How a Russian cyberwar in Ukraine could ripple out globally

Source

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for RiSec Weekly Cybersecurity Newsletter Today

Please login to bookmark

Safari and iOS users: Your browsing activity is being leaked in real-time

23 January 2022

Unfixed bug violating the Internet’s most foundational rules is easy to exploit.

For the past four months, Apple’s iOS and iPadOS devices and Safari browsers have violated one of the Internet’s most sacrosanct security policies. The violation results from a bug that leaks user identities and browsing activity in real-time.

Safari and iOS Data Leaked

The same-origin policy is a foundational security mechanism that forbids documents, scripts, or other content loaded from one origin—meaning the protocol, domain name, and port of a given webpage or app—from interacting with resources from other origins. Without this policy, malicious sites—say, badguy.example.com—could access login credentials for Google or another trusted site when it’s open in a different browser window or tab.

Obvious privacy violation

Since September’s release of Safari 15 and iOS and iPadOS 15, this policy has been broken wide open, research published late last week found. As a demo site graphically reveals, it’s trivial for one site to learn the domains of sites open in other tabs or windows, as well as user IDs and other identifying information associated with the other sites.

“The fact that database names leak across different origins is an obvious privacy violation,” wrote Martin Bajanik, a software engineer at FingerprintJS, a startup that makes a device identification interface for anti-fraud purposes. He continued:

It lets arbitrary websites learn what websites the user visits in different tabs or windows. This is possible because database names are typically unique and website-specific. Moreover, we observed that in some cases, websites use unique user-specific identifiers in database names. This means that authenticated users can be uniquely and precisely identified.

Attacks work on Macs running Safari 15 and on any browser running on iOS or iPadOS 15. As the demo shows, safarileaks.com is able to detect the presence of more than 20 websites—Google Calendar, YouTube, Twitter, and Bloomberg among them—open in other tabs or windows. With more work, a real-world attacker could likely find hundreds or thousands of sites or webpages that can be detected.

When users are logged in to one of these sites, the vulnerability can be abused to reveal the visit and, in many cases, identifying information in real time. When logged in to a Google account open elsewhere, for instance, the demo site can obtain the internal identifier Google uses to identify each account. Those identifiers can usually be used to recognize the account holder.

Raising awareness

The leak is the result of the way the Webkit browser engine implements IndexedDB, a programming interface supported by all major browsers. It holds large amounts of data and works by creating databases when a new site is visited. Tabs or windows that run in the background can continually query the IndexedDB API for available databases. This allows one site to learn in real time what other websites a user is visiting.

Websites can also open any website in an iframe or pop-up window in order to trigger an IndexedDB-based leak for that specific site. By embedding the iframe or popup into its HTML code, a site can open another site in order to cause an IndexedDB-based leak for the site.

“Every time a website interacts with a database, a new (empty) database with the same name is created in all other active frames, tabs, and windows within the same browser session,” Bajanik wrote. “Windows and tabs usually share the same session, unless you switch to a different profile, in Chrome for example, or open a private window.”

Bajanik said he notified Apple of the vulnerability in late November, and as of publication time, it still had not been fixed in either Safari or the company’s mobile OSes. Apple representatives didn’t respond to an email asking if or when it would release a patch. As of Monday, Apple engineers had merged potential fixes and marked Bajanik’s report as resolved. End users, however, won’t be protected until the Webkit fix is incorporated into Safari 15 and iOS and iPadOS 15.

For now, people should be wary when using Safari for desktop or any browser running on iOS or iPadOS. This isn’t especially helpful for iPhone or iPad users, and in many cases, there’s little or no consequence of browsing activities being leaked. In other situations, however, the specific sites visited and the order in which they were accessed can say a lot.

“The only real protection is to update your browser or OS once the issue is resolved by Apple,” Bajanik wrote. “In the meantime, we hope this article will raise awareness of this issue.”

