Posts

Vulnerability: Variants 3a and 4 of Side Channel Vulnerabilities

On May 21st, two vulnerabilities (CVE-2018-3640 –  Variant 3A- Rogue System Register Read and CVE-2018-3639 – Variant 4 – Speculative Store Bypass) were publicly disclosed.  These vulnerabilities indicate new variants of the Spectre and Meltdown class of hardware vulnerabilities and use “side-channel attacks” against speculative execution on many CPU architectures. Each of the vulnerabilities, Variants 3a and 4, attempt to exploit AMD, ARM and Intel CPUs. The effects vary from vendor to vendor. Details are scarce at this time on how an attacker would use these vulnerabilities in practical attacks.

A “side-channel attack,” targets the implementation of a computer system rather than the actual implemented software or algorithm.  The Spectre and Meltdown class of vulnerabilities use cache side-channel attacks, or monitor the cache within CPUs, to gain access to sensitive information that was previously unavailable through normal access.  Variant 3a uses a method of exploitation known as “Rogue System Register Read,” while Variant 4 uses an attack called speculative store bypass. Both vulnerabilities are highly complex and take advantage of various features of the “speculative execution” within various CPU architectures. Both if executed properly could result in unauthorized access to information within a system’s memory, such as passwords or other sensitive data.

The Proficio Threat Intelligence Recommendations:

  • Stay tuned for any type of practical attack that is being carried out in the wild against organizations leveraging these vulnerabilities. Note that these are difficult and complex vulnerabilities to leverage in practical attacks.
  • Apply standard patches and updates to both hardware, software, and operating systems that would mitigate risks of these vulnerabilities.

General Info – Click Here

Vulnerability: Red Hat DHCP Client Script Code Execution – CVE-2018-1111

A vulnerability affecting Red Hat DHCP Services was released via Twitter on May 16th. The exploit, tagged as Dynoroot by the research community and cataloged as CVE-2018-1111, allows an attacker to spoof a DHCP response and execute arbitrary commands with root privileges on a vulnerable Red Hat host. The vulnerability was discovered by Felix Wilhelm of Google, who stated the exploit could fit in a Tweet. Approximately six hours later, Barkın Kılıç, a Penetration Tester for Innovera, posted a proof-of-concept of the exploit using Dnsmasq, a lightweight service that can provide DHCP services.

The vulnerable platforms include the following:

  • RHEL 6
  • RHEL 7
  • Red Hat Fedora 28
  • Red Hat Enterprise Virtualization 4.1 (includes vulnerable components)

Proficio Threat Intelligence Recommendations:

  • Patch vulnerable Red Hat Operating Systems ASAP
  • Many IDPS vendors are releasing signatures for this attack (ex: Palo Alto – 40739 – RedHat DHCP Client Script Remote Code Execution Vulnerability). Put these signatures in block mode if possible if no well-known false positives are detected.
  • Make sure monitoring includes visibility of suspicious east / west traffic, especially for DHCP activity to and from RHEL servers.

 

General Info – Click Here

Twitter POC – Click Here

Vulnerability: Twitter passwords stored in plain text

Twitter recently announced that all 300+ million user passwords have been exposed by being stored in plain text, without any encryption technology protecting the data.

Twitter uses a password encryption technology known as “bcrypt”. Bcrypt leverages a password hashing functionality so that the system can validate the account authentication without revealing the password. The culprit of the exposure was an internal bug in the Bcrypt system. The bug caused the passwords to be written to the log prior to the completion of the password hashing process and stored in plain text.

Twitter CTO Parag Agrawal reported that an internal investigation has already identified and fixed the error. Agrawal explained that no evidence of the passwords being misused or leaving the system had been observed.

Proficio Threat Intelligence Recommendations:

  • Change your Twitter password immediately and on any other site you may have used the same password
  • Do not reuse duplicate passwords for individual accounts
  • Enable two factor authentication

 

General Info- Click Here

Vulnerability: KRACK Vulnerability Leaves Medical Devices Exposed

Numerous devices from medical technology company Becton, Dickinson and Company (BD) are vulnerable to the KRACK key-reinstallation attack directly impacting the integrity and confidentiality of patient records.

KRACK could allow a malicious actor to execute a man-in-the-middle attack, allowing the attacker within radio range to replay, decrypt or spoof frames leaving PHI exposed to unauthorized persons over WiFi.

