Patching Exchange Servers, Book Reviews, Rockwell, & Forgotten AM Broadcasts – PSW #685

Paul Asadoorian

1. Review: Perlroth’s book on the cyberarms market
   I am not the only one who finds this book to be, well, just horrible on so many levels. Props to Robert for actually getting through the whole thing, I could not... On a positive note, Perlroth's colleague, David Sanger, did a nice job with "The Perfect Weapon". I did not do a complete fact-check on Sanger's book, but I did enjoy listening to it. There is also Halvar's review, which also points out several more inaccuracies and hyperbole: http://addxorrol.blogspot.com/2021/02/book-review-this-is-how-they-tell-me.html
2. Chinese Exchange Hack: At Best, Microsoft is Incompetent
   Interesting snippets: "Some suspect it’s a sneaky way to encourage customers to dump on-prem Exchange and use Office 365 instead." and "Alright, just finished patching our server. Started documenting at 9AM, had all steps ready at [noon], and it’s now exactly midnight, only because I’ve never updated Exchange server before and nobody else that’s left in IT knows how to do it."
3. Why We Need More Blue Team Voices at the Table
   "I'm going to tell you one of the dirty secrets of enterprise cybersecurity. There are a lot of practitioners that secretly wish their company would get attacked. Because at least then, someone would listen to them. These people tend to reside on what we frequently refer to as the blue team."
4. Microsoft Exchange Zero-Day Attackers Spy on U.S. Targets
   The rabbit hole is even deeper than this: "The fact that Microsoft chose to patch these flaws out-of-band rather than include them as part of next week’s Patch Tuesday release leads us to believe the flaws are quite severe even if we don’t know the full scope of those attacks,” Satnam Narang, staff research engineer at Tenable, said via email."
5. Russian cybercrime forum hacked, user details exposed. Oh dear. How unfortunate…
6. Several Cisco Products Exposed to DoS Attacks Due to Snort Vulnerability
   Interesting: "The vulnerability was found during the resolution of a support case and there is no evidence that it has been exploited in malicious attacks."
7. Is Your Browser Extension a Botnet Backdoor?
   LOL: "The founder and director of Infatica — a resident of Biysk, Russia named Vladimir Fomenko — did not respond to multiple requests for comment."
8. Okta to Buy Rival Auth0
   Also, Thycotic and Centrify have been merged. If you predicted there would be consolidation in cybersecurity, you'd be correct.
9. Hacking is not a crime – and the media should stop using ‘hacker’ as a pejorative
   You go Alyssa Miller, go on with ya bad self (we got your back too): "Using the term “hacker” to describe cyber criminals is an unfortunate habit that plagues modern media. The accompanying imagery of hoodie-clad individuals hunched over computer displays in darkened rooms exacerbates the issue. The predominance of associating hacker with cyber criminals has exploded as cyber-attacks and breaches have become regular topics in mainstream media. However, using “hacker” in such a pejorative manner is perilous, both for its lack of precision and the counter-productive impact it can have on society." BRAVO! (See also: https://securityweekly.com/shows/unraveling-your-software-bill-of-materials-alyssa-miller-esw-186/)
10. Qualys hit with ransomware: Customer invoices leaked on extortionists’ Tor blog
    Official statements from Qualys highlight their response: "Speaking of the actions the firm took to remediate, Qualys's CISO, Ben Carr, said: "The zero-day vulnerability affecting Accellion was discovered by Accellion in another customer’s environment and a hotfix to remediate the vulnerability was released on December 21, 2020. The Qualys IT team applied the hotfix to secure our Accellion FTA server on December 22, 2020."
11. Home-Office Photos: A Ripe Cyberattack Vector
    "Analysis of images of home-working environments has revealed work email inboxes, internal emails, names of individuals in emails, private web pages, potentially sensitive internal business correspondence, software installed on computers and internal identification numbers of devices"
12. Scan the whole internet while drinking coffee
13. Another Chrome zero-day exploit – so get that update done!
    Wondering how this transfers, or if it transfers, to other Chromium-based browsers, such as Chromium and Edge. I'm actually running Edge on Linux. And I actually like it so far.
14. AnyDesk UDP Discovery Remote Code Execution (CVE-2020-13160) – devel0pment.de
    Amazing write-up, if you are interested in reverse engineering and/or exploit development, this is the post for you. Also, really neat how they were able to reverse the protocol and make changes in the management client.
15. AnyDesk 5.5.2 Remote Code Execution
16. Hard-coded key vulnerability in Logix PLCs has severity score of 10 out of 10
    Yikes: “Any affected Rockwell Logix controller that is exposed on the Internet is potentially vulnerable and exploitable,” said Sharon Brizinov, principal vulnerability researcher at Claroty, one of three organizations Rockwell credited with independently discovering the flaw. “To successfully exploit this vulnerability, an attacker must first obtain the secret key and have the knowledge of the cryptographic algorithm being used in the authentication process.” - SAY WHAT? - "Brizinov said that Claroty notified Rockwell of the vulnerability in 2019. Rockwell didn’t disclose it until Thursday."
17. Hackers release a new jailbreak tool for almost every iPhone – TechCrunch
18. Amazon Dismisses Claims Alexa ‘Skills’ Can Bypass Security Vetting Process

