Log in Request a demo

Weekly Security News Archive, Q4 2022.

This page holds the weekly security news issues and newsletters that Brandefense published. It covers the 13 items from October 2022 to December 2022 (2022 Q4). Each entry keeps its original title, publish date and text, newest first. Earlier addresses of these entries now lead to the matching entry here. The overview page lists all periods.

Other periods: 2023 | 2022 Q4 | 2022 Q3 | 2022 Q2 | 2022 Q1 | Overview

All 13 Entries On This Page

December 2022

Security News – Week 52

Published:

Godfather Trojan Activity Targeting Financial Sector Detected

The Group-IB Threat Intelligence team detected that the Godfather Android banking trojan targeted more than 400 international financial companies between June 2021 and October 2022. Half of the targeted financial companies are banks, and the other half are cryptocurrency wallets and exchanges. The Godfather’s targets include 49 US-based companies, 31 Turkish-based companies, and 30 Spanish-based companies. Financial service providers in Canada, France, Germany, England, Italy, and Poland are among the hardest-hit companies.

The Godfather trojan was developed using the source code of another banking trojan called Anubis. However, The Godfather differs from Anubis with its updated functionality, such as updated command and control (C&C) communication, traffic encryption algorithm, a new module for managing virtual network computing (VNC) connections, and Google Authenticator OTPs. The Godfather is distributed through fake apps hosted on Google Play. Fake pages are placed on Godfather-infected devices. These fake web pages are opened when users click on fake notifications or open legitimate apps targeted by the Godfather. All data entered on these pages (usernames and passwords) is sent to command and control (C&C) servers.

Some activities that Godfather trojan software performs on infected systems;

  • Recording the device’s screen
  • Creating VNC connections
  • Capturing keystrokes (keylogging)
  • Leaking push notifications and SMS messages (to bypass 2FA)
  • Send SMS messages
  • Forward calls
  • Execute USSD requests
  • Start proxy servers
  • Enabling silent mode
  • Establishing WebSocket connections

A Godfather sample analyzed in September 2022 was observed to mimic Google Protect. When a user launches a malicious application, the application imitates the legitimate Google application, but the Godfather activities are running in the background. Once the malware is launched, it persists on the infected device, creates a pinned notification, and hides its icon from the list of installed apps. Considering these details, it is recommended to consider the following security recommendations to avoid being a victim of targeted attacks that the Godfather malware may carry out.

  • Emails, attachments, and links from unknown parties should not be respected.
  • Downloaded applications should be downloaded from legitimate application stores, and by checking the evaluations made,
  • Comprehensive security solutions should be used.

Critical RCE Alarm in Linux Kernel

A critical vulnerability has been identified in the Linux Kernel that could allow threat actors to disclose sensitive information and execute arbitrary code on affected versions.

The vulnerability affecting the SMB2_TREE_DISCONNECT() component in ksmbd is a Use-After-Free error caused by not verifying the object’s existence before operations are performed on the object. Threat actors can exploit this vulnerability to execute code in kernel context. Exploiting this vulnerability does not require authentication. In addition, only systems with ksmbd enabled are affected by the vulnerability.

The purpose of the ksmbd program, which was integrated into the Kernel in 2021, is to provide fast SMB3 file serving performance. SMB is the main file server protocol in Windows on Linux over Samba. Ksmbd was designed to complement Samba, not replace it. Samba and ksmbd developers are working to make the programs work together. In this context, it is recommended that the published updates be implemented immediately in order not to be the target of attacks that can be carried out using the critical vulnerability.

Agenda Ransomware’s New Rust Variant Targets Critical Sectors

A new variant of Agenda Ransomware, developed with the Rust programming language, has been detected to be used in campaigns targeting critical sectors. Agenda has become one of the ransomware that adopts the cross-platform programming language, making it easy to adapt to different systems such as Windows and Linux with the new variant. Agenda, attributed to an operator named Qilin, is linked to a series of attacks targeting manufacturing and IT industries in different countries. The Agenda Ransomware family, which is still under development, has recently been observed to target critical sectors such as the healthcare and education industries.

Agenda’s new Rust variant, like the Royal ransomware, uses a partial encryption (also known as intermittent encryption) technique by configuring the parameters used to determine the percentage of file content to be encrypted. This method allows faster encryption and avoids detections based on malware read/write file operations. In addition, unlike older Agenda versions, the new variant can terminate the Windows AppInfo process and disable the User Account Control (UAC) feature, which helps prevent the execution of the malware with administrative rights.

Recently, it has been observed that the threat actors behind Ransomware software have started to migrate the ransomware codes to the Rust language. The Rust language is becoming more common among threat actors as it is more difficult to analyze and has a lower detection rate by antivirus engines.

In this context, it is recommended to consider the following security practices to avoid being exposed to targeted attacks that can be carried out using advanced malware.

  • E-mails, attachments, and links from unknown parties should not be respected,
  • Do not download files, programs, or applications from illegal and suspicious-looking sources,
  • Institution/organization personnel should be made aware of target-oriented social engineering/phishing attacks,
  • Network traffic should be continuously monitored for the possibility of malicious attempts and abnormal network behavior,
  • Comprehensive security solutions should be used,
  • Critical files/systems should be backed up regularly,

IoC findings related to the campaign should be blocked from the security solutions in use.

Security News – Week 51

Published:

Agenda Ransomware’s New Rust Variant Targets Critical Sectors

A new variant of Agenda Ransomware, developed with the Rust programming language, has been detected to be used in campaigns targeting critical sectors. Agenda has become one of the ransomware that adopts the cross-platform programming language, making it easy to adapt to different systems such as Windows and Linux with the new variant. Agenda, attributed to an operator named Qilin, is linked to a series of attacks targeting manufacturing and IT industries in different countries. The Agenda Ransomware family, which is still under development, has recently been observed to target critical sectors such as the healthcare and education industries.

Agenda’s new Rust variant, like the Royal ransomware, uses a partial encryption (also known as intermittent encryption) technique by configuring the parameters used to determine the percentage of file content to be encrypted. This method allows faster encryption and avoids detections based on malware read/write file operations. In addition, unlike older Agenda versions, the new variant can terminate the Windows AppInfo process and disable the User Account Control (UAC) feature, which helps prevent the execution of the malware with administrative rights.

Recently, it has been observed that the threat actors behind Ransomware software have started to migrate the ransomware codes to the Rust language. The Rust language is becoming more common among threat actors as it is more difficult to analyze and has a lower detection rate by antivirus engines.

In this context, it is recommended to consider the following security practices to avoid being exposed to targeted attacks that can be carried out using advanced malware.

