homepage
Open menu

SANS NewsBites

Dangerous VMware Vulnerability; CISA Warns On: Pulse Secure VPN Servers; Microsoft Windows Defender Definition Crash Issue; Malicious Libraries In RubyGems Repository

April 21, 2020  |  Volume XXII– Issue #32

Top of the NewsThe Rest of the Week's NewsInternet Storm Center Tech Corner

Top of the News

2020-04-17

Dangerous VMware Vulnerability

VMware recently released a patch for a vulnerability in vCenter management product; the vulnerability was given a CVSS score of 10. It is now known that the flaw could be exploited by anyone on the network to create new administrator accounts in the vCenter Directory. Admins are urged to apply the patch as soon as possible.

Editor's Note

A gap I regularly see when reviewing patch management strategies is the narrow focus on server and desktop operating systems and the applications that reside on them, but ignoring the virtualisation platforms on which many of those systems rely.

Brian Honan
Brian Honan

2020-04-20

CISA: Pulse Secure VPN Servers Vulnerable to Attacks After Patching Unless Passwords Changed

A patch was made available for an arbitrary file reading vulnerability in Pulse Secure VPN a year ago. However, the US Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) has warned that even if an organization has applied the fix, hackers could still use credentials stolen before the flaw was patched to access the system unless the organization has changed those credentials. Hackers used stolen Active Directory credentials to place ransomware on systems at US hospitals.

Editor's Note

Use the CISA "check-your-pulse" tool to analyze your Pulse Secure VPN logs for indications of compromise. If any are found, a full AD password reset, including administrator and service accounts is indicated. Implementing 2FA on your Pulse Secure VPN can also reduce the risk of compromised credentials being used to enter your network. https://github.com/cisagov/check-your-pulse

Lee Neely
Lee Neely

2020-04-17

Microsoft Releases New Windows Defender Definition to Fix Crash Issue

A recent Windows Defender definition update caused Windows 10 machines running the Microsoft anti-malware component to crash while in the middle of a full antivirus scan. Late last week, Microsoft pushed out a new definition to fix the problem.

2020-01-20

Malicious Libraries Uploaded to RubyGems Repository

Hackers uploaded malicious files to the RubyGems package manager. The files have names that are a character or two off from legitimate files. If users download the malicious libraries, the software they build with them will include bitcoin stealing malware.

The Rest of the Week's News

2020-04-17

"Is BGP Safe Yet?" Tool

Users can check to see whether their ISP is using features that improve the stability of the Border Gateway Protocol (BGP) through the "Is BGP Safe Yet" site. Sometimes BGP problem are accidental, sending traffic on unexpected routes, and sometimes it is deliberately disrupted, hijacked to route traffic through certain servers so attackers can steal data.

Editor's Note

While BGP was a vast improvement over prior options, anyone remember RIP? It does allow the updates to preferred routes. ISPs can implement RPKI which adds a trust anchor to BGP updates. The "Is BGP Safe Yet?" provides an easy way to check your ISP. The site also provides suggestions for encouraging your ISP implement RPKI and join MANRS.

Lee Neely
Lee Neely

2020-04-17

GitHub Users Targeted in Phishing Attacks

GitHub users are being targeted in a phishing scheme. The message in the malicious email says that unauthorized activity has been detected on a user's account, and provides a link that purportedly will show the questionable activity. Instead, the link takes users to a phony GitHub login page where their credentials could be stolen. Attackers have been accessing accounts of people who have fallen for the phish and have been downloading the contents of their repositories.

Editor's Note

Where multi-factor authentication is available, it should be enabled. Instructions to turn on MFA for Github are available here: https://help.github.com/en/github/authenticating-to-github/configuring-two-factor-authentication: Configuring two-factor authentication

Brian Honan
Brian Honan

2020-04-20

Cryptocurrency Theft

Hackers stole a total of $25 million worth of cryptocurrency from Lendf.me and Uniswap. The thefts are being investigated; they are believed to be related. The hackers used a combination of vulnerabilities and legitimate features to steal the funds.

2020-04-18

German State May Have Lost Millions in COVID-19 Aid to Phishers

The government of the German state of North Rhine-Westphalia appears to have lost between [euro]31.5 million ($34.2 million) and [euro]100 million ($109 million) to a phishing scheme. The funds were meant to be distributed to individuals and companies affected by the COVID-19 pandemic. The thieves set up a website that looked just like the one the North Rhine-Westphalia government created to help distribute the money. The thieves then sent links to their site, harvested information from people and organizations applying for the funds, and used the information to direct the payments into bank accounts under their control.

