SANS NewsBites
June 10, 2022 | Volume XXIV - Issue #46
2022-06-08
On Wednesday, the RSA Conference awarded Alan Paller, the founder of SANS who passed away in late 2021, with the 2022 RSAC Lifetime Achievement Award. You can watch the tribute to Alan and award acceptance by SANS Technical Institute President and longtime instructor Ed Skoudis at https://www.youtube.com/watch?v=zufVATv8zqE.
Thanks, John P.
2022-06-08
Eric Goldstein, CISA executive assistant director for cybersecurity told Cyberscoop that US government agencies with legacy systems may have difficulty implementing multi-factor authentication (MFA). Agencies were required to have implemented MFA by November 2021 as per a May 2021 executive order. The Biden administration is seeking $300 million for FY 2023 for the Technology Modernization Fund, which will be used to help agencies upgrade outdated IT systems.
Implementing MFA usually implies implementing some form of SSO/IAM. Many organizations struggle not only with legacy systems, but also new SAAS offerings that only offer integration with standards like SAML for a substantial additional fee. 100% MFA is (sadly) not always realistic and you will have to consider other controls for systems that do not support MFA. For example, you could require access via a VPN that uses MFA. For SaaS platforms: Pay up or find an alternative.
Over the years this has been the “the dog ate my homework” excuse for government agencies that are slow to make basic security hygiene improvements. History note: in 2001 a federal judge ordered the Bureau of Indian affairs to disconnect from the Internet because it could not protect Native American trust information. Some BIA offices were not allowed to reconnect until *2008*. We are at the point where failure to move away from reusable passwords on government networks (all networks, really) is a reason to say, “No Internet for you.”
Many initiatives which expect MFA implementations assume applications are modernized to support current authentication mechanisms, such as SAML and a federated IDP, where enforcing MFA is a configuration task. Legacy applications are sometimes fitted with new entry points which themselves support MFA; in so doing, care must be taken to not leave a path to the old less secure entry point. In the past we have raised the bar by implementing solutions which leveraged the password field for their one-time authenticator and then augmenting the password validation process. Note that current directives require phishing-resistant MFA, which means this too may need updating. When replacing legacy systems, plan carefully, not only for acquisition and implementation but also business process re-engineering. Avoid the trap of modification of the new solution to implement old business models which can result in an increased mortgage and make future updates challenging if not impossible.
Systems that are resistant to such a simple but powerful measure should be candidates for replacement rather than simply upgrade. While some argue that strong authentication is the most efficient security measure, it is unarguable that it is in the top three.
2022-06-08
Google has released its Android updates for June 2022. Of the 41 vulnerabilities addressed in the updates, five are rated critical. There are updates available for Android 10, 11, and 12. Among the vulnerabilities addressed are a remote code execution flaw in Android Media Framework and a denial of service/remote code execution vulnerability in Unisoc chip firmware.
Some Android phones (such as Google Pixel models) will get these updates fast, others (in the past most Samsung phones) will not. Spot check a few different makes of phones across your security team and warn users of those phones they are at risk.
Note that the source code for the fixes is released to the ASOP repository 48 hours after the security bulletin is released, and your device manufacturers are notified a month before this is published. Which all means that attackers can now start reverse engineering the flaws and, more importantly, don't wait on applying updates once published. If your OEM is not providing updates rapidly, you may want to assess the risk of their lagging behind and decide if another provider is appropriate.
2022-06-09
A phishing campaign targeting Facebook and Messenger users has stolen millions of account credentials and tens of millions of dollars. The phishing campaign operates by sending a malicious link in DMs from compromised accounts. The link redirects recipients through a series of pages containing ads, ultimately landing on a phony Facebook login page. The campaign has been ongoing since late 2021.
Facebook Direct Messenger is kinda like the Red Dye #2 of Internet communications – it really ought to be banned and replaced with something that at least has the same level of filtering that all email and SMS messaging gets these days. A warning about Facebook Messenger should be part of your security awareness outreach, as all too often security awareness videos that users have to watch will just talk generically – in many cases, warnings about using specific products and services are justified and needed.
