Security Boulevard

Authors/Presenters:Kevin Morio, Ilkan Esiyok, Dennis Jackson, Mozilla; Robert Künnemann

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – Automated Security Analysis of Exposure Notification Systems appeared first on Security Boulevard.

The DOJ shut down another "laptop farm" link to a North Korean fake IT worker scam that the country uses to illegally bring in money for its nuclear and ballistic weapons program and to steal information from unsuspecting companies in the United States and elsewhere.

The post DOJ Shuts Down Another North Korean ‘Laptop Farm’ appeared first on Security Boulevard.

IntroductionOn August 5, 2024, researchers at SonicWall discovered a zero-day security flaw in Apache OFBiz tracked as CVE-2024-38856. The vulnerability, which has been assigned a CVSS score of 9.8, allows threat actors to perform pre-authentication remote code execution (RCE). While testing a patch for CVE-2024-36104, SonicWall researchers discovered that unauthenticated access was permitted to the ProgramExport endpoint, potentially enabling the execution of arbitrary code. These vulnerabilities arise from a flaw in the override view functionality, which can be exploited by unauthorized threat actors through maliciously crafted requests, leading to the remote code execution.

RecommendationsZscaler ThreatLabz strongly advises users of the Apache OFBiz application to promptly upgrade to version 18.12.15, as this version contains fixes to mitigate the security vulnerabilities identified in CVE-2024-38856 and CVE-2024-36104.

Affected VersionsThe following versions of Apache OFBiz are affected by the disclosed vulnerabilities and should be updated immediately:

All versions 18.12.13 and below are impacted by CVE-2024-36104
All versions 18.12.14 and below are impacted by CVE-2024-38856

BackgroundApache OFBiz is an open-source Enterprise Resource Planning (ERP) system that provides business solutions for various industries. This includes tools to manage operations like customer relationships, order processing, human resource functions, warehouse management, and more.

During the analysis of CVE-2024-36104, a vulnerability disclosed on June 3, 2024, SonicWall researchers discovered the ControlServlet and RequestHandler functions received different endpoints when handling the same request. Ideally, both functions should process the same endpoint. CVE-2024-38856 allows unauthenticated access to the ProgramExport endpoint, which should have been restricted.

How It WorksIn the previous vulnerability, CVE-2024-36104, Apache OFBiz was found to have a flaw that enabled remote attackers to access system directories due to inadequate validation of user requests. Exploiting this flaw involved sending a malformed URL containing '..' sequences, which could result in the execution of arbitrary code on the system.

An example of a malformed POST request and request-body is shown below.

POST /webtools/control/forgotPassword/;%2e%2e/ProgramExport

POST-Body: groovyProgram=throw new Exception('whoami'.execute().text);

In the figure below, the example malformed request is shown. This request includes a command 'whoami' that is being executed, and the resulting output of the command is displayed in the error message. The output of the command is highlighted in the green box.

Figure 1: An example of a POST request related to CVE-2024-36104. The request includes an encoded request body, along with its corresponding output.

The most recent vulnerability, CVE-2024-38856, permits unauthorized access to the ProgramExport endpoint without the need for a path traversal vector. This means that access is granted even when it should have been restricted.

The figure below shows an attack chain exploiting CVE-2024-38856.

Figure 2: The attack chain depicting an attacker exploiting CVE-2024-38856.

The figure below shows the malformed request, without a path traversal vector, being executed, and the resulting output of the command is displayed in the error message.

Figure 3: An example of a POST request related to CVE-2024-38856. The request includes an encoded request body, and the output associated with it.

Further investigation revealed that unauthenticated access to the ProgramExport endpoint was possible by combining it with any other endpoint that does not require authentication. Examples of such endpoints include:

forgotPassword
showDateTime
TestService
view
main

URLs that could be used to exploit this vulnerability are:

POST /webtools/control/forgotPassword/ProgramExport
POST /webtools/control/showDateTime/ProgramExport
POST /webtools/control/TestService/ProgramExport
POST /webtools/control/view/ProgramExport
POST /webtools/control/main/ProgramExport

ConclusionTo protect against CVE-2024-38856, it is important to update Apache OFBiz systems to version 18.12.15 as soon as possible. Neglecting to upgrade promptly exposes systems to significant security risks, which could enable threat actors to manipulate login parameters and execute arbitrary code on the target server.

Zscaler CoverageThe Zscaler ThreatLabz team has deployed the following.

Zscaler Advanced Threat Protection

App.Exploit.CVE-2024-38856
App.Exploit.CVE-2024-36104

Zscaler Private Access AppProtection

HTML.Exploit.CommandInjection:6000004

For more details, visit the Zscaler Threat Library.

