Patch IPv6 Flaw Now; Microsoft's Endpoint Security Ecosystem Summit will Not be Open to the Press; Companies are Opting Out of Letting Apple Scrape Data for AI Training

Luckily, the released code will only cause a system to crash, and triggering even the DoS condition is not fully reliable. Finding paths to code execution will be tricky. Let's hope exploit developers are not going to surprise us with a solution anytime soon.

Johannes Ullrich

This one is still fragile as an exploit, but it works. However, the exploit is complicated and, over time, maybe weaponized. I'm not a fan of disabling IPv6Ó at the network adapter layer, as I've been through this movie before. We had the same conversations in the Novell IPX/SPX and IPv4 days. Once you get to 'enabling IPv6, you may find it's not as easy as disabling it. I prefer to patch the systems and properly route IPv6; if you cannot, disable IPv6. Do not leave IPv6 untouched; that is also a vector for adversary in-the-middle attacks.

Moses Frost

You're thinking, 'Switch to IPv6 they said; it'll be secure they said.' They weren't wrong - implementation details are where things can go south. At the time the patch was released on August 13, there weren't any known POCs or exploits. If you've already rolled out the update, you're good. If you're still doing analysis, time to step it up. Then go back and make sure you're following the current best practices for a secure IPv6 rollout.

Lee Neely

Way back in 2003, Microsoft acquired GeCAD, a Romanian antivirus software company and I wrote a Gartner research note urging Microsoft change the game by making Windows and Office apps more secure and not just join in on endpoint security revenue (projected to be over $5B in the US in 2024) - revenue which largely exists because of Microsoft vulnerable code and Microsoft's refusal to force Windows users away from reusable passwords. This area is kind of like the profit attractiveness of drugs to alleviate symptoms vs. development of cure for causes of disease.

John Pescatore

It's common for Microsoft to ask vendors to come in and discuss their products. I suspect this may be the first time all the vendors are at the same conference on the same topic.

Moses Frost

A not unexpected follow-on event after the CrowdStrike incident. Cyber Resiliency is critical and making sure our endpoints are as robust as possible, to include detection and prevention of attacks, is a key component here. Part of the discussion will be the efficacy of removing kernel access, something Apple has been working on for the last few years; it's not simple and has nominal return. Even so, cyber improvements are likely to come in small increments.

Lee Neely

Unlike traditional search engine web crawlers, AI bots will obscure the original source of any information they acquire to train their models. Even if asked for a reference, AI bots in the past have often made up fictitious references. Copyright holders are rightfully concerned about the use of their work by AI bots without being provided any credit or compensation.

Johannes Ullrich

On the Red Team my first thought is, what happens when I switch my user agents around and become one of these bots? It's always interesting.

Moses Frost

Applebot respects directives in your robots.txt file, for user-agent Applebot or Googlebot. The directive blocks the data on your site from being used to train their LLM. Google's AI-specific bot, Google-Extended, is blocked by about 43% of websites while OpenAI is blocked by about 53%. Apple competitors like OpenAI and Perplexity are negotiating partnerships with news outlets, social platforms and other sites to allow processing their content. Speculation is businesses want to withhold data until a partnership (typically paid) is established. If you have copyrighted content, you likely don't want the LLM's trained on it, update your robots.txt. With the plethora of new AI bots, consider wildcards to avoid perpetual updates.

Lee Neely

CVE-2024-70929 can be exploited over the network without authentication. There isn't a patch for the cameras, so you need to restrict access and monitor for unexpected activity. Mirai continues to be used to exploit unpatched/vulnerable IoT devices, so it's a good time to make sure you're both patching and defending these devices, particularly SOHO and other "set and forget" items, which easily fall of the radar because they "just work."

Lee Neely

Two issues here: First, the default, setup, HSQLDB database credentials were published in a support article. The database was not intended for production use, but some sites missed the guidance to create a replacement, and it is deprecated. Second is a SQLi flaw in their workflow, which requires update to 5.1.7 to fix. Make sure you're not using the default HSQLDB and if you are, limit access (it listens on port 4406), and then follow the guidance to create a replacement.

Lee Neely

Definitely a good document to brush up on your ransomware defenses. First and foremost, make sure you're using phishing resistant MFA wherever possible, eliminate SMS and phone call based two-factor, and make sure users are trained to recognize and report phishing attempts. You'll likely find your products already have the foundation you need to support MFA; this is more of creating (and executing) an implementation plan than rolling up a truckload of new products.

Lee Neely

Not a lot of specifics are being shared. The Dutch Ministry of Defense is categorizing this as login problems with some service impacts due to phones being offline. The outage is impacting flights to Eindhoven airport which serves as a military base; Schiphol, the country's largest airport, remains unaffected. Given the impact on civilian travelers, it's reasonable to expect better communications on the outage, impacts and related activities.

Lee Neely

I suspect they will revisit connectivity to other networks as part of the After Action Report (AAR) and look to segment those networks.

Curtis Dukes

The phrase "if this goes sideways, delete my browser history" comes to mind. While a privileged insider is tricky to prevent, particularly one with global admin, enforced MFA and monitoring can raise the bar.

Lee Neely

The court documents call into question the skillset of Mr. Rhyne as an infrastructure engineer. At a minimum, he didn't seem to have familiarity with the 'command line' interface. Oh well, score one for the good guys although it doesn't seem that they had to work that hard to find and charge the culprit.

Curtis Dukes

So far, Dick's is reporting that this didn't have a substantive impact on their operations, and ransomware wasn't in play. Store phone systems are offline, and employees are reporting that email and other accounts are locked, and access is only being restored after re-verification of employee identities on-camera, indicating the entry point was a compromised credential. Oddly, employees are being told the account lockouts were due to planned activity rather than the cyber incident and further information would be relayed via personal email or text messages rather than relying on the offline internal systems. Employees are being directed not to discuss the incident publicly or put anything in writing. Better guidance would be to direct any inquiries to the communication team. https://www.bleepingcomputer.com/news/security/dicks-shuts-down-email-locks-employee-accounts-after-cyberattack/: DICK'S shuts down email, locks employee accounts after cyberattack

Lee Neely