Firmware VS. Hardware, Tamper Protection, Hacking Gamers, & Unfortunate Spillage – PSW #756

Curious how pen testers (and attackers) discover these gaps: "BloodHound focuses on Active Directory and these hypothetical edges are missing, because they represent real escalation paths exploited by real attackers", and the situations are: Same Password (shared accounts), Same Admin Password (admins using the same password), Guest Machine (control the hypervisor), Provides Updates To (Supply chain)

"We are releasing an open source tool, INTRACTABLEGIRAFFE, which is my proof of concept implementation of the Uroburos VFS functionality along with a basic keylogger that writes intercepted keystrokes to the non-volatile/persistent VFS."

"40% of professional respondents indicated that their organizations scaled back their open-source software usage in the past year due to concerns around security. Additionally, 31% of professionals stated that “security vulnerabilities” were the biggest challenge in the open-source community today." (Full report: https://www.anaconda.com/state-of-data-science-report-2022)

This is pretty amazing: "As opposed to being sourced from slaughtering livestock, the beef for these morsels is derived from "starter cells" or STEM cells of the animal that are left to grow in a petri dish or flash under human-made conditions."

There has to be an easy solution to this problem, rate limit MFA requests? Reject the MFA request after so many in a certain time period? Block the sender of the MFA request if rate limit is exceeded?

"The company added this feature to its enterprise endpoint security platform in March 2019 to block changes to key security features and prevent attackers or malicious tools from disabling the antimalware solution or deleting security updates. Once toggled on, it locks Microsoft Defender Antivirus to secure default values and will prevent any security settings changes. To do that, it blocks other apps from changing the settings for real-time and cloud-delivered protection, behavior monitoring, and Defender components like IOfficeAntivirus (IOAV) which handles the detection of suspicious files downloaded from the Internet." - But if an attacker is in the kernel, can these protections still be disabled? Does this just force an attacker to Ring 0?

"The BackupRefPtr algorithm is based on reference counting. It uses support of Chrome's own heap allocator, PartitionAlloc, which carves out a little extra space for a hidden reference count for each allocation. raw_ptr increments or decrements the reference count when it’s constructed, destroyed or modified. When the application calls free/delete and the reference count is greater than 0, PartitionAlloc quarantines that memory region instead of immediately releasing it. The memory region is then only made available for reuse once the reference count reaches 0. Quarantined memory is poisoned to further reduce the likelihood that use-after-free accesses will result in exploitable conditions, and in hope that future accesses lead to an easy-to-debug crash, turning these security issues into less-dangerous ones."

This is a tried and true technique: "The attacker claims they went on to locate a network share containing powershell scripts that included the username and password of a system administrator."

"A good day in security is when nothing bad happens,” says Sounil Yu, CISO at JupiterOne. The problem for understanding ROI is why did nothing bad happen? Was it luck, and on that day, you were not attacked by an elite hacker? Was it because you maintain a thorough patching program? Was it because of one or more of your cybersecurity controls – but which one or ones were successful, and how much cost to the firm did they prevent? None of these is easy to explain or quantify if nothing bad happened." - We spent lots of money on Next-Generation security (cost), and we didn't get hacked (ROI), right?

So much fail, and this is just one vulnerability: "insecure communications due to explicit disabling of certificate validation (-k), which allows us to tamper with data returned from the server update packages are simply validated via a hash checksum, packages are not signed in any way arbitrary extraction to the root path with elevated privileges, allowing whoever controls the update package to overwrite anything anywhere on the device (which puts a lot of trust in a third party supplier)". This is how not to do software updates. Then there is a CMD injection in the auth token parameter. Original research: https://onekey.com/blog/security-advisory-netgear-routers-funjsq-vulnerabilities/

So, hacker gamers YouTube accounts, post videos with cheats, provide a link to said cheats, which really just downloads malware to more people's machines. Interesting: "In addition to the payload itself, the discovered bundle is of note for its self-propagation functionality. Several files are responsible for this, which receive videos, and post them to the infected users’ YouTube channels along with the links to a password-protected archive with the bundle in the description. The videos advertise cheats and cracks and provide instructions on hacking popular games and software."

