homepage
Open menu
Contact Sales

SANS NewsBites

Priority Patch All Apple and Android Devices, and MOVEit Applications; Have Legal Counsel Review EU US Data Privacy Review Court Agreement

July 11, 2023  |  Volume XXV - Issue #54

Top of the NewsThe Rest of the Week's NewsInternet Storm Center Tech Corner

Top of the News

2023-07-11

UPDATE: Apple Pulls Rapid Security Response Updates for WebKit Vulnerability

On Monday, July 10, Apple released Rapid Security Response updates to address an arbitrary code execution vulnerability in the browser WebKit module in iOS, iPadOS, and macOS Ventura. The flaw is being actively exploited. On Tuesday, Apple pulled the update after it became "aware of an issue where this Rapid Security Response might prevent some websites from displaying properly. Rapid Security Response macOS 13.4.1 (b) will be available soon to address this issue."

Editor's Note

Applying these patches should be a no-brainer. They fix currently exploited vulnerabilities, and Apple's "Rapid Security Response Updates" are specifically designed to be easy to apply. Should take less than five minutes per device. It does require a reboot, but the reboot is just a "regular" quick reboot and not the more lengthy reboot used by the larger operating system updates.

Johannes Ullrich
Johannes Ullrich

Apple released updates for iOS/iPadOS 16.5.1, macOS 13.4.1 and Safari 16.5.2 to address CVE-2023-37450 which are actively being exploited. Apple will be releasing new versions of the updates to iOS/iPadOS 16.5.1 and macOS Ventura as the update causes some web sites to to not display properly. If you're having issues, the rapid update can be removed through the settings app on macOS/iOS/iPadOS, and using the about the OS menu, remove the update. A restart is required.

Lee Neely
Lee Neely

I always recommend people keep automatic updates running, but I also find it inconsistent or delayed sometimes. If you are reading this and are security conscious, force the upgrade as it may not have already occurred.

Moses Frost
Moses Frost

Apple introduced Rapid Security Response updates in May of this year to address critical vulnerabilities. This is the second time they’ve used this update process. The updates are compact and quick to install. Given reports that the vulnerability is actively being exploited, download and install today.

Curtis Dukes
Curtis Dukes

“The flaw is being actively exploited” = Patch now !!

Brian Honan
Brian Honan

2023-07-10

Google Releases Android Security Bulletin for July

Google’s Android Security Bulletin for July 2023 addresses more than 40 vulnerabilities, several of which are being actively exploited. Those flaws include a privilege elevation vulnerability affecting the Midgard, Bifrost, and Valhall Mali GPU kernel drivers; a memory leak issue in the Arm Mali GPU driver for Bifrost and Avalon apps and Valhall chips; and a critical vulnerability in the Skia open-source 2D graphics library.

2023-07-10

Three More Vulnerabilities in MOVEit

Progress Software has disclosed three additional vulnerabilities affecting its MOVEit file transfer application: a critical SQL injection vulnerability; a high-severity group of SQL injection issues; and a high severity vulnerability that could be exploited to cause unexpected termination. The flaws are fixed in MOVEit versions 15.0.4, 14.1.8, 14.0.7, 13.1.7, and 13.0.9.

2023-07-10

EU US Data Privacy Agreement

The European Union has formally adopted the EU US Data Privacy Framework. The new data protection agreement requires US companies “to delete personal data when it is no longer necessary for the purpose for which it was collected, and to ensure continuity of protection when personal data is shared with third parties.” An EU court invalidated the previous EU US data privacy agreement, Privacy Shield, in 2020.

The Rest of the Week's News

2023-07-10

HCA Healthcare Discloses Data Breach

HCA Healthcare has disclosed a data security incident that compromised patient information, including names, telephone numbers, birth dates, and appointment data. HCA Healthcare said the incident “appears to be a theft from an external storage location exclusively used to automate the formatting of email messages.” HCA Healthcare is based in Tennessee and operates 180 hospitals and 2,300 ambulatory care sites across 20 US states.

Editor's Note

HCA seems to be doing a solid job of communicating 5 days after discovering the breach, but they didn’t notice it until sensitive data was released in a public forum. No details out, but odds are a cloud storage configuration issue could be the root cause. Good item to use to justify checking/updating all your cloud services configurations to one of many available secure baselines.