Editor's Note

Most scams take advantage of targets being distracted and in a hurry, and these are distracting and rapidly changing times. Even before this, we've seen CFOs and financial managers fall for similar schemes where financial disbursement processes did not have a formal approval checkpoint or were shortcut. Good idea to use this item to remind financial managers of the increased danger and to step up email quarantining of anything suspect.

John Pescatore
John Pescatore

Strong validation of users or organization enrolling for financial transactions, including out-of-band validation of bank information when setup or changed, is crucial. While remote enrollment introduces challenges, use existing services which use multiple sources for validation to raise the bar without having to roll your own solution.

Lee Neely
Lee Neely

2020-04-20

Cognizant Hit with Ransomware Attack

IT services company Cognizant was the target of a ransomware attack last week. The company notified its clients and shared "indicators of compromise" with them so they could take steps to protect their systems. Forensic information shared with Cognizant clients suggests that the Maze ransomware was used in the attack.

2020-04-18

State Dept. Concerned About Reports of Healthcare Organization Cyberattacks in Czech Republic

A press statement from the US Department of State expresses concern of a recent warning from the Czech Republic's National Cyber and Information Security Agency that hackers were targeting organizations in the country's healthcare sector. Reuters reports that the Prague Airport and a hospital in the Czech Republic both say they staved off cyberattacks against their IT systems.

2020-04-20

UK Ministry of Defence Temporarily Eases Cybersecurity Requirement for Contractors

The UK Ministry of Defence (MoD) is temporarily suspending certain cybersecurity requirements for its contractors. Until the COVID-19 threat abates, UK defence contractors will not need the Cyber Essentials Plus cybersecurity certification, which requires a visit from a third-party assessor.

2020-04-20

Virtual Exam Monitoring Raises Privacy Concerns

Students at the Australian National University (ANU) are protesting the school's plan to install monitoring software on their home computers to ensure that they do not cheat on exams. The software Proctorio, identifies students biometrically, locks down the system to prevent outside information from being transmitted during the exam, and records the environment during the exam. It also tracks students' eye movements. In a separate story, some schools in the US are using Proctorio as well as live remote proctors to monitor students during exams.

Editor's Note

n many ways dealing with the current impact of the Coronavirus and coming out of it will require some tradeoffs between privacy and safety/security/trustability. Some US states are suspending laws requiring in-person notarization of legal documents; some are not. Some will risk cheating over invasive controls - for now these will be local "learn as we go" decisions, but in the future I think we will see "remote drills" to test processes a few times per year, just as we do fire drills in most buildings.

John Pescatore
John Pescatore

A great success story, while it still uses in-person proctors, is the Anchorage Amateur Radio Club remote testing which has been performed in 32 states and Antarctica to date. For those seeking GIAC certification attempts, or other exams proctored by Pearson Vue, check their site for relevant information https://home.pearsonvue.com/coronavirus-update.aspx: Impact to candidate exam schedules

Lee Neely
Lee Neely

2020-04-20

US Supreme Court Will Review Case Involving Computer Fraud and Abuse Act

The US Supreme Court has agreed to review a case in which a former police officer was convicted of violating the Computer Fraud and Abuse Act (CFAA) for accessing data in a system he was authorized to use for a non-work-related purpose. Critics of the CFAA say the 34-year-old is overly broad and does not serve the current cyber climate.

Editor's Note

Lower courts have ping-ponged around how they interpret the Authorized Access wording in the CFAA for years. CFAA has been used semi-randomly against security researchers in the past and many times not supported charging malicious insiders with unauthorized use of data. The law is long overdue for rewriting but this case is more focused on the insider authorized access issue vs. the security researcher issue - a narrow ruling may not address security researcher liability issue at all.

John Pescatore
John Pescatore

Drafting legislation the accomplishes its intent while avoiding unintended consequences is difficult. When the CFAA was drafted most of those who could send a message to a system worked for the owners of the system.

William Hugh Murray
William Hugh Murray

Internet Storm Center Tech Corner

Weaponized RTF Document Generator Mailer in PowerShell

https://isc.sans.edu/forums/diary/Weaponized+RTF+Document+Generator+Mailer+in+PowerShell/26030/


KPOT AutoIt Script: Analysis

https://isc.sans.edu/forums/diary/KPOT+AutoIt+Script+Analysis/26012/


Microsoft Fixes Bad Anti-Malware Signatures

https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes


Sophos Pulls Bad Firmware Update

https://community.sophos.com/kb/en-us/135383


Credentials Stolen from Pulse Secure VPN Abused

https://www.us-cert.gov/ncas/alerts/aa20-107a


Chrome Update

https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_15.html


FPGA Vulnerability

https://www.usenix.org/conference/usenixsecurity20/presentation/ender


Nagios XI Vulnerability

https://exchange.xforce.ibmcloud.com/vulnerabilities/179406