  • E-mails, attachments, and links from unknown parties should not be respected,
  • Do not download files, programs, or applications from illegal and suspicious-looking sources,
  • Institution/organization personnel should be made aware of target-oriented social engineering/phishing attacks,
  • Network traffic should be continuously monitored for the possibility of malicious attempts and abnormal network behavior,
  • Comprehensive security solutions should be used,
  • Critical files/systems should be backed up regularly,

IoC findings related to the campaign should be blocked from the security solutions in use.

Critical RCE Alert in Foxit PDF Reader and PDF Editor

Foxit has released updates that fix a remote code execution (RCE) vulnerability affecting the PDF Reader and PDF Editor products. The vulnerability affects the Windows operating system and is found in Foxit PDF Reader 12.0.2.12465 and earlier and Foxit PhantomPDF-10.1.7.37777 and earlier.

The details of the detected security vulnerability are as follows;

The vulnerability, tracked as CVE-2022-28672, allows remote threat actors to run arbitrary code on affected installations of Foxit PDF Reader. Exploiting this vulnerability requires user interaction.

The related vulnerability has been fixed in Foxit PDF Reader 12.1 and Foxit PDF Editor 12.1. In this context, in order not to be the target of attacks that can be carried out using the said vulnerability, PDF Reader users are recommended to apply the updates that fix the vulnerability immediately.

Multiple Vulnerabilities Detected in Nessus Network Monitor

Multiple security vulnerabilities have been identified in Nessus Network Monitor due to third-party components that could allow threat actors to perform remote code execution (RCE) and Denial of Service attacks on affected installations.

The details of the critical vulnerabilities identified are as follows;

  • The security vulnerability, tracked as CVE-2022-24785, is due to an input validation error in the npm version of Moment.js. A remote threat actor can access files on the system by sending a specially crafted HTTP request. (Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates.)
  • The security vulnerability, tracked as CVE-2021-23369, is due to incorrect login validation. A remote threat actor can run arbitrary code on the target system through a specially crafted request.

Tenable has released Nessus Network Monitor version 6.2.0, which fixes the vulnerabilities. Nessus Network Monitor 6.2.0 updates moment.js to version 2.29.4 and Handlebars to version 4.7.7 to fix identified security vulnerabilities. In this context, it is recommended to immediately upgrade to the current version published in order not to be the target of attacks that can be carried out using vulnerabilities.

Security News – Week 50

Published:

Critical RCE Alarm on Citrix ADC and Citrix Gateway

A critical security vulnerability has been identified in Citrix ADC and Citrix Gateway network solutions that could allow threat actors to remote code execution in affected installations.

The security vulnerability tracked as CVE-2022-27518 is caused by incorrect access restrictions on systems configured as SAML SP or SAML IdP. An unauthenticated, remote threat actor can gain unauthorized access to the system and execute arbitrary code.

The following supported versions of Citrix ADC and Citrix Gateway are affected by this vulnerability;

  • Citrix ADC And Citrix Gateway 13.0, Before 13.0-58.32
  • Citrix ADC And Citrix Gateway 12.1, Before 12.1-65.25
  • Pre 12.1-55.291 Citrix ADC 12.1-FIPS
  • 1-55.291 Pre-Citrix ADC 12.1-NDcPP

Citrix ADC and Citrix Gateway version 13.1 are not affected by the vulnerability. In addition, the vulnerability is actively exploited by threat actors. The following scripts specify whether the Citrix ADC or Citrix Gateway is configured as SAML SP or SAML IdP. If any of these scripts are present in the ns.conf file and the version is affected, the application needs to be updated;

  • Add Authentication SamlIdPProfile
  • Add Authentication SamlAction

It is recommended that users using vulnerable versions and configurations immediately apply the published updates in order not to be the target of attacks that can be carried out using the vulnerability. Customers using Citrix-managed cloud services or Citrix-managed Adaptive Authentication do not need to take any action regarding the vulnerability.

ZeroBot: New Botnet Malware Using IoT Security Vulnerabilities

A new botnet malware named ZeroBot has been detected that spreads through IoT security vulnerabilities. Developed with Golang, Zerobot exploits multiple vulnerabilities detected in IoT devices to gain access to targeted systems and spread further.

Vulnerabilities exploited in the deployment process of Zerobot malware include bugs in Zyxel firewalls, TOTOLINK routers, F5 BIG-IP, Spring Framework, D-Link DNS-320 NAS, Hikvision cameras, and FLIR AX8 thermal imaging cameras. It has also been observed that the botnet targets i386, amd64, arm, mips64le, mipsle, arm64, mips, mips64, ppc64, ppc64le, riscv64 and s390x CPU architectures. After communicating with the command and control (C2) server via the WebSocket Protocol, additional instructions allow Zerobot to execute arbitrary commands and launch attacks over various network protocols, including TCP, TLS, UDP, ICMP, and HTTP.

Zerobot is developed with a propagation exploit module that makes it harder to detect as it infects more IoT devices. Zerobot has been identified as a critical threat as it can gain unauthorized access to vulnerable systems and prevent targets from stopping the Zerobot program through its AntiKill module.

In this context, in order not to be the target of attacks that can be carried out using Zerobot, it is recommended to use the most up-to-date versions of the systems and programs used and to prevent the shared IoC findings related to the botnet from the security solutions in use.

Critical RCE Alarm in FortiOS sslvpnd

A critical security vulnerability has been detected in FortiOS’s SSL-VPN (sslvpnd) that could allow threat actors to remote code execution (RCE) on affected installations.

The security vulnerability tracked as CVE-2022-42475 is caused by a Heap-based Buffer Overflow affecting the sslvpnd daemon component. An unauthenticated, remote threat actor can manipulate the SSL-VPN component through specially crafted data, triggering a stack-based buffer overflow and executing arbitrary code on the targeted system. Fortinet states that this vulnerability is actively exploited and recommends that users check their systems for the following indicators of compromise.

If the following log string is observed more than once in user systems;

  • Logdesc=”Application Crashed” And Msg=”[…] Application:sslvpnd,[…], Signal 11 Received, Backtrace: […]

If the existence of the following structures is detected in the file system;

  • /Data/Lib/Libips.Bak
  • /Data/Lib/Libgif.So
  • /Data/Lib/Libiptcp.So
  • /Data/Lib/Libipudp.So
  • /Data/Lib/Libjepg.So
  • /Var/.Sslvpnconfigbk
  • /Data/Etc/Wxd.Conf
  • /Flash

If connections are made from FortiGate to the following suspicious IP addresses:

  • 34.130.40:444
  • 131.189.143:30080,30081,30443,20443
  • 36.119.61:8443,444
  • 247.168.153:8033

Threat actors actively exploit the vulnerability. In this context, in order not to be the target of attacks that can be carried out using vulnerabilities, it is recommended to immediately implement the published updates and prevent the specified consensus indicators (IoC) from the security solutions in use.

