homepage
Menu
Open menu

SANS NewsBites

UK Gov't. to Replace SMS Verification with Passkeys; DDoS-for-Hire Service Suspects Arrested; PowerSchool Paid Ransom, but Extortion Continues; US DOD Software Fast Track Initiative

May 9, 2025  |  Volume XXVII - Issue #36

Top of the NewsThe Rest of the Week's NewsInternet Storm Center Tech Corner

Top of the News

2025-05-08

UK Government Turning to Passkeys for Digital Services

The UK government plans to roll out passkeys for digital services later this year. The technology will replace SMS-based verification. As described by the National Cyber Security Centre, "Passkeys are unique digital keys that are today tied to specific devices, such as a phone or a laptop, that help users log in safely without needing an additional text message or other code. When a user logs in to a website or app, their device uses this digital key to prove the user's identity without needing to send a code to a secondary device or to receive user input." The shift to passkeys will not only be cost effective, but also expected to improve security.

Editor's Note

The plan is not only to move away from SMS-based 2FA to passkeys, removing the risks around SMS, but also to remove passwords altogether. Further, the UK NCSC has joined the FIDO Alliance, providing a path for UK agencies to collaborate with alliance members on the development and deployment of needed technologies to keep the bar high.

Lee Neely
Lee Neely

The tech industry, primarily companies that provide digital services, has been moving to passkeys for the last few years (see recent reporting in SANS NewsBites Vol. 27, No. 35). Glad to see a government organization adopting passkeys. Additional kudos for mandating the authentication standard, FIDO, for the solution. Hopefully the USG will follow the UK in the use of passkeys for its digital services.

Curtis Dukes
Curtis Dukes

2025 is proving to be the year of Passkeys, the use of asymmetric key cryptography to authenticate clients to servers. For single user devices, they serve to authenticate the single user. However, for shared devices, they depend upon the ability of the device to associate a private key with an individual and to limit the use of that key to just that user. As we increase the use of this convenient mechanism, we must account for this limitation.

William Hugh Murray
William Hugh Murray

2025-05-07

International Law Enforcement Effort Disrupts DDoS-for-Hire Operation

Polish law enforcement authorities have arrested four individuals with alleged ties to a distributed denial-of-service (DDoS)-services-for-hire operation, also known as stresser or booter services. The suspects are believed to be responsible for six such services that were used to conduct attacks against schools, government agencies, private companies, and other organizations. The law enforcement operation involved authorities in four countries Ð Poland, Germany, the Netherlands, and the US Ð with support from Europol.

Editor's Note

Six DDoS services: CfxAPI, CfxSecurity, NeoStress, JetStress, QuickDown, and ZapCut, often marketed as legitimate testing tools on the dark web, which are actually DDoS-for-hire services (aka booters, or stressers), have been taken down along with nine domains seized by the US. Dutch investigators created fake booter sites to warn those seeking DDoS-for-hire services that what they are doing is illegal. These are part of the ongoing Operation PowerOFF, started in December 2018, which continues to find and shutter these services.

Lee Neely
Lee Neely

2025-05-07

PowerSchool Paid Ransom, but Schools are Being Extorted

Cloud-based education software provider PowerSchool stated in communication with BleepingComputer that "a threat actor has reached out to multiple school district customers in an attempt to extort them using data from the previously reported December 2024 incident." The company's Student Information System (SIS) was breached using a compromised support credential as early as August 2024, and in December 2024 a threat actor stole data including personally identifiable information (PII) belonging to tens of millions of current and former students, teachers, and parents and guardians. PowerSchool has reported the extortion attempts to law enforcement in the US and Canada, and says, "[we] are working closely with our customers to support them," additionally offering two years of free credit monitoring and identity protection. The company also confirmed that they paid a ransom following the discovery of the breach, stating, "We thought it was the best option for preventing the data from being made public, and we felt it was our duty to take that action. As is always the case with these situations, there was a risk that the bad actors would not delete the data they stole, despite assurances and evidence that were provided to us."

Editor's Note

Something to consider when building and reviewing your ransomware response plan is that there is no way to adequately verify the data is deleted as promised, or that it hasn't also been sold to another threat actor. With the growing trend to extortion, increasingly without encrypting the systems left behind, consider this as you would a data breach. Also keep in mind that paying the ransom can get you in hot water with regulators such as OFAC.

