• chevron_right

      Windows vulnerability reported by the NSA exploited to install Russian backdoor

      news.movim.eu / ArsTechnica · 3 days ago - 20:36

    Kremlin-backed hackers exploit critical Windows vulnerability reported by the NSA

    Enlarge (credit: Getty Images)

    Kremlin-backed hackers have been exploiting a critical Microsoft vulnerability for four years in attacks that targeted a vast array of organizations with a previously undocumented backdoor, the software maker disclosed Monday.

    When Microsoft patched the vulnerability in October 2022—at least two years after it came under attack by the Russian hackers—the company made no mention that it was under active exploitation. As of publication, the company’s advisory still made no mention of the in-the-wild targeting. Windows users frequently prioritize the installation of patches based on whether a vulnerability is likely to be exploited in real-world attacks.

    Exploiting CVE-2022-38028, as the vulnerability is tracked, allows attackers to gain system privileges, the highest available in Windows, when combined with a separate exploit. Exploiting the flaw, which carries a 7.8 severity rating out of a possible 10, requires low existing privileges and little complexity. It resides in the Windows print spooler, a printer-management component that has harbored previous critical zero-days . Microsoft said at the time that it learned of the vulnerability from the US National Security Agency.

    Read 7 remaining paragraphs | Comments

    • chevron_right

      “Highly capable” hackers root corporate networks by exploiting firewall 0-day

      news.movim.eu / ArsTechnica · Friday, 12 April - 20:48 · 1 minute

    The word ZERO-DAY is hidden amidst a screen filled with ones and zeroes.

    Enlarge (credit: Getty Images )

    Highly capable hackers are rooting multiple corporate networks by exploiting a maximum-severity zero-day vulnerability in a firewall product from Palo Alto Networks, researchers said Friday.

    The vulnerability, which has been under active exploitation for at least two weeks now, allows the hackers with no authentication to execute malicious code with root privileges, the highest possible level of system access, researchers said. The extent of the compromise, along with the ease of exploitation, has earned the CVE-2024-3400 vulnerability the maximum severity rating of 10.0. The ongoing attacks are the latest in a rash of attacks aimed at firewalls, VPNs, and file-transfer appliances, which are popular targets because of their wealth of vulnerabilities and direct pipeline into the most sensitive parts of a network.

    “Highly capable” UTA0218 likely to be joined by others

    The zero-day is present in PAN-OS 10.2, PAN-OS 11.0, and/or PAN-OS 11.1 firewalls when they are configured to use both the GlobalProtect gateway and device telemetry. Palo Alto Networks has yet to patch the vulnerability but is urging affected customers to follow the workaround and mitigation guidance provided here . The advice includes enabling Threat ID 95187 for those with subscriptions to the company’s Threat Prevention service and ensuring vulnerability protection has been applied to their GlobalProtect interface. When that’s not possible, customers should temporarily disable telemetry until a patch is available.

    Read 11 remaining paragraphs | Comments

    • chevron_right

      Haters gonna hate – Inoxtag met une claque aux rabat-joie de l’Everest

      news.movim.eu / Korben · Thursday, 11 April - 14:00 · 4 minutes

    Je viens de tomber sur une vidéo de BFM TV qui m’a bien fait marrer dans laquelle les journalistes parlent de l’ascension du Youtubeur Inoxtag sur le mont Everest. Le gars a 22 ans, il est parisien et y’a un an, il s’est lancé le défi de monter tout là haut. Et au moment où j’écris ces lignes, il y est.

    Je suis pas abonné à sa chaîne, et je ne le connais pas, mais quand je tombe sur un bout de vidéo de lui sur les réseaux, j’éprouve direct de la sympathie, car je le trouve joyeux, positif, feel good comme on dit :). Ce que j’aime, c’est sa motivation et son optimisme à toute épreuve.

    Du coup, je suis ça de loin et j’espère vraiment qu’il va y arriver, qu’il n’aura pas de problème là-bas… etc. Perso, je trouve que c’est un super challenge qui de l’extérieur donne l’impression que c’est une mission suicide, mais comme le gars s’est quand même bien entraîné avant, qu’il s’est bien entouré, qu’il est intelligent et surtout motivé comme jamais et poussé par sa communauté, je pense qu’il a toutes les chances de son côté pour réussir.