Security News – Week 49

Published:

Critical XSS Alert Affecting Zyxel’s Specific Firewall Models

Zyxel has released updates for a critical XSS (Cross Site Scripting) vulnerability that affects specific models of firewalls.

The vulnerability, tracked as CVE-2022-40603, affects the CGI program of firewall versions and is caused by insufficient sanitization of user-supplied data. A remote threat actor can direct targeted users to visit an XSS-loaded URL and execute a malicious script in the user’s browser. A threat actor who successfully exploited the vulnerability could access sensitive browser-based information.

The firewall models and versions affected by the security vulnerability are as follows;

Zyxel has fixed the said vulnerability with the current versions mentioned above. In this context, it is recommended to implement the published updates immediately in order not to be the target of targeted attacks that can be carried out using the vulnerability.

Critical RCE Alarm in FreeBSD Ping

A critical security vulnerability has been identified in the ping module of the open-source FreeBSD operating system that threat actors could potentially exploit to gain remote code execution.

The Stack Buffer Overflow vulnerability, tracked as CVE-2022-23093, is caused by a boundary error in the ping module’s pr_pack() function and affects all supported versions of FreeBSD. The ping module allows testing the accessibility of a remote host using ICMP messages and reads raw IP packets to process responses in the pr_pack() function. The pr_pack() function copies the received IP and ICMP headers to the stack buffers for further processing. A remote threat actor could exploit this vulnerability to trigger a boundary fault, crash the ping program, and execute code remotely on the affected system.

There has yet to be an update that fixes the vulnerability. In this context, in order not to be the target of attacks that can be carried out using the vulnerability, it is recommended that the updates to be published should be implemented immediately if they are followed and published.

LastPass Suffers A Data Breach

LastPass, a popular password management service, suffered a data breach that resulted in threat actors gaining unauthorized access to a certain number of customer information.

The data breach targeting LastPass and its subsidiary, GoTo, is known to have been carried out using information obtained in the August 2022 security breach. There are no details about the breach, but the statement made by LastPass officials stated that the unauthorized parties only gained access to some aspects of the customers with the said data breach attempt.

LastPass has launched a comprehensive investigation into the breach through the well-known security firm Mandiant and law enforcement. LastPass reported that its Zero-Knowledge architecture securely encrypts and stores customers’ passwords and that LastPass products and services continue to be available. Therefore, there is no action for customers to take.

November 2022

Security News – Week 48

Published:

WhatsApp Suffered from a Data Breach – 487 Million Users’ Data in Danger

In a well-known hacking forum, it was detected that on November 16, 2022, a threat actor claimed that a database of 487 million WhatsApp users’ mobile phone numbers was compromised.

database whatsapp data breach
Figure 1: The Countries in the Breached Database

It is claimed that the database seized in the post contains the personal data of WhatsApp users from 84 countries. The distribution of the compromised data by country is given below;

  • 45 Million User Data of Egyptian Citizens
  • 32 Million User Data of US citizens
  • 35 Million User Data of Italian citizens
  • 29 Million User Data of Saudi Arabian Citizens
  • 20 Million User Data of French Citizens
  • 20 Million User Data of Turkish Citizens
  • 10 Million User Data of Russian Citizens
  • Over 11 Million User Data of UK Citizens

Cybernews researchers contacted the threat actor who shared the post and requested a data set sample as evidence to confirm the relevant leak. In the shared example, there are phone numbers of 1097 UK and 817 US users. However, the threat actor did not provide details on how the database was obtained, suggesting that they used their strategies to collect the data. Upon this, the analysis of the sample data set by Cybernews researchers confirmed that all numbers belong to active WhatsApp users.

whatsapp data leaked
Figure 2: An example of leaked accounts

The intercepted data is mostly used in phishing, smashing, and vishing attacks by threat actors. So, WhatsApp users are advised to be wary of incoming calls and message contents from unknown numbers. Meta, the parent company of WhatsApp, was contacted regarding the related data leak, but a response has yet to be received. WhatsApp users and parties will be informed of developments on the subject.

Amazon Fixes a Security Vulnerability Affecting AWS AppSync

A security vulnerability called “cross-tenant” has been detected by Datadog researchers in AppSync, a popular Amazon Web Services (AWS) tool. AppSync is a popular AWS service that allows developers to quickly create GraphQL and Pub/Sub APIs.

The vulnerability is due to a case-sensitivity parsing issue of the AppSync service that could potentially be used to bypass cross-account role usage validations and act as a service on customer accounts. Successful vulnerability exploitation allows threat actors to assume Identity and Access Management (IAM) roles in other AWS accounts.

appsec AWS
Figure: Vulnerability flow diagram

The vulnerability detected on September 1, 2022, was immediately reported to AWS. AWS, which rescheduled the attack, verified the impact of the vulnerability and released a fix that fixed it. In addition, Amazon released a statement on Monday, November 21, confirming the details of the vulnerability and stating that no customers were affected by it. There is no action for Amazon customers to take due to the vulnerability.

Multiple Vulnerabilities Detected in IT Management Solution GLPI

Multiple security vulnerabilities have been identified in GLPI, an open-source web application that helps institutions/organizations and companies manage their IT infrastructure and inventories. These vulnerabilities allow threat actors to execute SQL queries against the application database and to perform Cross-Site Scripting (XSS) and Server-Side Request Forgery (SSRF) attacks.

The details of the detected security vulnerabilities are as follows;

  • The security vulnerability tracked as CVE-2022-39375 is due to insufficient cleaning of user-supplied entries in the RSS Feed function. A remote threat actor can execute arbitrary HTML code and script in the user’s browser in the context of the vulnerable website via a malicious link. Successful exploitation of this vulnerability allows remote threat actors to obtain sensitive information, alter the web page’s appearance, and carry out phishing attacks.
  • The security vulnerability tracked as CVE-2022-39234 is due to an insufficient session expiration time. This vulnerability allows threat actors to access users’ accounts by reusing users’ old session credentials (Cookies) and thus may lead to the capture of users’ sensitive information.
  • The security vulnerability tracked as CVE-2022-39323 is due to insufficient sanitization of user-supplied data in the API REST user_token component. A remote threat actor can execute arbitrary SQL commands in the application database by sending a specially crafted request to the affected application.
  • The security vulnerability, tracked as CVE-2022-39276, is due to insufficient validation of user-supplied inputs in RSS feeds. A remote threat actor can direct the application to initiate requests to arbitrary systems (SSRF) via a specially crafted HTTP request.
  • The vulnerability security tracked as CVE-2022-39277, is due to insufficient sanitization of user-supplied data on external connections. A remote threat actor can run arbitrary HTML code and script in the user’s browser in the context of the vulnerable website via a specially crafted link.

These vulnerabilities affect specific versions of GLPI, and security updates have been released that fix the vulnerabilities. In this context, it is recommended to immediately upgrade vulnerable installations to the current versions published in order not to be the target of attacks that can be carried out using vulnerabilities.

