Flaw Archives - TuxCare

Hackers exploit Oracle WebLogic Servers and Docker APIs to mine Crypto

Cybersecurity company Trend Micro has uncovered a malware campaign in which threat actors exploit security vulnerabilities in the Oracle WebLogic Server to deliver cryptocurrency mining malware.

One of the malware that exploits the vulnerabilities is Kinsing malware. The operators behind Kinsing malware are notorious for looking for vulnerable servers to co-opt them into a botnet.

For the latest trend, the attackers use CVE-2020-14882, a two-year-old RCE remote code execution bug that targets unpatched servers to gain control of the server and drop malicious payloads. The flaw has a severity score of 9.8.

To successfully exploit the vulnerability, the attackers use a shell script that performs various sections, including removing the /car/log/syslog system logs, disabling security features and cloud service agents from Alibaba and Tencent, and killing competing mining processes.

After it has been successfully deployed, the shell script downloads the Kinsing malware from a remote server and takes action to ensure persistence.

Researchers from Aqua Security also identified another cryptojacking group called TeamTNT.

One of TeamTNT’s attack chains aims to crack the SECP256K1 encryption, and if successful, it could allow attackers to calculate the keys to each cryptocurrency wallet. The campaign aims to use the high but illegal computing power of its targets to run the ECDLP solver and obtain the key.

Two other attacks carried out by TeamTNT relate to the exploitation of exposed Redis servers and misconfigured Docker APIs to use coin miners and Tsunami binaries.

According to the researchers, the accounts (alpineos and sandeep078) are reportedly used to spread a variety of malicious payloads such as rootkits, Kubernetes exploit kits, credentials stealers, XMRig Monero miners, and even the Kinsing malware.

As a security measure, companies are recommended to configure the exposed REST API with TLS to mitigate hostile AiTM attacks, as well as to use credentials stores and helpers to host user data.

The sources for this piece include an article in TheHackerNews.

Bumblebee Malware Offers a new Infection Chain

A new version of the Bumblebee malware loader has been discovered by researchers. The new strain of malware offers a new chain of infection, including the use of a PowerScript framework for stealthy reflective injection of a DLL payload into memory.

Unlike in the past, when it reached victims via e-mails containing password-protected zipped USO files, the new variant uses a VHD (Virtual Hard Disk) file instead of the ISO file. The new VHD file contains a LNK shortcut file.

Instead of running Bumblebee (DLL) directly, the LNK now executes “imageda.ps1,” which starts a PowerShell window and hides it from the user by abusing the ‘ShowWindow’ command. The SP1 script is obfuscated using Base64 and string concatenation to evade AV detection while loading the second stage of the PowerShell loader.

For the second stage of the infection, a similar disguise tactic is used as the first. This tactic includes the PowerShell module which is used to load the 64-bit malware into the memory of the PowerShell process through reflective injection.

“PowerSploit is an open source post-exploitation framework in which the malware uses a method, Invoke-ReflectivePEInjection, for reflectively loading the DLL into the PowerShell Process. This method validates the embedded file and performs multiple checks to ensure that the file is loaded properly on the executing system,” Cyble explains in the report.

The new chain of infection allows Bumblebee to load from memory and never touch the hard drive of the computer, minimizing the chances of being detected and stopped by antivirus tools. Increasing its stealthiness also provides the malware loader with a stronger initial access threat and increases its chances of enticing ransomware and malware operators.

The sources for this piece include an article in BleepingComputer.

Hackers Actively Exploit WordPress Zero-day Flaw

Wordfence, a WordPress security company, has warned of a zero-day WordPress vulnerability that is now being exploited by attackers.

The bug is in a WordPress plugin called BackupBuddy. BackupBuddy is a plugin that allows users to back up their entire WordPress installation from within the dashboard, including theme files, pages, posts, widgets, users, and media files.

According to Wordfence, the vulnerability is rooted in the Local Directory copy function, which is designed to store a local copy of the backups. The vulnerability is the product of an insecure implementation that allows attackers to download arbitrary files to the server.

“This vulnerability makes it possible for unauthenticated users to download arbitrary files from the affected site which can include sensitive information,” Wordfence said.

The bug affecting BackupBuddy is tracked as CVE-3022-31474 and has a severity of 7.5. While the bug affects versions 8.5.8.0 to 8.7.4.1, it was fixed in version 8.7. 5, which was released on September 2, 2022.

Wordfence stated that the active exploitation of CVE-2022-31474 began on August 26, 2022. Since then, the platform has been able to block nearly five million attacks, with the majority of intrusions attempting to read files such as /etc/passwd, /wp-config.php,.my.cnf, and .accesshash.

Details of the vulnerability remained secret to prevent further exploitation by attackers.

“This vulnerability could allow an attacker to view the contents of any file on your server that can be read by your WordPress installation. This could include the WordPress wp-config.php file and, depending on your server setup, sensitive files like /etc/passwd,” said the plugin’s developer, iThemes.

BackupBuddy users are advised to upgrade to the latest version to fix the bug and prevent it from being compromised by attackers. Those who are already compromised should reset the database password, change WordPress Salts, and rotate API keys stored in wp-config.php.

The sources for this piece include an article in TheHackerNews.