Doug White

1. Exchange servers need to be patched.
2. TALON surveillance cams can tell if you’ve been naughty or nice.
3. Global chip shortage may not resolve anytime soon.
4. Overclocking warranties die as the hobby dies.
5. GTX 970 rocks. Sure it’s old.

Larry Pesce

1. New SUNSHUTTLE Second-Stage Backdoor Uncovered Targeting U.S.-Based Entity; Possible Connection to UNC2452
2. Three Top Russian Cybercrime Forums Hacked — Krebs on Security
3. GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence – Microsoft Security
4. Malicious Code Bombs Target Amazon, Lyft, Slack, Zillow
5. Hackers Now Hiding ObliqueRAT Payload in Images to Evade Detection
6. matt blaze on Twitter
7. HAFNIUM targeting Exchange Servers with 0-day exploits – Microsoft Security

Lee Neely

1. US Telemarketing Biz Exposes 114,000 in Cloud Config Error
   A misconfigured, unsecured AWS S3 bucked belonging to U.S.-based telemarking firm CallX has been found exposed online containing some 114,000 files that include personally identifiable information (PII) belonging to "thousands of customers."
2. Mitigate Microsoft Exchange Server Vulnerabilities
   Microsoft has released out-of-band security updates to address four vulnerabilities in Exchange Server: CVE-2021-26855 allows an unauthenticated attacker to execute arbitrary code on vulnerable Exchange Servers, enabling the attacker to gain persistent system access, as well as access to files and mailboxes on the server and to credentials stored on that system.
3. Microsoft says a group of cyberattackers tied to China hit its Exchange email servers
   Microsoft and outside researchers say the China-linked cyber espionage group "Hafnium" has been exploiting four previously undetected vulnerabilities affecting different versions of Microsoft's mail server software in a hacking campaign designed to steal emails from targeted mailboxes. Microsoft and outside researchers say the China-linked cyber espionage group "Hafnium" has been exploiting four previously undetected vulnerabilities affecting different versions of Microsoft's mail server software in a hacking campaign designed to steal emails from targeted mailboxes. The four newly disclosed vulnerabilities in Microsoft Exchange enable malicious actors to bypass authentication, remotely access email accounts, and deploy additional malware and are being tracked as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065.
4. https://us-cert.cisa.gov/ics/advisories/icsa-21-056-03
   Rockwell recommends users requiring setup or deployment guidance for CIP Security should refer to the deployment reference guide. Users can also refer to Rockwell Automation’s System Security Design Guidelines (https://literature.rockwellautomation.com/idc/groups/literature/documents/rm/secure-rm001_-en-p.pdf) on how to use Rockwell Automation products to improve the security of their industrial automation systems. The authentication vulnerability does not affect CIP Security.
5. Experts found a critical authentication bypass flaw in Rockwell Automation software
   Researchers have identified a critical authentication bypass vulnerability (CVE-2021-22681) affecting the Logix Designer software used in Rockwall Automation's programmable logic controllers (PLCs) that could be exploited by unauthenticated, remote attackers to bypass verification mechanisms, connect to Logix controllers, and alter a controller's configuration.
6. NSA Publishes Guidance on Adoption of Zero Trust Security
   The U.S. National Security Agency (NSA) has issued a document titled "Embracing a Zero Trust Security Model" to provide guidance to security professionals on how they can adopt and implement a "Zero Trust" security model to more adequately secure sensitive data.
7. Working Windows and Linux Spectre exploits found on VirusTotal
   Working exploits targeting Linux and Windows systems not patched against Spectre were found by security researcher Julien Voisin on VirusTotal. The exploits require local access and a non-patched system.
8. Boat Building Giant Beneteau Says Cyberattack Disrupted Production
   French boat maker Groupe Beneteau is working on restoring operations after falling victim to a cyber-attack roughly ten days ago. After discover they reported the deployment of a backup application and systems.
9. Over 8 million COVID-19 test results leaked online
   Indian government websites have inadvertently leaked the COVID-19 test results of more than eight million West Bengali citizens, according to researchers and Bleeping Computer. Malicious actors have leveraged the pandemic to enhance social engineering campaigns, and the publicly leaked PII in this incident could be used to advance these operations.