Security News – Week 47

Published:

Critical RCE Vulnerabilities Affecting F5 Products Detected

Application service provider F5 has issued a security notice for two critical security vulnerabilities that allow an unauthenticated threat actor with network access to remote code execution in BIG-IP systems, a combination of software and hardware designed around access control, application availability, and security solutions.

In the statement made by F5, it was stated that the security vulnerabilities detected were found in the representative state transfer (REST) interface for the iControl framework used to communicate between F5 devices and users.

The identified security vulnerabilities are:

The vulnerability, code CVE-2022-41622, is caused by cross-site request forgery (CSRF) that affects BIG-IP and BIG-IQ products, allowing threat actors to gain root access to a device’s management interface.

The vulnerability code CVE-2022-41800 allows a threat actor with administrative privileges to execute code remotely on vulnerable systems via an RPM file.

BIG-IP product versions affected by these security vulnerabilities are as follows;

  • 1.0 – 16.1.2
  • 1.0 – 15.1.5
  • 1.0 – 14.1.4
  • 1.0 – 13.1.4
  • 1.0 – 12.1.6
  • 6.1 – 11.6.5

Stating that they will not release updates for 11. x (11.6.1 – 11.6.5) and 12. x (12.1.0 – 12.1.6) versions, F5 said that there is no information that security vulnerabilities have been exploited yet and that existing updates will be included in future versions as soon as possible and announced that it will. In order not to be the target of target-oriented attacks that can be carried out by using the vulnerability of the users, it is recommended that the published updates be implemented immediately.

Reflected XSS Alarm in ProfileGrid WordPress Plugin

A security vulnerability has been detected, allowing threat actors to perform Reflected XSS attacks in the ProfileGrid WordPress plugin, which offers features such as creating and managing user groups on WordPress websites. A Reflected XSS attack is carried out by injecting malicious scripts directly into an HTTP request by threat actors and executing them in the target user’s browser.

The vulnerability, tracked as CVE-2022-3578, is caused by the ProfileGrid WordPress plugin insufficiently clearing parameters sent to the page in versions before 5.1.1. As a result, a remote threat actor can direct users to open a malicious link, and they can execute arbitrary HTML code and script in the user’s browser in the context of the vulnerable website.

In order not to be the target of attacks that can be carried out using the security vulnerability in question, it is recommended to immediately upgrade the vulnerable ProfileGrid versions to the current versions (5.1.1) that fix the vulnerability.

Multiple Vulnerabilities Detected in IT Management Solution GLPI

Multiple security vulnerabilities have been identified in GLPI, an open-source web application that helps institutions/organizations and companies manage their IT infrastructure and inventories. These vulnerabilities allow threat actors to execute SQL queries against the application database and to perform Cross-Site Scripting (XSS) and Server-Side Request Forgery (SSRF) attacks.

The details of the detected security vulnerabilities are as follows;

  • The security vulnerability tracked as CVE-2022-39375 is due to insufficient cleaning of user-supplied entries in the RSS Feed function. A remote threat actor can execute arbitrary HTML code and script in the user’s browser in the context of the vulnerable website via a malicious link. Successful exploitation of this vulnerability allows remote threat actors to obtain sensitive information, alter the web page’s appearance, and carry out phishing attacks.
  • The security vulnerability tracked as CVE-2022-39234 is due to insufficient session expiry time. This vulnerability allows threat actors to access users’ accounts by reusing users’ old session credentials (Cookies) and thus may lead to the capture of users’ sensitive information.
  • The security vulnerability tracked as CVE-2022-39323 is due to insufficient sanitization of user-supplied data in the API REST user_token component. A remote threat actor can execute arbitrary SQL commands in the application database by sending a specially crafted request to the affected application.
  • The security vulnerability, tracked as CVE-2022-39276, is due to insufficient validation of user-supplied inputs in RSS feeds. A remote threat actor can direct the application to initiate requests to arbitrary systems (SSRF) via a specially crafted HTTP request.
  • The vulnerability security, tracked as CVE-2022-39277, is due to insufficient sanitization of user-supplied data on external connections. A remote threat actor can run arbitrary HTML code and script in the user’s browser in the context of the vulnerable website via a specially crafted link.

These vulnerabilities affect specific versions of GLPI, and security updates have been released that fix the vulnerabilities. In this context, it is recommended to immediately upgrade vulnerable installations to the current versions published in order not to be the target of attacks that can be carried out using vulnerabilities.

Security News – Week 46

Published:

Critical UEFI Firmware Vulnerabilities Detected in Specific Lenovo Notebook Models

Lenovo has released updates regarding vulnerabilities detected in the UEFI Firmware component affecting Yoga, IdeaPad, and ThinkBook devices. UEFI refers to software that acts as an interface between the operating system and the firmware embedded in the device’s hardware and is responsible for starting the operating system when a device is powered on. Therefore, UEFI offers a highly attractive attack surface for threat actors who want to release hard-to-detect and remove malware.

Here are the details of the vulnerabilities that could be used by threat actors to disable Secure Boot, a security mechanism designed to prevent malicious programs from loading during the boot process;

  • The vulnerability, tracked as CVE-2022-3430, affects the WMI Setup driver on certain Lenovo Notebook PC devices and allows a threat actor with elevated privileges to modify Secure Boot settings by modifying an NVRAM variable.
  • The vulnerability, tracked as CVE-2022-3431, affects a driver used in certain Lenovo Notebook PC devices that is not accidentally disabled during the manufacturing process and could allow a threat actor with elevated privileges to change the Secure Boot setting by changing an NVRAM variable.
  • The vulnerability, tracked as CVE-2022-3432, affects a driver used during the manufacturing process on the IdeaPad Y700-14ISK that was not accidentally disabled and could allow a threat actor with elevated privileges to alter the Secure Boot setting by changing an NVRAM variable.

After the vulnerabilities were detected by the Eset security researcher, Lenovo announced that they took action to fix the vulnerabilities. However, Lenovo has stated that they do not plan to release fixes for CVE-2022-3432 as the affected model has reached the end of life (EoL). In this context, it is recommended that users of other affected devices update their firmware to the latest version in order not to be the target of attacks that can be carried out using vulnerabilities.

Threat Group Named Worok Performs Espionage Activities With Backdoors Hidden Inside Image Files

A recently discovered cyber spy group called Worok has been found to hide malware in image files. PNG files’ purpose is to hide a malicious payload used to facilitate information theft.

Avast discovered that Worok used a C++-based Payload called CLRLoad to pave the way for a PowerShell script embedded in PNG images, using a cloaking technique known as steganography. The findings show that the threat actor applied DLL Injection after gaining initial access to execute the CLRLoad malware.