The attack includes about 400 unique Facebook phishing pages; analysis of 17 found an average of 985,228 visits. The attacker claims they net about $150 for every 1000 visits. Be careful with FB messenger: make sure that messages are really coming from your friends, particularly when one shows up from someone you're not accustomed to using Messenger with. I suggest verifying their status through other mechanisms. The URLs shared are using common URL generators like litch.me, famouis.co, amaze.co and funnel-preview.com, which are also used by legitimate apps. That said, if you're not used to getting links from these domains, don't click them.
A key here is when training your workforce on “phishing,” emphasize that phishing is no longer just email attacks, but SMS, voice phishing or on social media. Focus less on the medium that is used and more on the most common indicators of a social engineering attack; they are often the same, tremendous sense of urgency being one of the most common.
The Register: Facebook phishing campaign nets millions in IDs and cash
Bleeping Computer: Massive Facebook Messenger phishing operation generates millions
2022-06-09
A new feature in Microsoft Defender for Endpoint (MDE) allows administrators to “contain” unmanaged (not enrolled in MDE) devices and devices suspected of being compromised. The feature is designed to prevent threat actors from moving laterally within organizations. MDE will tell enrolled devices to block all communication with devices tagged as “contained.” The “contain” feature works only on enrolled devices running Windows 10 or later or Windows Server 2019 or later.
This is essentially good old-fashioned NAC (Network Access Control) which is really the foundation for any form of “Zero Trust.” (History note: Microsoft called it Network Access Protection and Cisco called it Network Admission Control back in the day.) NAC got a bad name 15 years ago due to interoperability issues across vendors and because it was mainly used to keep unpatched PCs from connecting - which punished the users for an IT ops failure to patch. Prioritize a testbed network segment to try it out – you will likely need to do some upskilling to deal with false positives, defining “contain” to balance security with disruption, and in threat hunting skills to investigate the devices being contained.
Pay attention to how this works. If it fits your environment, you should definitely start piloting the capability. You can only use this capability on MDE devices, and the controls only work against other MDE devices. That said, this is an effective way of removing access to resources for devices which are compromised or otherwise don't meet your acceptable level of risk. Also, containment is tied to machine identity rather than IP address, so access is blocked irrespective of connection location or IP.
2022-06-08
Sophos has published its Active Adversary Playbook 2022, which “details the main adversaries, tools, and attack behaviors seen in the wild during 2021 by Sophos’ frontline incident responders.” The report found that average dwell time for cyber intruders increased from 11 days in 2020 to 15 days in 2021. Healthcare organizations had on average the shortest dwell time (8.5 days), which educational institutions had the longest (34 days). Average well time was higher (more than 50 days) for companies with 250 or fewer employees than for larger organizations.
Make sure your detection and response capabilities are where they need to be. Talk to your defenders to find where they have gaps, then take steps to address them. Make sure that you're leveraging all the tools and automation available from your services. If you're too small to insource your defense, talk to your service provider to make sure you have sufficient coverage. Lastly, schedule regular assessments and tests to verify you're where you should be. Don't forget to leverage resources from your local CISA, ISAC etc.
While not a good statistic, it is better than in years past when average dwell time was measured in months, not weeks. However, the most recent DBIR report had a disturbing metric about dwell time: over 50% of breaches were self-reported by the cyber attacker. In other words, the victim found out about the breach from the attacker themselves (primarily ransomware).
2022-06-09
Threat actors continue to exploit the Follina vulnerability in Windows (CVE-2022-30190) to spread malware. In addition to the phishing attacks targeting European and US government entities with Qbot malware, as noted by Proofpoint, Symantec has detected threat actors exploiting the vulnerability to spread AsyncRAT.
Remember we were holding off on disabling MSDT? It's time to re-assess. Your endpoint and other protection services are updating their protections. The attacks are coming from multiple well-resourced organizations. You need defense in depth.
