homepage
Open menu

SANS NewsBites

FLASH: Microsoft's Most Dangerous Flaw in Years; Immediate Patching Required. Plus: Exploit Now Available for Citrix Flaw; Ransomware Operators Publish Data Stolen from Victims

January 14, 2020  |  Volume XXII - Issue #4

Top of the NewsThe Rest of the Week's NewsInternet Storm Center Tech Corner

Top of the News

2020-01-14

What You Need to Know About the Crypt32.dll / CryptoAPI Flaw

As part of today's "Patch Tuesday", Microsoft addressed a critical flaw in the Windows 10 and Windows Server 2016 version of crypt32.dll. Crypt32.dll implements the Windows CryptoAPI, which provides various cryptographic features used by software to verify digital signatures. This flaw was originally discovered by the NSA but has not been used in attacks yet. After you install the patches, sign up for this webcast featuring two of the most respected experts on sophisticated vulnerabilities and exploits. In this webcast, you will learn more about the nature of the vulnerability, how it could be exploited, and current recommendations to implement the patches as efficiently as possible.

Webcast URL: https://sans.org/cryptoapi-nb

Speaker: Jake Williams, CEO Rendition InfoSec

Hosted by: Johannes Ullrich, Director of SANS Internet t Center and Dean of Research at SANS Technology Institute

2020-01-13

Exploit Available for Citrix Flaw

Code is now available for exploiting an as-yet unpatched patch traversal flaw in Citrix Application Delivery Controller (ADC) and Gateway. The vulnerability can be exploited to remotely execute code. Citrix has published mitigations to help protect users from attacks. The company says that fixes for various versions will be rolled out between January 20 and the end of the month.

Editor's Note

Implement the published mitigations immediately, (https://support.citrix.com/article/CTX267679: Mitigation Steps for CVE-2019-19781) and plan to test and install the updates as they are released. While the mitigations are not a 100% fix, they do reduce the attack surface.

Lee Neely
Lee Neely

2020-01-13

Maze and Sodinokibi Ransomware Operators Publish Data Stolen from Victims

In December, operators of Maze ransomware posted data they claimed was taken from Southwire, a US wire and cable manufacturer, during a cyberattack. That website was taken down after Southwire filed a lawsuit. The Maze ransomware operators have now posted an additional 14 GB of data they allegedly took from Southwire, and said they would keep posting data until the company paid the ransom. The new website also lists the names of organizations the attackers claim to have infected with ransomware and that have not paid. Following the lead of the Maze attackers, operators of the Sodinokibi ransomware have begun publishing data belonging to organizations that have not paid the demanded ransom.

Editor's Note

The question of payment becomes more complex with active release of data in exchange for non-payment. Ensuring your DLP and unauthorized exfiltration protections are functioning is a good first step to reducing the data that could be used this way. This also raises the question of will the ransomware operators retain a copy of the data if paid.

Lee Neely
Lee Neely

The Rest of the Week's News

2020-01-13

Travelex Ransomware Attack Update

Foreign currency exchange company Travelex was hit with a ransomware attack on December 31, 2019. The company's website and mobile app were both affected. Travelex now says that some of its internal systems have been restored, although it has not said when it expects to restore customer services. The attackers behind the ransomware have threatened to post data they said they've taken from Travelex systems if the company does not pay the #4.6m (US $6m) ransom.

Editor's Note

Indications are that Travelex was hit by REvil/Sodinokibi ransomware, and the Sodinokibi operators are now publishing files where payment is not received. (See Maze and Sodinokibi story above.) Travelex has to weigh the options, including negotiating a lower ransom, versus the impact of having that data released. It will also be interesting to see if there are any GDPR (or CCPA) actions as a result of ransomware related data releases.

Lee Neely
Lee Neely

2020-01-10

Voting Machine Vendors Testify at Congressional Committee Hearing

CEOs of three major US voting machine manufacturers told lawmakers that they would be amenable to federal regulations requiring them to disclose company ownership, sources of voting machine components, and how they manage cyberattacks. Executives from Election Systems and Software, Dominion Voting Systems, and Hart InterCivic answered questions at a January 9 House Administration Committee hearing.

