INTERNET STORM CENTER SPOTLIGHT
ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html
Microsoft September 2024 Patch Tuesday
Published: 2024-09-10.
Last Updated: 2024-09-10 17:59:45 UTC
by Johannes Ullrich (Version: 1)
Today, Microsoft released its scheduled September set of patches. This update addresses 79 different vulnerabilities. Seven of these vulnerabilities are rated critical. Four vulnerabilities are already being exploited and have been made public.
Noteworthy Vulnerabilities:
CVE-2024-43491: This "downgrade" vulnerabilities. An attacker can remove previously applied patches and exploit older vulnerabilities. This issue only affects Windows 15 Version 1507, which is EOL. It appears to differ from the similar vulnerabilities (CVE-2024-38202 and CVE-2024-21302) made public by Alon Leviev during Blackhat this year. These two vulnerabilities appear to remain unpatched.
CVE-2024-38014: A Windows Installer issue could lead to attackers gaining System access.
CVE-2024-38217: Yet another "Mark of the Web" bypass that is already exploited and could be used to trick a victim into installing malware.
CVE-2024-38226: Similar to the above vulnerability, a security feature bypass in Publisher.
Microsoft also patched four remote code execution vulnerabilities in Sharepoint, but the lower CVSS score indicates that exploitation will require access and specific prerequisites.
CVE-2024-38119: A critical vulnerability in the Windows NAT code. The low CVSS score is likely because this is not enabled by default.
https://isc.sans.edu/diary/Microsoft+September+2024+Patch+Tuesday/31254/
Attack Surface [Guest Diary]
Published: 2024-09-04.
Last Updated: 2024-09-05 01:15:09 UTC
by Guy Bruneau (Version: 1)
[This is a Guest Diary by Joshua Tyrrell, an ISC intern as part of the SANS.edu BACS program]
Managing the Attack Surface
You’ve begun the journey of reviewing your IT infrastructure and attempting to figure out how to protect yourself from those who might not have the greatest intentions. That’s great! Stop yourself though, before you get too far into the weeds of the different technologies available to you to defend yourself. Before you get to that point, there are some details that need to be fleshed out. Let’s have a look:
What industry are you in? Depending on the service provided, you may already have a baseline that you need to be at, provided to you by those who came before you and have danced with those who mean you harm.
Where and who do you do business with? If you’re a utility provider in Topeka, Kansas, does it make sense to have your online presence available to the general public outside of the Continental United States? Think about the potential risk versus limiting access to those who need to manage it.
What does your organization actually need to be successful? What data do you actually need to survive, what devices are necessary, what software will get you to where you need to be?
These are all pertinent questions to either scaling up or scaling down your attack surface and working towards having chaos-free Friday nights.
Fortify the Exterior Walls
Defense-in-Depth is the name of the game in the 21st Century, but that doesn’t mean we shouldn’t be doing what we can to make sure the perimeter walls aren’t as imposing as possible. You use firewalls, yes, but are you using them to their maximum potential? Modern firewalls allow for geo-blocking, which is the blocking of traffic based on IP addresses correlated to countries. These databases are updated somewhat regularly, so there is maintenance to be done on your firewalls to make sure they’re up to date. If you’d like even stronger evidence for using geo-blocking, search for “Top 10 Countries where cyber attacks originate”. Lists have been generated by teams across the world to show where many of the world’s cyber criminals are calling home. Now though, what if you do have a business partner that resides in one of those countries that you may not want traffic widely from? Easy enough, create an exception for their ASN in the geo-fence.
Another tool at your disposal is reputation filtering. This process allows your firewall to reference the IP of either source or destination and forward or drop the packet as per the policy. This can be highly effective at reducing the amount of potentially malicious traffic that is not initially blocked by your geo-fence. Take heed though: Cloud Service Providers may be unintentionally flagged and dropped due to the nature of their business model. There is a way to help you navigate this mystery though, and that is to simply look at who the largest CSP’s are, and weigh that against historical traffic to your assets. You may want to allow AWS, Azure, GCP, and even DigitalOcean, but how about that small-time server farm in Seychelles? Or the Netherlands? Those you can probably block outright, after considering those initial questions we talked about earlier.
https://isc.sans.edu/diary/Attack+Surface+Guest+Diary/31232/
Scans for Moodle Learning Platform Following Recent Update
Published: 2024-09-04.
Last Updated: 2024-09-04 14:37:39 UTC
by Johannes Ullrich (Version: 1)
On August 10th, the popular learning platform "Moodle" released an update fixing CVE-2024-43425. RedTeam Pentesting found the vulnerability and published a detailed blog post late last week. The blog post demonstrates in detail how a user with the "trainer" role could execute arbitrary code on the server. A trainer would have to publish a "calculated question". These questions are generated dynamically by evaluating a formula. Sadly, the formula was evaluated using PHP's "eval" command. As pointed out by RedTeam Pentesting, "eval" is a very dangerous command to use and should be avoided if at all possible. This applies not only to PHP but to most languages (also see my video about command injection vulnerabilities). As I usually say: "eval is only one letter away from evil".
The exploit does require the attacker to be able to publish questions. However, Moodle is used by larger organizations like Universities. An attacker may be able to obtain credentials as a "trainer" via brute forcing or credential stuffing.
I got pointed to "Moodle" after seeing this URL in our "First Seen" list of newly accessed URLs ...
https://isc.sans.edu/diary/Scans+for+Moodle+Learning+Platform+Following+Recent+Update/31230/