Execution Vulnerability – Last Updated: 13th Dec 2018.

Preface: Key component of smart city are the IoT devices. The communication protocol of the IoT devices are Lora, SigFox and NarrowBand (NB).

Background: In realistic, smart city cannot lack of wifi setup for assistance. So, WiFi is one the key component in this family (Smart City).

Vendor Cisco follow up TI BLE chips vulnerability – CVE-2018-16986: Suggest verify with the following command on wireless AP device. If device show not support BLE function and therefore confirm device not vulnerable.

ap# show controllers bleRadio 0 interface
BLE not supported on this platform

If it is supported, please review below URL:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181101-ap

2018, Application Development, cyber security incident news highlight

Facebook 6.8 million users’ private photos leaked – Suspected it was happened in developers environment.

Facebook looks bad luck this year. It is better to invite Chinese Feng Shui master provides suggestion. Yes, it is kidding.

Perhaps Facebook intend to improve their image. It immediately let’s public know what is happening in the moment. It is talking about 6.8 million users’ private photos leakage. But suspected that the loophole was happened in developers environment.
My comment is that may be vulnerability happens in call to action function. A design limitation keep the CTA access token. And therefore it provides unauthorize access.

Headline News: https://www.theverge.com/2018/12/14/18140771/facebook-photo-exposure-leak-bug-millions-users-disclosed

Potential Risk of CVE

Pixars Tractor – Vulnerability Note VU#756913 (13th Dec, 2018)

Preface: As time goes by, an evolution in technology offers best-of-class in rendering for both VFX and feature film animation.

What does VFX stand for?
Visual effects (abbreviated VFX) is the process by which imagery is created or manipulated outside the context of a live action shot in film making.
RenderMan offers a combination of unbiased and biased rendering techniques which provide both accuracy and technical efficiency

Vulnerability details:
Pixar’s Tractor software, versions 2.2 and earlier, contain a stored cross-site scripting vulnerability.

Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application.
In most of the cases, cross-site scripting attack is being used to steal the other person‘s cookies. As we know, cookies help us to log in automatically. Therefore with stolen cookies, we can login with the other identities. Cope with above vulnerability, the stored information is displayed when a user requests information about the node. An attacker could insert Javascript into this note field that is then saved and displayed to the end user.

Reference: https://kb.cert.org/vuls/id/756913/

Application Development

Something 101 – Are you aware Docker containers safety?

Preface: Docker’s introduction of the standardized image format has fueled of interest in the use of containers in the enterprise recently. A Docker container look likes a Virtual machine.

It is without antivirus or malware detector facilities install to Docker container platform. Is that secure?

On the market, there is no such product available in the market. However if you would like to find out something 101 about preventive control. It can find on this short discussion.

Hints: When a container accesses a database or service it will require a secret, like an API key or username and password. An attacker that gains access to the secret will also have access to the service. For more details, please refer to attached diagram.

Recommendation:

  1. Ensure that processes in containers do not run as root, so when attacker try to exploiting privileges command, it will be restricted by role base control.
  2. Cut down on the kernel calls that a container can make to reduce the potential attack surface.

So called “something 101” as usual technical details not suitable describe in long format. See whether we have chance to discuss more in future.

Potential Risk of CVE

CVE-2018-1002105 (kubernetes) : authentication/authorization bypass in the handling of non-101 responses – Dec 2018

Preface: Since we launched it in 2014, Kubernetes running strong. It is becoming “the Linux of the cloud,” according to Jim Zemlin, Executive Director of the Linux Foundation. Analysts estimate that 54 percent of Fortune 100 companies use Kubernetes across a spectrum of industries including finance, manufacturing, media, and others.

Giant will sick as normal people (so called vulnerability):
Critical – CVE-2018-1002105 kubernetes: authentication/authorization bypass in the handling of non-101 responses. Reference: https://access.redhat.com/security/cve/cve-2018-1002105

CVE-2018-1002101 – In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nodes, which could lead to command line argument injection. Reference:
Reference:  https://github.com/kubernetes/kubernetes/issues/65750

CVE-2018-1002103 – The attacker can use DNS rebinding to indirectly make requests to the Kubernetes Dashboard, create a new Kubernetes Deployment running arbitrary code. If minikube mount is in use, the attacker could also directly access the host filesystem.
Reference: https://github.com/kubernetes/minikube/issues/3208