The Consensus Security Vulnerability Alert

ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html

Malware Dropped Through a ZPAQ Archive

Published: 2023-11-01

Last Updated: 2023-11-01 06:33:33 UTC

by Xavier Mertens (Version: 1)

Did you ever seen ZPAQ archives? This morning, my honeypot captured a phishing attempt which lured the potential victim to open a "ZPAQ" archive. This is not a common file format. This could be used by the attacker to bypass classic security controles. What Wikiepadia says about ZPAQ:

ZPAQ is an open source command line archiver for Windows and Linux. It uses a journaling or append-only format which can be rolled back to an earlier state to retrieve older versions of files and directories. It supports fast incremental update by adding only files whose last-modified date has changed since the previous update. It compresses using deduplication and several algorithms (LZ77, BWT, and context mixing) depending on the data type and the selected compression level. To preserve forward and backward compatibility between versions as the compression algorithm is improved, it stores the decompression algorithm in the archive.

The file was called "Purchase Order pdf<dot>zpaq" (SHA256:1c33eef0d22dc54bb2a41af485070612cd4579529e31b63be2141c4be9183eb6). The fact that the archive is using an "exotic" compress algorithm, the VT score is null! I tried the classic tools on a stock Windows operating systems, including 7Zip and no one was able to decompress the archive. This is a strange because it reduces the number of potential victims! On Windows, you can use PeaZip.

Read the full entry:

https://isc.sans.edu/diary/Malware+Dropped+Through+a+ZPAQ+Archive/30366/

Multiple Layers of Anti-Sandboxing Techniques

Published: 2023-10-31

Last Updated: 2023-10-31 14:51:53 UTC

by Xavier Mertens (Version: 1)

It has been a while that I did not find an interesting malicious Python script. All the scripts that I recently spotted were always the same: a classic intostealer using Discord as C2 channel. Today I found one that contains a lot of anti-sanboxing techniques. Let's review them. For malware, it's key to detect the environment where they are executed. When detonated inside a sandbox (automatically or, manually, by an Analyst), they will be able to change their behaviour (most likely, do nothing)

Like all scripting languages running in the Windows eco-system, Python can call any Microsoft API call and there are useful to perform check at operating system. Here is what the scripts try to detect ...

Read the full entry:

https://isc.sans.edu/diary/Multiple+Layers+of+AntiSandboxing+Techniques/30362/

Flying under the Radar: The Privacy Impact of multicast DNS

Published: 2023-10-30

Last Updated: 2023-10-30 15:30:39 UTC

by Johannes Ullrich (Version: 1)

The recent patch to iOS/macOS for CVE-2023-42846 made me think it is probably time to write up a reminder about the privacy impact of UPNP and multicast DNS. This is not a new issue, but it appears to have been forgotten a bit [vuln]. In particular, Apple devices are well-known for their verbose multicast DNS messages.

What is multicast DNS?

Typically, we think of DNS as a client-server protocol where our clients will connect to preconfigured resolvers. In this scenario, it is possible to register hostnames dynamically. Still, the setup is complex and requires configuring the DNS server to allow for these registrations. For a home user, this is complex, but you would still like to have the option to refer to systems by hostname instead of by IP address.

Multicast DNS solves two issues: It allows hosts to register their name and any services they offer and allows hosts connected to the same local network to find services offered by hosts on the network. Multicast DNS uses port 5353 and the multicast group 224.0.0.251 (IPv4) or ff02::fb (IPv6). These are link-local addresses, and the traffic is not routable. The main security feature of Multicast DNS is that the messages only reach local hosts on a (believed to be) trusted local network. There is no authentication or encryption of the messages as this would require some cryptographic key infrastructure. The protocol is supposed to be "plug and play."

Netbios and LLMNR have played roles like this in Windows, but even Windows has been moving to mDNS. While mDNS was originally developed by Apple as "Bonjour", it has now been adopted by Windows and Linux. Another similar protocol is SSDP (Simple Service Discovery Protocol). SSDP is often used next to mDNS. But SSDP never became an IETF standard, and no RFC describes it. Instead, the SSDP standard is now defined as part of Universal Plug and Play (UPNP) [upnp] ...