You may also enjoy reading, UK Psych Hospitals Using Covert Cameras In Patient Rooms

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for RiSec Weekly Cybersecurity Newsletter Today

Please login to bookmark

UK Psych Hospitals Using Covert Cameras In Patient Rooms

23 January 2022

NHS trusts criticised over system that films mental health patients in their bedrooms

Oxevision system, used by 23 NHS trusts, could be in breach of privacy rights, charities say.

NHS trusts are facing calls to suspend the use of a monitoring system that continuously records video of mental health patients in their bedrooms amid concerns that it breaches their human rights.

Mental health charities said the Oxevision system, used by 23 NHS trusts in some psychiatric wards to monitor patients’ vital signs, could breach their right to privacy and exacerbate their distress.

The call comes after Camden and Islington NHS foundation trust (C&I) suspended its use of Oxevision after a formal complaint by a female patient who said the system amounted to “covert surveillance”.

Covert Camera In Patient Rooms

The Oxevision system allows staff to monitor a patient’s pulse and breathing rate via an optical sensor, which consists of a camera and an infrared illuminator to allow night-time observation.

It includes a live video feed of the patient, which is recorded and kept for 24-72 hours, depending on the NHS trust, before being deleted. Oxehealth, which created the system, said it was not like CCTV because staff could only view the video feed for about 10-15 seconds during a vital signs check or in response to a safety incident.

The system, which is also installed at Exeter police station custody suite and an Oxfordshire care home, can alert staff if someone else has unexpectedly entered a patient’s room or if they are in a blindspot, such as the bathroom, for too long.

Alexa Knight, associate director of policy and practice at Rethink Mental Illness, said: “While we appreciate that the motivation for putting surveillance cameras in people’s bedrooms stems from the need to protect them, to do so without clear consent is unjustifiable and this pilot should be suspended immediately.”

Camden Borough User Group and other service users have raised concerns with C&I that patient consent was not being consistently obtained.

The trust’s patient information leaflet about Oxevision states that rooms are monitored by an optical sensor but does not mention that patients are being recorded.

A spokesperson for C&I said the trust acknowledged that patient consent for Oxevision needed to be tightened, including the option to opt out of the system. “While the [patient] leaflet advises that the system monitors service users 24/7, we are not confident that the video element was always made clear,” she said, adding that the trust was conducting a review into whether to resume using the technology.

Rheian Davies, head of legal advocacy at mental health charity Mind, said: “Being videoed without consent in your own room is a dreadful thought and could add to the distress someone is already feeling.”

Davies, a former psychiatric nurse, said: “We urge any mental health trusts considering trialling, or trialling, this technology with their patients without consent, to pause and reconsider, because of the legal, ethical, and clinical questions it raises.

“Even if you are detained under the Mental Health Act you do not lose all your legal rights … and blanket use of surveillance raises issues of privacy, which is protected under the Human Rights Act.”

Of the 17 other NHS trusts that Oxehealth said it could disclose as piloting the system, another five revealed patient leaflets with similar descriptions to C&I’s: Derbyshire Healthcare NHS foundation trust, Midlands Partnership NHS foundation trust, Pennine Care NHS foundation trust, Rotherham Doncaster and South Humber NHS foundation trust (RDaSH), and West London NHS trust.

All five trusts said patients were informed by staff about how Oxevision works, and RDaSH added that its leaflet was under review.

Leaflets provided by three trusts – Central and North West London NHS foundation trust, Cumbria, Northumberland, Tyne and Wear NHS foundation trust and Surrey and Borders Partnership NHS foundation trust – explicitly mention that Oxevision incorporates a camera or records video footage. Several other trusts did not clarify whether their leaflets did so but said patients were informed about the system.

Mary Sadid, policy officer at mental health charity the National Survivor User Network, said: “Oxevision is playing out in some settings as blanket surveillance with questionable attempts at informed consent.

“The Care Quality Commission does not authorise the use of ‘covert intrusive surveillance’. What we have heard about Oxevision so far, including possible breaches of right to privacy, points to a potential need for an investigation by the regulator. The suspension of blanket surveillance and surveillance without consent should be an immediate priority.”