Used in the attack chain, Malware called DropboxControl uses a Dropbox account for command and control (C&C) and captures data by allowing the threat actor to download/upload/run files to specific folders. Private companies and government agencies operating in locations such as Cambodia, Vietnam, and Mexico are among the countries affected by DropboxControl.

Avast confirmed the Worok findings of ESET researchers and contributed to the expansion of the attack chain.

The tools used by Worok, which capture data through Dropbox accounts registered in active Google e-mails, are not very common; It is considered to be an APT project focused on high-profile organizations in the private and public sectors in Asia, Africa and North America.

As a precaution against targeted cyber attacks;

  • E-Mails, attachments, and links from suspicious parties should not be respected,
  • Files or programs should be downloaded from reliable sources,
  • The most up-to-date versions of existing systems/programs should be used,
  • It is recommended to block IoC findings related to the attack campaign by security solutions.

New KmsdBot Malware Detected for Crypto Mining Activities and DDoS Attacks

Cyber security researchers have detected malware called KmsdBot, which carries out DDoS attacks and cryptocurrency mining activities by accessing targeted systems using the SSH cryptographic network protocol.

KmsdBot malware is distributed on systems with weak SSH credentials by downloading the “kmsd.exe” file from a server (C2) controlled by threat actors.

KmsdBot malware has the ability to perform scanning activities on targeted systems, spread to different systems through username and password combinations, control cryptocurrency mining processes and update itself. In addition, the malware has been found to organize DDoS attacks in which Layer 4 TCP/UDP or Layer 7 HTTP/GET requests are sent to strain the targeted server resources and hinder the server’s ability to process and respond.

It is known that the number of malware that carries out cryptocurrency mining activities is increasing day by day. In the recently detected cryptocurrency mining malware campaign called KmsdBot, threat actors target gaming, automobile, and security companies. In this context, in order not to be targeted by the related malware campaign;

  • Use public key authentication for SSH connections,
  • Not using weak or default credentials for servers or deployed applications,
  • Do not open attachments/links from suspicious-looking sender e-mail addresses,
  • Beware of unreliable content,
  • Use of up-to-date and comprehensive security solutions,
  • Keeping systems and applications up to date,

It is strongly recommended that IoC findings related to the attack campaign are blocked by security solutions.

Download the IoCs

Security News – Week 45

Published:

WordPress reCAPTCHA Plugin has an XSS Vulnerability

A vulnerability has been identified in the WordPress reCAPTCHA plugin, which protects WordPress website forms from spam/robot logins, that could allow threat actors to perform XSS (Cross-Site Scripting) attacks on affected installations.

The security vulnerability with code CVE-2022-3831 affects the “unfiltered_html” component and is caused by insufficient cleaning of user-supplied data. Exploiting the vulnerability requires administrative privileges.

The vulnerability, assessed as medium critical, affects all versions of WordPress reCAPTCHA 1.6 and earlier. The plugin has been removed from the WordPress market since November 2, 2022, and no current version fixes the vulnerability. In this context, it is recommended that users using the plugin in WordPress installations immediately disable or remove it to avoid being affected by the vulnerability.

Medibank Confirms Security Breach Affecting 9.7 Million Customers’ Data

Australian-based insurance firm Medibank has confirmed that they were exposed to a security breach by BlogXX threat actors, resulting in unauthorized access to 9.7 Million customer data. BlogXX is a structure of the Revil Ransomware group that was shut down by law enforcement in 2021.

9.7 million customer data captured by threat actors in this Ransomware attack includes personal information such as name, surname, date of birth, full address, phone number, and email address. In addition, the captured data also includes the Medicare numbers of customers, passport numbers, and visa details of international student customers. After the data breach, the Medibank security team announced that they detected Ransomware on their systems on October 12, 2022, and the affected systems were isolated. It is known that BlogXX threat actors threatened Medibank with leaking the captured data if the ransom payment was not made, but Medibank refused to pay the ransom.

With more than 3.9 million customers and 4,000 employees, Medibank is among Australia’s largest private health insurance providers. Every day, many institutions and organizations, regardless of large or small scale, are targeted by Ransomware attacks. In this context, it is recommended to consider the following suggestions in order not to be the target of similar attacks;

  • Emails, Attachments, Files/Links From Suspicious/Unknown Parties Should Not Be Relied on.
  • File, Software, and Program Downloads Must Be Performed From Legitimate And Official Sources.
  • Current and Comprehensive Security Solutions should be used.
  • System And Applications Should Be Keep At The Latest Version.

Dynamics 365 Customer Voice Service Detected To Be Manipulated In Phishing Attacks

Avanan security researchers have determined that the Dynamics 365 Customer Voice service, a Microsoft product that institutions/organizations use to get customer feedback, is manipulated in phishing attacks by threat actors. Threat actors behind this phishing campaign are planning to seize the Microsoft account information of customers by sending phishing links that appear legitimate to customers via Dynamics 365 Customer Voice.

The campaign starts with the delivery of a phishing e-mail to the recipients via the old name of the service, “Forms Pro,” stating that they have a new voicemail. When the Play Voicemail button is clicked, targets are directed to a phishing page that mimics the Microsoft login page. However, the URL of that phishing page has no connection with Microsoft. Therefore, Microsoft login credentials entered by targets are captured by threat actors.

The campaign is an attack that requires careful detection by targets, as the phishing link is not visible until the last step. Additionally, destinations are redirected from the e-mail body to a legitimate page first, so hovering over the URL in the e-mail body does not provide protection. In this context, in order not to be the target of phishing attacks that can be carried out using similar methods, attention is paid to the following security recommendations;

Security News – Week 44

Published:

Critical Zero-Day Alarm on iOS and iPadOS

Apple has released updates to 20 security vulnerabilities affecting iOS and iPadOS operating systems, including a 0-day vulnerability known to be actively exploited by threat actors.

The 0-day vulnerability, tracked as CVE-2022-42827, exists due to a boundary error affecting the “Kernel“ component of the operating system. Threat actors can execute with root privileges on the vulnerable system by triggering an out-of-bounds write error through a specially crafted application.

Apart from the vulnerability mentioned above, Apple has also fixed two high-severity vulnerabilities with the released iOS 16.1 and iPadOS 16 updates. In order not to be the target of attacks that can be carried out using vulnerabilities, Apple users using vulnerable versions are recommended to apply the published updates immediately.

Preliminary Information Released for OpenSSL Vulnerability

The developers of the OpenSSL library, which has implemented HTTPS secure networking in numerous applications, have stated that a critical security vulnerability will be fixed in version 3.0.7, released on November 1, 2022 (Reference Link). However, the project developers made public announcements that did not include all details of the vulnerability, as more information was kept confidential until the update for the identified vulnerability was released.