Read the full entry:

https://isc.sans.edu/diary/Flying+under+the+Radar+The+Privacy+Impact+of+multicast+DNS/30358/

Spam or Phishing? Looking for Credentials & Passwords (2023.10.29)

https://isc.sans.edu/diary/Spam+or+Phishing+Looking+for+Credentials+Passwords/30354/

Size Matters for Many Security Controls (2023.10.28)

https://isc.sans.edu/diary/Size+Matters+for+Many+Security+Controls/30352/

Adventures in Validating IPv4 Addresses (2023.10.26)

https://isc.sans.edu/diary/Adventures+in+Validating+IPv4+Addresses/30348/

Product: ILIAS CVSS Score: 9.0NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-45869NVD References: - https://rehmeinfosec.de/labor/cve-2023-45869- https://rehmeinfosec.de/report/358ad5f6-f712-4f74-a5ee-476efc856cbc/CVE-2023-42769 - Cookie session ID in this product is too short, enabling brute force attacks, leading to unauthorized session access, authentication bypass, and transmitter manipulation by remote attackers.Product: Sielco Radio Link and Analog FM TransmittersCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-42769NVD References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-08CVE-2023-46661 - Sielco PolyEco1000 is vulnerable to an attacker escalating their privileges by modifying passwords in POST requests.Product: Sielco PolyEco1000CVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-46661NVD References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07CVE-2023-5754 - Sielco PolyEco1000 has weak default administrative credentials, making the system vulnerable to remote password attacks and granting full control.Product: Sielco PolyEco1000CVSS Score: 9.1NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-5754NVD References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07CVE-2023-46665 - Sielco PolyEco1000 allows attackers to gain unauthorized administrative access through an authentication bypass vulnerability.Product: Sielco PolyEco1000CVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-46665NVD References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-07CVE-2023-5790 - SourceCodester File Manager App 1.0 is affected by a critical vulnerability in the file endpoint/add-file.php, allowing for unrestricted remote file uploads.Product: Remyandrade File Manager AppCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-5790NVD References:  - https://github.com/Yp1oneer/cve_hub/blob/main/File%20Manager%20App/Unrestricted%20File%20Upload.pdf- https://vuldb.com/?ctiid.243595- https://vuldb.com/?id.243595CVE-2023-5792 - SourceCodester Sticky Notes App 1.0 is prone to a critical remote SQL injection vulnerability (VDB-243598) via manipulation of the "note" parameter in the endpoint/delete-note.php file, which has been publicly disclosed and could be exploited.Product: Remyandrade Sticky Notes AppCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-5792NVD References: - https://github.com/Yp1oneer/cve_hub/blob/main/Sticky%20Notes%20App/SQL%20Injection-1.pdf- https://vuldb.com/?ctiid.243598- https://vuldb.com/?id.243598CVE-2023-46435 - Sourcecodester Packers and Movers Management System v1.0 is vulnerable to SQL Injection via mpms/?p=services/view_service&id.Product: Oretnom23 Packers And Movers Management SystemCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-46435NVD References: https://github.com/kirra-max/bug_reports/blob/main/packers-and-movers-management-system-phpoop-free-source-code/SQL-1.mdCVE-2023-44267, CVE-2023-43737,CVE-2023-44268, CVE-2023-43738, CVE-2023-44162, CVE-2023-44375, CVE-2023-44376, CVE-2023-44377 - Online Art Gallery v1.0 multiple unauthenticated SQL Injection vulnerabilities.Product: Online Art Gallery  v1.0CVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-44267NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-43737NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-44268NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-43738NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-44162NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-44375NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-44376NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-44377NVD References: https://fluidattacks.com/advisories/onoNVD References: https://https://projectworlds.in/CVE-2023-5820 -  The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery, allowing unauthenticated attackers to upload arbitrary files by tricking a site administrator into performing a specific action.Product: WordPress Thumbnail Slider With Lightbox pluginCVSS Score: 9.6NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-5820NVD References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=1263536%40wp-responsive-slider-with-lightbox&new=1263536%40wp-responsive-slider-with-lightbox&sfp_email=&sfph_mail=- https://wordpress.org/plugins/wp-responsive-slider-with-lightbox- https://www.wordfence.com/threat-intel/vulnerabilities/id/e51e1cd2-6de9-4820-8bba-1c6b5053e2c1?source=cveCVE-2023-5807 - TRtek Software Education Portal allows SQL Injection before 3.2023.29.Product: TRtek Software  Education PortalCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-5807NVD References: https://www.usom.gov.tr/bildirim/tr-23-0608CVE-2023-46604 - Apache ActiveMQ is vulnerable to Remote Code Execution through manipulation of serialized class types in the OpenWire protocol, allowing an attacker to run arbitrary shell commands on the broker.Product: Apache ActiveMQCVSS Score: 10.0NVD: h…