AI & LLMs – Josh More, Matthew Carpenter – PSW #808

Paul Asadoorian

1. Design Flaw in Google Workspace Could Let Attackers Gain Unauthorized Access
2. Hackers spent 2+ years looting secrets of chipmaker NXP before being detected

   "Its chips are used in iPhones and Apple watches to support advanced near-field communications security mechanisms such as tag originality, tamper detection, and authentication for Apple Pay. NXP also provides chips for the MIFARE card used by transit companies, FIDO-compliant security keys, and tools for relaying data inside the networks of electric vehicles. Some security researchers said it was surprising that NXP officials didn’t inform customers of the two-year intrusion by threat actors, often abbreviated as TAs." - This is a big deal. It represents a potential supply chain attack, and yet there is a lot of denial, and no one is really talking about it. Let's talk about it! - Also, Jake is talking about it (thank you Jake!):https://infosec.exchange/@malwarejake/111477602993876340

3. Hackers Can Exploit ‘Forced Authentication’ to Steal Windows NTLM Tokens
4. InfectedSlurs Botnet Spreads Mirai via Zero-Days

   Looks to me like there is a remotely exploitable NTP service on NVRs and at least one router module. Details are hard to come by as they are giving vendors time to rollout a patch, but it could also be that this requires a login, and attackers are using default credentials to login, then leverage a vulnerability to gain RCE. I am also concerned about the supply chain as I believe there will be more devices at risk as component re-use is common in IoT and network devices.

5. CVE-2023-43177: Critical Unauthenticated RCE Vulnerability in CrushFTP
6. UK and South Korea: Hackers use zero-day in supply-chain attack
7. How to Fortify Your Docker Containers: A Guide to Advanced Security Practices
8. Analysis of CVE-2023-46214 + PoC
9. How to voltage fault injection
10. aquasecurity/trivy: Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
11. The problems with vulnerability reporting

    We have problems: "These incidents also illustrate how inadequately reporting and cataloging vulnerabilities could lead to a potential cascade of missed opportunities to fix dangerous bugs. Moreover, in some cases, the current opaque bug reporting system can lead to the irreversible overclassification of harmless software bugs as vulnerabilities, leaving software makers with little recourse for correcting these mistakes and forcing them to spend time dealing with the knock-on effects of these errors." - How do we fix them?

12. Our audit of PyPI
13. Detailed data on employees of U.S. national security lab leak online
14. Commercial Flights Are Experiencing ‘Unthinkable’ GPS Attacks and Nobody Knows What to Do

    This is crazy: "The entities behind the novel spoofing attacks are unknown, but Humphreys said that he and a student have narrowed down possible sources. “Using raw GPS measurements from several spacecraft in low-Earth orbit, my student Zach Clements last week located the source of this spoofing to the eastern periphery of Tehran" and observed in the wild: "In late September, multiple commercial flights near Iran went astray after navigation systems went blind. The planes first received spoofed GPS signals, meaning signals designed to fool planes’ systems into thinking they are flying miles away from their real location. One of the aircraft almost flew into Iranian airspace without permission."

15. Netflix bug that opened smart TVs to attacks is detailed, 4 years later
16. Windows Hello Fingerprint Authentication Bypassed on Popular Laptops
17. North Korean Software Supply Chain Attack Hits North America, Asia
18. Researcher flags OpenCart security issue, founder rages

    This is not how you handle vulnerability disclosure: "As a last resort to get the issue fixed, Brollo says he again tried to contact administrators via the OpenCart forums. A day later, Kerr gave his first response via email saying: "Ur a fucking tim.e waster!", according to a screenshot Brollo shared in his disclosure blog, which was published three days after Kerr's email. That same day, Brollo took to OpenCart's GitHub and opened a pull request with a hotfix for the issue, but the OpenCart administrator closed it immediately, marking it as spam and a "non vulnerability." - How do you handle it? Its a great question. Should you fix every bug? Probably. Should you have a safe and secure way to handle reports? Yes.

19. USB worm unleashed by Russian state hackers spreads worldwide
20. Hackers Hijack Industrial Control System at US Water Utility
21. Patch Now! Tecno 4G Portable WiFi TR118 Firmware Flaw Exposes Devices
22. Denmark Faces Unprecedented Cyber Onslaught: 22 Energy Companies Breached

    This relates to our discussion of CVE. So we have https://nvd.nist.gov/vuln/detail/CVE-2023-4398 - a recent CVE detailing an integer overflow in QuickSec IPSec software on Zyxel firewalls. The CVE in this case calls out that it exists in QuickSec. The RCE used against the Danish ICS systems was noted as https://nvd.nist.gov/vuln/detail/CVE-2023-28771 - This vulnerability is exploitable remotely for code execution, test it for yourself: https://packetstormsecurity.com/files/172820/Zyxel-IKE-Packet-Decoder-Unauthenticated-Remote-Code-Execution.html. Zyxel is the CNA for both CVEs. However, what we really need is a way to identify this vulnerability as being associated with Quicksec, which is VPN software created by a company that was bought by other companies in a chain of acquisitions that I have yet to fully trace back (references to Safenet, Inside Secure, and Rambus). Which version(s) of QuickSec are vulnerable? Where are those vulnerable versions of software used? Was it only Zyxel or others as well?

23. New BLUFFS attack lets attackers hijack Bluetooth connections

Jeff Man

1. Ardent Health Services hit with ransomware attack, forcing hospitals in multiple states to divert ambulances

   Hospitals in multiple states have been forced to divert ambulances and reschedule some elective patient procedures after U.S. hospital owner Ardent Health Services was hit with a ransomware attack.