It has been announced that the critical security vulnerability detected is affected by the versions between OpenSSL 3.0 and version 3.0.6, released on September 7, 2021. Therefore the affected versions were not widely known until OpenSSL 1.x, which has been available for 12 years.

OpenSSL security vulnerabilities have a widespread impact. The HeartBleed vulnerability, discovered in April 2014, has been observed on Apache and Nginx web servers, which have a usage rate of over 66% among all active websites on the internet. However, it is unknown whether the detected and declared critical vulnerability would lead to a mass exploit like HeartBleed.

In this context, to limit the risk of being affected by the relevant security vulnerability as much as possible; Until the release of the measures by OpenSSL developers, it is recommended to master the “Software Supply Chain” processes to determine which applications the old version OpenSSL libraries are running, and to make preliminary preparations.

Air New Zealand Suffered A Security Breach

New Zealand’s flag carrier, a national airline in Oceania, has suffered a security breach that resulted in threat actors gaining access to customer accounts.

In the security breach, threat actors performed credential-stuffing attacks to gain unauthorized access to customer accounts. A credential stuffing attack is performed by trying compromised credentials until the targeted system is logged in.

Following the detection of the security breach, the airline’s officials stated that the breach did not affect any of the company’s systems, but only individual customer accounts were affected. Upon the relevant explanation, customer accounts were blocked, and customers were contacted to change their login information before using the Airpoints system again.

Logging in to more than one platform with the same login information and not enabling MFA/2FA authentication mechanisms on the platforms cause such attacks to be seen frequently. In this context, it is recommended to consider the following security recommendations not to be the target of similar attacks.

  • The same username and password should not be used in more than one online session,
  • The login information should be created by applying unique and strong password policies.
  • The airline’s customers should be aware of the data that could be leaked to the internet in this breach and used in various phishing/social engineering attacks.

October 2022

Security News – Week 43

Published:

Critical Zero-Day Alarm on iOS and iPadOS

Apple has released updates to 20 security vulnerabilities affecting iOS and iPadOS operating systems, including a 0-day vulnerability known to be actively exploited by threat actors.

The 0-day vulnerability, tracked as CVE-2022-42827, exists due to a boundary error affecting the “Kernel“ component of the operating system. Threat actors can execute with root privileges on the vulnerable system by triggering an out-of-bounds write error through a specially crafted application.

Apart from the vulnerability mentioned above, Apple has also fixed two high-severity vulnerabilities with the released iOS 16.1 and iPadOS 16 updates. In order not to be the target of attacks that can be carried out using vulnerabilities, Apple users using vulnerable versions are recommended to apply the published updates immediately.

Iran Atomic Energy Agency Suffered from a Breach

The Atomic Energy Agency of Iran was exposed to a security breach that resulted in the threat actors gaining unauthorized access to their e-mail servers, compromising their data security.

The security breach came to light when threat actors known as “Black Reward” claimed to have obtained sensitive data on their Telegram channel, including contract files, business plans, and information about other facilities. In addition to the sharing, the threat actors announced that the captured data would be shared publicly if the political prisoners arrested during the recent protests against the Iranian government on October 21 were not released within 24 hours.

The Iranian Atomic Energy Agency officials confirmed the security breach by targeting e-mail servers, but it was emphasized that the captured data was unimportant. Furthermore, it was stated that the intercepted e-mails contained technical and casual messages. In this context, it is recommended that institutions and organizations take into account the following security practices in order not to be the target of targeted attacks that can be carried out in a similar way to protest and attract attention.

  • Internal inventories such as e-mail servers used within the institution/organization should be used in the most up-to-date versions where the vulnerabilities are fixed.
  • Institution/organization personnel should not rely on spam e-mails, attachments, and links from unknown parties.
  • Comprehensive security solutions should be deployed to the corporate/organizational network.

Magniber Ransomware Targets Windows Users with Fake Software Updates

HP Wolf Security researchers have detected that the operators of Magniber Ransomware are running a new malware distribution campaign targeting Windows home users with advanced features.

The chain of infection begins when users download a ZIP file that allegedly contains anti-virus software or a Windows 10 update from a threat actor-controlled website. However, contrary to what was promised, the ZIP archive contains compressed Javascript files containing malware. JavaScript files use a variation of the DotNetToJScript technique to load a .NET executable into memory, so the ransomware does not need to be saved to disk. Using this technique, detection and prevention mechanisms that monitor files written to disk are bypassed, and traces left on the vulnerable system are minimized. The .NET code decodes the shell code and injects it into another process.

On the other hand, the ransomware code disables Windows’s backup and recovery features by deleting the copy files before encrypting the user files. However, Magniber requires administrator privileges to disable its data recovery capability, so the malware bypasses User Account Control (UAC) control to execute commands without the user’s knowledge. However, the logged-in user must be part of the Administrators group for this process to work. Magniber enumerates the files and checks the file extension against a list during the encryption process. If the file extension is in the list, the file is encrypted. In the final stage, Magniber places a ransom note in each directory and displays the message to the user by opening it in a web browser. While it was observed that the malware spread through MSI and EXE files in the past attacks using Magniber, it was observed that it started to be distributed via JavaScript files in the said attacks carried out in September 2022.

The threat actors behind the Magniber malware are known to demand a $2500 ransom payment from infected users. In this context, it is recommended to consider the following security steps in order not to be the target of this and similar ransomware campaigns.

Security News – Week 42

Published:

Magniber Ransomware Targets Windows Users with Fake Software Updates

HP Wolf Security researchers have detected that the operators of Magniber Ransomware are running a new malware distribution campaign targeting Windows home users with advanced features.

The chain of infection begins when users download a ZIP file that allegedly contains anti-virus software or a Windows 10 update from a threat actor-controlled website. However, contrary to what was promised, the ZIP archive contains compressed Javascript files containing malware. JavaScript files use a variation of the DotNetToJScript technique to load a .NET executable into memory, so the ransomware does not need to be saved to disk. Using this technique, detection and prevention mechanisms that monitor files written to disk are bypassed, and traces left on the vulnerable system are minimized. The .NET code decodes the shell code and injects it into another process.

On the other hand, the ransomware code disables Windows’s backup and recovery features by deleting the copy files before encrypting the user files. However, Magniber requires administrator privileges to disable its data recovery capability, so the malware bypasses User Account Control (UAC) control to execute commands without the user’s knowledge. However, the logged-in user must be part of the Administrators group for this process to work. Magniber enumerates the files and checks the file extension against a list during the encryption process. If the file extension is in the list, the file is encrypted. In the final stage, Magniber places a ransom note in each directory and displays the message to the user by opening it in a web browser. While it was observed that the malware spread through MSI and EXE files in the past attacks using Magniber, it was observed that it started to be distributed via JavaScript files in the said attacks carried out in September 2022.

