How not to address a criticalvulnerability.
The astonishing scale of the MOVEit security breach. US government agencies' illegal use of commercial data. The risks of mixing work and personal devices. Madagascar caught using spyware. And cats, keyboards, disaster.
FUBAR
As if more proof were needed of the dysfunctionality of the technology sector, a critical vulnerability affecting as many as 3.5 million mail servers went unfixed for more than 15 months. The issue (with a severity rating of 9.8 out of 10) was reported to the team responsible for the Exim platform in June 2022 and then nothing happened until the following May. Following the publication of the vulnerability last week, Exim has now released a fix. The email thread regarding the timeline around this would be comical if the implications weren’t so serious.
There’s a rich history of attackers targeting Exim (and other mail servers) because doing so can be as simple as sending a specially designed email. In 2019, researchers identified a critical vulnerability in Exim. At the time, no ways to exploit the issue were known to exist. Nearly a year later, the US National Security Agency said that in fact a notorious Russian military hacking group had been taking advantage of it all along.
In the latest episode, everyone is blaming each other. The developers say they weren’t given enough information to fix the issue. The team that collates vulnerabilities say they reached out several times with little to show for it. Like all cybersecurity people, we stress the importance of keeping systems updated - but, as this episode demonstrates, there is a much deeper problem with the technology on which we depend…and at the moment there’s no apparent solution.
Threats
Recruitment: North Korean attackers compromised the network of a Spanish aerospace company by posing as recruiters for Facebook parent, Meta, and tricking an employee into running malicious software on a work computer. ESET
QR codes: We don’t like QR codes! There’s a long history of exploiting them for nefarious ends and new research suggests there’s a widespread belief that they’re safe. The problem is that even if you look to see where the code is going to take you, the link is often meaningless so it’s impossible to tell whether or not it’s OK. Dark Reading
Adapter: As if to prove the point, 404 Media has details of an iPhone to HDMI adapter that steals photos, videos and location data. When inserted, it asks the user to “Scan QR code for use.” Doing so leads to a website riddled with adverts and a request to install the thieving app.
EvilProxy: The phishing kit is being used to target senior executives and steal “session cookies” stored on their computers. The small files can enable attackers to bypass multi-factor authentication. The attack begins with an email that appears to lead to the Indeed job listing site. Menlo Security
Elderly: Older people are fertile ground for fraudsters. The FBI is warning about a rise in a time-worn scam in which scumbags try to scare victims into installing malicious software by telling them they’ve been hacked. The latest variation involves additional stages with the attackers posing as bank and government representatives.
Bing: Attackers are subverting the advertising market to insert malicious web links in Bing Chat responses. Malwarebytes
Thunderbird: Mozilla is warning about websites offering fake versions of its email client.
MoveIT
Sony is the latest organisation to reveal itself as a victim of the vulnerability in the MOVEit file transfer platform. While the story has drifted out of the headlines, the impact has been steadily spreading with 2,342 organisations and 62.6 million people affected (at the time of writing). British Airways, Shell, the BBC and the US Department of Energy are just some of those to have lost data as a result of the vulnerability. The reason for such a widespread impact is that the MOVEit solution was widely used by third party services (such as payroll processing) which selected it because it was supposed to be secure. So far, the impact of the breaches has been limited but that may be because the Russian gang responsible is still working through the data it has amassed.
Lawbreakers
US immigration and border agencies as well as the Secret Service broke the law by using location data harvested from ordinary apps installed on smartphones. An oversight report also found one official had used the technology to track the location of coworkers with no investigative purpose. “This occurred because the components did not have sufficient internal controls to ensure compliance with [Department of Homeland Security] DHS privacy policies, and because the DHS Privacy Office did not follow or enforce its own privacy policies and guidance,” the report says. There has been a steady stream of reports about the use of commercially available data by US government agencies. This is the first confirmation it was done illegally.
