NewsBites Volume XXII - Issue #53 July 7, 2020

Top of the News

2020-06-30

US CYBERCOM Warning on Palo Alto Technologies OS Vulnerability; Patch Now!

On June 29, US Cyber Command issued a cybersecurity alert regarding a critical flaw affecting Palo Alto Networks PAN-OS, the operating system that runs on the company's firewalls and VPN appliances. The alert urges users to "patch all devices affected by CVE-2020-2021 immediately, especially if SAML is in use." US Cyber Command expects that foreign adversaries will likely begin to exploit the vulnerability soon.

Editor's Note

It is regrettable but "patching" is now a mandatory, expensive, and continuous, activity. However, all patches are not equal; patch first those vulnerabilities that are being actively exploited.

William Hugh Murray

NSA Issues Guidance on Securing IPsec VPNs

The US National Security Agency (NSA) has released guidance to help organizations secure their IPsec virtual private networks (VPNs). Many organizations are using these to allow their employees to work from home. The BNSA has also released a document with information about configuring IPsec VPNs.

Editor's Note

Related to this item and the one about the Cybercom warning of critical vulnerabilities in Palo Alto Network's PAN-OS based products, Johannes Ullrich of SANS put forth great guidance earlier in the year about critical vulnerabilities in security and VPN appliances and certified. SANS published that guidance as part of the SANS 2020 New Attack and Threat Report available at https://www.sans.org/reading-room/whitepapers/threats/paper/38908

John Pescatore

This guidance seems to assume that all VPNs will terminate on a network "gateway." While there will be a lot of these in a WFH situation, prefer to terminate VPNs on applications rather than on networks or operating systems.

William Hugh Murray

New macOS Ransomware ThiefQuest Found on Torrent Sites

Researchers at Malwarebytes have detected new ransomware that targets devices running macOS. Dubbed ThiefQuest, the ransomware also has spyware capabilities: it can exfiltrate files, search for cryptocurrency wallets and passwords, and log keystrokes. ThiefQuest has been detected bundled with other software on torrent sites.

Managed Service Provider Xchanging Hit by Ransomware

In an 8-K form filed with the US Securities and Exchange Commission (SEC), DXC technologies disclosed that systems at one of its subsidiaries were hit with a ransomware attack. The company, Xchanging, is a managed service provider that focuses primarily on the insurance industry but has customers in other sectors as well. According to the filing, "DXC is actively working with affected customers to restore access to their operating environment as quickly as possible."

The Rest of the Week's News

2020-07-03

Barclays Website Was Calling Javascript File from Internet Archive

The Barclays Bank website appears to have been calling a Javascript file from the Internet Archive's Wayback Machine. This meant that if the Internet archive went down, the Barclays website would be down as well. Barclays has fixed the issue.

Editor's Note

It is tempting to include both data and procedure by reference, rather than by copying. Be careful what you refer to.

William Hugh Murray

F5 Releases Patches for Flaws in BIG-IP Networking Devices; POC Exploit Code Released

F5 has released fixes to address a critical flaw in its BIG-IP networking equipment that could be exploited to take complete control of vulnerable devices. US Cyber Command tweeted last week that patching this vulnerability is urgent. On Sunday, July 5, CISA Director Christopher Krebs tweeted. "If you didn't patch by this morning, assume compromised." Proof-of-concept exploit code for the critical vulnerability, which has been given a CVSS score of 10, has been released. Hackers have begun exploiting the vulnerability. F5 has also released fixes for a high-severity cross-site scripting vulnerability in the BIG-IP Configuration utility.

Editor's Note

We continue to see the publication by "researchers" of work product, "exploits," that reduces the cost of attack against our systems rather than that increases it. This appears to be a part of a "culture of hacking" left over from an era when hackers were motivated by, and recognized for, "cleverness."

William Hugh Murray

Cisco Fixes XSS Flaw in Small Business VPN Router Firmware

Cisco has released fixes for a cross-site scripting vulnerability that affects two of its small business VPN routers. The flaw is the result of "insufficient validation of user-supplied input by the web-based management interface of the affected software." The issue affects Cisco Small Business RV042 and RV042G Routers running firmware releases older than 4.2.3.14.

Cisco Releases Firmware Updates for Vulnerability in Small Business Switches

Cisco has released a security update to fix a high-severity flaw in its Small Business Smart and Managed Switches. The vulnerability, which "is due to the use of weak entropy generation for session identifier values," could be exploited to gain administrator privileges. The issue is fixed in version 2.5.5.47 of the firmware release for affected products that ae still supported.