    Du coup, ça me fait bien marrer de voir les vieux grigous, des « professionnels de la profession » de la Montagne ça vous gagne, qui passent sur BFM TV pour expliquer aux autres vieux grigous qui regardent cette chaîne, que ce projet d’Inox c’est de la merde.

    Alors si on n’a pas trop de cerveau, on pourrait les écouter et se dire : « Mais ils ont l’expérience, ils ont raison, faut respecter la Nature sauvage, ça ne se fait pas comme ça et bla bla bla bla… «

    Mais leurs arguments sont tout pétés et laissent transparaître leur seum. Ils disent par exemple que son ascension ne respecte pas « l’esprit et les valeurs de l’alpinisme « , que c’est devenu un « truc à cocher « … Y’en a même un qui dit carrément que c’est « violer l’Everest « . Bah putain…

    Perso, je crois que « l’esprit et les valeurs de l’alpinisme » ont déjà été bafoués depuis longtemps par la surcommercialisation et la surfréquentation de l’Everest à laquelle ils participent depuis des années. Et si on réfléchit un peu, on se rend compte que si l’Everest pue littéralement la merde, c’est quand même à cause de tous ces soi-disant « professionnels » qui durant des années en ont fait leur précarré, allant chier dans tous les coins, laissant leurs ordures sur place, exploitant les locaux jusqu’au péril de leur vie… Ce sont eux-mêmes qui ont dégradé la montagne pendant toutes ces années et Inoxtag ne fait que suivre la tendance qu’ils ont initiée.

    Après, faut reconnaître qu’il y a quand même des mecs sérieux et respectueux dans le lot, faut pas généraliser non plus. Mais ça n’enlève rien au ridicule de la situation. Il suffit qu’une seule fois, un noob débarque et se dise : « Azy moi je le fais « , pour que tout ce qui a été dégradé avant soit de sa faute. C’est pathétique, j’ai jamais vu ça.

    Ce qui leur fout les boules, je pense, c’est surtout qu’un gamin venant d’un univers qui leur est totalement étranger (Internet / Youtube), vienne marcher sur leurs plates-bandes et les ridiculiser avec seulement 1 an d’entraînement dans les pattes, eux, les vieux briscards, les experts, les « professionnels ».

    Et le pire dans tout ça, c’est qu’ils passent à côté de l’essentiel. Parce que l’ascension d’Inox, qu’elle réussisse ou non, elle aura au moins le mérite de rajeunir l’image de la montagne et d’intéresser un nouveau public à l’alpinisme. C’est plutôt une bonne nouvelle pour leur discipline, ils devraient être contents. Mais non, ils préfèrent jouer les vieux cons et chouiner dans les médias.

    Perso, ça m’énerve autant que ça me fait marrer .

    Donc pour ça, je dis merci Inox, et je croise très fort les doigts pour qu’il atteigne son objectif en toute sécurité. Et qui sait, peut-être que son ascension va finir par faire bouger les lignes et enclencher une prise de conscience chez tous ces dinosaures de la montagne.

    Il serait temps que les mentalités et les pratiques évoluent un peu là-haut, pour plus de respect de l’environnement et des populations locales.

    Ce serait ça, la vraie victoire d’Inoxtag.

    • chevron_right

      Critical takeover vulnerabilities in 92,000 D-Link devices under active exploitation

      news.movim.eu / ArsTechnica · Monday, 8 April - 18:56

    Photograph depicts a security scanner extracting virus from a string of binary code. Hand with the word "exploit"

    Enlarge (credit: Getty Images)

    Hackers are actively exploiting a pair of recently discovered vulnerabilities to remotely commandeer network-attached storage devices manufactured by D-Link, researchers said Monday.

    Roughly 92,000 devices are vulnerable to the remote takeover exploits, which can be remotely transmitted by sending malicious commands through simple HTTP traffic. The vulnerability came to light two weeks ago. The researcher said they were making the threat public because D-Link said it had no plans to patch the vulnerabilities, which are present only in end-of-life devices, meaning they are no longer supported by the manufacturer.