2. Okta Breach Impacted All Customer Support Users—Not 1 Percent

   In late October, the identity management platform Okta began notifying its users of a breach of its customer support system. The company said at the time that about 1 percent of its 18,400 customers were impacted by the incident. But in a massive expansion of this estimate early this morning, Okta said that its investigation has uncovered additional evidence that, in fact, all of its customers had data stolen in the breach two months ago.

3. ‘Gay Furry Hackers’ Breach U.S. Nuclear Research Facility

   Sieged Security, which describes itself as a group of “gay furry hackers,” recently infiltrated a leading U.S. nuclear-research facility (Idaho National Laboratory) and obtained sensitive personal data.

   Idaho? Lee? Tyler?

4. Holiday Season Increases Cybersecurity Risks

   Threats are not risks.. Payment Card Data is not a threat yet alone one of the biggest threats facing retailers this year. Grumble, grumble, grumble.

Larry Pesce

1. Hacker Tools Origin Stories
2. iPhones have been exposing your unique MAC despite Apple’s promises otherwise
3. New BLUFFS attack lets attackers hijack Bluetooth connections
4. Man buys $15 router from thrift store and discovers millionaire’s dirty secrets
5. Thousands of routers and cameras vulnerable to new 0-day attacks by hostile botnet
6. Extracting Training Data from ChatGPT

Lee Neely

1. Vulns expose ownCloud admin passwords, sensitive data

   Last week, open source document sharing software ownCloud released advisories with fixes for three critical vulnerabilities. The first of these vulnerabilities, CVE-2023-49103, allows attackers to access critical credentials. The other vulnerabilities allow arbitrary file deletion and account takeover. The SANS Internet Storm Center detected attacks exploiting CVE-2023-49103 starting this weekend.

2. Idaho National Nuclear Lab Targeted in Major Data Breach

   The Idaho National Laboratory (INL) nuclear research lab has confirmed a November 19 breach of a system that supports its Human Resources (HR) applications. (Oracle HCM) Compromised data include addresses, Social Security numbers, and financial account information. The politically motivated hacking group SiegedSed is taking credit for the attack. While work to get to the root cause is ongoing, initial indications are a subcontractor account, without MFA was used to access data in their Oracle HCM instance.

3. InfectedSlurs Botnet Spreads Mirai via Zero-Days

   Researchers at Akamai’s Security Intelligence Response Team (SIRT) have detected new Mirai botnet activity that exploits two as-yet unpatched vulnerabilities. The flaws target routers and video recorders using default passwords. Both vulnerabilities have been reported to vendors and fixes are expected to be released in December.

4. Ex-infosec COO pleads guilty to nightmarish sales strategy

   An Atlanta tech company's former COO has pleaded guilty to a 2018 incident in which he deliberately launched online attacks on two hospitals, later citing the incidents in sales pitches. Not creepy, not unethical right?

5. Secure AI System Development Guidelines

   The UK National Cyber Security Centre, the US Cybersecurity and Infrastructure Security Agency (CISA) and similar organizations from 16 other countries have published guidelines for secure AI system development. The guidelines address four stages in the development lifecycle: secure design, secure development, secure deployment, and secure operation and maintenance.

6. Kansas Supreme Court releases statement on October 12 security incident

   The Kansas Supreme Court has issued a statement about the October 12 ransomware attack against its systems. The incident disrupted access to court information systems, and more than a month later, many of the court[s systems remain offline. The new statement reveals that the perpetrators stole data, including Office of Judicial Administration files, district court case records on appeal, and other confidential information. The statement also expresses sorrow for the suffering the citizens face from the attack, as well as re-affirming they will stick to their core values as they work to resolve this case. Consider the value of the human element and acknowledgement of the impact on customers when planning your incident communication.

7. CISA Pilot Program Will Provide Cybersecurity Shared Services for Critical Infrastructure

   CISA has announced a pilot program to broaden its scope of managed security services to non-federal entities that support the country’s critical infrastructure. CISA says it “has acted as a managed service provider to the federal civilian government for years and observed significant risk reduction along with the benefits of cost-savings and standardization.” In short, CISA is looking to offer their services as a MSP to non-federal organizations. While still a pilot, this could provide coverage for many small, privately owned, utilities which may not otherwise be able to afford this sort of cyber support.

8. Hackers Hijack Industrial Control System at US Water Utility

   Over the weekend, the Municipal Water Authority of Aliquippa (Pennsylvania) disclosed that one of its booster stations that regulates and monitors water pressure for two towns was breached by a state-sponsored threat actor. An alarm alerted the utility to the intrusion, and they took the affected system offline. This appears to be a case of an Internet accessible HMI. These are no longer low risk conveniences, and need to not be Internet accessible.

9. Google Drive users angry over losing months of stored data

   Google Drive users are reporting that recent files stored in the cloud have suddenly disappeared, with the cloud service reverting to a storage snapshot as it was around April-May 2023

   If you're affected, the best action is to not change your Google cloud storage, particularly the root/data folder until this is resolved, instead open a support ticket with Google. If you have room, copy your app data folder to a local hard drive. Google Drive tier one support appears to be volunteers, which means the ticket is needed to escalate to the paid support engineers. Take a look at where you're using non-enterprise cloud services to store enterprise data and revisit the backup and recovery processes for those to make sure that you're not needlessly risking data loss.