The threat actors behind the Magniber malware are known to demand a $2500 ransom payment from infected users. In this context, it is recommended to consider the following security steps in order not to be the target of this and similar ransomware campaigns.

Multiple Vulnerabilities Detected in Juniper Networks Junos OS

Multiple critical security vulnerabilities have been identified in Junos OS, a network operating system used in security and network devices developed by Juniper Networks. The vulnerabilities allow threat actors to perform unauthorized file access, cross-site scripting (XSS), and directory traversal attacks.

Some of the detected security vulnerabilities are as follows;

  • The security vulnerability, tracked as CVE-2022-22241, is due to incorrect login validation affecting the J-Web component of Juniper Networks Junos OS. As a result, an unauthenticated threat actor that successfully exploits the vulnerability can gain access to data through a specially crafted POST request without proper authorization.
  • The vulnerability, tracked as CVE-2022-22246, is a PHP Local File Inclusion (LFI) vulnerability that affects the J-Web component of Juniper Networks Junos OS and could allow a low-privileged authenticated threat actor to execute a malicious PHP file on the vulnerable system.
  • The vulnerability tracked as CVE-2022-22242 is a Cross-Site Scripting (XSS) vulnerability that affects the J-Web component of Juniper Networks Junos OS and could allow an unauthenticated threat actor to run malicious scripts in the user’s browser in the context of a J-Web session.
  • The vulnerability tracked as CVE-2022-22244 is an XPath Injection vulnerability that affects the J-Web component of Juniper Networks Junos OS. An unauthenticated threat actor can exploit the vulnerability through a specially crafted POST request.

These vulnerabilities, which affect all versions of the Junos operating system, are critically rated as high and have been fixed with the updates released by Juniper Networks. In this context, in order not to be the target of attacks that can be carried out using vulnerabilities, it is recommended that vulnerable Junos OS users upgrade immediately to released updates, while as a workaround, disable J-Web or restrict access to trusted hosts only.

Timing Attacks Via Npm API Discloses Custom Package Names

An attack method that reveals the names of special packages has been identified by Aqua Security researchers. Organizations create internal projects and custom packages of certain software products to keep their code and functionality private to minimize the risk of their development teams and inventories being exposed to targeted attacks.

The detected attack method includes a timing attack using the npm API. The npm Register API allows users to download existing packages and check for the existence of packages. When using the npm registry to download a package that does not exist or is set as private, the website returns a 404 HTTP error code stating that the package could not be found.

Aqua Security researchers used this feature to compare the response time of 404 HTTP errors with non-existent packets to check for the presence of custom packets they created in npm. As a result of the results obtained, it was observed that the response time to the request containing the name of an existing package was longer than the response time to the request made for the non-existent package. Therefore, threat actors can learn whether the package exists in the system through dictionary attacks by creating a list of possible package names for special packages used by institutions/organizations.

 

After detecting the private packages of the organizations, the threat actors can create fake malicious packages with the same name and trick the public/organizational employees into downloading them. It is predicted that such an attack could be linked to wider supply chain attacks. In this context, it is recommended to take the following security measures in order to reduce the risk of attacks that can be carried out using the said method.

  • Organizations should take preventive measures by frequently searching npm for suspicious packages that spoof their custom packages with similar names,
  • Because npm doesn’t allow same-named packages to be installed in public repositories, organizations should create public packages that emulate their private packages as placeholders,
  • If similar packages are found, it should be ensured that they do not contain malware, and relevant stakeholders should be informed.

Security News – Week 41

Published:

Microsoft Released Critical Security Updates

As part of the October security updates, Microsoft has released updates for 85 security vulnerabilities, including 0-day vulnerabilities known to be actively exploited by threat actors. The criticality ratings of the vulnerabilities are 15 critical, 69 high, and one medium. In addition, it is stated that the published updates do not cover the “ProxyNotShell” vulnerabilities (CVE-2022-41040, CVE-2022-41082) recently detected in Microsoft Exchange Server.

Some of the critical vulnerabilities fixed by the updates are as follows;

  • The vulnerability, tracked as CVE-2022-41033, is caused by a buffer overflow affecting the Windows COM+ Event System Service. The vulnerability, which affects all versions of Windows starting with Windows 7 and Windows Server 2008, allows a local user to execute code with SYSTEM privileges on a vulnerable system.
  • The security vulnerability, tracked as CVE-2022-37979, is caused by a Race Condition bug in Windows Hyper-V. A local user can exploit the vulnerability to gain unauthorized access to sensitive information and elevate their privileges in the system.
  • The security vulnerability, tracked as CVE-2022-37976, is caused by improper enforcement of security restrictions in Active Directory Certificate Services.
  • The vulnerability, tracked as CVE-2022-37978, exists because the security features in Active Directory Certificate Services are bypassed. As a result, a remote user can exploit the vulnerability to perform man-in-the-middle (MitM) attacks and gain access to network communications.
  • The vulnerability, tracked as CVE-2022-41043, exists due to excessive data output by Microsoft Office applications. As a result, a local user can gain unauthorized access to sensitive information in the system by exploiting the vulnerability.

Updates that fix vulnerabilities affect the following Microsoft products and versions;

It is recommended that users using the products and versions mentioned above immediately apply the published updates in order not to be the target of attacks that can be carried out using vulnerabilities.

Toyota Confirms a Security Vulnerability Affecting Customer Data

Toyota has stated that a security vulnerability has been identified that compromises the 296,019 email addresses and customer management numbers of registered persons on the T-Connect help platform. T-Connect is a support platform for unlocking Toyota vehicles that offers features such as smartphone-based digital keys, navigation services, and remote start.

The vulnerability is due to a developer tasked with building the T-Connect platform uploading the site’s source code to a GitHub public repository in December 2017. Upon inspection of the publicly available source code by Toyota officials, it was discovered that the source code contained an access key to a server that stores customer data. Immediately after the vulnerable GitHub repository was discovered, Toyota officials made it private, and the exposed access key was replaced.

Toyota has launched an investigation into the vulnerability, but there is no evidence yet whether threat actors used the vulnerability to capture data from the server. It is recommended that T-Connect users with the potential to be affected by the breach be aware of the data that may be leaked to the internet regarding spear-phishing/Social engineering attacks and change the login information registered to the platform by applying strong password policies.

More than 400 Mobile Apps Detected to Hijack Facebook Login Credentials

More than 400 malicious Android and iOS apps have been identified by meta security researchers on the official Apple and Google app stores, aiming to hijack Facebook users’ login information. It has been observed that these malicious applications are disguised as photo editors, games, VPN services, business applications, and other utilities.

