homepage
Open menu
Contact Sales

SANS NewsBites

Make Sure This Week’s Chrome Patches Are Restarted and Completed; Google Says Cloud Threats Mitigated By MFA, Strategies for Patching Kubernetes Faster, and Essential Security Hygiene; Another Spyware Company Exits the “Law Enforcement” Market

April 18, 2023  |  Volume XXV - Issue #31

Top of the NewsThe Rest of the Week's NewsInternet Storm Center Tech Corner

Top of the News

2023-04-17

Google Releases Emergency Fix for Chrome Zero-day

Google has released an emergency update for its Chrome desktop browser to fix a vulnerability that is being actively exploited. The type confusion vulnerability in the Chrome V8 JavaScript engine could “allow a remote attacker to potentially exploit heap corruption via a crafted HTML page.”

Editor's Note

A lot of times you hear advice to "update your browser" (I may have said that myself). For Chrome, and most other browsers, you never need to actually do anything to update the browser, but the browser will do it for you behind the scenes. Just make sure you fully exit the browser once a day to allow it to apply the update. Bad actors are using news like this to distribute malware via fake browser updates.

Johannes Ullrich
Johannes Ullrich

Check out the Chrome Enterprise settings to ensure that users are required to relaunch to finish the update process. Encourage users to click the relaunch prompt when shown rather than waiting for it to timeout, or your processes to intervene. Google reports an exploit for CVE-2023-2033 exists in the wild. Don't overlook updates for Chromium based browsers, Brave, Opera, Vivaldi, etc.

Lee Neely
Lee Neely

Since most browsers and even mobile operating systems push patches out constantly, “Emergency Fix” is pretty much an outdated term that largely only applies to Windows these days. Convince your CIO that all since all those cloud services you use are able to patch continually, the same should be true for data center and fat client apps.

John Pescatore
John Pescatore

The type confusion vulnerability allows remote code execution and should be patched immediately. Several years ago, Google greatly simplified the patch management process for Chrome, now mirrored by all major browser vendors. It’s as simple as closing and reopening the browser.

Curtis Dukes
Curtis Dukes

Browsers, the universal clients, are open, general, flexible, feature rich, complex, and vulnerable. Prefer purpose built clients for sensitive applications.

William Hugh Murray
William Hugh Murray

2023-04-17

Google’s April 2023 Cloud Threat Horizons Report

Google’s Cybersecurity Action team has published a new edition of its Cloud Threat Horizons Report. Among the findings: A Chinese state-sponsored hacking group used the Google Command and Control (GC2) red teaming tool in attacks against organizations in Taiwan and Italy. Weak passwords and API compromise are the most frequently used methods of cloud compromise.

2023-04-17

Reports from Citizen Lab, Microsoft May Have Prompted Shutdown of Israeli Spyware Company

QuaDream, an Israeli spyware company, is reportedly shutting down operations just days after Citizen Lab and Microsoft released reports detailing the company’s tools and victims. QuaDream’s spyware “framework” was reportedly used against dissidents, NGO workers, and journalists in North America, Asia, Europe, and the Middle East.

The Rest of the Week's News

2023-04-17

US Dept. of Health and Human Services Publishes Cybersecurity Resources

The US Department of Health and Human Services (HHS) 405(d) Program and the Health Sector Coordinating Council Cybersecurity Working Group (HSCC CWG) have released resources to help healthcare organizations address cybersecurity concerns: the 2023 edition of the Health Industry Cybersecurity Practices (HICP); Knowledge on Demand, an online educational platform that offers free healthcare-focused cybersecurity awareness training; and a report, Hospital Cyber Resiliency Initiative Landscape Analysis.

Editor's Note

These documents work to relate cybersecurity to healthcare practices to help practitioners relate to the importance of the guidance. They are focused on relevant, cost-effective ways to raise the bar on cybersecurity as well as identifying top threats which can impact patient safety (social engineering, ransomware, data loss, network attacks of medical devices and lost/stolen equipment). Worth the time to read and leverage to work any gaps/omissions. If nothing else, use them to show decisions made to raise the bar were credible and necessary.

Lee Neely
Lee Neely

HHS has put together a compendium of cybersecurity practices for the Health Industry. It can be a little difficult to wade through with a main document, two technical volumes, and a separate resources/templates volume, but great awareness information nonetheless.

Curtis Dukes
Curtis Dukes

Healthcare remains vulnerable and a target of opportunity, in part because, HIPAA security guidance was not prescriptive. Strong guidance, prescription, is what is needed in healthcare.

William Hugh Murray
William Hugh Murray

2023-04-14

CSC 2.0: Space Systems are Critical Infrastructure

In a new report from CSC 2.0, the successor to the Cyberspace Solarium Commission, says, “The national security components of the space race today include not just weapons systems but also the security of critical infrastructure — much of which relies on global positioning satellites, remote imagery, and advanced communication.” As such, CSC 2.0 says that space systems should be designated as critical infrastructure.

2023-04-12

US State Dept. Plans to Have Diplomats Trained in Cybersecurity at Every Embassy

The US State Department’s Bureau of Cyberspace and Digital Policy plans to have a diplomat with training in technology at each of its 168 embassies worldwide by the end of 2024. To meet the goal, the State Department is providing training sessions for its diplomats. The project is being overseen by Nate Fick, who is the first US ambassador at large for Cyberspace and Digital Policy.

2023-04-16

Recent KEV Catalog Additions

The US Cybersecurity and Infrastructure Security Agency (CISA) has recently added four new vulnerabilities to its Known Exploited Vulnerability (KEV) catalog. The vulnerabilities are a privilege elevation issue in Android Framework; an insecure deserialization vulnerability in Novi Survey; a type confusion vulnerability in the Google Chromium V8 Engine; and a use-after-free vulnerability in macOS. Federal Civilian Executive Branch (FCEB) agencies have mitigation deadlines for these vulnerabilities in early May.

2023-04-17

NCR Aloha PoS Platform Hit with Ransomware

NCR says that a ransomware attack against one of its data centers has created problems for some customers of its Aloha point-of-sale (PoS) software platform. Aloha PoS is used in restaurants. Aloha PoS service disruptions began earlier this month; on April 13, NCR determined that the cause was a ransomware attack. The “data center outage … is impacting a limited number of ancillary Aloha applications for a subset of … hospitality customers.”

2023-04-14

Rheinmetall Suffers Cyberattack

Rheinmetall, an automotive and arms manufacturer based in Dusseldorf, Germany, has disclosed that it experienced a cyberattack that affects its industrial customer division. A company spokesperson said that their defense division was not affected. The incident occurred on Friday, April 14.

Internet Storm Center Tech Corner

The strange case of the Great Honeypot of China

https://isc.sans.edu/diary/The+strange+case+of+Great+honeypot+of+China/29750

The LockBit ransomware (kinda) comes for macOS

https://objective-see.org/blog/blog_0x75.html

Google Cloud Used as C&C

https://thehackernews.com/2023/04/google-uncovers-apt41s-use-of-open.html

Attack Campaign That Uses Fake Google Chrome Errors

https://insight-jp.nttsecurity.com/post/102icvb/attack-campaign-that-uses-fake-google-chrome-error-to-distribute-malware-from-com

Chromium Publishes Emergency Update

https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_14.html

LAPS Update Errors

https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview

Manage Engine Vulnerability

https://hnd3884.github.io/posts/CVE-2023-29084-Command-injection-in-ManageEngine-ADManager-plus/