Lee Neely
Lee Neely

Usually going back to the victim for additional money is bad for business, but this becomes an option when you attack targets that maintain other data. Bottom line: think long and hard before deciding to pay a ransom; you're dealing with someone who, by definition, is untrustworthy.

Curtis Dukes
Curtis Dukes

2025-05-07

US Defense Department's Software Fast Track Initiative Aims to Revamp Procurement Process

A US Department of Defense press release notes that "Current systems for software procurement were developed for a different environment and using processes that are outdated and slow, with little to no supply chain visibility." In light of these issues, DoD has announced the development of the Software Fast Track (SWFT) Initiative, which "will define clear, specific cybersecurity and Supply Chain Risk Management (SCRM) requirements; rigorous software security verification processes; secure information sharing mechanisms; and federal government-led risk determinations to expedite the cybersecurity authorizations for rapid software adoption." DoD has made three related Requests for Information (RFI); they expect to have the plan ready within 90 days.

Editor's Note

Not much detail here yet, really only announcing the three RFIs and a 90 day 'sprint.' Faster can be better, but lowering the cybersecurity rigor in DoD procurements to buy bad software faster obviously increases risk. The basic idea seems to be using SBOMs and third party assessments and tools to speed up the Authority to Operate process. One of the RFIs focuses on AI-based assessment tools, with a key question: 'What are potential challenges in the implementation of automation or AI for high trust situations related to cybersecurity authorization official responsibilities?' - that needs to be focused on.

John Pescatore
John Pescatore

No doubt the DoD procurement process, to include software, is in major need of a rethink. That said, the RFI isn't clear on what they have in mind for an evaluation process; probably third-party, which means more revenue for the certification industrial complex. Just remember who the architect behind CMMC was. Also, it's not clear what the basis for the evaluation will be. My vote, not that they're asking, is for the NIST Secure Software Development Framework (SSDF).

Curtis Dukes
Curtis Dukes

As a major buyer and user of software, the DoD is in a position to demand high quality of suppliers and thus benefit us all. While perhaps less tolerant of shoddy software than the broader market, and having given up time and resources in its attempts to ensure the quality of the software that it buys and uses, the results have not been as good as one might have hoped. The market continues to tolerate shoddy software. This initiative recognizes that simply doing harder what is not working is not likely to produce the desired results. One hopes that this effort will improve both the timeliness of deployment and the quality of the code, to the benefit of us all.

William Hugh Murray
William Hugh Murray

Improving and streamlining software procurement will be a welcome change to both sides. The as-yet-to-be-defined process hopes to leverage AI to provide faster, more comprehensive analysis of a given package's fit to the new requirements. DoD is also looking to address risks of Open-Source Software. One hopes the effort is used to update existing DoD guidance to clarify and deconflict it, for greater consistency.

Lee Neely
Lee Neely

The Rest of the Week's News

2025-05-06

Langflow Critical RCE Flaw Added to KEV

The Cybersecurity and Infrastructure Security Agency (CISA) has added a flaw to the Known Exploited Vulnerabilities (KEV) catalog: a critical vulnerability in Langflow, an open-source web-based tool for developing AI application workflows using components such as agents, data sources, LLMs, and prompts. CVE-2025-3248, CVSS score 9.8, would allow a remote unauthenticated attacker to execute arbitrary code by sending crafted HTTP requests, due to the /api/v1/validate/code endpoint being susceptible to code injection. This flaw was fixed in Langflow 1.3.0 on April 1, 2025, but users should update to the latest version, currently 1.4.0, released May 6, 2025. Dr. Johannes Ullrich, Dean of Research for SANS Technology Institute, wrote in an Internet Storm Center diary on April 12, 2025: "The vulnerability went somewhat unnoticed, at least by me, until Horizon3 created a detailed writeup showing how easy it is to exploit the vulnerability and provide proof of concept exploit. Horizon3 published its blog on April 9th. We saw a first hit to the vulnerable URL ... on April 10th. Today (April 12th), we saw a significant increase in hits for this URL." Horizon3 notes that the 1.3.0 patch "puts the vulnerable endpoint behind authentication"; the researchers recommend restricting network access to Langflow, and if a recently developed AI tool must be exposed to the internet, "consider putting it an isolated VPC and/or behind SSO."

