INTERNET STORM CENTER SPOTLIGHT
ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html
From Perfctl to InfoStealer
Published: 2024-10-09.
Last Updated: 2024-10-09 07:18:37 UTC
by Xavier Mertens (Version: 1)
A few days ago, a new stealthy malware targeting Linux hosts made a lot of noise: perfctl. The malware has been pretty well analyzed and I won’t repeat what has been already disclosed. I found a copy of the "httpd" binary (SHA256:22e4a57ac560ebe1eff8957906589f4dd5934ee555ebcc0f7ba613b07fad2c13). I dropped the malware in my lab to see how it detonated. I infected the lab without root privileges and detected the same behavior except files were not written to some locations due to a lack of access (not root). When executing without root privileges, the rootkit feature is unavailable and the malware runs "disclosed" ...
Read the full entry:
https://isc.sans.edu/diary/From+Perfctl+to+InfoStealer/31334/
Microsoft Patch Tuesday - October 2024
Published: 2024-10-08.
Last Updated: 2024-10-08 19:18:33 UTC
by Johannes Ullrich (Version: 1)
Microsoft today released patches for 117 vulnerabilities. Three additional vulnerabilities apply to Chromium/Edge. Another three vulnerabilities are rated critical.
Five of the vulnerabilities were disclosed before today. Two vulnerabilities were not only disclosed but also exploited, according to Microsoft
Notable Vulnerabilities:
Microsoft Management Console Remote Code Execution Vulnerability (CVE-2024-43572)
To Exploit this vulnerability, the attacker must convince the victim to open a malicious file.
Open Source Curl Remote Code Execution Vulnerability (CVE-2024-6197)
This vulnerability was disclosed and patched in libcurl back in July. Accordng to curl.se, the most likely outcome is a crash, but code execution can not be ruled out.
Windows Hyper-V Security Feature Bypass Vulnerability (CVE-2024-20659)
The vulnerability allows an attacker to bypass the UEFI on the host machine and compromise the hypervisor and the secure kernel. Exploitation requires a reboot at the right time.
Windows MSHTML Platform Spoofing Vulnerability (CVE-2024-43573)
yet another Windows MSHTML Platform Spoofing vulnerability. Fourth 0-day just this year in this component. APT actors usually use these issues to make downloading and executing malware more likely.
Read the full entry:
https://isc.sans.edu/diary/Microsoft+Patch+Tuesday+October+2024/31336/
macOS Sequoia: System/Network Admins, Hold On!
Published: 2024-10-07.
Last Updated: 2024-10-07 15:58:48 UTC
by Xavier Mertens (Version: 1)
It's always tempting to install the latest releases of your preferred software and operating systems. After all, that's the message we pass to our beloved users: "Patch, patch, and patch again!". Last week, I was teaching for SANS and decided to not upgrade my MacBook to macOS 15.0 (Sequoia). Today, I had nothing critical scheduled and made the big jump. Upgrading the operating system is always stressful but everything ran smoothly. So far so good...
Later, I started to do my regular geek tasks and connected to several SSH hosts. After a random amount of time, I noticed the following error for many connections:
ssh_dispatch_run_fatal: Connection to x.x.x.x port 22: Connection corrupted
This happened multiple times. I started to google for some users' feedback and experiences. It seems to be a problem faced by many people. What I've read:
It happens randomly
It affects IPv4 / IPv6
Not related to an SSH client (term, iTerm2, same)
People who upgraded to 15.0.1 have less frequent disconnections but the problem is not solved yet
Some recommendations (worked for some users)
Disable the macOS firewall
Turn off "Limit IP address tracking
Disable private rotating MAC
Disable tools like LittleSnitch
There is no "magic recipe" to fix the issue. On my Mac, disabling the address tracking did the job. I've now an SSH session open for 2h+.
Many forums are covering this topic. The most complete one I found is on the Apple support forum[1]. In conclusion, if SSH is a critical protocol for you, maybe hold on before upgrading your macOS.
Tip: If you need to SSH to a host, be sure to start your shell in a "screen" (or Byobu, ... ) session[2] to not lose your work.
[1] https://discussions.apple.com/thread/255761702?sortBy=rank&page=1
[2] https://ss64.com/bash/screen.html
https://isc.sans.edu/diary/macOS+Sequoia+SystemNetwork+Admins+Hold+On/31330/