Pig Butchering, Dell Driver FTW, Deep Access, & PHP Supply Chain Attacks – PSW #758

Paul Asadoorian

1. Hackers maintained deep access inside military organization’s network, U.S. officials reveal
   This did not seem all that stealthy: "In April 2021, APT actors used Impacket for network exploitation activities. See the Use of Impacket section for additional information. From late July through mid-October 2021, APT actors employed a custom exfiltration tool, CovalentStealer, to exfiltrate the remaining sensitive files"
2. Amazon‑themed campaigns of Lazarus in the Netherlands and Belgium
   "The most notable tool delivered by the attackers was a user-mode module that gained the ability to read and write kernel memory due to the CVE-2021-21551 vulnerability in a legitimate Dell driver. This is the first ever recorded abuse of this vulnerability in the wild. The attackers then used their kernel memory write access to disable seven mechanisms the Windows operating system offers to monitor its actions, like registry, file system, process creation, event tracing etc., basically blinding security solutions in a very generic and robust way."
3. Detecting Deepfake Audio by Modeling the Human Acoustic Tract
   "Specifically, we apply fluid dynamics to estimate the arrangement of the human vocal tract during speech generation and show that deepfakes often model impossible or highly-unlikely anatomical arrangements." - That is, until a computer can replicate that...
4. Microsoft Exchange server zero-day mitigation can be bypassed
5. How to Solve the Common Problems of Embedded Firmware
   Backup memory drives up the cost of the device though, which is why I believe there are so many devices floating around that will never get updates: "A common problem here is interruptions. Simple devices that lack memory size have to rewrite the firmware as soon as they receive the data. If anything interrupts the process, the firmware will be corrupted: for example, if the power shuts off before the installation is complete. In the worst case scenario, the device will brick, and nothing can fix it. If the device has a bootloader, the firmware can be reinstalled. Nevertheless, when you deal with OTA updates, interruptions can be frequent. The problem is commonly fixed with backup memory. When our team worked on a smart home project, it was clear that the device will be updated over the air. Bricking or malfunctioning because of interruptions were not acceptable. Therefore, the team provided the system with backup memory. In this case, the update file is downloaded to the backup memory first. It can be either a file system or a flash memory area. After that, the device runs a data integrity check to make sure no byte was lost or changed during transmission. Only after that, the update is installed. "
6. An issue was discovered in Insyde InsydeH2O with kernel 5… · CVE-2022-36338 · GitHub Advisory Database
   Basically, an attacker can execute code in SMM outside of SMRAM: "An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver FwBlockServiceSmm, creating SMM, leads to arbitrary code execution. An attacker can replace the pointer to the UEFI boot service GetVariable with a pointer to malware, and then generate a software SMI." From Binarly: "the handler will try to locate protocol 74d936fa-d8bd-4633-b64d-6424bdd23d24 using the EFI_BOOT_SERVICES which is located outside of SMRAM, hence this call could be hijacked by a possible attacker."
7. Cyberespionage group developed backdoors tailored for VMware ESXi hypervisors
   "By default, VMware ESXi is configured to accept only the installation of VIBs that are VMWareCertified, VmwareAccepted, or PartnerSupported. At these levels of acceptance, the bundles need to be digitally signed by either VMware or a partner whose signature VMware trusts. However, there is a fourth level of acceptance called CommunitySupported and VIBs in this category do not need to be digitally signed." Secure Boot to the rescue! "When Secure Boot is enabled the use of the ‘CommunitySupported’ acceptance level will be blocked, preventing attackers from installing unsigned and improperly signed VIBs (even with the --force parameter as noted in the report),"
8. Announcing Our Series B – Eclypsium
   Yep, we can talk about this now :)
9. Vulnerable ≠ Exploitable: A lesson on prioritization
   An automated pen test vs a crappy pen test, who wins?
10. The secrets of Schneider Electric’s UMAS protocol – Securelist
11. Pixel 6 bootloader: Emulation, ROP
12. Pixel6: Booting up
13. A flaw in the Packagist PHP repository could have allowed supply chain attacks
14. Securing Developer Tools: A New Supply Chain Attack on PHP
    We demonstrated how we discovered an argument injection in the backend services of the PHP package manager Composer and could successfully exploit it to compromise any PHP software dependency.
15. Russian Hacker Arrested in India for Reportedly Helping Students Cheat in JEE-Main Exam
16. URGENT! Microsoft Exchange double zero-day – “like ProxyShell, only different”
17. Fake CISO Profiles on LinkedIn Target Fortune 500s – Krebs on Security
18. Comm100 Chat Service Hacked In A Supply-Chain Attack
19. Detecting and preventing LSASS credential dumping attacks – Microsoft Security Blog

Doug White

1. Political Spam is coming for you.
2. Tesla has a bit of work to do on Optimus robot
3. Linux 6.1: Rust to hit mainline kernel
4. New Android malware ‘RatMilad’ can steal your data, record audio
5. FBI warns of “Pig Butchering” cryptocurrency investment schemes

Sam Bowne

1. Tech Journalists Offered Bribes to Write Articles for Major Outlets
   From Dan Goodin at Ars Technica Bribes are $2k - $5k, delivered secretly The marketer claims to have 10-40 writers taking bribes now, publishing on Techcrunch, Forbes and others
2. Uncle Sam orders federal agencies to step up scans for govt IT security holes
   CISA has ordered federal civilian agencies to scan for and report software vulnerabilities in their IT systems more frequently. They must scan their entire IPv4 space for vulnerabilities every 14 days and update vulnerability detection signatures within 24 hours of availability. This must be working by April 3, 2023.
3. Never-before-seen malware has infected hundreds of Linux and Windows devices
   Small office routers? FreeBSD machines? Enterprise servers? Chaos infects them all.