Editor's Note

The KEV due date for CVE-2025-3248 is May 26th. Given the data contained in your LLM, putting your AI behind SSO with appropriate access controls, just as you would a data lake or other repository, should be an SOP. Make sure that you're verifying access controls are working, as well as ensuring the product updates are applied.

Lee Neely
Lee Neely

2025-05-06

Update Android to Fix FreeType Flaw Exploited Since March

In the May 2025 Android Security Bulletin, Google announced fixes for 46 vulnerabilities, including a high-severity flaw in the FreeType open-source font rendering library affecting versions 2.13.0 and below, which was first found exploited in the wild and disclosed by Facebook on March 13, 2025. CVE-2025-27363, CVSS score 8.1, allows a user to execute arbitrary code when too small of a heap buffer is allocated when attempting to parse font subglyph structures related to TrueType GX and variable font files, leading to up to six signed long integers being written out of bounds relative to the buffer. Google's bulletin notes that code execution could occur "with no additional execution privileges needed," and that "user interaction is not needed for exploitation," also confirming indications that the flaw is under "limited, targeted exploitation." FreeType patched the vulnerability as of version 2.13.3, and users should update devices to the latest version of Android. On May 6, 2025, the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to the Known Exploited Vulnerabilities (KEV) catalog; federal agencies must patch by May 27, 2025.

Editor's Note

The 2025-05-01 Security Bulletin covers weaknesses which apply to Android 13, 14 & 15. CVE-2025-27363 has been fixed in AOSP 13 & 14. Recommended mitigations are to update the OS and make sure that you're leveraging Google Play Protect, which is enabled by default on devices with Google Mobile Services, and is critical if you're using an app store other than Google Play.

Lee Neely
Lee Neely

2025-05-08

FBI Alert Warns of Attacks Targeting End-of-Life Routers

The US Federal Bureau of Investigation (FBI) has published a Public Service Announcement warning that cybercriminals are installing proxy services on vulnerable end-of-life routers and using the compromised devices to disguise their identities while conducting illegal activity. The FBI published a second related document that lists indicators of compromise (IoCs) and tactics, techniques, and procedures associated with cybercriminal groups that have been known to exploit these unsupported routers.

Editor's Note

Leverage this information to make the threat real to folks who don't understand lifecycle replacements are necessary. The information also includes easy to read mitigations you should be using in current devices, such as immediate application of patches and updates, changing default credentials, and using unique 16 to 64-character passwords.

Lee Neely
Lee Neely

It's pretty simple if the device has reached end of life: upgrade. Not doing so demonstrates a lack of duty of care in protecting company and customer data. Which opens you up to possible litigation should the device be compromised.

Curtis Dukes
Curtis Dukes

"A system must be able to protect itself from all the traffic on any network to which it is connected." Many, not to say most routers, are connected to the Internet. We rely upon them to protect themselves from their traffic and to act as the first layer of protection for the things behind them. As single application devices they should be relatively easy to secure. However, they share with many other appliances gratuitous code, including general purpose operating systems, that both increase their attack surface and make them targets for incorporation into botnets. They also have a history of shipping with unsafe defaults. We must do better.

William Hugh Murray
William Hugh Murray

2025-05-07

CISA: Bad Cyber Hygiene Facilitates Simple Attacks on Oil & Gas OT

The US Cybersecurity and Infrastructure Security Agency has published an alert jointly with the FBI warning of "unsophisticated cyber actor(s) targeting ICS/SCADA systems within U.S. critical Infrastructure sectors (Oil and Natural Gas), specifically in Energy and Transportation Systems." The notice emphasizes the threats of defacement, interference with configuration, operational disruption, and even physical damage, despite the simplicity of the intrusion techniques. Many systems are at risk due to poor cyber hygiene and exposed assets, and CISA refers critical infrastructure asset owners and operators to a fact sheet of mitigations authored by CISA, the FBI, the Environmental Protection Agency (EPA), and the Department of Energy (DOE). Expert commentary throughout journalistic coverage of this alert unanimously stresses the widespread danger of negligent security practices, cautioning against default credential use, unsecure remote access, and vulnerable third-party and support access, among other issues. The joint guidance on mitigation recommends owners and operators disconnect OT from the public internet; change default passwords to strong, unique passwords; strengthen security of remote access, documenting and configuring the process; segment IT and OT networks; and "practice and maintain the ability to operate OT systems manually" in the event of an incident.

