Apple Updates and ARM CPU Vulnerability; StrelaStealer Affecting US and EU Organizations

This update patches only one vulnerability (CVE-2024-1580). But this vulnerability affects two different components, CoreMedia and WebRTC.

CVE-2024-1580, an integer overflow in the dav1d AV1 decoder, has a CVSS score of 5.9. Exploiting the flaw can result in memory corruption within the decoder. While the fix only addresses the two packages, the code was in use across multiple OSes so you need to make sure you're pushing the update to all the affected devices. Apple has not indicated there is exploitation in the wild, but now that the fixes are out, expect reverse engineering to lead to POC exploits soon.

This vulnerability is substantially different than prior side channel attacks. But to leak the key material of encryption operations, an attacker must be able to "probe" the system by having it encrypt data. The attack will have to launch a "chosen input attack." M3 processors have the ability to turn off the vulnerable features, but this needs to be specifically done by developers. Any additional patch will likely come from software developers writing encryption code for Macs. It is unlikely that Apple will be able to develop a "universal patch."

The vulnerability has been named "GoFetch" as it takes advantage of the feature known as data memory-dependent prefetcher (DMP) to target constant-time cryptographic implementations and capture sensitive data from the CPU cache. This is not a flaw which could be remedied via an OS update. The future chip designs would have to be changed to prevent the activities, or applications would need to implement mitigations internally. M3 chips with DIT enabled are not vulnerable to this attack, however in that mode the processor takes the worst-case amount of time to complete the instruction, regardless of the input data.

While this implementation-induced vulnerability is resistant to an easy fix, it is not of concern for most users. Exploitation requires both special knowledge and possession of the device. Apple offers the user the ability to remotely disable a lost or stolen device.

This supply chain attack is much more involved than many of the other GitHub/Python attacks. The attack started in February, and compromised well-respected contributors to Python packages. Malicious code was well concealed by creating a smoke screen of benign changes and selecting plausible domains to host the compromised components.

This is a particularly well-crafted supply chain attack. It allows the attacker to target the developer community and through them, software products.

The researchers say 36% of vulnerable devices have been upgraded. Odds are much higher that your credit card was compromised from the hotels website or reservation management system.

When the dust settled, the locks used the known vulnerable MIFARE Classic RFID system and the attack required a $300 Proxmark RFID read-write device, a stack of blank RFID cards, and an Android phone or Flipper Zero. Replace all your keycards and update/replace all your locks, now update your encoders and third-party integrations is a tall order. It's surprising they are not still sitting on the discovery while mitigations are underway; current estimates are about 35% of the vulnerable locks and systems have been replaced or upgraded.

A serious vulnerability that has been in existence for years. In the short term, don’t keep valuables in your hotel room and use a secondary locking device (door block) whilst in the room. Finally, just remember that back in the day, physical keys could be duplicated or picked; it continues to be a game of cat-and-mouse.

Japan is also running a similar program with the Association of Southeast Asian Nations, having launched the ASEAN-Japan Cybersecurity Capacity Building Center in Thailand in 2018. While sidestepping the issue of China's threat to the area, this is a good opportunity to better preserve their nation's security, economic vitality, and resilience.

Kudos to Japan and the US, indirectly, for establishing the first of what will be several regional cyber defense drills. Through knowledge, smaller, less resourced nations can raise their cybersecurity awareness and hopefully better defend against cyberattack.

United Health Group Optum spent over a year and $8B to acquire Change Healthcare and apparently did not do a thorough due diligence around cybersecurity risk. The cost to United Health Group to deal with lawsuits and fines from Change Healthcare’s security failure should include repaying government Change Healthcare/Optum Payment Disruption (CHOPD) accelerated payments to Part A providers and advance payments to Part B suppliers experiencing claims disruptions as a result of the incident.

This seems like an ideal lesson-learned from the Change Healthcare attack. And, while the bill would not go into effect until two years after being passed, to allow stakeholders to adapt to the required standards, this is reminiscent of the measures taken by cyber insurance to reduce the volume of covered settlements. Careful attention to the details must be made to assure stakeholders will be able to meet requirements for payment of a claim.

While attention is paid to this specific cyberattack, it can happen in every other industrial sector. This bill in its present form doesn’t address the vendor consolidation that creates single points of failure in critical services. Additionally, it continues to perpetuate the myth that each sector is somehow unique when it comes to cyber-attacks. Have CISA establish a single minimum cybersecurity standard for every industrial sector.