Editor's Note

It is sad that we must regulate in order to get vendors to do what they believe their competitors should do. However, this is the source of much regulation. As Franklin Roosevelt said, "Make me do it (the right thing)."

William Hugh Murray
William Hugh Murray

2020-01-10

Legislators Urge FCC to Protect Consumers from SIM-Swapping

US legislators have written to Federal Communications Commission (FCC), urging them to take steps to protect consumers from SIM-swapping. The letter notes that while some carriers have adopted policies that make SIM-swapping more difficult, "implementation of these additional security measures by wireless carriers in the US is still spotty and consumers are unlikely to find out about the availability of these obscure, optional security features until it is too late."

Editor's Note

It may take a while for the FCC to take the risks of unauthorized SIM swapping seriously, just as it took them a while to take the issues around robocalling seriously. In the interim, making sure that you enable the available security from your carrier, such as an account passcode, and/or PIN is critical. Additionally, enable two-factor using mechanisms other than SMS messages on email and other accounts so a swapped SIM cannot be used to recover or access those accounts.

Lee Neely
Lee Neely

In addition to the phone number, carriers also have an e-mail address, and a postal address. No changes to any of these should be implemented until a confirmation has been acknowledged by one of the other two. It is reckless not to do this kind of "out of band confirmation," and carriers should be liable for the failure to do so.

William Hugh Murray
William Hugh Murray

2020-01-13

Cable Haunt Buffer Overflow Flaw Affects Millions of Cable Modems

A critical buffer overflow flaw in a Broadcom chip used in millions of cable modems could be exploited to take control of vulnerable devices. The vulnerability, which has been named Cable Haunt, lies in the chip's spectrum analyzer component.

Editor's Note

This vulnerability has to be exploited from the consumer interface to the device, which is why it relies on the user accessing a site with malicious JavaScript. Even so, it is a very complex attack to execute. The best mitigations are to ensure the firmware on your cable modem is updated and that the default password has been changed, irrespective of who owns or manages the device.

Lee Neely
Lee Neely

This is a pervasive vulnerability but expensive to exploit. The report suggests that the exploit must originate from the inside, the IP side, rather than the service, the DOCSIM, side. Most SOHO users will not be vulnerable. Enterprise users that are targets of organized crime and nation states and that are likely to have compromised systems on their networks should have a goal of identifying and removing these modems in months. One might well wish that these so-called "researchers" had waited to publish until they had identified indicators of compromise. One suspects that they did not do so because they have identified a vulnerability but no compromises.

William Hugh Murray
William Hugh Murray

2020-01-13

India's Supreme Court Says Internet Service Suspension in Kashmir is Illegal

The Supreme Court of India has found that the government's five-month blackout of Internet services in Kashmir violates India's telecommunications laws. The Indian government also shut down mobile phone and landline services in the area. The court has given the government a week to review its policies.

Editor's Note

This is a political issue, not a security one. It is now clear that the Internet is a powerful tool for organizing resistance to tyranny, or even incompetence. It is equally clear that regimes will attempt to restrict its use when they feel threatened.

William Hugh Murray
William Hugh Murray

2020-01-13

Texas School District Loses Millions in eMail Scam

The Manor Independent School District, near Austin, TX, lost $2.3 million in an email scam. The funds were sent in three separate transactions in November and December 2019.

Editor's Note

Analysis suggests that legitimate looking emails were sent requesting payment to altered accounts. Out-of-band verification of payment information, particularly when the accounts don't match what you have on-file, whether updated or new, is critical.

Lee Neely
Lee Neely

2020-01-10

Coding Education Should Be Integrated into K-8 Curriculum

An educational technology specialist said that coding education should be integrated across the K-8 school curriculum rather than taught as a standalone subject. Students are likely to develop better problem-solving and design skills if they have an application for coding outside of the computer science lab.