Versions of BD Pyxis, the company’s medication and supply management system, are impacted by the vulnerability, according to ICS-CERT. That includes 12 versions of the system, such as the BD Pyxis Anesthesia ES, BD Pyxis SupplyStation, and BD Pyxis Parx handheld.

Proficio Threat Intelligence Recommendations:

  • Patch to the latest recommended updates for Wi-Fi access points implemented in Wi-Fi enabled networks
  • Ensure that appropriate physical controls are in place to prevent attackers from being within physical range of an affected Wi-Fi access point and client
  • Ensure data has been backed up and stored according to your individual processes and disaster recovery procedures

General Information –  Click Here

Vulnerability: CVE-2018-0228 – Cisco ASA DOS Vulnerability

A vulnerability has been discovered in the ingress flow creation functionality of the Cisco Adaptive Security Appliance (ASA).  This vulnerability could potentially allow an unauthenticated, remote attacker to send a steady stream of malicious IP packets to DoS (denial of service) and infect the system by maxing out CPU usage. A DoS of this type could cripple network traffic that is being routed through the device, and would directly impact the availability of business resources. Cisco has not publicly released details regarding what traffic to send to initiate the DoS.

This vulnerability affects Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software that is running on the following Cisco products:

  • 3000 Series Industrial Security Appliances (ISA)
  • ASA 5500 Series Adaptive Security Appliances
  • ASA 5500-X Series Next-Generation Firewalls
  • ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
  • Adaptive Security Virtual Appliances (ASAv)
  • Firepower 2100 Series Security Appliances
  • Firepower 4110 Security Appliances
  • Firepower 9300 ASA Security Modules.

Proficio Threat Intelligence Recommendations:

  • Workaround: The ASA and FTD configuration commands, set connection per-client-embryonic-max (TCP) and set connection per-client-max (TCP, UDP, and Stream Control Transmission Protocol {SCTP}), can be configured to limit the number of connection requests allowed.  Setting the vendor recommended configuration parameters can reduce the number of connections and greatly reduce the impact of the DoS attack
  • Permanent Fix: Customers should upgrade to an appropriate firmware release as indicated in the link below

Firmware Checker –  Click Here

Vulnerability: Trustjacking

A new iPhone vulnerability was disclosed at the RSA Conference in San Francisco. The vulnerability allows persistent control over an iPhone device without it being physically connected to a computer. With just a simple tap by the iOS device owner when connected to the same network as the attacker, the network link grants permanent control of the device without the owner even knowing the device has been compromised.This vulnerability exploits a weakness in an iOS function called iTunes Wi-Fi sync, a feature that allows users to sync up iTunes content and data between Apple devices wirelessly.

How it works:

  • User connects phone to a malicious charger/computer and chooses to trust it
  • Attacker allows the device to connect to iTunes and enables iTunes Wi-Fi sync (can be accomplished automated without user interaction)
  • The attacker remotely installs a developer image suitable to users iOS version over Wi-Fi

Attackers are then able to gain access to photos, install applications, remote backup as well as receive a livestream of the screen without needing any other confirmation from the user. After that initial “tap to trust” moment, the attacker does not require any more interaction with the user and all of the user’s vulnerable data is accessible remotely.

Proficio Threat Intelligence Recommendations:

  • Clear all “trusted” computers on iOS devices by resetting the location and privacy settings
  • Enable encrypted backup on your iOS devices

General Information – Click Here

Vulnerability: CVE-2018-0171 – Cisco IOS and IOS XE Software Smart Install – Remote Code Execution

Cisco has disclosed a vulnerability in the Smart Install feature of the Cisco IOS Software and Cisco IOS XE Software.  This vulnerability could allow an unauthenticated, remote attacker to execute arbitrary code on affected switches as well as leverage this vulnerability to cause the devices to reload, which will result in a temporary DoS while the devices are reloading.

The vulnerability is due to improper validation of packet data resulting in a buffer overflow. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected switch on TCP port 4786. Only Smart Install client switches are affected by the vulnerability. Smart Install client functionality is enabled by default on Cisco IOS switches on software releases that have not been updated to address the Cisco bug ID CSCvd36820.

Researchers said they had identified roughly 250,000 vulnerable Cisco devices with TCP port 4786 open. Sophisticated nation-state groups have previously exploited vulnerabilities in Smart Install in their campaigns targeting critical infrastructure. There has not been any evidence indicating that CVE-2018-0171 has been exploited in malicious attacks.