The post CVE-2024-38856: Pre-Auth RCE Vulnerability in Apache OFBiz appeared first on Security Boulevard.

via the comic & dry wit of Randall Munroe, creator of XKCD

Permalink

The post Randall Munroe’s XKCD ‘Vice President First Names’ appeared first on Security Boulevard.

Torrance, Calif., Aug. 12, 2024, CyberNewsWire — Criminal IP, an expanding Cyber Threat Intelligence (CTI) search engine from AI SPERA, has recently completed its technology integration with Maltego, a global all-in-one investigation platform that specializes in visualized analysis … (more…)

The post News alert: Criminal IP and Maltego team up to broaden threat intelligence data search first appeared on The Last Watchdog.

The post News alert: Criminal IP and Maltego team up to broaden threat intelligence data search appeared first on Security Boulevard.

In today’s rapidly evolving digital landscape, ensuring the security of web applications is essential to ensure revenue growth and a positive business reputation. One critical aspect of this security is the management of SSL/TLS certificates. The AppViewX AVX ONE platform is a comprehensive solution designed to automate and streamline the end-to-end lifecycle of digital certificates […]

The post AppViewX Automated Certificate Management for PingAccess appeared first on Security Boulevard.

Authors/Presenters:Feng Dong, Liu Wang Xu Nie, Fei Shao, Haoyu Wang, Ding Li, Xiapu Luo, Xusheng Xiao

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – DISTDET: A Cost-Effective Distributed Cyber Threat Detection System appeared first on Security Boulevard.

Threat Intelligence Report

Date: August 12, 2024

Prepared by: David Brunsdon, Threat Intelligence - Security Engineer, HYAS

Threat Actors Exploiting Legitimate Services to Disguise Traffic

Recently, the HYAS Threat Intelligence team has noticed an increase in malware communicating with subdomains under the ply.gg domain. The domain is a part of Playit.gg’s infrastructure, which is a service for computer gamers used to facilitate online play. Although intended for games like Minecraft, it provides a free domain name and a reverse proxy, which is a tool a threat actor can use to hide their malicious infrastructure.

This article demonstrates how threat actors will use legitimate services to disguise their traffic and hide their true location from investigators. It also draws attention to the ply.gg domain as a potential threat vector for malware-based attacks on organizations and individuals.

About Reverse Proxies

A reverse proxy is a server that sits between client devices and a server, intercepting requests from clients and forwarding them to the intended server. It functions as an intermediary that enhances the performance, security, and reliability of services.

Typical Uses of Reverse Proxies

1. Load Balancing:

Reverse proxies distribute incoming traffic across multiple servers to ensure no single server becomes overwhelmed. This improves the availability and reliability of applications, particularly those experiencing high traffic volumes.

2. Enhanced Security:

By hiding the backend servers' IP addresses, reverse proxies add an additional layer of security. They can also block malicious requests, protect against Distributed Denial-of-Service (DDoS) attacks, and serve as a first line of defense in a network security strategy.

3. SSL Termination:

Reverse proxies can manage SSL/TLS encryption and decryption, relieving backend servers from the computational load of handling these tasks. This is particularly useful for improving the performance of HTTPS websites.

4. Web Acceleration:

By caching content, reverse proxies can reduce the load on backend servers and speed up response times for users. This is beneficial for delivering static content such as images, stylesheets, and scripts more efficiently.

5. Content Filtering:

Reverse proxies can inspect and filter incoming requests to ensure they meet predefined criteria. This is useful for content filtering, enforcing security policies, and preventing access to restricted areas.

6. Compression:

They can compress outbound data to reduce the amount of bandwidth used, which can be particularly beneficial for users with slow internet connections.

Reverse Proxies in Malicious Activities

While reverse proxies serve many legitimate purposes, they can also be exploited by threat actors to conceal malicious activities. Cybercriminals use reverse proxies to:

• Hide Malicious Infrastructure: By routing traffic through a reverse proxy, attackers can mask the true location of their command-and-control (C2) servers, making it difficult for investigators to trace and shut them down.
• Bypass Security Measures: Reverse proxies can help bypass IP-based security controls, allowing attackers to evade detection and maintain persistent access to compromised systems.
• Proxy for Anonymity: Using reverse proxies helps cybercriminals maintain anonymity by preventing the exposure of their actual IP addresses during malicious campaigns.

By leveraging services like Playit.gg, threat actors can blend their traffic with legitimate gaming traffic, complicating efforts to detect and block malicious communications. Recognizing and understanding the use of reverse proxies is crucial for enhancing cybersecurity measures and thwarting such threats.

How Threat Actors Could Utilize Playit.gg

Threat actors could exploit the Playit.gg service to hide their malicious infrastructure and facilitate Command and Control (C2) operations. Here's a step-by-step breakdown of how this can be achieved:

1. Account Creation and Verification:

• The threat actor creates an account on Playit.gg by providing an email address.
• The email address is verified through a confirmation process, granting access to the service.