Oxehealth’s own research, with up to 78 patients from five mental health trusts, found that 80% agreed the system provided a better sense of safety and two thirds agreed it provided a greater sense of privacy.

A spokesman said: “We take patients’ privacy rights very seriously and Oxevision is fully compliant with all the laws that apply to it. It is a service that is only used where necessary and it is only used for patient benefit. Oxevision offers significant patient safety benefits and allows clinicians to measure pulse and breathing rate without disturbing the patient.”

Case study: Lily’s story

Lily, not her real name, who has schizotypal disorder and autism, became acutely distressed after discovering that she was being recorded by Oxevision at Camden and Islington NHS foundation trust.

The 26-year-old was admitted to the Rosewood Unit, based at St Pancras Hospital, which is dedicated to treating the trust’s most vulnerable female psychiatric patients, in mid-July, after she “became incredibly unwell and a danger to myself”.

“A nurse came into my room while I was using the toilet and said: ‘Oh you’re in the bathroom, I couldn’t see you on the camera.’ When I asked what camera she meant, she claimed she misspoke. I was later made aware of a poster and leaflet that had been placed next to the nurse’s station but neither of these mention a camera.

“It was a few more days before a nurse showed me the monitor they have in the office. It fed into my delusion that staff were intentionally keeping patients unwell … I tried to cover the cameras but staff stopped me, and I became so distressed that the response team was called. They nearly injected me.

“Staff still told some patients that Oxevision only took their blood pressure and heart rate, and denied the existence of the cameras. So a lot of patients thought that I was having psychotic delusions.

“To be under surveillance 24 hours a day is incredibly distressing and dehumanising. It is a violation of privacy and dignity. This constant monitoring can make people who struggle with paranoia or psychosis even more unwell.

“I rely on staff to tell me if a thought is rational or delusional. I can no longer trust them to do this. I told the staff that the system was unethical and required consent.”

You may also enjoy reading, Cisco Issues Patch for Critical RCE Vulnerability in RCM for StarOS Software

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for RiSec Weekly Cybersecurity Newsletter Today

Please login to bookmark

Pwndora – Mass IPv4 Scanner

22 January 2022

Pwndora is a mass and fast IPv4 address range scanner, integrated with multi-threading.

Using sockets, it analyzes which ports are open, and collects more information about targets, each result is stored in Elasticsearch. You can integrate with Kibana to be able to visualize and manipulate data, essentially, it’s like having your own IoT search engine at home.

What is Pwndora?

Pwndora is a mass and fast IPv4 address range scanner, integrated with multi-threading.

Pwndora Features

Port scanning with different options and retrieve software banner information.
Detect some web technologies running on servers, using Webtech integration.
Retrieves IP geolocation from Maxmind free database, updated periodically.
Possibility to take screenshots from hosts with HTTP using Rendertron.
Anonymous login detection on FTP servers

Pwndora Usage

usage: CLI.py [-h] [-s START] [-e END] [-t THREADS] [--massive FILE] [--timeout TIMEOUT]
              [--screenshot] [--top-ports] [--all-ports] [--update]
options:
  -h, --help         show this help message and exit
  -s START           Start IPv4 address
  -e END             End IPv4 address
  -t THREADS         Number of threads [Default: 50]
  --massive FILE     File path with IPv4 ranges
  --timeout TIMEOUT  Socket timeout [Default: 0.5]
  --screenshot       Take screenshots from hosts with HTTP
  --top-ports        Scan only 20 most used ports [Default]
  --all-ports        Scan 1000 most used ports
  --update           Update database from Wappalyzer

Pwndora Examples

If this is your first time running, you should use the –update argument.

Scan only a single IPv4 address range:

python3 CLI.py -s 192.168.0.0 -e 192.168.0.255 -t 150 --top-ports

Scan from a text file with multiple IPv4 address ranges:

python3 CLI.py --massive-scan Argentina.csv -t 200 --all-ports --screenshot

If you use an excessive amount of threads, some ISPs may detect suspicious traffic and disconnect you from the network.