Editor's Note

The smaller the entity for which an appliance is intended, the more of them there are likely to be and the less likely that they will be actively managed.

William Hugh Murray

Apple's Decision Forces Shortening of Digital Certificate Lifespans

Starting September 1, 2020, Apple software, Chrome, and Firefox will identify new TLS certificates that are valid for more than 398 days as invalid. The changes arises from a unilateral decision Apple made earlier this year, bypassing the expected practice of bringing issues like this one to the CA/B Forum, "a voluntary group of certification authorities (CAs), vendors of Internet browser software, and suppliers of other applications that use X.509 v.3 digital certificates for SSL/TLS and code signing." The intent of reducing certificates' lifespans is to force websites and apps to issue new certificates every year. This will introduce more certificates that use the newest cryptographic standards.

Editor's Note

In 2007 the CA/Browser forum moved quickly to specify Extended Validation certificates that would cost more but turn out to be of minimal security value. Ever since then, the Browser companies (who mostly do not charge for their browser software) have driven all increases in related security areas while the Certificate Authority part of the CA/Browser Forum (who mostly charge for certificates) have moved much more slowly or voted against proposed enhancements. Google at times, Mozilla at times, now Apple - in areas other than certificates, too - good to see the browser world pushing the security envelope.

John Pescatore

Microsoft Releases Two Out-of-Cycle Patches for Windows

On June 30, Microsoft released two unscheduled patches to address remote code execution vulnerabilities in the Windows Codecs Library. Microsoft took the unusual step of delivering the fixes through the Microsoft Store rather than through Windows Update. The advisories for the vulnerabilities say, "Affected customers will be automatically updated by Microsoft Store. Customers do not need to take any action to receive the update."

Home Router Study Finds "Alarming" Security Issues

A study of 127 home routers from seven manufacturers found numerous security issues. The Fraunhofer Institute for Communication (FKIE) in Germany looked at each router's most current firmware, focusing on five security aspects: when the firmware was last updated; which operating systems are used and how many known flaws they have; what exploit mitigation techniques the vendors use; whether the firmware images contain private cryptographic key material; and whether there are any hard-coded login credentials. Among the report's findings: 46 of the routers had not had a security update in the past year; some vendors ship firmware updates that contain known vulnerabilities, and just one of the seven vendors did not publish private cryptographic keys in its firmware.

Top Three Network Intrusion Signatures Used Against Federal Agencies in May 2020

The top three network intrusion signatures detected by the US Department of Homeland Security's (DHS's) EINSTEIN intrusion detection system during May 2020 are the NetSupport Manager Remote Access Tool (RAT) - legitimate software that is also being used in phishing campaigns; the Kovter fileless Trojan; and the XMRig cryptocurrency miner. EINSTEIN gathers and analyzes traffic flowing into and out of federal civilian organizations systems and networks.

Internet Storm Center Tech Corner

More Security Vulnerabilities in Perimeter Security Devices and What To Do About Them

The last two weeks highlighted yet again security problems with software and devices that are supposed to protect our perimeters. Most notable, F5's BigIP devices were found to suffer from a trivially exploitable remote code execution vulnerability. This vulnerability is already heavily exploited, and a vulnerable, badly configured device was likely exploited over the weekend. But F5 wasn't alone. About a week ago, Palo Alto reported a problem allowing authentication bypass in certain configurations of its devices. And less noted, but still important were vulnerabilities in the open source RDP gateway Guacamole. As a cheaper alternative to commercial solutions, some organizations implemented this solution to provide controlled access to RDP services for remote workers. One of the most important things you can do, even if you do not use any of these products, is to ensure that any administrative interfaces for these devices are accessible only from management networks or VPNs. Limiting access will prevent the vast majority of the exploits used against these vulnerabilities.

F5 BigIP Critical RCE

https://support.f5.com/csp/article/K52145254

https://isc.sans.edu/forums/diary/CVE20205902+F5+BIGIP+Exploitation+Attempt/26310/

https://github.com/rapid7/metasploit-framework/pull/13807/commits/0417e88ff24bf05b8874c953bd91600f10186ba4

https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller

Special F5 BigIP Webcast

https://www.sans.org/webcasts/116065

More BigIP Exploits

https://isc.sans.edu/forums/diary/Summary+of+CVE20205902+F5+BIGIP+RCE+Vulnerability+Exploits/26316/

Guacamole RDP Gateway Vulnerability

https://blog.checkpoint.com/2020/07/02/hole-y-guacamole-fixing-critical-vulnerabilities-in-apaches-popular-remote-desktop-gateway/

Barclays Caught Serving Code from Wayback Machine