iOS Users Can Avoid Ad Tracking; Codecov Compromise Snares HashiCorp Code Signing Key; Passwordstate Password Manager Downloaded Malware

The important issue is that consumers increasingly have the choice (as they should) to decide how much of their personal info gets exposed, and they are increasingly choosing to reduce the exposure. That has been good news for app dev groups and DevOps methodologies that actually do focus on the users wants and needs – software architects and DevOps leads listing “privacy” as one of their core business requirements is a good thing.

John Pescatore

Initially Apple introduced IDFA where you could disable the unique identifier for your device. With 14.5, applications will prompt for permission to track, with an optional messages explaining why they want to track; and you can click “Ask App not to Track.” Note that the prompt will not show up where developers are tracking you across their own services, e.g., Facebook tracking you from their main platform to Messenger and Instagram.

Lee Neely

This is more useful than the now-universal warnings about the use of cookies without distinguishing between native cookies (those used for saving state in the application) and tracking cookies.

William Hugh Murray

For encryption and digital signatures to be more than placebos, essential security hygiene is needed to enforce strong access controls around the private keys. When code signing is used, processes/playbooks for how to perform revocation need to be established and periodically tested.

John Pescatore

Supply chain attacks are so dangerous because they not only affect end-users ("consumers") but also suppliers. This can lead to a snowball effect with one compromise of a key supplier leading to the compromise of additional suppliers with vastly different customers.

Johannes Ullrich

Private keys must not be stored online when not in use. That is what thumb drives are for.

William Hugh Murray

The impact of the compromised code is increased as this is an enterprise password manager, as opposed to one for individual users. Providing an enterprise password manager is an excellent way to help users establish good passwords and minimize reuse. And as it is now a central repository of key sensitive information, due diligence is essential, not only for making sure updates are genuine, but also that security controls are fully implemented. Click Studios, the makers of Passwordstate, are posting advisories and updates (https://clickstudios.com.au/advisories/default.aspx) which include checksums of the bad DLL, suggested actions, exfiltrated data description and status. Australian customers may also reach out to the Australian Cyber security Center (ACSC) for assistance at ASD.Assist@defence.gov.au or 1300 CYBER1.

Lee Neely

Password managers are one of those “if you put all your eggs in one basket, you better really, really watch that basket” areas. This appears to have a narrow compromise window but the severity means that all PCs using the compromised Passwordstate software should be considered compromised until examined.

John Pescatore

Another case of a supplier distributing malicious code, distributing code that it did not write, leaving others with a huge mess to clean up. Unlike SolarWinds, this code was not distributed to enterprises but to end-users, at least some of whom are enterprise users. We cannot put all the risk of supply chain compromises on the end users. We must hold suppliers accountable for distributing malicious code. Distributing only code that one originates is a much easier problem than never distributing code with errors or vulnerabilities.

William Hugh Murray

The uninstaller was delivered by the captured Emotet C2 servers in late January with a self-destruct date of April 25th. The package addresses the two ways Emotet achieves persistence: either as a system service or a Run key. The Malwarebytes blog explains the behavior of the package and actions it takes. Per the US DOJ, the update was provided by foreign law enforcement using overseas C2 servers, not FBI agents. The delay between distribution and removal was to give time for responders to complete forensic analysis and cleanup of any other related malware.

Lee Neely

The Emotet takedown appears to be one of the more successful takedowns in recent memory. A lot has been written about law enforcement pushing an update to remove the malware (similar also to recent law enforcement action against unpatched Exchange servers). I believe we should and hopefully will see more of the same in the future. Waiting for users to patch and fix their systems hasn't been working and these systems become ticking timebombs waiting for additional infections, or being used to revive taken down botnets.

Johannes Ullrich

Our industry has a lot to learn from the FAA about how to distribute intelligence in a timely manner to those who can best, or must, act on it.

William Hugh Murray

This is not how you partner with someone to improve processes. This is analogous to an unauthorized penetration test, causing more harm than the improvements envisioned at inception. It is commendable that the UMN both apologized and stopped the research efforts leading to the commits; more work is still needed to repair the damage. While the apology identifies that they didn’t achieve permission, current actions still don’t reflect they are following the processes for legitimate patch submission. This is now about regaining trust rather than fixing technical issues.

Lee Neely

Even if you don’t think you are a target, review the US-CERT CISA Alert recommendations you can leverage across your organization: implementing MFA, and making sure that newly provisioned systems are configured to appropriate security baseline, and that you’re actively monitoring services for abuse. Additionally, make sure that your user verification processes are still robust. Make sure that adjustments made for a fully remote workforce didn’t introduce gaps an attacker can leverage to get legitimate credentials.

Lee Neely

Labeling this vulnerability the "worst in recent memory" may be overhyping it a bit, but while exploitation still requires a user to willingly install malware, the vulnerability evades all controls Apple put in place in recent years to prevent just that from happening. Upgrade quickly.

Johannes Ullrich

At core, the Apple protections assumed applications would have a file “info.plist.” An application, which is actually a script and doesn’t contain that file, would bypass the security check, including the mandatory notarization check, and be executed. In addition to the macOS update, XProtect has also been updated to detect and warn for attempts to exploit the flaw which means that will be available for older macOS users. While the XProtect update is installed automatically, the macOS update is not. Apple released updates to Big Sur, Mojave, and Catalina this week to address multiple vulnerabilities; you’ll want to get those all queued up for installation.

Lee Neely

The telling quote is in the Wired story: “The flaw is akin to a front entrance that's barred and bolted effectively, but with a cat door at the bottom that you can easily toss a bomb through. Apple mistakenly assumed that applications will always have certain specific attributes.” This type of flaw is pretty much at the level of buffer overflows.

John Pescatore

Ignoring special purpose systems which have to run Windows 7, such as an instrument controller or oscilloscope, general purpose systems need to move to a supported OS. The common argument is that the old system is fully functional typically followed by not wanting to learn a new OS. Because there are no fixes or support for these systems, they need to be isolated as they are no longer sufficiently secure for Internet access. This is further complicated by cloud migrations which require these systems to have Internet access. The good news is that new versions of applications are unlikely to operate on either Windows 7 systems either because the OS isn’t supported or the hardware is not sufficient for its needs which can be used to drive the conversation.

Lee Neely