Pwndora To-do list

Command-line interface
Execution time in terminal
Logging module implementation, for exception handling
Massive and automatic scanning
Default FTP login detection
Automatic download of IP ranges by country
Web technologies detection
Web application vulnerability scan
Find domains associated with IP
Build image with Docker
Honeypot detection
RDP Screenshot

Remember, CyberSecurity Starts With You!

Globally, 30,000 websites are hacked daily.
64% of companies worldwide have experienced at least one form of a cyber attack.
There were 20M breached records in March 2021.
In 2020, ransomware cases grew by 150%.
Email is responsible for around 94% of all malware.
Every 39 seconds, there is a new attack somewhere on the web.
An average of around 24,000 malicious mobile apps are blocked daily on the internet.

Please login to bookmark

CISA, Microsoft Warn of Wiper Malware Amid Russia-Ukraine Tensions

22 January 2022

The U.S. government agency overseeing cybersecurity is urging the country’s businesses and other organizations to take the necessary steps to protect their networks from any spillover that might occur from the ongoing cyberattacks aimed at Ukraine government agencies and private companies.

In an alert issued this week, the Cybersecurity and Infrastructure Security Agency (CISA) cited a series of cyberattacks perpetrated against public and private Ukrainian organizations as tensions between Ukraine and Russia grow despite talks between U.S. and Russian government leaders.

Government and private entities in Ukraine have been targeted this month by a barrage of malware that has defaced websites and wiped or corrupted data from Windows- and Linux-based systems. Microsoft’s Threat Intelligence Center, in a blog post Jan. 15, outlined the malware operation that began hitting Ukrainian organizations days before.

Malware Designed to Destroy

The malware “is designed to look like ransomware but lacking a ransom recovery mechanism, is intended to be destructive and designed to render targeted devices inoperable rather than to obtain a ransom,” the Microsoft unit wrote. “Our investigation teams have identified the malware on dozens of impacted systems and that number could grow as our investigation continues. These systems span multiple government, non-profit, and information technology organizations, all based in Ukraine. … It is unlikely these impacted systems represent the full scope of impact as other organizations are reporting.”

Other organizations also have issued reports about data-wiping and other malware being used against groups in the troubled country. Ukraine’s cyber authorities said in a statement that the malware exploited vulnerabilities in the OctoberCMS content management systems and the high-profile Log4j flaw, as well as compromised credentials, to launch the attacks.

Within a couple of days, 95% of the Ukrainian government sites impacted by the malware had been restored, they said.

Threats in a Connected World

In light of the attacks and the ongoing geopolitical situation in Ukraine, both CISA and Microsoft urged public and private groups in the United States to use the information to proactively protect their infrastructure against malware attacks that might result from the troubles in that region.

“Public and private entities in Ukraine have suffered a series of malicious cyber incidents, including website defacement and private-sector reports of potentially destructive malware on their systems that could result in severe harm to critical functions,” CISA said in its alert. “The identification of destructive malware is particularly alarming given that similar malware has been deployed in the past – e.g., NotPetya and WannaCry ransomware – to cause significant, widespread damage to critical infrastructure.”

No group or nation-state has been accused of the malware attacks in Ukraine, but CISA said cybersecurity and IT staffs should review the detailed document the agency released earlier this month, Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure. They also should check out another government site, StopRansomware.gov, CISA noted.

CISA’s Cybersecurity Checklist

CISA’s alert outlines myriad steps U.S. organizations should take to protect their networks and data from malware attacks, including validating all remote access and instituting multifactor authentication where needed, making sure that software is patched and up-to-date, and ensuring they are prepared to respond to an intrusion.

The steps also include quickly identifying and assessing unusual network behavior, running antivirus and anti-malware solutions on the network and testing backup procedures. CISA also noted the need to test industrial control systems and “if working with Ukrainian organizations, take extra care to monitor, inspect, and isolate traffic from those organizations; closely review access controls for that traffic.”