    An ideal recipe

    On Monday, researchers said their sensors began detecting active attempts to exploit the vulnerabilities starting over the weekend. Greynoise, one of the organizations reporting the in-the-wild exploitation, said in an email that the activity began around 02:17 UTC on Sunday. The attacks attempted to download and install one of several pieces of malware on vulnerable devices depending on their specific hardware profile. One such piece of malware is flagged under various names by 40 endpoint protection services.

    Read 10 remaining paragraphs | Comments

    • Sc chevron_right

      New Windows/Linux Firmware Attack

      news.movim.eu / Schneier · Monday, 11 December - 22:00 · 1 minute

    Interesting attack based on malicious pre-OS logo images :

    LogoFAIL is a constellation of two dozen newly discovered vulnerabilities that have lurked for years, if not decades, in Unified Extensible Firmware Interfaces responsible for booting modern devices that run Windows or Linux….

    The vulnerabilities are the subject of a coordinated mass disclosure released Wednesday. The participating companies comprise nearly the entirety of the x64 and ARM CPU ecosystem, starting with UEFI suppliers AMI, Insyde, and Phoenix (sometimes still called IBVs or independent BIOS vendors); device manufacturers such as Lenovo, Dell, and HP; and the makers of the CPUs that go inside the devices, usually Intel, AMD or designers of ARM CPUs….

    As its name suggests, LogoFAIL involves logos, specifically those of the hardware seller that are displayed on the device screen early in the boot process, while the UEFI is still running. Image parsers in UEFIs from all three major IBVs are riddled with roughly a dozen critical vulnerabilities that have gone unnoticed until now. By replacing the legitimate logo images with identical-looking ones that have been specially crafted to exploit these bugs, LogoFAIL makes it possible to execute malicious code at the most sensitive stage of the boot process, which is known as DXE, short for Driver Execution Environment.

    “Once arbitrary code execution is achieved during the DXE phase, it’s game over for platform security,” researchers from Binarly, the security firm that discovered the vulnerabilities, wrote in a whitepaper. “From this stage, we have full control over the memory and the disk of the target device, thus including the operating system that will be started.”

    From there, LogoFAIL can deliver a second-stage payload that drops an executable onto the hard drive before the main OS has even started.

    Details .

    It’s an interesting vulnerability. Corporate buyers want the ability to display their own logos, and not the logos of the hardware makers. So the ability has to be in the BIOS, which means that the vulnerabilities aren’t being protected by any of the OS’s defenses. And the BIOS makers probably pulled some random graphics library off the Internet and never gave it a moment’s thought after that.

    • chevron_right

      ownCloud vulnerability with maximum 10 severity score comes under “mass” exploitation

      news.movim.eu / ArsTechnica · Wednesday, 29 November - 00:38 · 1 minute

    Photograph depicts a security scanner extracting virus from a string of binary code. Hand with the word "exploit"

    Enlarge (credit: Getty Images)

    Security researchers are tracking what they say is the “mass exploitation” of a security vulnerability that makes it possible to take full control of servers running ownCloud, a widely used open-source filesharing server app.

    The vulnerability, which carries the maximum severity rating of 10, makes it possible to obtain passwords and cryptographic keys allowing administrative control of a vulnerable server by sending a simple Web request to a static URL, ownCloud officials warned last week. Within four days of the November 21 disclosure, researchers at security firm Greynoise said , they began observing “mass exploitation” in their honeypot servers, which masqueraded as vulnerable ownCloud servers to track attempts to exploit the vulnerability. The number of IP addresses sending the web requests has slowly risen since then. At the time this post went live on Ars, it had reached 13.

    Spraying the Internet

    “We're seeing hits to the specific endpoint that exposes sensitive information, which would be considered exploitation,” Glenn Thorpe, senior director of security research & detection engineering at Greynoise, said in an interview on Mastodon. “At the moment, we've seen 13 IPs that are hitting our unadvertised sensors, which indicates that they are pretty much spraying it across the internet to see what hits.”

