Make Sure You Know Who Your Remote Employees Are; FreeBSD Updates Address OpenSSH Vulnerability; Microsoft Office Zero-Day

Understand how this fraud works to prevent falling for it: Knoot was hired by dozens of firms using a stolen identity; the firms then sent him laptops that he connected in Nashville and which the North Korean workers would VPN into and use. At times this scenario also includes cameras which are pointed at MFA tokens so the remote worker can enter the code. His undoing was likely his reporting income, against the stolen identity, in Nashville, which didn't mesh with the actual taxes filed. Due care must be made to ensure remote workers are who they claim to be, and that additional connections, with corresponding RDP services, to remote laptops are not in play.

Lee Neely

It's not clear how technical this person was or if they were a hobbyist who got duped into some type of fraud. It is a strange case, and I am going to look further into it. If this has happened once, it may have been happening in more places.

Moses Frost

In my 90th year, I may yet live long enough to see the day when the risk of cyber crime exceeds its return.

William Hugh Murray

This update addresses the regreSSHion vulnerability made public a couple weeks ago. Exploitation is not trivial, but given the severity, the vulnerability should be addressed quickly.

Johannes Ullrich

There are two mechanisms to mitigate FreeBSD: either update to the latest supported version of FreeBSD OS 13 or 14, which includes the binary patch, or download and deploy the source for the affected products. Even if you're compiling from source, get on the current versions so you get updated/fixed source for all your packages.

Lee Neely

I am not sure if this is related to HDMoore's thing around SSHamble, but SSH is getting a closer look lately.

Moses Frost

The exploit patterns around tricking Windows into establishing SMB connections with no or little user interaction is probably not going away until NTLM is removed from Windows. There appears to be an inexhaustible reservoir of vulnerabilities. By now, you hopefully have at least outbound port 445 blocked.

Johannes Ullrich

While mitigations to this flaw were published in July, applying the update, scheduled for August 13th, provides the full fix to the flaw. If you've not yet deployed the mitigations, make sure all your endpoints are ready to automatically deploy the update when it is released today.

Lee Neely

Two vulnerabilities, CVE-2024-21302 and CVE-2024-38202, need to be chained to exploit this attack, and Microsoft has not yet released a patch to mitigate these flaws. In the interim, follow the guidance in the linked Microsoft advisories to enabling auditing of file access use, and check your EDR provider for their ability to detect attempted exploitation of these flaws.

Lee Neely

Typically, one or more product vulnerabilities are announced at BlackHat/DefCon. And often, Microsoft is a target. This year is no different. While the vulnerability requires local access and admin privileges to implement, do follow the mitigation guidance provided by Microsoft until a patch is released.

Curtis Dukes

I saw this at DefCon this weekend. It's an interesting attack vector. It makes you feel more confident when Apple removes the ability to Downgrade. This issue is happening because Windows can downgrade. The toolchain allows for downgrade attacks that enable further exploitations. Interesting vectors, difficult problem for Microsoft.

Moses Frost

Two vulnerabilities, CVE-2024-21302 and CVE-2024-38202, need to be chained to exploit this attack, and Microsoft has not yet released a patch to mitigate these flaws. In the interim, follow the guidance in the linked Microsoft advisories to enabling auditing of file access use, and check your EDR provider for their ability to detect attempted exploitation of these flaws.

Lee Neely

Typically, one or more product vulnerabilities are announced at BlackHat/DefCon. And often, Microsoft is a target. This year is no different. While the vulnerability requires local access and admin privileges to implement, do follow the mitigation guidance provided by Microsoft until a patch is released.

Curtis Dukes

CVE-2023-31315 has a CVSS score of 7.5, and is not remotely exploitable. Fixes have been released to OEMs for distribution. Note that some of the fixes werenÕt available until this August. The fix is a firmware flash, although some CPUs have a mitigation 2 option of installing updated microcode, for consistency the best bet is to do the FW update across your affected AMD processors. This would be a good time to make sure all your AMD CPUs are running the latest firmware.

Lee Neely

The latest Intel CPUs have CPU bugs, which is why people are running to AMD. AMD is not bug-free either. I'm just watching this space.

Moses Frost

It is sad that so much time and talent is wasted exposing obscure vulnerabilities while we do not have enough to implement strong authentication, structured networks, cryptography, and least privilege access control, much less develop and apply novel security measures.

William Hugh Murray

Score one for the good guys. That said, ransomware purveyors have demonstrated a penchant for reestablishing themselves quickly after loss of infrastructure. The best long-term bet is to put maximum pressure on how the ransom is transacted.

Curtis Dukes

Indications are Radar/Disposessor is an outgrowth from the displaced LockBit ransomware gang members under the guidance of ÒBrain.Ó They have been in existence since August 2023, and target small to mid-sized businesses. This ransomware operates in two steps, first as a data stealer and second as an encryptor, and has many parallels to LockBit.

Lee Neely

While not much can be said about the actual cyber incident, a lot can be said about the amount and type of data maintained. Maintaining up to 48 different data types seems excessive but then as you look at the potential make-up of the student population, on-site medical support, and faculty it makes sense. Now comes the rub: what is the data retention policy and how much is required by regulation? Organizations should always look for ways to minimize what data is collected and retained while still complying with laws.

Curtis Dukes

Application fraud is far more serious than transaction fraud. The collection and use of multiple forms of identifying information may be justified to resist it. However, retaining such data after a decision has been made on the application is reckless.

William Hugh Murray

Key in the notification, besides offering credit monitoring to affected individuals, are clear instructions on freezing your credit, something we all need to do, particularly our younger generation who haven't yet experienced ID theft or other consequences when it's not frozen.

Lee Neely

Have your threat hunters grab the IOCs from Reason Labs and see if you've got some of these malicious extensions in your environment. Next, make sure your EDR solution is checking for malicious browser extensions, if they don't ask for a roadmap of when, this is an increasingly common attack and you're going to want your endpoints defending themselves from malicious extensions, which may require a pivot in your EDR plans.

Lee Neely