Editor's Note

While it is good for people to know how to code, our problem is not a shortage of coders but one of quality code. Currently we have too much porous code written by amateurs.

William Hugh Murray
William Hugh Murray

2020-01-13

US Dept. of the Interior Plans to Permanently Ground Drones That Contain Chinese Technology

According to a report in the Financial Times, the US Department of the Interior plans to permanently ground more than 800 drones. The decision is due to concerns that some of the drones' components were developed in China and that the Chinese government could possibly access the data the drones gather. The Interior Department uses drones to monitor fires, track natural resources, and map terrain. The drones were taken out of service in October 2019 pending the results of a program review.

Editor's Note

When analysis determines a supply chain weakness, in this case the DJI produced drones represent an unacceptable level of risk, you have two choices - replace the items with trusted ones, or repair the weakness. Analysis has to be made on a case-by-case basis. While the cost of new drones is large, the cost of retrofit, to the point where you're assured the devices are acceptable, is typically much higher and can be more error prone, void warrantees or support agreements, and have long-term cost/impacts.

Lee Neely
Lee Neely

2020-01-13

Dixons Carphone Fined Over Data Breach

The UK Information Commissioner's Office (ICO) has fined Dixons Carphone #500,000 (US $650,000) for failing to adequately protect customer data. The company's point-of-sale system was compromised between July 2017 and April 2018, exposing personal information of as many as 14 million customers.

Editor's Note

It is worth reading the actual report from the ICO itself to see what issues, such as a WordPress installation from 2009, no anti-virus installed on servers, encryption keys stored in plain text, and several other issues, that led to the issuance of this fine. https://ico.org.uk/media/action-weve-taken/mpns/2172972/carphone-warehouse-mpn-20180110.pdf: Supervisory Powers of the Information Commissioner | Monetary Penalty Notice

Brian Honan
Brian Honan

2020-01-10

Albany, NY Airport Hit with Ransomware Through MSP

Administrative servers at Albany (New York) International Airport became infected with ransomware in December 2019. The malware made its way onto the system through the airport's managed service provider (MSP). The ransomware also infected the airport's backup servers, and the airport has "severed its relationship with" the MSP. The airport said that it paid an undisclosed amount of ransom to regain access to its data.

Editor's Note

Strong authentication, end-to-end application layer encryption, least privilege access control, privilege access management software, safe backup and fast recovery, et. al. can increase the cost of ransomware attacks by an order of magnitude.

William Hugh Murray
William Hugh Murray

2020-01-10

SIM-Swappers Are Escalating Their Tactics

Some SIM-swappers are bypassing the social engineering techniques they have used in the past and are now breaking into telecommunications companies' systems to facilitate the swapping. The attackers manipulate telecommunications company employees into installing Remote Desktop Protocol (RDP) software, and then using the access to port phone numbers.

Internet Storm Center Tech Corner

Citrix ADC Vulnerability Actively Exploited. Assume vulnerable systems are compromised.


Updated Citrix Advisory: https://support.citrix.com/article/CTX267027


Exploit Activity Summary: https://isc.sans.edu/forums/diary/Citrix+ADC+Exploits+are+Public+and+Heavily+Used+Attempts+to+Install+Backdoor/25700/


Vulnerability Scanner: https://github.com/trustedsec/cve-2019-19781/


Special Webcast: https://i5c.us/citrix


YouTube Walk Through of the vulnerability: https://youtu.be/msslpqyf98c


Upcoming Critical MSFT Patch

https://krebsonsecurity.com/2020/01/cryptic-rumblings-ahead-of-first-2020-patch-tuesday/


SIM Swapping is Easy

https://www.issms2fasecure.com/assets/sim_swaps-01-10-2020.pdf


Google Open Sources wombat dressing room npm publication proxy

https://opensource.googleblog.com/2020/01/wombat-dressing-room-npm-publication_10.html