2. Download and Setup:

• An application is downloaded from Playit.gg and installed on a server controlled by the threat actor.
• The application is linked to the Playit.gg account, often requiring verification through the website.

3. Establishing and Hardening the C2 Server:

• The C2 server is configured to ensure it can only be accessed by the operators and through the Playit.gg proxy network.
• Security measures, such as IP allowlisting and authentication, are implemented to harden the C2 server against unauthorized access.

4. Configuring the Malware:

• The port number and the assigned domain name (provided by Playit.gg) are entered into the malware's configuration. These details are embedded in the malware, which is then deployed to victim devices.

5. Routing Malware Communications:

• Once the malware is active on victim devices, it initiates communication with the C2 server.
• All communications between the malware and the C2 server are routed through the Playit.gg proxy network.
• This setup masks the true location of the threat actor's server, making it challenging for defenders to trace and block the malicious infrastructure.

By leveraging Playit.gg, threat actors can seamlessly integrate their C2 infrastructure within legitimate gaming traffic. This not only obfuscates their activities but also complicates detection efforts by cybersecurity professionals, as the traffic appears to come from a well-known and trusted service.

(Image: Warning during configuration of playit.gg service)

Playit.gg clearly recognizes the potential for misuse on the platform and expressly forbids it from being used in such a way.

Recommendations

1. Restrict Access to the ply.gg Domain:
Organizations should consider blocking access to the ply.gg domain at the network level. This can be achieved through protective DNS solutions, or firewall rules to prevent potential malware communications from reaching their command-and-control (C2) servers.

2. Monitor Network Traffic for Anomalies:
Regularly monitor network traffic for any unusual or unauthorized connections to the ply.gg domain. Implementing advanced threat detection systems can help identify and alert on suspicious traffic patterns associated with C2 communication.

3. Implement Threat Intelligence Feeds:
Incorporate threat intelligence feeds that include indicators of compromise (IoCs) related to ply.gg and other similar domains. This can help in detecting and blocking known malicious activities associated with these services.

4. Educate Employees on Potential Threats:
Raise awareness among employees about the risks of accessing unauthorized or suspicious domains, including those related to gaming services like Playit.gg. Training should focus on recognizing phishing attempts and avoiding the installation of unauthorized software.

5. Enhance Endpoint Security:
Ensure that endpoint protection solutions are up-to-date and capable of detecting and blocking malware that may attempt to use ply.gg for C2 communication. Advanced endpoint detection and response (EDR) solutions can provide additional layers of protection.

6. Engage in Regular Security Audits:
Conduct regular security audits and vulnerability assessments to identify any weaknesses in your network that could be exploited by threat actors using reverse proxies like those provided by Playit.gg.

7. Collaborate with Threat Intelligence Providers:
Work closely with threat intelligence providers like HYAS, to stay informed about emerging threats and to receive timely updates on domains and services being exploited by cybercriminals.

By implementing these measures, organizations can significantly reduce the risk of malware using the ply.gg domain as a vector for attacks, thereby enhancing their overall cybersecurity posture.

Recent Example IOCs

Domain: ads-jeremy.gl.at.ply[.]gg
MD5: 36a75d896d48d43a54a8792fd92f3912
Family: asyncrat

Domain: paris-itself.gl.at.ply[.]gg
MD5: 9b2b8770c462d91bcf4d915cbea54202
Family: asyncrat

Domain: tax-sri.gl.at.ply[.]gg
MD5: b0198f2d25536cb8efb928857f696c1b
Family: nanocore

Domain: dead-he.gl.at.ply[.]gg
MD5:ad0314c9588f196a9a752b6732cf9612
Family: xworm

Domain: western-requires.gl.at.ply[.]gg
MD5:553326c1417f4220586311bae847d37b
Family: xworm

Domain: to-reconstruction.gl.at.ply[.]gg
MD5: ca312e982c9e4e5664ef45e8cb2be9cf
Family: xworm

Disclaimer: This Threat Intelligence Report is provided “as is” and for informational purposes only. HYAS disclaims all warranties, express or implied, regarding the report’s completeness, accuracy, or reliability. You are solely responsible for exercising your own due diligence when accessing and using this Report's information. The analyses expressed in this Report reflect our current understanding of available information based on our independent research using the HYAS Insight platform. The Report’s inclusion of any companies, organizations, or ASNs does not imply any wrongdoing on their part; it is simply an indication of where digital threat activities have been observed. HYAS reserves the right to update the Report as additional information is made known to us.

Learn More About HYAS Insight

An efficient and expedient investigation is the best way to protect your enterprise. HYAS Insight provides threat and fraud response teams with unparalleled visibility into everything you need to know about the attack.This includes the origin, current infrastructure being used and any infrastructure.