The campaign chain starts with malware developers creating malicious mobile apps disguised as apps with fun or useful functions. Threat actors, who have begun publishing developed malicious applications on official application stores, may publish fake reviews and comments to cover up the negative comments of people who detect that the applications are malicious. With the installation of any of these applications, users are faced with a “Facebook Login” request before using the promised features. If users log in with their login information, the malicious application captures the entered user name, e-mail, and password information. It can use login information obtained by threat actors for various activities such as providing full access to people’s Facebook accounts, sending fake/spam messages to one’s friends, accessing private information, and fraud.

There are also many legitimate apps that offer the features listed above and require you to securely log into Facebook. In order to distinguish malicious apps from legitimate apps, there are a few important things to consider before logging into a mobile app with your Facebook account;

  • If social media credentials are requested to use the application, it is important for users to check whether the application can be used without providing their Facebook information. For example, a photo editing app that requires your Facebook login and password before allowing you to use it has the potential to be harmful.
  • App reputation, though imprecise, provides insight into whether the app is malicious before it is downloaded. Therefore, app reviews, downloads, and ratings, including negative ones, should be checked.
  • It should be checked whether the application provides the promised functionality before or after login.

Considering these issues, users who suspect they have been affected by a malicious mobile application with the above features should take the following steps immediately.

  • The app should uninstall from the device.
  • Login information of social media accounts used in the application should be changed by applying strong password policies.
  • Two-factor authentication mechanisms must be enabled.
  • Login alerts should be enabled to detect unauthorized access attempts by unknown parties.

Security News – Week 40

Published:

$566 Million worth of Binance Coins from Binance Bridge Seized

Binance Bridge has suffered a massive cyber-attack that resulted in the seizure by threat actors of 2 million Binance Coins (BNB) worth $566 Million.

The attack was launched at 14:30 on October 6, 2022, and the threat actors transferred the seized funds to their wallets through two transactions of 1,000,000 BNB each. Detecting the security breach at 18:19, Binance paused BNB Smartchain transactions.

In the statements made by Binance officials on social media, the attack was confirmed, and it was announced that the security weakness that caused the attack was under control. It was also stated that a large part of the seized funds remained and secured on BNB Smartchain.

As a result of the attack, it is predicted that $70 Million to $80 Million worth of crypto money was withdrawn from Binance BNB Smartchain by threat actors. Suspended BNC Smartchain transactions have been resumed as of October 7, 2022. Investigations are regarding the violation continue.

Critical XSS Alarm in Canon Medical Vitrea View Software

A critical XSS vulnerability has been identified in Canon Vitrea View medical image imaging software provided by Canon Medikal, which, if exploited, could allow unauthorized access to patient information.

The security vulnerability with code CVE-2022-37461 is caused by insufficient cleaning of the data provided by the user in the error message in the “/vitrea-view/error/” directory. As a result, a remote threat actor can exploit the vulnerability to access patient information or stored images and change the data depending on the privileges used during the session.

The vulnerability affects versions before Vitrea View 7.7.6 and has been fixed with Vitrea View 7.7.6. In this context, all Vitrea View users using 7. x versions are recommended to apply the published updates immediately to avoid being exposed to data breaches that can be carried out using the vulnerability.

Critical 0-Day Alarm in Microsoft Exchange Server

Two new 0-day vulnerabilities have been identified affecting Microsoft Exchange Server 2013, 2016, and 2019 products.

The details of the identified vulnerabilities are as follows;

  • The first critical security vulnerability (SSRF), tracked as CVE-2022-41040, is due to insufficient validation of user-supplied input in the Exchange OWA interface. A remote threat actor can direct the application to initiate requests to arbitrary systems via a specially crafted HTTP request.
  • Another security vulnerability, tracked as CVE-2022-41082, is due to incorrect login validation in Exchange Server. A remote user who has access to PowerShell Remoting on Exchange systems affected by security vulnerability can execute arbitrary code on the system.

It is observed that threat actors in targeted attacks exploit these vulnerabilities. The attacks detailed by Microsoft show that the two vulnerabilities are used together in an exploit chain, and the SSRF vulnerability allows an authenticated threat actor to execute arbitrary code. However, successfully exploiting the vulnerabilities requires authenticated access to vulnerable Exchange Servers.

Microsoft has announced that Exchange Online users are not affected by these vulnerabilities and has released a set of workarounds they should implement to mitigate potential threats to their affected customers. In order not to be the target of targeted attacks that can be carried out using vulnerabilities, it is recommended to immediately implement the following workaround suggestions published by Microsoft and to monitor the updates to be released regularly.

  • IIS Manager should open.
  • The Default Web Site bar should be expanded.
  • The Autodiscover tab should open.
  • The URL Rewrite feature within the IIS framework should be clicked.
  • In the Actions pane on the right, the Add Rule(s) option should open.
  • Select the Request Blocking option and click OK.
  • In the Add Request Rule window that opens, add the string “.*autodiscover\.json.*\@.*Powershell.*” to the URL Pattern section and click OK.
  • The added rule should be selected, and the Edit feature in the Conditions frame on the side tab should be opened.
  • Should change the condition entry from {URL} to {REQUEST_URI}.

Multiple Vulnerabilities Detected in Solarwinds Orion

In the Solarwinds Orion platform, which is an IT management and monitoring solution, two critical security vulnerabilities have been identified that may cause threat actors to access sensitive/critical data and execute code on the vulnerable system.

  • The SQL Injection vulnerability with code CVE-2022-36961 is caused by insufficient cleaning of user-supplied data. As a result, a remote user can run arbitrary SQL commands in the application database by sending a specially crafted request to the affected application. Successful exploitation of this vulnerability allows remote threat actors to read, delete, modify data in the database and gain full control over the affected application.
  • The security vulnerability code CVE-2022-36965 is also caused by insufficient cleaning of user-supplied data and allows a remote threat actor to perform cross-site scripting (XSS) attacks. A remote threat actor can exploit the vulnerability to inject arbitrary HTML and script code into the user’s browser in the context of the vulnerable website. Successful exploitation of the vulnerability allows remote threat actors to gain access to sensitive information, alter the appearance of the affected web page, and carry out phishing and malware attacks.

These vulnerabilities affect all versions of Solarwind Orion Platform 2022.2 and earlier and have been fixed with the latest SolarWinds Platform 2022.3 release. In this context, it is recommended to implement the security updates published immediately in order not to be the target of potential attacks that can be carried out using vulnerabilities.

Other periods: 2023 | 2022 Q4 | 2022 Q3 | 2022 Q2 | 2022 Q1 | Overview

Know What Is Exposed. Before Attackers Do.

Book a demo of the platform.

  • 4.7Gartner Peer Insights
  • 24hEarly warning time
  • 190+Countries covered

What you see in the demo

  1. Your exposureAssets and services seen from the outside, starting from your own domain.
  2. Threats aimed at youLeaked credentials, look-alike domains and brand abuse in one view.
  3. From alert to actionHow findings reach your team and what to do next.