John Pescatore
John Pescatore

HCA is an exception within the healthcare sector in that they communicated the data breach within five days of becoming aware. While we have scant details on how the theft occurred, ‘dollars to donuts’ the likely culprit will be a cloud misconfiguration. Take the time to revisit each external storage location and configure to a known security standard, such as the CIS foundation benchmarks.

Curtis Dukes
Curtis Dukes

This is about third-party risk. Make sure you're only providing them the data elements needed for their function, have a clear understanding of how that information is handled and protected, then make sure the incident response plan has appropriate contacts. While your contract analyst needs to know about an incident, your incident response team is probably a better first step, and better situated to respond.

Lee Neely
Lee Neely

2023-07-07

Grand Jury Indicts Individual for Alleged Cyberattack on California Water Treatment Facility

A US federal grand jury in California has indicted Rambler Gallo for allegedly intentionally causing damage to a protected computer at a water treatment facility. Gallo worked for a contractor hired by the Discovery Bay Water Treatment Facility. While employed by the contractor, Gallo allegedly installed software that allowed him to access the facility’s computer system from his home computer. Following his resignation, Gallo allegedly used the remote access to “transmit… a command to uninstall software that was the main hub of the facility’s computer network and that protected the entire water treatment system, including water pressure, filtration, and chemical levels.”

2023-07-10

New Firefox Feature Blocks Questionable Addons

Mozilla released Firefox 115.0 on July 4, 2023. The latest version of the introduces a feature called Quarantined Domains. Mozilla explains that the “feature allows us to prevent attacks by malicious actors targeting specific domains when we have reason to believe there may be malicious add-ons we have not yet discovered.” Firefox 115.0 also includes fixes for 13 security issues.

2023-07-10

Toitoin Banking Trojan Used in Attacks Against LATAM Organizations

A malware campaign targeting organizations in Latin America infects targets with the TOITOIN banking Trojan. The multi-stage attacks start with phishing and uses custom modules that are designed for “injecting harmful code into remote processes, circumventing User Account Control via COM Elevation Moniker, and evading detection by Sandboxes through clever techniques like system reboots and parent process checks.”

2023-07-10

Ventia Discloses Cyber Incident

Infrastructure services provider firm Ventia has taken some of its key systems offline to contain a cyber incident. Ventia, which is based in Australia and New Zealand, first disclosed the cyber incident over the weekend.

2023-07-10

Atlantic Council’s Cyber Statecraft Initiative Report: Critical Infrastructure and the Cloud: Policy for Emerging Risk

A report from the Atlantic Council’s Cyber Statecraft Initiative examines cloud adoption in five critical infrastructure sectors: healthcare, transportation and logistics, energy, defense, and financial services. healthcare, transportation and logistics, energy, defense, and financial services. The report focuses on how the cloud operates as a benefit and/or a necessity in each sector with regard to data storage and availability, scale and scalability, and continuous availability requirements. The “report aims to raise awareness of the risks that a potential cloud compromise or outage poses to CI and, in so doing, to make the case that these risks necessitate the maturation of current policy tools, and creation of others, to address these risks.”

Internet Storm Center Tech Corner

Apple Rapid Security Update Patches Three Exploited Vulnerabilities

https://isc.sans.edu/diary/Apple+Rapid+Security+Update+Patches+Three+Exploited+Vulnerabilities/30012

DSSuite Didier Toolbox Docker Image Update

https://isc.sans.edu/diary/DSSuite+Didiers+Toolbox+Docker+Image+Update/30008

Ubiquity EdgeRouter and AirCube miniupnpd Heap Overflow

https://ssd-disclosure.com/ssd-advisory-edgerouters-and-aircube-miniupnpd-heap-overflow/

More MoveIT Flaws and New Service Pack

https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023

Cisco Nexus 9000 Flaw

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aci-cloudsec-enc-Vs5Wn2sX

Mozilla Restricting Extensions on Quarantined Domains

https://support.mozilla.org/en-US/kb/quarantined-domains

https://www.mozilla.org/en-US/firefox/115.0/releasenotes/

https://lapcatsoftware.com/articles/2023/7/1.html