Cisco has responded by releasing software updates to fix this critical vulnerability for affected switches. Switches that are running releases earlier than Cisco IOS Software Release 12.2(52)SE are not capable of running Smart Install.

Proficio Threat Intelligence Recommendations:

  • Utilize the Cisco IOS Software Checker to determine if devices are vulnerable

Cisco IOS Software Checker – Click Here
General Information – Click Here

Vulnerability: CVE-2018-7600 – Drupal core – Remote Code Execution

A vulnerability has been discovered that could allow criminals to execute code remotely on websites that are running Drupal. Drupal is a Content Management System (CMS) that is used by more than 1 million websites worldwide. According to W3techs.com, Drupal is third most popular CMS, only behind Joomla and WordPress.

The discovered vulnerability can be exploited by an input validation issue that allows unsanitized data to enter Drupal’s data space. Drupal warns that an unprivileged and untrusted attacker could compromise the site and modify or delete data hosted on affected CMS platforms.

Due to the high criticality of the vulnerability, Drupal informed website administrators a week prior that important fixes would be coming soon.The idea was to attempt to stay ahead of potential attackers who could quickly develop code that would exploit Drupal websites once made aware of the vulnerability.

Drupal has since released updates to patch the vulnerability and recommends users who have deployed the Content-Management Framework to immediately update to versions 7.58 or 8.5.1. Although Drupal versions 8.3.x and 8.4.x are no longer supported, Drupal has released an out-of-band patch that would fix the highly critical security issue in updates 8.3.9 and 8.4.6.

Proficio Threat Intelligence Recommendations:

  • Immediately update Drupal to versions 7.58 or 8.5.1

General Info – Click Here

Drupals FAQ surrounding CVE-2018-7600 – Click Here

Vulnerability: Apache – CVE-2017-5638 – Apache Struts Jakarta Parser

In March of 2017, attackers began exploiting a bug in the Apache Struts Jakarta Multipart parser. The attack resulted in attackers being able to execute arbitrary commands on HTTP servers with specially crafted HTTP requests. This vulnerability has recently gained additional buzz because there has been a recently named campaign (Zealot) that uses this vulnerability to compromise a web server and gain a foothold on the network and then use EternalBlue and EternalSynergy exploits to move laterally.

Campaign using vulnerability to gain foothold via web servers – https://f5.com/labs/articles/threat-intelligence/cyber-security/zealot-new-apache-struts-campaign-uses-eternalblue-and-eternalsynergy-to-mine-monero-on-internal-networks?sf176487178=1

NVD Reference – https://nvd.nist.gov/vuln/detail/CVE-2017-5638#vulnDescriptionTitle

Proficio Threat Intelligence Recommendations:

  • Upgrade to Struts 2.3.32 or Struts 2.5.10.1 on any Apache system within the organization

Proficio Observes New Bluetooth Vulnerabilities

Proficio has observed several open sources of intelligence that have detailed the release of multiple critical vulnerabilities for Bluetooth and an attack vector utilizing those vulnerabilities known as “BlueBorne.” Here are the details we have gathered so far.

BlueBorne Summary

Multiple news outlets have reported the discovery of several important vulnerabilities in both the design and implementation of the Bluetooth communication protocol. These vulnerabilities are notable for both their unusual reach and effectiveness since, according to sources, unpatched devices can be compromised by attacking devices within 32 feet, with the only requirements being that the Bluetooth must be turned on. The vulnerabilities are further magnified by Bluetooth being the leading and most widely utilized protocol for short-range connectivity and communications. These vulnerabilities can be utilized by attackers to run malicious codes on vulnerable devices as well as perform Man-in-the-Middle (MITM) attacks. More information can be found here.

Technical Details

There are eight fully operational and exploitable vulnerabilities identified and released at this time.

1. Linux kernel RCE vulnerability – CVE-2017-1000251

This vulnerability allows an attacker to perform a buffer overflow attack on a 64-byte buffer on the kernel stack by an unlimited amount of data. While stack overflow attacks does not automatically translate into code execution due to the presence of mitigation techniques on modern operating systems, most devices running Linux today lack such mitigation techniques like stack canaries and Kernel Address Space Layout Randomization.