Chris Gonsalves, vice president of research at Channelnomics, told eSecurity Planet that the CISA alert is part of a larger propaganda campaign by the U.S. government as it pushes back at possible Russian intrusion into Ukraine and looks to ease tension in the region.

“But here’s the thing about propaganda: It can also be true,” Gonsalves said. “Warnings about global climate change are also propaganda. The information is designed to foment a change in the belief or behavior. They’re also factually correct and that’s the same thing here.”

Out of the Lab and Into the Wild

The reference to NotPetya and WannaCry – notorious ransomware from North Korea rather than Russia – makes sense because both were very targeted pieces of malware that eventually got into the wild and affected targets that were beyond what was initially intended. The threat from the malware attacks this month in Ukraine to companies and agencies outside of the region is similar, he said.

As noted in the CISA alert, companies that do business with Ukrainian counterparts may be impacted by a phishing email or other threats that make their way through the Ukraine companies’ networks and to their global partners.

“They called these things computer viruses originally because they behave exactly like biological viruses, and that once they get out of the lab, it’s very difficult to contain where they go and who they infect,” Gonsalves said. “The thing about – and this is wiper malware [being used in Ukraine], but it works the same with ransomware – is that phishing messages get forwarded and partner networks are integrated together and there are hidden credentials between third parties that we’re not aware of. When I attack a utility in Ukraine, I see that a particular network might be connected through supply chain links to some organization in the U.S. that were never my intended target, but that’s just the way internet connections work. It’s not like they are also going to be targeted. They’re collateral damage.”

Good Security Advice

Once the possible threat is established, the question becomes whether what CISA is telling organizations through the checklist is effective. In this case, it’s essentially a rewording of the NIST CSF, hitting the high notes of delineating, identifying, protecting, detecting and recovering.

“God bless them for staying on message and using their absolute best cybersecurity framework to continue to get people to do the very basic things that they need to do to protect themselves,” Gonsalves said. “All of this information is applicable and proven to be effective.”

Gonsalves also was pleased to see CISA note the need to protect industrial control systems, as infrastructure will be better protected the more the line between those control systems and traditional IT blurs.

Review Security in Light of Pandemic

One point CISA could have raised is that many companies may believe they’ve addressed the items on the checklist, but haven’t done so in light of the COVID-19 pandemic, which widely dispersed much of their workforces.

‘Even On Days When Russia Is Not Menacing Its Neighbors, This Is Really Good Advice’

“You have remote access in places you’ve never had it before,” Gonsalves said. “Do you really have a handle on your access management and your credentials the way you did two years ago in this new world order that we’re in, where everybody’s a remote worker and completely decentralized? Yeah, look at this list, but also review it through the lens of the way that you work in the COVID and post-COVID environment because many of these elements are much more crucial and have changed radically over the last year.”

He also suggested that CISA issue this checklist on a continuous basis.

“You should issue this memo on the first day of every quarter for the rest of our lives,” Gonsalves said. “Even on days when Russia is not menacing its neighbors, this is really good advice.”

You may also enjoy reading, Cisco Issues Patch for Critical RCE Vulnerability in RCM for StarOS Software

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for RiSec Weekly Cybersecurity Newsletter Today

Please login to bookmark

Cisco Issues Patch for Critical RCE Vulnerability in RCM for StarOS Software

22 January 2022

Cisco Systems has rolled out fixes for a critical security flaw affecting Redundancy Configuration Manager (RCM) for Cisco StarOS Software that could be weaponized by an unauthenticated, remote attacker to execute arbitrary code and take over vulnerable machines.

Tracked as CVE-2022-20649 (CVSS score: 9.0), the vulnerability stems from the fact that the debug mode has been incorrectly enabled for specific services.