Editor's Note

Before you eyeroll at another warning about ICS/SCADA, take this as a chance to both verify that you're implementing the recommended mitigations and make sure that you're not missing any new ones, such as practicing manual operation and documenting remote access and privileges. Remember passive monitoring is your friend with these systems. Be sure to engage with system owners; you may find both use cases you hadn't understood as well as ideas they have which could raise the bar even higher.

Lee Neely
Lee Neely

It was only four years ago when the Colonial Pipeline suffered a ransomware attack. The guidance back then is the same as found in today's alert. Every critical infrastructure provider, not just Oil and Gas, should be measured against a baseline set of security controls. CIS has its Critical Security Controls, Implementation Group 1, what they call Essential Cyber Hygiene. Why not start there? https://www.cisecurity.org/controls/implementation-groups/ig1

Curtis Dukes
Curtis Dukes

2025-05-08

Medical Device Maker Discloses Cyberattack That is Disrupting Operations

In a May 6 filing with the US Securities and Exchange Commission (SEC), California-based medical device manufacturer Masimo has disclosed a cybersecurity incident that has disrupted the company's operations and interfered with their ability to process and fill customer orders. Masimo detected the unauthorized activity on their network on April 27, 2025, and took steps to contain the incident, "including proactively isolating impacted systems." Masimo makes patient monitoring devices, including "pulse oximeters, brain function monitors, hemodynamic monitoring systems, capnography and gas monitoring solutions, and remote patient monitoring platforms."

Editor's Note

While this is suspected of being a ransomware attack, no ransomware gang is taking credit for the attack. The attack affected their on-premises systems; their cloud-based systems appear unaffected. Given the integration (and trust) between on-prem and cloud-based systems you currently have, verify your capabilities to detect, or block, lateral movement (of malware) between them.

Lee Neely
Lee Neely

As part of the supply chain, Masimo has a responsibility to ensure that it does not allow itself to ship malicious code to its customers. Supply chain security must go beyond caveat emptor.

William Hugh Murray
William Hugh Murray

2025-05-07

UK Legal Aid Agency Privately Disclosing Cyber Incident

The UK government's Legal Aid Agency (LAA) has sent a letter notifying law firms of a "security incident." The letter states that the LAA cannot yet confirm whether information was accessed and if so what type was accessed, but warns legal offices that "it is possible that financial information relating to legal aid providers may have been accessed by a third party"; investigation is ongoing, and "action has been taken to mitigate the incident." Officers from the UK National Crime Agency are working with the National Cyber Security Centre and the Ministry of Justice (of which the LAA is an executive agency) to investigate and provide support. The LAA makes legal aid services available to the general public, funds the Civil Legal Advice service, publishes statistical information on legal aid, and runs the Public Defender Service, employing approximately 1,250 staff in England and Wales.

Editor's Note

Given that the UK NCSC just published guidance and advised all UK organizations to follow it to strengthen their cybersecurity defenses, this would not be the time for LAA to discover gaps, nor to push back on recommended improvements. While those recommendations are not new ideas, the challenge is to get from POC to comprehensive implementation, with monitoring to ensure you remain protected. Threat actors will also discover gaps in your implementation, but that is suboptimal.

Lee Neely
Lee Neely

A fundamental dilemma in intelligence is getting it to those intended to act on it while not disclosing it those who will misuse or abuse it.

William Hugh Murray
William Hugh Murray

2025-05-08

South African Airways Investigating Cyber Incident

South African Airways (SAA) is investigating a cyber incident that "temporarily disrupted access to the airline's website, mobile application, and several internal operational systems," according to a company statement. SAA says they have successfully contained the incident, which began on Saturday, May 3. The company has brought in third-party forensic investigators to help them determine how the attackers gained access to their network and what data and systems were affected.

Editor's Note

Threat actors have been targeting South African state-owned banks, critical energy infrastructure, government pension plans, state-run weather service, and their telecommunication services (MTN), which has resulted in a new law mandating reporting of cyberattacks to facilitate monitoring and response to attacks on personal information. The challenge will be for the South African Information Regulator to turn the reporting into resources and information others can use to protect their systems.

