PSW #759 – Ismael Valenzuela

Pretty awesome article, deep technical, I need to study eBPF and kernel structures more.

"The team then took steps to trace the Wi-Fi signal and used a Fluke system to identify the Wi-Fi device. "This led the team to the roof, where a 'modified DJI Matrice 600' and a 'modified DJI Phantom' series were discovered," Linares explained. The Phantom drone was in fine condition and had a modified Wi-Fi Pineapple device" Wow: "The Matrice drone was carrying a case that contained a Raspberry Pi, several batteries, a GPD mini laptop, a 4G modem, and another Wi-Fi device."

"Team82 has developed a new, innovative method to extract heavily guarded, hardcoded, global private cryptographic keys embedded within the Siemens SIMATIC S7-1200/1500 PLC and TIA Portal product lines." Kind of similar to finding that one page on the webapp that doesn't check for auth: "Use [REDACTED] opcode, which has no security memory region checks, to copy an internal struct containing a native pointer to a valid memory area to a writable memory area".

To sum it all up, this is a Kaminsky attack on a closed resolver using an email server as the vector.

"Thermal attacks can occur after users type their passcode on a computer keyboard, smartphone screen or ATM keypad before leaving the device unguarded. A passerby equipped with a thermal camera can take a picture that reveals the heat signature of where their fingers have touched the device. The brighter an area appears in the thermal image, the more recently it was touched. By measuring the relative intensity of the warmer areas, it is possible to determine the specific letters, numbers or symbols that make up the password and estimate the order in which they were used. From there, attackers can try different combinations to crack users’ passwords."

Wow, so basically, if you're vulnerable, it's like having the web interface exposed to the Internet with no password required as you can: "Modify the admin users’ SSH keys to enable the attacker to login to the compromised system, Add new local users, Update networking configurations to reroute traffic, Download the system configuration, Initiate packet captures to capture other sensitive system information."

Wait, could Microsoft fix this problem? - "Given the history, you might think that Microsoft would have created a viable defense to stop BYOVD attacks, but sadly there's no evidence that's the case. The company claims that Windows users can enable a feature that automatically blocks known vulnerable drivers, but I was unable to make it work on my ThinkPad running the latest version of Windows 10, and as I'll get to shortly, Microsoft has no interest in helping me." Oh wait, nope: " turning on the combination of memory integrity and Hypervisor-protected code integrity will offer protection against BYOVD attacks, but at my request, Kálnai enabled both on a system running Windows 10 Enterprise, 10.0.19044 and then attempted to load the vulnerable Dell driver exploited by Lazarus. As the screenshot below shows, the driver loaded just fine." - Also, why can't we get a block list, or even better, a certificate revocation? Of course, if the driver is working as intended, and does not contain vulnerabilities and the key has not leaked, I supposed you wouldn't want to revoke it globally. Can admins get control of the revocation list? Sure, but then an attacker could also control the revocation...

Interesting: " it is designed to work across several architectures, including: ARM, Intel (i386), MIPS and PowerPC—in addition to both Windows and Linux operating systems. Second, unlike largescale ransomware distribution botnets like Emotet that leverage spam to spread and grow, Chaos propagates through known CVEs and brute forced as well as stolen SSH keys.""

It appears this leak was a developer that was working on UEFI implementations for, what appears to be, Lennovo. The leak contained binary blobs from different manufacturers, UEFI source code, some keys, and scripts/configs that help OEMs package all this together. As far as I can tell from reading about this the keys that were leaked do not really pose a threat unless the public key was fused into the hardware. There is also a difference between UEFI Secure Boot, BIOSGuard, signed BIOS updates, and BootGuard (essentially they all use different keys). The keys involved were for BootGuard, and I believe these for for testing, meaning production computers that shipped would not use the keys. Two main points, that few are actually talking about: 1) The supply chain for firmware on your computer is a "hot mess" 2) This gives researchers valuable information to conduct further research (e.g. microcode updates).

I really like this insight: "To sum up, the problem of the zero day attack has not been solved because every approach depends on knowledge of events that have happened in the past, whether it’s known malware or known “normal” network/application behavior that serves as a benchmark for spotting malware-caused anomalies."

This response from @NikolajSchlej is highly accurate: "If that is really a KeyManifest signing key, and there are any machines that have a hash of the public key fused into FPFs, BG on that platform is under nearly full control. I.e. one can generate a new BootPolicy signing key and protect any BG-protectable range, including none."