Nice research: "To successfully carry out the attack, IOActive reverse-engineered the NFC protocol Tesla uses between the NFC card and the vehicle, and we then created custom firmware modifications that allowed a Proxmark RDV4.0 device to relay NFC communications over Bluetooth/Wi -Fi using the Proxmark’s BlueShark module." Paper: https://act-on.ioactive.com/acton/attachment/34793/f-6460b49e-1afe-41c3-8f73-17dc14916847/1/-/-/-/-/NFC-relay-TESlA_JRoriguez.pdf

"NVIDIA's address space isolation approach is around asynchronous detection of unsafe events and to block the event before it happens. Their approach involves MMU-based memory coloring and is outlined in more detail via this PDF slide deck from the Open-Source Summit Europe 2022 event."

"The money was available for Curry to spend, but he said he was simply holding onto it in case Google tried to get it back. He said if Google took too long to get back to him, he might have to move the cash into a separate account to avoid paying taxes on it."

What a scam: "UNC4034 initiated communication with the victim by offering them a job opportunity at Amazon via email. Subsequently, UNC4034 communicated with them over WhatsApp and shared the file amazon_assessment.iso, which the user downloaded using the web version of WhatsApp. The amazon_assessment.iso archive held two files: an executable and a text file. The text file named Readme.txt had connection details for use with the second file: PuTTY.exe." - I'll bring my own SSH software thank you very much.

"Turner said in Vectra’s interactions with customers, only those organizations with extreme exposure to sophisticated adversaries (defense contractors, critical infrastructure operators) are seriously considering eliminating the Teams.exe application on endpoints and forcing users to collaborate through Teams via a managed browser." - I am already removing teams from my Linux systems, in favor of the browser...

This is pretty cool, see you just need a Next Generation IPS with an AI/ML model to detect zero-day exploits: "Our model has learned more generalizable common patterns in command injection exploits while also being specific enough to avoid false positives. In our latest tests, we achieved a true positive rate of >99% and a false positive rate of <0.025%." - All kidding aside, they presented evidence that they've done this.

This is one of the biggest game leaks in history. Also, this: "The hacker hasn’t shared details on how they gained access to the GTA 6 videos and source code other than claiming to have stolen them from Rockstar’s Slack and Confluence servers. The threat actor also claims to be the same hacker, named 'TeaPots,' behind the recent Uber cyberattack, but BleepingComputer could not confirm whether these claims are valid."

"A variety of factors can affect the legibility of text reflected in a video conference participant's glasses. These include reflectance based on the meeting participant's skin color, environmental light intensity, screen brightness, the contrast of the text with the webpage or application background, and the characteristics of eyeglass lenses. Consequently, not every glasses-wearing person will necessarily provide adversaries with reflected screen sharing." So like don't be browsing porn: "When the goal was to identify just the specific website visible on the screen of a video meeting participant from an eyeglass reflection, the success rate rose to 94 percent among the Alexa top 100 websites."

"This group typically uses similar techniques to target technology companies, and in 2022 alone has breached Microsoft, Cisco, Samsung, NVIDIA, and Okta, among others," the San Francisco-based company said in an update. The financially-motivated extortionist gang was dealt a huge blow in March 2022 when the City of London Police moved to arrest seven individuals aged between 16 and 21 for their alleged connections to the group. Two of those juvenile defendants are facing fraud charges."

"The malware is able to redirect the user’s traffic and hijacking user search queries to popular search engines, including Google, Yahoo, and Bing. The malicious code is also able to use PowerShell to inject itself into the browser and added the extension to the browser." Original research: https://blogs.vmware.com/security/2022/09/the-evolution-of-the-chromeloader-malware.html

Hannah's birthday is today! She's strong, growing her hair back, homeschooling (she's still immuno-compromised), and looking forward to living a normal life!