Read how the HYAS Threat Intelligence team uncovered and mitigated a Russian-based cyber attack targeting financial organizations worldwide.

Want more threat intel on a weekly basis?
Follow HYAS on LinkedIn
Follow HYAS on X

Sign up for the (free!) HYAS Insight Intel Feed

Read Recent HYAS Threat Reports:

The Prevalence of DarkComet In Dynamic DNS
Caught in the Act: StealC, the Cyber Thief in C
HYAS Protects Against Polyfill.io Supply Chain Attack with DNS Safeguards
StealC & Vidar Malware Campaign Identified

More from HYAS Labs

Polymorphic Malware Is No Longer Theoretical: BlackMamba PoC.
Polymporphic, Intelligent and Fully Autonomous Malware: EyeSpy PoC.

The post HYAS Investigates Threat Actors Hidden In Gaming Services appeared first on Security Boulevard.

Get the essential checklist for POPIA compliance. Learn key requirements and steps to meet South Africa's data protection law.

The post How to Achieve POPIA Compliance: Complete Checklist appeared first on Scytale.

The post How to Achieve POPIA Compliance: Complete Checklist appeared first on Security Boulevard.

The Trump campaign is claiming a hack is the work of Iranian operatives, adding to expanding election-interference campaigns that also include China and Russia, which the federal government calls the "predominant threat to U.S. elections."

The post Trump Campaign Hack Points to Growing U.S. Election Threats appeared first on Security Boulevard.

Identifying and addressing underlying issues and their root causes can lead to risk reduction, cost savings and better overall performance of a vulnerability management program.

The post The Value in Root Cause Analysis for Vulnerability Management appeared first on Security Boulevard.

Torrance, United States / California, 12th August 2024, CyberNewsWire

The post Criminal IP and Maltego Collaborate to Broaden Threat Intelligence Data Search appeared first on Security Boulevard.

A global survey of 300 IT and security professionals suggests that while security budgets are increasing the way funding is being allocated is shifting as organizations look to automate workflows.

The post Survey: Cybersecurity Teams Investing in Automation to Reduce Noise Levels appeared first on Security Boulevard.

Chief information security officers (CISOs) are struggling to manage cybersecurity effectively due to a lack of strategic support from other C-suite executives, according to a LevelBlue survey of 1,050 C-suite and senior executives.

The post AI Integration, Budget Pressures Challenge CISOs appeared first on Security Boulevard.

In today’s digital world, data exfiltration is a stealthy threat that often flies under the radar.

The post How Outdated Security Measures Can Devastate Your Organization appeared first on Seceon.

The post How Outdated Security Measures Can Devastate Your Organization appeared first on Security Boulevard.

Apache Tomcat is a widely used open-source web server and servlet container, but like any software, it is not immune to vulnerabilities. Canonical has released security updates to address multiple Tomcat vulnerabilities across different releases, including Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 ESM, and Ubuntu 16.04 ESM. These vulnerabilities, if exploited could lead […]

The post Addressing Tomcat Vulnerabilities in End-of-Life Ubuntu Systems appeared first on TuxCare.

The post Addressing Tomcat Vulnerabilities in End-of-Life Ubuntu Systems appeared first on Security Boulevard.

I recently wrote about reliable software. I also usually write about cybersecurity and major incidents. Today’s story intertwines both, in a situation so far reaching that, if you tried to write it as the script of the next Bond movie with a villain scheming to cause worldwide chaos, it would fit perfectly. Let’s look at […]

The post Crowdstrike, or “How to Own the Planet” appeared first on TuxCare.

The post Crowdstrike, or “How to Own the Planet” appeared first on Security Boulevard.

LAS VEGAS – Here’s what I discovered last week here at Black Hat USA 2024: GenAI is  very much in the mix as a potent X-factor in cybersecurity.

Related: Prioritizing digital resiliency

I spoke with over three dozen cybersecurity … (more…)

The post MY TAKE: Black Hat USA 2024’s big takeaway – GenAI factors into the quest for digital resiliency first appeared on The Last Watchdog.

The post MY TAKE: Black Hat USA 2024’s big takeaway – GenAI factors into the quest for digital resiliency appeared first on Security Boulevard.

Authors/Presenters:Yisroel Mirsky, George Macon, Michael Brown, Carter Yagemann, Matthew Pruett, Evan Downing, Sukarno Mertoguno, Wenke Lee

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – VulChecker: Graph-based Vulnerability Localization in Source Code appeared first on Security Boulevard.

Carter Schoenberg is a trusted security expert who has vast experience in the public and private sectors. Here’s his guidance on what works and what doesn’t with the cybersecurity industry.

The post Book Review: ‘Why Cybersecurity Fails in America’ appeared first on Security Boulevard.