Vulnerabilities in Microsoft Apps for macOS; 400 CVE Numbering Authorities; More National Public Data Breach Information

The issue here is that once an application has the entitlements like camera access, these entitlements extend to the entire application, including libraries loaded at run time or extensions and plugins. It is up to the application at this point to protect itself. The issue Cisco points out is that the applications do not enforce security features available to protect the application. However, all of these applications have some form of scripting interface. This would allow an attacker to abuse these applications even if dynamically loaded libraries are validated.

Johannes Ullrich

As always, this is a good writeup from the Talos group around a portion of the enterprise ecosystem that seldom gets talked about. There is a lot of effort to subvert Windows, but how many MacOS devices are in the corporate ecosystem? Specifically in the executive suites at a minimum.

Moses Frost

macOS has a layered security model, including TCC and entitlements which are aimed at protecting user privacy and system security. They are not foolproof. These apps include the entitlement to disable library validation, which only allows them to access libraries signed by their developer, which was removed with updates to Teams and OneNote. Excel, Outlook, PowerPoint and Word remain this capability to support plug-ins. Other than pushing updated applications, reviewing their access (user granted, e.g. Camera/Microphone access) is a good idea.

Lee Neely

I appreciate Mitre making it easier to assign CVEs. The solution to the current "flood" of vulnerability is not to ignore them. NIST has laid out a plan to catch up with its NVD database, and even if the data enrichment is incomplete, it is better to have a CVE than not to have a CVE.

Johannes Ullrich

While I applaud multiple organizations stepping up here, most are scoped to support their products only, this does give them more skin in the game which is needed. Even so, the bigger need is to support CVE analysis to clear both the current and seven-month backlog. As of June 3, there were 13,358 CVEs waiting to be analyzed, as of August 13th the number was 17,372 and is projected to hit nearly 28,400 by the end of 2024. Fingers crossed the contractor is able to scale up to process 200-300 CVEs/day to overcome the backlog.

Lee Neely

National Public Data is downplaying the breach. The data posted by USDoD for sale was analyzed by Troy Hunt (maintainer of HaveIBeenPwned) found the data contains 134 million unique email addresses, as well as criminal record data for 70 million of those addresses. Access Data Privacy analyzed the data and found as many of 272 million unique SSNs, many of which are no longer living. While there is precedent for changing the amount of data exfiltrated as the investigation proceeds, it's important to get this straight rapidly, particularly when others are analyzing the data and find a discrepancy with your reporting. While this gets sorted, double down on ID protection/restoration services and don't forget to freeze your credit.

Lee Neely

The current read on this is that the company is “unsure” of how many records have been stolen. They claim that only 1.3 million (instead of 2.9 billion) records were taken. According to reports from Troy Hunt, 134 million email addresses are in the dump. This doesn’t mean that all the data is from the same place, so there is still speculation about this entire breach. One to watch. Is this the fourth or fifth time our social security number data has been breached? I lose count.

Moses Frost

Well that was a bit of a rounding error by National Public Data. Still, its 1.34M people affected that had little say in how their information was collected and used. Perhaps it’s time to regulate data brokers and ‘for Pete’s sake,’ let’s pass a national data protection law.

Curtis Dukes

This is data from the July 18th ransomware attack by the Rysida gang which claims to have stolen 6.5 terabytes of data. The data appears to have been released on the dark web, and while the average citizen doesn't have access to it, criminals likely do which is why the city attorney is letting city residents, customers and employees know they are ready to support them with needed protection or other civil orders relating to this data being released. Offering to support your customer in a breach, beyond just ID/Credit monitoring/restoration is a classy move to consider for your playbook.

Lee Neely

Good on Columbus for not paying the ransom. Bad on Columbus for not exhibiting a standard of reasonableness in protecting its citizens information. While much of the information is likely public, the city still has a responsibility to protect it as some of it may be sensitive. Take a look at the ‘Blueprint for Ransomware Defense,’ an actionable framework for ransomware mitigation, response, and recovery.

Curtis Dukes

Flint residents can pay for the affected city services only via cash or check. Double check with your FI if your online bill-pay electronic payment mechanism needs to fall back to sending a check. Even if you're not in Flint, ask them if they have a protocol for failing back to an analog payment. To date, no ransomware gang is taking credit for this attack and the city doesn't yet have an ETA for service restoration. While it can be hard to get your arms around that timeline, make sure that your tabletop exercises include flushing out how you'd determine a recovery date and how to meet it.

Lee Neely

The third-party payment site was decommissioned in late June, and a new secure site provisioned. Nevertheless, payment information, including names, card numbers, CVV and expiration dates were exfiltrated for six months. The zoo is notifying affected parties and offering them a year of credit monitoring.

Lee Neely

While not as serious as new account application fraud, card transaction fraud remains a nuisance and a cost in the system. This is in part because online merchants continue to accept, not to say rely on, them rather than use payment proxies like PayPal, Amazon, Google Pay, and Apple Pay. While use of the proxies does have a cost, it is more than offset by the reduction in fraud loss.

William Hugh Murray

Microsoft provides multiple MFA options for Entra including FIDO2 security keys, certificate-based authentication (CAC, PIV, X509), passkeys and the Microsoft authenticator using biometrics, push notifications or OTP. Don't enable SMS/phone-call based MFA; it's too easily compromised. alk to your Azure/Entra ID administrators about their plans for MFA, not only about which technical options they will support but also their communication and user-support activities.

Lee Neely

The trend continues making MFA mandatory for users. Microsoft signaled its intent late last year and this is its follow-through. We can add Microsoft to the ‘mandatory use’ club and MFA as the de facto standard for identity management.

Curtis Dukes

There is nothing quite like the letter from a provider letting you know your data has been breached. Take note of the guidance on their incident web site; it provides in-depth options and contacts for organizations which can aid users both secure their credit as well as help monitor for activity related to the use of their data.

Lee Neely

I’m sorry but nine months is about seven months too long to begin notifying individuals that their information has been taken. I get that there needs to be a balance between investigation and victim notification. Just remember for every day the investigation continues it’s a day the evil doer can use it, unbeknownst to the victim.

Curtis Dukes

CVE-2024-23897, parser flaw, has a CVSS 3 base score of 9.8. The command parser replaces @ followed by a pathname with the content of that file, allowing for arbitrary files to be read. CISA has a KEV due date of September 9th. Jenkins 2.442, Jenkins LTS 2.426.3 or LTS 2.440.1 disables the command parser feature which does this. Another workaround is to disable access to the CLI to prevent exploitation entirely.

Lee Neely

Yet another vulnerability [er, software defect] in a WordPress plug in. The open-source plugin has had several critical vulnerabilities over the last 18 months, this continues that trend. Sometimes the open-source model comes at a cost to the end-user.

Curtis Dukes

CVE-2024, InPost for WooCommerce and InPost PL plugin vulnerabilities, CVSS score of 10, needs to be addressed post-haste. Check for both plugins. InPost-for-woocommerce should already be auto-updated to 1.4.5 or higher. If you're still running woo-InPost, you need to replace it, including uninstalling the old one.

Lee Neely