Security Week: 'Follina' Vulnerability Exploited to Deliver Qbot, AsyncRAT, Other Malware
The Register: Now Windows Follina zero-day exploited to infect PCs with Qbot
The Register: Symantec: More malware operators moving in to exploit Follina
Symantec: Attackers Exploit MSDT Follina Bug to Drop RAT, Infostealer
2022-06-08
In a joint advisory, the US National Security Agency (NSA), the FBI, and the Cybersecurity and Infrastructure Security Agency (CISA) warn that Chinese “state-sponsored cyber actors continue to exploit publicly known vulnerabilities in order to establish a broad network of compromised infrastructure.” The advisory lists 16 known vulnerabilities the hackers have been exploiting to infiltrate networking devices from 10 vendors.
These are not new vulnerabilities. They range from 2017 to 2021, and most are in network equipment (firewalls, switches, access points, NAS.) It is paramount to make sure that your boundary protection and network devices are kept updated and secure, particularly as more segmentation and NAC solutions are implemented to support a more flexible service access model such as zero trust.
CISA: People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices
The Register: Beijing-backed baddies target unpatched networking kit to attack telcos
SC Magazine: US warns Chinese hackers exploiting known vulnerabilities in espionage campaign on telecoms
ZDNet: NSA, FBI warning: Hackers are using these flaws to target VPNs and network devices
Dark Reading: China-Sponsored Cyberattackers Target Networking Gear to Build Widespread Attack Infrastructure
Cyberscoop: Fed cyber officials detail Chinese state hackers using common exploits against telcos
2022-06-08
The US Cybersecurity and Infrastructure Security Agency’s (CISA’s) Cyber Innovations Fellows program will bring experts from the private sector to work at the agency part-time for up to four months. The fellows will bring “their expertise to some of our most critical teams.” CISA will hire the first group of up to eight fellows later this year.
CISA has been working hard to raise the bar for both public and private sector cyber security. Even so, it has been noted that some of the CISA directives are not viable in the real world. This is an exciting opportunity to infuse real world experience and expertise into their processes as well as gain insight and understanding you can bring back. They are looking for a broad range of expertise including AI, ML, Cyber Risk, Remediation, Cloud, SBOM and Threat intel. If you’re interested read the CISA Prospective Cyber Fellow Candidates page for details: https://www.cisa.gov/prospective-cyber-fellow-candidates
2022-06-09
This week, the US Cybersecurity and Infrastructure Security Agency (CISA) has added 39 flaws to its Known Exploited Vulnerabilities Catalog, 36 on Wednesday, June 8 and three more on Thursday, June 9. The flaws have mitigation due dates between June 22 and June 30.
Note that there are multiple vulnerabilities which can be resolved with a single update, such as pushing the latest Chromium, Acrobat and Microsoft updates. Note there are some Flash Player issues listed. It is past time to remove Flash with extreme prejudice. CISA has also updated their guidance and FAQs associated with the KEV catalog: https://www.cisa.gov/uscert/ncas/current-activity/2022/06/07/cisa-provides-criteria-and-process-updates-kev-catalog
This database is becoming quite large. It demonstrates how porous our environment is. Items in the catalog should get priority when patching.
Atlassian Confluence Attacks
TA570 QBot attempts to exploit CVE-2022-30190 (Follina)
https://isc.sans.edu/forums/diary/TA570+Qakbot+Qbot+tries+CVE202230190+Follina+exploit+msmsdt/28728/
QBot Uses Follina
https://twitter.com/threatinsight/status/1534227444915482625
Analysis of a Facebook Phishing Campaign
Zyxel Security Advisory
Fujitsu Centricstor Vulnerability
Meeting Owl Vulnerabilities
https://www.modzero.com/static/meetingowl/Meeting_Owl_Pro_Security_Disclosure_Report_RELEASE.pdf
Fake CCleaner Malvertisements
https://blog.avast.com/fakecrack-campaign
Weakness in Verbatim Keypad Secure USB Drive
https://blog.syss.com/posts/hacking-usb-flash-drives-part-1/
The Trouble With Microsoft's Troubleshooters
https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd
Deadbolt Ransomware
Google Android Updates
https://source.android.com/security/bulletin/2022-06-01?hl=en