All posts by admin

Cyber War, Potential Risk of CVE

APT Group attack major focus: time window before release and patched (19th Feb 2020)


Preface: In normal circumstance, the remediation of vulnerabilities is time consumption. Even though Software-based vulnerabilities policy allow up to 90 days for the vendor to provide a patch.

Background: It looks that existing period of time can be happen plenty of matters. So far APT Group have talented and knowledge to discover the defect of the I.T product. Refer to cyber security evaluation report found that the new round of cyber attack for specify APT group will be focusing the SSL VPN products vulnerability. Refer to attached diagram, it shown that at least 3 different products of SSL VPN service encountered vulnerabilities last year (2019).

Our Focus: Perhaps vendor will based on the severity level priority the remedy schedule. This gap can provide such a space to hacker engage cyber attack.

The suspected defect like Sonicwall SSL-VPN. APT Group not difficult to conduct this attack.The memcpy function can be overflow the local buffer. So overwriting EIP and using a rop chain to execute commands is simple.

*Return-oriented programming (ROP) is a computer security exploit technique that allows an attacker to execute code in the presence of security defenses such as executable space protection and code signing.

Public safety, Under our observation, Virus & Malware

Hacker exploit Coronavirus Crisis, send scam email to different industries – 18th Feb 2020

Synopsis:

a. Attackers disguise their scam email as an official (WHO) alert issued by the Centers for Disease Control Health Alert Network. (Targeting individuals from the United States and the United Kingdom)

b. Attackers disguise their scam email as an alert of Coronavirus status, they are target to shipping industry.

Description: About the attack to shipping industry – Hacker exploit the vulnerability of CVE 2017-11882, perhaps they found that the patch management on the boat not enforce in frequent. And therefore the attack explicitly target shipping industry. About the attack to individuals from the United States and the United Kingdom – WHO urge that if anyone see similar type of scam email. Report to WHO – https://www.who.int/about/report_scam/en/

The slogan – Do not rush to open a URL or open a email. Take care.

Public safety, Ransomware, Under our observation

Hong Kong Broadband Network customer staying alert! 17th Feb 2020

Synopsis: The threat actors hidden their email phishing package anywhere. As common we know, email phishing scam foot print are wide in area. But the antivirus and malware solution vendor setup blacklist domain name and content filtering function has reduced the infection ratio of malware and ransomware. It looks that the similar of idea to hunting cyber victim still valid. In my observation, the attacker sometimes will be reuse their technique. This time they store the trap in social media web. Found that the scam activities which mimic Hong Kong Broadband luck draw online program activities is awaken again. I found similar activities on yesterday (16th Feb 2020). Even the VirusTotal repository has only one cybersecurity vendor detected a similar record type. In the sense that they can escape your defense solution.

For more detail, please refer to announcement by HKBN in past. https://www.hkbn.net/personal/dist/img/src/pdf/Warning-Against-Phishing-Website_en.pdf

Potential Risk of CVE, Under our observation

FIFO project problem tracker – SEND_FILE_WITH_HEADER Use-After-Free (Feb 2020)

Preface: The security of FIDO deployment largely depends on the choice of underlying security subsystems and their implementation.

Background: An ioctl , which means “input-output control” is a kind of device-specific system call. There are only a few system calls in Linux (300-400), which are not enough to express all the unique functions devices may have. So a driver can define an ioctl which allows a userspace application to send it orders.
Samsung’s kernel tree contains two implementations of device-side MTP. One of them (drivers/usb/gadget/function/f_mtp.c), based on its copyright headers,seems to be from Google, but this one is disabled at build time.
The second one is drivers/usb/gadget/function/f_mtp_samsung.c.
Both of them have ioctl handlers that handle the ioctl command SEND_FILE_WITH_HEADER; the Google version runs this handler under a lock, but Samsung version doesn’t hold any locks.

Impact: If the object has been freed and then filled with data controlled by attacker, the EIP/RIP register for x86/x64 architecture or the register for ARM architecture is to be hijacked to injected shellcode and an arbitrary code execution in kernel will be achieved.

Remedy: Waiting for response by vendor

Potential Risk of CVE

Perhaps you don’t use Internet Explorer, you could still be at risk. Conduct patch install on IE today – 12th Feb 2020

3 Comments

Preface: If you try to open an .MHT file on a computer including Windows 10, or Windows Server 2012 R2 then it will attempt to load the file using Internet Explorer eventhough of the default browser in place!

Security Focus: Microsoft released an emergency security update on Monday (February 10, 2020) to fix a vulnerability in Internet Explorer (IE) designed to alert business customers. This issue occurs because the ‘scripting engine’ fails to properly handle objects in memory. Attackers can exploit this issue by enticing an unsuspecting user of the affected application to view a specially crafted web page.

Remedy: For more details, please refer to official announcement – https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0674

System

2019 – The security protection of Docker, where are they?

Preface: Sysadmin may unintentionally expose a Docker registry service without enforcing proper access control, said Palo Alto Networks.