“An attacker could exploit this vulnerability by connecting to the device and navigating to the service with debug mode enabled,” Cisco said in an advisory. “A successful exploit could allow the attacker to execute arbitrary commands as the root user.”

The network equipment maker, however, noted that the adversary would need to perform detailed reconnaissance to allow for unauthenticated access to vulnerable devices.

Stating that the vulnerability was discovered during internal security testing, Cisco added it found no evidence of active exploitation in malicious attacks.

The Flaw Continued

On top of this, the company also remediated a number of other flaws —

CVE-2022-20648 (CVSS score: 5.3) – Cisco RCM Debug Information Disclosure Vulnerability
CVE-2022-20685 (CVSS score: 7.5) – Multiple Cisco Products Snort Modbus Denial of Service Vulnerability (credited to Uri Katz of Claroty Research)
CVE-2022-20655 (CVSS score: 8.8) – ConfD CLI Command Injection Vulnerability

Cisco explained that CVE-2022-20655 is due to an “insufficient validation of a process argument” on an affected device.

“An attacker could exploit this vulnerability by injecting commands during the execution of this process,” it said. “A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the management framework process, which are commonly root privileges.”

You may also enjoy reading, Why did Putin Pwn Russian Cyber gang REvil?

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for RiSec Weekly Cybersecurity Newsletter Today

Please login to bookmark

U.S Department of Treasury Imposes Sanctions on four Ukrainian Government Officials

21 January 2022

The US Department of Treasury has imposed sanctions on four Ukrainian government officials for acting in the interest of Russian-directed influence activities.

The officials include four present and ex-government officials and have been found collecting critical data on Ukraine’s key network and infrastructure. This comes on the same day that the Department sanctioned a former Ukrainian official for helping Russian cyberspies.

Ukrainian government officials sanctioned – Moscow owned the Ukraine officials?

As per the US Department of Treasury statements, among the sanctioned individuals the two Ukrainian members of parliament and two ex-government officials were recruited and owned by Russia’s Federal Security Service in a mission to place its agents on key positions in the society to steal sensitive information, leverage Ukrainian situation and officials, report to Russia on time-sensitive intelligence.

Moscow is behind these acts and recruited such high profile and government officials to hand over Ukrainian officials and the government’s critical infrastructure with assistance from Moscow.

Chinese-Origin Hackers Breach US Government Systems

Recommended reading: Why did Putin Pwn Russian Cyber gang REvil

Key Ukrainian government official sanctioned

The individuals are Volodymr Oliynyk, a former Ukrainian government official who has worked as per instructions from the FSB for Kremlin-backed cyberattacks on Ukrainian infrastructure. Oliynyk has been linked to Russia for a long time and is currently living in Moscow after leaving the Ukrainian border as a refuge.

Most of the cyberattacks happening in Ukraine are one way or the other linked to Moscow, including the massive power outage that happened in Ukraine recently. It is said that Russia has had its hands on Ukraine and its critical infrastructure for several years now, as Moscow is orchestrating multiple cyber-espionage campaigns against the Ukrainian Energy Sector.

Also, US, Europe and other nations including the UN are concerned about Russian invasion over Ukrainian soil as Russian troops are lined up near the Ukraine border in thousands. However, Vladimir Putin claims innocent about that thought and Moscow doesn’t intend anything so on Ukraine.

You may also enjoy reading, Why did Putin Pwn Russian Cyber gang REvil?

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for RiSec Weekly Cybersecurity Newsletter Today

Please login to bookmark

Malware That Can Survive OS Reinstalls Strikes Again, Likely for Cyberespionage

21 January 2022

A new windows based malware strain that can survive operating system reinstalls was spotted last year secretly hiding on a computer, according to the antivirus provider Kaspersky.

The company discovered the Windows-based malware last spring running on a single computer. How the malicious code infected the system remains unclear. But the malware was designed to operate on the computer’s UEFI firmware, which helps boot up the system.

The malware, dubbed MoonBounce, is especially scary because it installs itself on the motherboard’s SPI flash memory, instead of the computer’s storage drive. Hence, the malware can persist even if you reinstall the computer’s OS or swap out the storage.