Lee Neely
Lee Neely

Incidents that impact that wide range of systems generally start with an internal privileged account being compromised and attackers exploiting lack of strong internal access controls/segmentation to make spreading harder or at least minimize Time to Detect/Respond through alerting. This type of an event is a great framework to use for a table-top exercise to convince management to drive needed changes - which generally will cost less than the hard costs of this widespread compromise.

John Pescatore
John Pescatore

Not much in the way of details on the incident. Suffice it to say, likely ransomware attack. Payout to be determined.

Curtis Dukes
Curtis Dukes

Internet Storm Center Tech Corner

SANS Internet Storm Center StormCast Friday, May 9, 2025

SSH Exfil Tricks; magicINFO still vulnerable; SentinelOne Vulnerability; Commvault insufficient patch

https://isc.sans.edu/podcastdetail/9444

No Internet Access? SSH to the Rescue

If faced with restrictive outbound network access policies, a single inbound SSH connection can quickly be turned into a tunnel or a full-blown VPN

https://isc.sans.edu/diary/No+Internet+Access+SSH+to+the+Rescue/31932

SAMSUNG magicINFO 9 Server Flaw Still exploitable

The SAMSUNG magicINFO 9 Server Vulnerability we found being exploited last week is apparently still not completely patched, and current versions are vulnerable to the exploit observed in the wild.

https://www.huntress.com/blog/rapid-response-samsung-magicinfo9-server-flaw

Bring Your Own Installer: Bypassing SentinelOne Through Agent Version Change Interruption

SentinelOne’s installer is vulnerable to an exploit allowing attackers to shut down the end point protection software

https://www.aon.com/en/insights/cyber-labs/bring-your-own-installer-bypassing-sentinelone

Commvault Still Exploitable

A recent patch for Commvault is apparently ineffective and the PoC exploit published by watchTowr is still working against up to date patched systems

https://infosec.exchange/@wdormann/114458913006792356

SANS Internet Storm Center StormCast Thursday, May 8, 2025

Modular Malware; SysAid Vuln; Cisco Wireless Controller Patch; UniFi Protect Camera Patch

https://isc.sans.edu/podcastdetail/9442

Example of Modular Malware

Xavier analyzes modular malware that downloads DLLs from GitHub if specific features are required. In particular, the webcam module is inspected in detail.

https://isc.sans.edu/diary/Example+of+Modular+Malware/31928

SysAid XXE Vulnerabilities

IT Service Management Software SysAid patched a number of XXE vulnerabilities. Without authentication, an attacker is able to obtain confidential data and completely compromise the system. watchTowr published a detailed analysis of the flaws including exploit code.

https://labs.watchtowr.com/sysowned-your-friendly-rce-support-ticket/

Cisco IOS XE Wireless Controller Software Arbitrary File Upload Vulnerability

Cisco Patched a vulnerability in its wireless controller software that may be used to not only upload files but also execute code as root without authentication.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-file-uplpd-rHZG9UfC

UniFi Protect Camera Vulnerability

Ubiquity patched a vulnerability in its Protect camera firmware fixing a buffer overflow flaw.

https://community.ui.com/releases/Security-Advisory-Bulletin-047-047/cef86c37-7421-44fd-b251-84e76475a5bc

SANS Internet Storm Center StormCast Wednesday, May 7, 2025

Infostealer with Webserver; Android Update; CISA Warning

https://isc.sans.edu/podcastdetail/9440

Python InfoStealer with Embedded Phishing Webserver

Didier found an interesting infostealer that, in addition to implementing typical infostealer functionality, includes a web server suitable to create local phishing sites.

https://isc.sans.edu/diary/Python+InfoStealer+with+Embedded+Phishing+Webserver/31924

Android Update Fixes Freetype 0-Day

Google released its monthly Android update. As part of the update, it patched a vulnerability in Freetype that is already being exploited. Android is not alone in using Freetype. Freetype is a very commonly used library to parse fonts like Truetype fonts.

https://source.android.com/docs/security/bulletin/2025-05-01

CISA Warns of Unsophisticated Cyber Actors

CISA released an interesting title report warning operators of operational technology networks of ubiquitous attacks by unsophisticated actors. It emphasizes how important it is to not forget basic security measures to defend against these attacks.

https://www.cisa.gov/news-events/alerts/2025/05/06/unsophisticated-cyber-actors-targeting-operational-technology