Background: Easy to deploy, one of the goal of container-based technology. Docker storing image in a managed collection, with standardized methods of identifying, committing, and pulling individual images. With this feature it is equivalent as a image Repositories. It makes Docker so useful is how easy it is to pull ready-to-use images from a Docker’s Central Registry. Meanwhile you can’t share your repository with other because it contains proprietary code or confidential information.

Technical details: Docker-Registry is a simple Python app. Your Registry can develop as a Private Registries. Besides, in some environments, sysadmin can setup the Registry SRV on port 443 and make it accessible on internet (Registry-dot-com). Such services are popular on AWS S3 or Azure.

Key areas of concern: Compromised Containers, mis-configuration & access control.

What we can do? Perhaps we can reference to NIST SP 800-190 application container security guide. URL display as below: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-190.pdf

Virus & Malware

HKMA alerting public of the hsbc phishing email – 6th Feb 2020

Preface: Not the first time heard that cyber criminals mimics email from bank to hunting the victims.

Historical record: HSBC’s “Payment Notification” malware email was discovered in 2018.
These emails are designed to confuse people’s vigilance and use the HSBC brand name to reduce the defensive awareness of email recipients. An “auto-generated” email suggests that you open an attachment to view the payment proposal document.
If you open the attached Microsoft word file, you will be prompted to enable macros. If you do allow, a malicious macro will run in the background, The macro will download and install malware on your computer. I believed that cyber criminals hunting the mobile phone users this round.

Staying alert: For more details, please refer to official announcement for reference. https://www.about.hsbc.com.hk/-/media/hong-kong/en/news-and-media/200205-website-hsbc-warns-against-phishing-email-eng-20200205.pdf

Potential Risk of CVE

Learn more about CVE-2019-18634 – sudo vulnerability

Preface: Sudo (substitute user [or superuser] do) is a program used in Unix-like operating systems such as BSD, Mac OS X, and GNU / Linux to allow users to execute programs in a secure manner with special permissions (usually the system Super user).

Highlight: When pwfeedback is set, sudo will provide visual feedback when the user presses a key. This function allows the system to indicate the currently entered character with an asterisk character.

Vulnerability details: In January 2020, CVE-2019-18634 announced a vulnerability that had existed for more than 9 years, pointing out in the pwfeedback feature option. This function allows the system to indicate the currently entered character with an asterisk character. However, after the pwfeedback function is enabled in the sudoer file, it may allow users to trigger a stack buffer overflow attack, allowing users without system management rights, even those not listed in the sudoer file. Users in can be elevated to root account permissions.

Remedy: The bug is fixed in sudo 1.8.31.

Under our observation

F-secure internet gatekeeper 5.40 (heap overflow) – 30th Jan 2020

Preface: Heap overflows are exploitable in a different manner to that of stack-based overflows. Memory on the heap is dynamically allocated at runtime and typically contains program data.

Product background: F-Secure Internet Gatekeeper for Linux, aim to serve for small and medium business cyber security protection services. It capable to scanning incoming and outgoing including SMTP, HTTP, FTP and POP3 traffic for all types of malware.

Vulnerability details: F-Secure Internet Gatekeeper contains an admin panel that runs on port 9012/tcp. If attacker send a large size “Content-Length” with an unsigned long int through user administration process.
It will causes strtoul return the ULONG_MAX value which corresponds to 0xFFFFFFFF on 32 bit systems.
Adopt to above circumstances, when the fs_httpd_civetweb_callback_begin_request function tries to issue a malloc request to handle the data send by attacker, it first adds 1 to the content_length variable and then calls malloc. This causes a problem as the value 0xFFFFFFFF + 1 will cause an integer overflow. During the overflow, this code will read an arbitrary amount of data onto the heap – without any restraints.

Remedy: This critical issue was tracked as FSC-2019-3 and fixed in F-Secure Internet Gatekeeper versions 5.40 – 5.50 hotfix 8 (2019-07-11).

Potential Risk of CVE

The endless story of the SMTP gateway – CVE-2020-7247

Preface: Ray Tomlinson sent the first email across a network, initiating the use of the “@” sign to separate the names of the user and the user’s machine in 1971, when he sent a message from one DEC-10 computer to another DEC-10.

Synopsis: An SMTP relay is a protocol that allows email to be transmitted through the internet. OpenSMTPD design goals include security, reliability & easy of configuration. If you are OpenBSD ( open-source Unix-like operating system ) user, you can setup OpenSMTPD to relay local emails to Gmail.

Vulnerability details: So called the code blew a hole in relay server.

Privileges escalation: When mail is received by server, it uses the root (superuser account) to deal with it. And therefore anyone who’s can exploit this vulnerability. It similar to “promote” themselves to root.

This vulnerability exists in OpenBSD’s mail server OpenSMTPD’s “smtp_mailaddr()” function, and affects OpenBSD version 6.6. This allows an attacker to execute arbitrary shell commands like “sleep 66” as root user.

Remedy: To remediate this vulnerability, affected OpenBSD users are recommended to install patches for OpenBSD 6.6. See reference 019 in https://www.openbsd.org/errata66.html.