Attackers use Watering Hole Attacks to Install ScanBox Keylogger

A China-based threat actor dubbed APT TA423 is carrying out waterhole attacks on domestic Australian organizations and offshore energy companies in the South China Sea to distribute the ScanBox reconnaissance tool to victims.

Waterhole Attack is a cyberattack on a specific organization in which malware is installed on a website that is regularly visited by members of the organization to infect computers used within the organization itself.

In order to successfully carry out their malicious activities, the attackers use the ScanBox framework. ScanBox is a customizable and multifunctional Javascript-based framework that is used by adversaries to carry out and convert reconnaissance operations.

ScanBox keylogger data from “waterholes” are part of a multi-level attack that gives attackers knowledge of potential targets that will help them launch future attacks against organizations.

To execute an attack, the attackers upload the malicious JavaScript to a compromised website where the ScanBox acts as a keylogger, snapping all user-entered activity on the infected website.

TA423 launches its attacks with phishing emails pretending to be from an employee of the “Australian Morning News,” a fictitious organization.

Targets are then advised to visit their “humble news website.” australianmorningnews[.]com. As soon as the target clicks on the link, they are redirected to a website whose contents are copied from actual news websites, and the malware framework is leaked to them.

The primary initial script of a ScanBox keylogger provides a list of information about the target computer, including the operating system, language, and installed version of Adobe Flash. ScanBox also performs an audit for browser extensions, plugins, and components such as WebRTC.

The sources for this piece include an article in ThreatPost.

New ‘GIFShell’ Attack Technique Exploits Microsoft Teams GIFs

A new ‘GIFShell” attack technique exploits bugs and vulnerabilities in Microsoft Teams to abuse legitimate Microsoft infrastructure, execute malicious files, execute commands, and exfiltrate data.

According to Bobby Rauch, the cybersecurity consultant and pentester who discovered the hidden vulnerabilities, the “GIFShell” technique allows attackers to create a reverse shell that transmits malicious commands via base64 encoded GIFs in Teams. The outputs are then exfiltrated through GIFs retrieved by Microsoft’s own infrastructure.

To create the reverse shell, attackers need to convince a user to install a malicious stager that executes commands and uploads command output via a GIF URL to a Microsoft Teams web hook.

Microsoft Teams vulnerabilities exploited by the malware include Microsoft Teams security controls bypass which allows external users to send attachments to Microsoft Teams users.

The malware also modifies sent attachments to allow users to download files from an external URL instead of the generated SharePoint link. It forges attachments from Microsoft Teams to appear as harmless files, but instead downloads a malicious executable program or document. It uses insecure URLs to allow SMB NTLM hash theft or NTLM relay attacks.

Microsoft supports sending HTML-based 64-encoded GIFs, but does not scan the byte content of these GIFs. This allows malicious commands to be delivered within a normal-looking GIF. Since Microsoft stores Teams messages in a parsable file located locally on the victim’s machine, it can be accessed by a less privileged user.

Microsoft servers fetch GIFs from remote servers that allow data exfiltration via GIF file names.

The sources for this piece include an article in BleepingComputer.

Samsung Breach Leaks U.S. Customer Data

Samsung has confirmed a cyberattack on the company which led to attackers accessing some vital information belonging to attackers.

The company stated in its data breach notice that the hackers “in some cases” took customer names, contact, and demographic information, date of birth, and product registration information. The company’s notice however indicate that while not every Samsung customer is affected, it remains unknown how much data was stolen in its data breach.

“In late July 2022, an unauthorized third-party acquired information from some of Samsung’s U.S. systems. On or around August 4, 2022, we determined through our ongoing investigation that personal information of certain customers was affected,” the company said in a notice.

The breach did not affect users’ Social Security numbers or credit and debit card numbers and the extent of information leaked for each customer varies.

The tech giant urge customers to be on guard against potential social engineering attempts, avoid clicking on links or operating attachments from unknown senders. Customers are also warned to review their accounts for potentially suspicious activity.

While alerting customers of the breach, Samsung has also shown decisive steps to secure the affected system and engage an outside cybersecurity firm to lead the response efforts.

Samsung action since the flaw was disclosed has raised several questions from experts. Following the disclosure, Samsung published a new privacy policy which many adjudged to be controversial.

According to the new policy, Samsung can use a customer’s “precise geolocation” for marketing and advertising with the user’s consent. The new policy also states how long Samsung stores data that users share from the Quick Share feature. Samsung says it may “collect the contents you share, which will remain available for 3 days.” The reason behind the controversial policy remains unknown.

The sources for this piece include an article in TheHackerNews.

Resources

State of Enterprise Linux Cybersecurity ... Read More State of Enterprise Linux Cybersecurity ...
Dangerous remotely exploitable vulnerability ... Read More Dangerous remotely exploitable vulnerability ...
Securing confidential research data ... Read More Securing confidential research data ...
State of Enterprise Vulnerability Detection ... Read More State of Enterprise Vulnerability Detection ...
Demand for Rapid Risk Elimination for ... Read More Demand for Rapid Risk Elimination for ...
TuxCare Free Raspberry Pi Patching Read More TuxCare Free Raspberry Pi Patching