2. Linux Bluetooth stack (BlueZ) information Leak vulnerability – CVE-2017-1000250

This vulnerability is due to a mistake in the implementation of fragmentation mechanisms within Bluetooth’s Service Discovery Protocol (SDP) on Linux systems. The vulnerability allows an attacker to perform an out of bounds read from the response buffer sent from an SDP server. BlueZ comprises two parts, one running in the kernel and the other in the user space within the Bluetooth process. Some examples of the critical data that can be leaked include encryption keys used in Bluetooth communications.

3. Android information Leak vulnerability – CVE-2017-0785

This vulnerability is due to a mistake in the implementation of fragmentation mechanisms within Bluetooth’s Service Discovery Protocol (SDP) on Android systems. As with the vulnerability described above, this allows an attacker to effectively perform an out of bound read from the response buffer sent from an SDP server. Some of the data that can then be leaked include encryption keys, address spaces and pointers

4. Android RCE vulnerability #1 – CVE-2017-0781

This is the first of two vulnerabilities found in the code flow handling incoming Bluetooth Network Encapsulation Protocol control messages. This vulnerability allows an attacker to use an arbitrarily sized packet to overflow 8 bytes on the heap following a buffer of any chosen size.

This is made easier as the Bluetooth service in Android is immediately and automatically restarted by the Android Service Manager when it crashes.

5. Android RCE vulnerability #2 – CVE-2017-0782

This is the second of two vulnerabilities found in the code flow handling incoming Bluetooth Network Encapsulation Protocol control messages. This vulnerability allows an attacker to create a heap spray and cause remote code execution if the heap is groomed prior to the overflow.

This is made easier as the Bluetooth service in Android is immediately and automatically restarted by the Android Service Manager when it crashes.

6 & 7. The Bluetooth Pineapple in Android – Logical Flaw CVE-2017-0783 and the Bluetooth Pineapple in Windows – Logical Flaw CVE-2017-8628

The Security Management Protocol within Bluetooth allows for the bypass of authentication and short-term pairing with an Android or Windows devices. This allows an attacker to obtain access to higher level services and profiles such as PAN. Due to the low security level requirement, an attacker can leverage the capabilities of the PAN profile without any authorization to force the victim device to treat the attacker as a new network interface, forcing a DHCP request from the victim. This allows an attacker to perform a MITM attack much like the WiFi Pineapple without any user interaction required.

8. Apple Low Energy Audio Protocol RCE vulnerability – CVE-2017-14315

This vulnerability was identified within a protocol created by Apple operating on top of Bluetooth, known as Low Energy Audio Protocol (LEAP). Insufficient validation allows an attacker to achieve a heap overflow. As this can be triggered multiple times, code execution can be achieved. Again, an attack on this vulnerability does not require any user interaction.

Current Protection Provided by Security Vendors

As is common with such releases, patches are typically made available prior to the release of information. ProSOC notes the following vendors have verified patches:

Microsoft:

All identified vulnerabilities in BlueBorne has been addressed and patched in this month’s security advisory
https://support.microsoft.com/en-us/help/20170912/security-update-deployment-information-september-12-2017
https://portal.msrc.microsoft.com/en-us/security-guidance/summary

Google (Android):

Google has provided device manufacturers with a patch last month, and the patches were made available for users of Google branded phones.
https://source.android.com/security/bulletin/2017-09-01

Apple:

Only Apple’s iOS prior to version 10 are vulnerable. The vulnerability was already mitigated by Apple in iOS 10.

Recommendations and Summary

While it is unlikely that mission-critical systems are Bluetooth enabled, the vulnerabilities and exploits tied to those vulnerabilities require no user or victim interactions and are therefore worm-able. This means that such vulnerabilities can be exploited much like WannaCry with ShadowBroker’s exploits. Given that Bluetooth communications are typically not monitored within a corporate environment and its nature as a covert channel of communications, this should be treated seriously.

As such, we would very strongly recommend disabling and minimizing the use of Bluetooth on affected Bluetooth enabled devices until the confirmation of an installed patch. Beyond that, vulnerability releases like BlueBorne serve to illustrate a very important lesson. There are no invulnerable services, no invulnerable protocols and certainly no invulnerable implementations. It is therefore important to assess if services or protocols are essential for use within a given environment. Services and protocols that are unessential should be disabled or removed from a given environment.