"In fact, famed security researcher Mark Ermolov has already been hard at work analyzing the code. His early reports indicate that he has found secret MSRs (Model Specific Registers) that are typically reserved for privileged code and thus can present a security problem"

The workaround sounds like a nightmare: "To block attack attempts, VMware advises admins to switch to Active Directory over LDAPs authentication OR Identity Provider Federation for AD FS (vSphere 7.0 only) from the impacted Integrated Windows Authentication (IWA)."

Review Adobe Security Bulletins and apply the necessary updates. • Adobe Cold Fusion APSB22-44 • Adobe Acrobat and Reader APSB22-46 • Adobe Commerce and Magneto Open Source APSB22-48 • Adobe Dimension APSB22-57

Toyota revealed it had discovered that roughly 296,000 email addresses and customer numbers may have been leaked from its "T-Connect" telematics service, which is used to connect vehicles via a network.

BidenCash, a popular dark web carding site, released a dump of more than 1.2 million credit cards to promote its service.

Lloyd’s of London says they have “detected unusual activity on [their] network and … are investigating the issue.” Lloyd’s has reset its IT systems and shut down external connectivity, but has yet provided no further details.

The update to the instructions changes the blocking rule in IIS Manager from .*autodiscover.json *Powershell.* to (?=.*autodiscover.json)(?=.*powershell). It's likely going to be easier to use the updated EOMTv2 PowerShell script and avoid transcription errors.

An unpatched code-execution vulnerability in the Zimbra Collaboration software is under active exploitation by attackers using the attacks to backdoor servers.

Resurrected Emotet report The report reveals never-before-exposed insights into Emotet, including a large-scale, detailed analysis of: The modules Emotet delivers Emotet’s execution chains and their evolution Emotet’s multiple attack waves, campaigns, and network infrastructure How to create an Emotet sock puppet to fetch modules How to extract the recently updated Emotet configuration Correlating infection techniques and Emotet’s network infrastructure, revealing the agile-like software development lifecycle of Emotet Key highlights and takeaways for you from the Emotet research report: Shows evidence that attacking patterns are in continuous evolution Its attacks serve multiple objectives and have become more prolific due to its wide range of infiltration tactics Infrastructure is constantly shifting due to threat actors attempts to stay covert and maintain their C2 framework The report concludes with recommendations and best practices to support your security strategy for a more ironclad defense against Emotet and other nefarious malware strains.

Perils of Iphone 14 Crash detection system Google's Pixel phone already has a crash detection system. Previous reporting by the WSJ testing Apple's system in a variety of collisions - including using the skills of a "demolition derby" driver - did not suggest the system was overly sensitive. However, the newspaper was provided with records of six calls to local emergency services from iPhones whose crash detection system had been triggered while on rides at Kings Island amusement park outside Cincinnati, Ohio. Dollywood has signs suggesting turn off watches and phones

My questions For avg dev, would having one-on-one guidance/chance for code-level review aid in building in security? Why or why not New series of interactive Q&As and one-on-ones provide developers with direct access to Apple experts can inquire about a variety of topics, such as testing on the latest seeds; implementing new and updated frameworks from Worldwide Developers Conference (WWDC); adopting new features like the Dynamic Island; moving to Swift, SwiftUI, and accessibility; and preparing their apps for new OS and hardware releases. ask questions to various Apple team members through Q&As on Slack or in one-on-one office hours. Q&As allow developers to connect with Apple evangelists, engineers, and designers Developers can ask for code-level assistance, design guidance, input on implementing technologies and frameworks, advice on resolving issues, or help with App Review Guidelines and distribution tools.

Client-side encryption coming to Gmail and Google Calendar. Under this system, data will be encrypted on the end user’s device before being transmitted to datacenter servers, which means not even Google will have access to the encryption keys necessary to gain access.

Two drones landed on an investment company's roof carrying a WiFi Pineapple, a Raspberry Pi, and a laptop. They entered the WI-Fi network by spoofing an authorized MAC address.

North Koreans are applying for jobs at cryptocurrency companies and using exploits to steal massive amounts of cryptocurrency--$840 million in the first five months of 2022.

All Windows versions now have a policy available to lock out accounts for a time period after too many failed logins, intended to mitigate RDP and other brute force password vectors.