    Read 11 remaining paragraphs | Comments

    • chevron_right

      The latest high-severity Citrix vulnerability under attack isn’t easy to fix

      news.movim.eu / ArsTechnica · Thursday, 19 October, 2023 - 21:56

    Enraged computer technician man screaming and breaking a PC with a hammer.

    Enlarge (credit: Getty Images)

    A critical vulnerability that hackers have exploited since August, which allows them to bypass multifactor authentication in Citrix networking hardware, has received a patch from the manufacturer. Unfortunately, applying it isn’t enough to protect affected systems.

    The vulnerability, tracked as CVE-2023-4966 and carrying a severity rating of 9.8 out of a possible 10, resides in the NetScaler Application Delivery Controller and NetScaler Gateway, which provide load balancing and single sign-on in enterprise networks, respectively. Stemming from a flaw in a currently unknown function, the information-disclosure vulnerability can be exploited so hackers can intercept encrypted communications passing between devices. The vulnerability can be exploited remotely and with no human action required, even when attackers have no system privileges on a vulnerable system.

    Citrix released a patch for the vulnerability last week , along with an advisory that provided few details. On Wednesday, researchers from security firm Mandiant said that the vulnerability has been under active exploitation since August, possibly for espionage against professional services, technology, and government organizations. Mandiant warned that patching the vulnerability wasn’t sufficient to lock down affected networks because any sessions hijacked before the security update would persist afterward.

    Read 5 remaining paragraphs | Comments

    • chevron_right

      They have begun: Attacks exploiting vulnerability carry maximum 10 severity rating

      news.movim.eu / ArsTechnica · Tuesday, 3 October, 2023 - 21:53 · 1 minute

    They have begun: Attacks exploiting vulnerability carry maximum 10 severity rating

    Enlarge (credit: Getty Images)

    Ransomware hackers have started exploiting one or more recently fixed vulnerabilities that pose a grave threat to enterprise networks around the world, researchers said.

    One of the vulnerabilities has a severity rating of 10 out of a possible 10 and another 9.9. They reside in WS_FTP Server , a file-sharing app made by Progress Software. Progress Software is the maker of MOVEit, another piece of file-transfer software that was recently hit by a critical zero-day vulnerability that has led to the compromise of more than 2,300 organizations and the data of more than 23 million people, according to security firm Emsisoft. Victims include Shell, British Airways, the US Department of Energy, and Ontario’s government birth registry, BORN Ontario, the latter of which led to the compromise of information for 3.4 million people.

    About as bad as it gets

    CVE-2023-40044, as the vulnerability in WS_FTP Server is tracked, and a separate vulnerability tracked as CVE-2023-42657 that was patched in the same October 28 update from Progress Software, are both about as critical as vulnerabilities come. With a severity rating of 10, CVE-2023-40044 allows attackers to execute malicious code with high system privileges with no authentication required. CVE-2023-42657, which has a severity rating of 9.9, also allows for remote code execution but requires the hacker to first be authenticated to the vulnerable system.

    Read 11 remaining paragraphs | Comments

    • chevron_right

      Vulnerable Arm GPU drivers under active exploitation. Patches may not be available

      news.movim.eu / ArsTechnica · Monday, 2 October, 2023 - 19:37

    Photograph depicts a security scanner extracting virus from a string of binary code. Hand with the word "exploit"

    Enlarge (credit: Getty Images)

    Arm warned on Monday of active ongoing attacks targeting a vulnerability in device drivers for its Mali line of GPUs, which run on a host of devices, including Google Pixels and other Android handsets, Chromebooks, and hardware running Linux.

    “A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory,” Arm officials wrote in an advisory . “This issue is fixed in Bifrost, Valhall and Arm 5th Gen GPU Architecture Kernel Driver r43p0. There is evidence that this vulnerability may be under limited, targeted exploitation. Users are recommended to upgrade if they are impacted by this issue.”

    The advisory continued: “A local non-privileged user can make improper GPU processing operations to access a limited amount outside of buffer bounds or to exploit a software race condition. If the system’s memory is carefully prepared by the user, then this in turn could give them access to already freed memory.”

    Read 9 remaining paragraphs | Comments