“What’s more, because the code is located outside of the hard drive, such bootkits’ activity goes virtually undetected by most security solutions unless they have a feature that specifically scans this part of the device,” Kaspersky said.

The discovery marks the third time the security community has uncovered a UEFI-based malware that’s designed to persist on a computer’s flash memory. The previous two include Lojax, which was found infecting a victim’s computer in 2018, and Mosaic Regressor, which was found on machines belonging to two victims in 2020.

The new strain MoonBounce was designed to retrieve additional malware payloads to be installed on the victim’s computer. But according to Kaspersky, the MoonBounce is even more advanced and stealthy because it can use a “previously benign” core component in the motherboard’s firmware to facilitate malware deployment.

“The infection chain itself does not leave any traces on the hard drive, since its components operate in memory only, thus facilitating a fileless attack with a small footprint,” the company added.

Kaspersky didn’t name the owner of the infected computer, but the company has uncovered evidence the malicious code is the work of a Chinese state-sponsored group dubbed APT41, which is known for cyberespionage. In 2020, the Justice Department charged five alleged members of the hacking group for breaching over 100 companies, including software and video game developers, to steal source code, customer account data, and other intellectual property.

“MoonBounce has only been found on a single machine. However, other affiliated malicious samples have been found on the networks of several other victims,” the company said, a possible sign the malware may be more prevalent than currently known.

Kaspersky discovered MoonBounce because it developed a “firmware scanner,” which can run over its antivirus programs to detect for UEFI tampering. The easiest way to remove MoonBounce from a computer isn’t entirely clear. But theoretically, it should be doable by reflashing the SPI memory on the motherboard.

“Removal of UEFI bootkit requires overwriting the SPI flash with benign and verified vendor firmware, either through a designated flashing tool or other methods provided by the vendor itself,” Kaspersky told PCMag. “On top of that, it is advised to check if the underlying platform supports Boot Guard and TPM, and validate those are supported by the new firmware.”

The antivirus provider also recommends keeping the UEFI firmware up-to-date, which can be done through BIOS updates from your motherboard’s manufacturer.

You may also enjoy reading, Why did Putin Pwn Russian Cyber gang REvil?

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for RiSec Weekly Cybersecurity Newsletter Today

Remember, CyberSecurity Starts With You!

Globally, 30,000 websites are hacked daily.
64% of companies worldwide have experienced at least one form of a cyber attack.
There were 20M breached records in March 2021.
In 2020, ransomware cases grew by 150%.
Email is responsible for around 94% of all malware.
Every 39 seconds, there is a new attack somewhere on the web.
An average of around 24,000 malicious mobile apps are blocked daily on the internet.

Please login to bookmark

17 Million Jobs In Jeopardy As New Privacy Bill Aims to Curtail Targeted Ads

21 January 2022

The FTC could have the authority to enforce fines of up to $5,000

The IAB—which represents 700 media companies, brands, agencies and technology firms—slammed the bill, saying that it would ‘effectively eliminate internet advertising in the United States’.

On Tuesday, Congresswomen Anna G. Eshoo (D-CA), Jan Schakowsky (D-IL) and Senator Cory Booker (D-NJ), introduced the Banning Surveillance Advertising Act, a bill that would dramatically alter the ways tech companies like Google and Facebook can leverage personal data for online ads.

The bill is attracting pushback from, among others, the Interactive Advertising Bureau (IAB).

The digital advertising body said the bill could jeopardize an estimated 17 million jobs, primarily at small- and medium-sized businesses that account for a large share in internet economy growth. The IAB—which represents 700 media companies, brands, agencies and technology firms—slammed the bill, saying that it would “effectively eliminate internet advertising in the United States.”

Data-driven digital advertising is the heart of online commerce that helps industries diversify the products and services consumers rely on. However, if the new bill becomes a law, advertisers will find themselves with a limited capacity to maximize targeted, programmatic or personalized ads.

