CD Projekt Ransomwared, Ciphers, Water Supply Hacked, & Clubhouse Security Risks – PSW #683

Interesting hack, police officers will play popular music in the hopes what when the video is uploaded to a major site it's taken down due to a copyright violation.

This is bad news: "A US appeals court has ruled that Customs and Border Protection agents can conduct in-depth searches of phones and laptops, overturning an earlier legal victory for civil liberties groups. First Circuit Judge Sandra Lynch declared that both basic and “advanced” searches, which include reviewing and copying data without a warrant, fall within “permissible constitutional grounds” at the American border."

"Researchers showed that if an attacker learns the names of private libraries used inside a company's app-building process, they could register these names on public package repositories and upload public libraries that contain malicious code. The "dependency confusion" attack takes place when developers build their apps inside enterprise environments, and their package manager prioritizes the (malicious) library hosted on the public repository instead of the internal library with the same name."

Forescout is leading this research, from their paper: "In the second study of Project Memoria, Forescout Research Labs discloses NUMBER:JACK, a set of 9 new vulnerabilities affecting embedded TCP/IP stacks. The vulnerabilities are all related to the same problem: weak Initial Sequence Number (ISN) generation, which can be used to hijack or spoof TCP connections. Ultimately, attackers may be able to leverage those vulnerabilities to close ongoing connections, causing limited denials of service, to inject malicious data on a device or to bypass authentication" (Paper: https://www.forescout.com/company/resources/numberjack-weak-isn-generation-in-embedded-tcpip-stacks/)

I like that they are showing kids how neat cypto is: "KeypadCrypt is a so-called hand cipher, i.e. a simple manual method for encryption, without a computer. It is a substitution cipher that replaces each letter by a number. The numbers are chosen from a phone keypad, where letters have been shuffled according to an effortless memorizable secret code agreed between parties on forehand."

But don't call it Zero Trust: "And organizations will need to implement a zero-trust framework without calling it zero trust (it's definitely a morale killer if you tell all your employees you don't trust them). Internal communications teams should come up with creative campaigns, so employees rally behind and adopt zero-trust concepts (talking about "protecting each other," for example, is a nice way to flip things around)."

And it means getting a hold of new AMD processors, Nvidia RTX 30 series, Xbox series X/S and PS5.

"The in-app audio chats are believably deleted once everyone has left the room. But the Alpha Exploration’s privacy policy says the conversations are only deleted automatically if nobody reported a “Trust and Safety violation” throughout the chat. In other words, if there is an incident, Clubhouse retains the audio until “the investigation is complete.” Although they added that the temporary audio recordings are encrypted, they reserve the right to share them with law enforcement if necessary."

“We are excited to launch OSV (Open Source Vulnerabilities), our first step towards improving vulnerability triage for developers and consumers of open source software.” reads the post published by Google. “The goal of OSV is to provide precise data on where a vulnerability was introduced and where it got fixed, thereby helping consumers of open source software accurately identify if they are impacted and then make security fixes as quickly as possible.”

Teamviewer for the loss.

Maybe the general public can find more bugs now: "If we will not come to an agreement, then your source codes will be sold or leaked online and your documents will be sent to our contacts in gaming journalism"

"The DoS exploits for these CVEs would allow a remote attacker to cause a stop error. Customers might receive a blue screen on any Windows system that is directly exposed to the internet with minimal network traffic."

"Recently, I discovered that RD Web Access is susceptible to an anonymous authentication timing attack that can validate usernames within an Active Directory domain. Furthermore, RD Web Access exposes the connected domain name if the Remote Procedure Call (RPC) endpoint is accessible on the target server. An anonymous attacker can exploit this behavior to gather intelligence about an organization’s Active Directory environment and build a list of valid domain users for use in secondary attacks."

Melbourne, Australia-based book, course, and article publisher SitePoint has disclosed it suffered a data breach after an unknown attacker compromised a third-party tool it uses to monitor its GitHub account, breached its infrastructure, and then stole approximately one million records containing "non-sensitive" customer data.

Microsoft has issued an alert urging customers to immediately patch two remote code execution (RCE) vulnerabilities and another flaw (CVE-2021-24086) that can be easily exploited to conduct denial-of-service (DoS) attacks. According to Microsoft, while all three vulnerabilities affect the Windows transmission control/internet protocol (TCP/IP) networking stack, CVE-2021-24086 is easy to exploit and can result in a "STOP" error accompanied by the Blue Screen of Death.

Iranian hacking groups "Domestic Kitten" (APT-C-50) and "Infy" (Prince of Persia), which are believed to be sponsored by the Iranian government, have been spotted conducting eavesdropping campaigns around the world in order to collect sensitive information. According to Check Point, Domestic Kitten was identified targeting victims in Afghanistan, Iran, Pakistan, Turkey, the U.K., the U.S., and Uzbekistan, while Infy was found targeting dissidents in 12 different countries.

In coordination with U.S. authorities, the Ukrainian attorney generals' office announced last week that, along with the National Police, it had shut down the "U-Admin" phishing service; seized computer equipment, hard drives, and cell phones; and arrested the 39-year-old man responsible for developing the phishing package and a special admin panel for the service.

Palo Alto Unit 42 researchers have disclosed the existence of "BendyBear," a new poly-morphic and "highly sophisticated" piece of malware that was initially discovered in August 2020 and includes capabilities similar to those found in the "WaterBear" malware family, which has been connected to the Chinese government-linked "BlackTech" cyber espionage group.

CD PROJEKT RED, the video game development studio behind Cyberpunk 2077 and The Witcher trilogy, has disclosed a ransomware attack that impacted its network.

A security researcher on Monday said the recent ransomware attacks on hospital chains in Florida and Texas are tied to the Conti ransomware gang.

Hackers broke into the computer system of a facility that treats water for about 15,000 people near Tampa, Florida and sought to add a dangerous level sodium hydroxide to the water supply. Remote access to OT what can go wrong?

US-CERT alert on the compromise of the Florida Water Treatment Facility - including technical details. Mentions of teamview and Windows 7 concerns. What could go wrong?

Use No. 16: It keeps snow from sticking to shovels. (Thanks to Chelle for this)