Unmanaged
The vast majority of ransomware attacks over the past year originated from unmanaged “bring your own devices,” according to Microsoft. Its latest Digital Defense Report adds that, despite the coverage of high-profile incidents, the primary victims have been small and medium size organisations. It warns that ransomware operators are increasingly exploiting vulnerabilities in less common software which is harder to protect. The report is wide-ranging and says in 2023 the cyber conflict thermometer reached “boiling point” despite nation states pivoting from destructive attacks to focussed espionage. Microsoft’s recommended defences rest mainly on doing the basics; multi-factor authentication, updates, backups, effective security software and “zero-trust” principles.
AI
Impact: Artificial intelligence is contributing to the decline of internet freedom around the world - although good old-fashioned repression is to blame as well. In its annual report, Freedom House said the decline (for the 13th consecutive year) was hardly surprising, “Advances in AI from the past year are really deepening this crisis for internet freedom.”
Slovakia: Bloomberg reports on the widespread use of fake media in the recent Slovakian election. An official said that that in one case, “Even though the deepfake was technically quite crude — you could definitely hear that this was not a real person — the recording spread rapidly.”
Watermarks: There had been hopes that watermarking would help control the use of deepfakes. University researchers in the US have now demonstrated that they can be easily defeated.via The Register
Imaginary friends: Casey Newton explores the implications of adding the power of speech to ChatGPT and says the latest developments in AI suggest the possibility of “synthetic companions…not unlike the real people you encounter during the day, only smarter, more patient, more empathetic, more available.”
Sigh: Microsoft’s Bing image creator is being used to create pictures of SpongeBob (and other cartoon characters) reenacting the attacks of 9/11. This is despite a slew of filters designed to prevent exactly such practices. 404 Media
In brief
Spyware: Madagascar has been using watering hole attacks to install Predator spyware for domestic surveillance. This involved adding booby-trapped links to blogs containing genuine newspaper articles. Sekoia
Bounties: Last week, it was news of a spyware company offering $20 million for ways to attack an iPhone. This week, it emerges that prices for WhatsApp vulnerabilities have also shot up. TechCrunch says that as long ago as 2021 up to $8 million was on offer for such exploits.
Raid: Press freedom groups have called for more transparency about the reasons for a raid on a US journalist’s home and the seizure of computer equipment. Prosecutors have been investigating whether videos of former Fox News host, Tucker Carlson, were obtained through a hacking operation but the search warrant in the case remains sealed.
Convention: The International Committee of the Red Cross has proposed rules to govern the activities of civilian hackers during war. They include a ban on attacking hospitals or threatening violence. BBC
Facial: In the latest steps towards ubiquitous facial recognition, Israel is set to expand its use to monitor public spaces while Singapore is planning to scan faces rather than passports.
X: Apple has provided customer support via Twitter/X since 2016. The service involved real people answering queries and was a great way to resolve issues. As MacRumors reports, the real people have gone and an automated response tells people to visit the Apple website instead.
Support: A Geneva-based non-profit is to provide free cybersecurity support to NGOs in The Netherlands. “They don’t have budgets to become cyber secure, so we’re going to help,” The CyberPeace Institute said.
Feline: The Register reports that a server belonging to the US Department of Veteran Affairs was wiped after a cat jumped onto a technician’s keyboard. As The Register points out, the incident remains unconfirmed but such cases are far from unknown.
Updates
Apple: (Yet) Another update to iOS 17 to fix (yet) another previously unknown (‘zero-day’) vulnerability. iOS 17.0.3 also aims to sort out overheating problems that have been affecting the new iPhone 15.
Microsoft: Edge and Teams also get updates to address zero-day issues in the WebP image handling code library that we wrote about last week.
Android: The October monthly update also aims to remedy the same WebP problem - as well as 53 others.
Atlassian: An urgent update for Confluence Data Center and Server to fix a maximum severity issues that has already been used to attack “a handful of customers.”
WS_FTP: The company behind the MOVEit file-sharing platform has released fixes for critical vulnerabilities in the widely-used file-transfer application.
Tails: Version 5.18 of the security focused OS updates the Tor Browser and the Tor software.