Calling it “surveillance advertising” and the “unseemly collection and hoarding of personal data,” Rep. Eshoo said her bill will explicitly prohibit targeting ads based on protected class information, such as race, gender and religion, including personal data purchased from data brokers. The bill would allow targeted ads based on general location data at the city and state level and contextual advertising—or advertising based on the content a user chose to engage with.

With the bill, the Federal Trade Commission (FTC), along with state attorneys general, would have the authority to enforce fines of up to $5,000 per violation.

National privacy reform has taken a back seat to other issues in Washington D.C, while individual states are moving forward with their own privacy laws.

This was evident in 2021 alone, where 23 states introduced 34 different data privacy bills, which may “significantly hinder the thousands of small and mid-sized businesses that rely upon data-driven advertising,” according to IAB CEO David Cohen, who advocates for a federal privacy law.

Pointing to an IAB study, The Economic Impact of the Market-Making Internet, Cohen echoes how the internet economy grew seven times faster than the total U.S. economy from 2016 to 2020 and accounts for 12% of gross domestic product.

“If the sponsors understood the devastating effects this bill would have, not only on the advertising industry but also on our entire economy, they wouldn’t have introduced it,” he said. “This bill would make advertising less precise, more expensive and raise costs for everyone.”

In pursuit of successful lobbying on many issues including privacy, the responsible use of data for advertising and content moderation, in Washington D.C, the IAB is also focused on ensuring the “unintended consequences of [this] bad legislation” is not realized, he added.

Why not read, Why did Putin Pwn Russian Hacking Group REvil?

Please login to bookmark

McAfee Agent bug lets hackers run code with Windows SYSTEM privilege

21 January 2022

McAfee has patched a security vulnerability discovered in the company’s McAfee Agent software for Windows enabling attackers to escalate privileges and execute arbitrary code with SYSTEM privileges.

McAfee Agent is a client-side component of McAfee ePolicy Orchestrator (McAfee ePO) that downloads and enforces endpoint policies and deploys antivirus signatures, upgrades, patches, and new products on enterprise endpoints.

The company has patched the high severity local privilege escalation (LPE) flaw tracked as CVE-2022-0166 and discovered by CERT/CC vulnerability analyst Will Dormann issued security updates with the release of McAfee Agent 5.7.5 on January 18.

All McAfee Agent versions before 5.7.5 are vulnerable and allow unprivileged attackers to run code using NT AUTHORITY\SYSTEM account privileges, the highest level of privileges on a Windows system, used by the OS and OS services.

“McAfee Agent, which comes with various McAfee products such as McAfee Endpoint Security, includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory that may be controllable by an unprivileged user on Windows,” Dormann explained.

“McAfee Agent contains a privileged service that uses this OpenSSL component. A user who can place a specially-crafted openssl.cnf file at an appropriate path may be able to achieve arbitrary code execution with SYSTEM privileges.”

Exploitable for evasion, loading malicious payloads

Following successful exploitation, threat actors could persistently execute malicious payloads and potentially evade detection during attacks.

While only exploitable locally, threat actors commonly exploit this type of security flaw during later stages of their attacks, after infiltrating the target machine to elevate permissions for gaining persistence and further compromising the system.

This is not the first time security researchers have found vulnerabilities while analyzing McAfee’s Windows security products.

For instance, in September 2021, the company patched another McAfee Agent privilege escalation bug (CVE-2020-7315) discovered by Tenable security researcher Clément Notin that allowed local users to execute arbitrary code and kill the antivirus.

Two years before, McAfee fixed a security vulnerability impacting all editions of its Antivirus software for Windows (i.e., Total Protection, Anti-Virus Plus, and Internet Security) and allowing potential attackers to escalate privileges and execute code with SYSTEM account authority.

You may also enjoy reading, Red Cross hit by a Sophisticated Cyber Attack leading to Databreach

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for RiSec Weekly Cybersecurity Newsletter Today