Cybersecurity Today: Detailed Summary of November 18, 2024 Episode

Host: Jim Love
Release Date: November 18, 2024

1. Framing Attempt on Security Researcher via GitHub

The episode opens with Jim Love discussing a sophisticated attempt to tarnish the reputation of security researcher Mike Bell through malicious activities on GitHub.

Incident Overview:
Multiple GitHub projects were compromised through malicious code commits and pull requests aimed at injecting backdoors into open-source repositories. A notable case involved Exo Labs, an AI and machine learning startup, which identified a seemingly benign pull request that altered a Python file to include a sequence of Unicode numbers. When decoded, this sequence formed a script designed to download and execute a remote payload from evildojo.com, effectively creating a backdoor for remote code execution on user systems.

Impersonation Tactics:
The malicious pull request originated from a deleted GitHub account, EvilDojo666, which impersonated Texas-based security researcher Mike Bell. Bell vehemently denied any involvement, labeling the incident as a smear campaign. A similar account, darkimage666, was also linked to comparable malicious activities before being removed.

Insight from Jim Love:
“At [05:30], Jim Love remarked, ‘This evidence strongly suggests a coordinated effort to frame Bell, exploiting the ease with which impersonation can occur on platforms like GitHub.’”

Scope and Detection:
At least 18 similar pull requests were detected across various open-source projects, including the popular video downloader ytdip. Threat Intelligence reports traced many of these attacks to Indonesia-based actors. The swift detection was largely due to vigilant project maintainers and automated defense tools like Pre Submits AI Reviewer, which flagged the Exo Labs pull request with a critical security alert at [07:45].

Conclusion:
Jim Love emphasized the increasing risks associated with open-source supply chains, stating, “[10:15] While the attack was thwarted, it underscores the persistent vulnerabilities in our software supply chains and the critical need for robust code review processes.”

2. Microsoft’s November Patch Tuesday Reveals Four Zero Days

Jim Love delves into Microsoft's November Patch Tuesday, highlighting over 90 security issues, including four zero-day vulnerabilities, two of which are currently exploited in the wild.

Key Vulnerabilities Discussed:

• CVE-2024-43451: An NTLM hash disclosure spoofing attack that exposes NTLM manager authentication hashes, allowing attackers to authenticate as users. Exploitation requires user interaction, such as opening a malicious file delivered via phishing ([15:20]).

• CVE-2024-49039: A Windows Task Scheduler elevation of privilege vulnerability. Attackers can gain elevated privileges on a compromised system using Remote Procedure Call (RPC) functions. This requires access to the target system and the ability to run a malicious application ([18:05]).

• CVE-2024-43498: A .NET vulnerability permitting unauthenticated remote attacks on .NET Web Apps, scoring 9.8 out of 10 on the CVSS ([19:45]).

• CVE-2024-43639: A Windows Kerberos vulnerability enabling unauthenticated attackers to execute code, also scoring 9.8 CVSS ([20:30]).

Expert Opinion:
Tyler Reguli, a security expert at Fortra, was quoted by Jim Love: “[22:10] Exploitation could lead to significant systems compromise, making prompt updates essential.”

Recommendations:
Jim Love advises listeners to update Windows systems and Microsoft software immediately to mitigate these vulnerabilities. He stresses the importance of timely patching as the primary defense against these high-severity threats.

3. Veeam Backup Software Targeted by New Ransomware Variant FRAG

The podcast shifts focus to the alarming rise in ransomware attacks targeting Veeam backup and replication software.

Attack Details:
A new ransomware variant named FRAG is actively exploiting a critical vulnerability in Veeam software, scoring 9.8 on the Common Vulnerability Scoring System (CVSS). This marks a continuation of attacks following similar campaigns by threat groups Akira and FOG.

Attack Mechanism:
Attackers initially gain access through compromised VPN appliances before exploiting the Veeam vulnerability to infiltrate systems. They establish persistence by creating new administrator accounts, often named Point and Point2, to maintain control over the affected networks.

Industry Impact:
Jim Love highlights that FRAG utilizes tactics consistent with Akira and FOG ransomware groups, indicating a possible overlap or shared methodologies among these attackers ([30:55]). This similarity suggests that organizations must brace for ongoing and potentially more sophisticated assaults.

Preventative Measures:
Listeners are urged to:

• Patch Immediately: Ensure Veeam backup and replication software is updated with the latest security patches.
• Audit Access: Review VPN and remote access configurations to detect unauthorized accounts like Point or Point2.
• Monitor for Compromise: Look for signs such as suspicious admin account activity or unusual file access ([33:20]).

Conclusion:
Jim Love warns that the persistent exploitation of the Veeam vulnerability underscores the critical need for organizations to maintain up-to-date security measures, especially for backup systems that are prime targets for ransomware deployment.

4. Microsoft Exchange Update Causes Disruption to Mail Transport Rules

The episode concludes with a discussion on Microsoft's problematic Exchange Server update released in November 2024.

Issue Summary:
Microsoft temporarily halted the deployment of its November Exchange Server security update on November 14th after it was discovered that the update disrupts transport rules—a vital feature for email compliance and flow.

Impact on Organizations:
The flawed update affected hybrid and on-premises setups, leading to interrupted email delivery. Organizations relying on transport rules for inspecting emails, enforcing compliance, and managing exceptions experienced periodic failures and, in some cases, complete stoppage of email flow ([40:10]).

Microsoft’s Response:
Following customer complaints on social media and forums, Microsoft recommended that affected users uninstall the patch and await a revised version. Jim Love commented, “[42:35] It’s a challenging situation where the necessity of early patching is pitted against the operational risks of disrupted core functionalities.”

Broader Implications:
This incident raises critical questions about Microsoft’s testing procedures for updates. Jim Love emphasizes the importance of maintaining security through updates while ensuring that essential business operations remain unaffected. He notes, “[45:00] It’s difficult to fault organizations for delayed patching when updates can jeopardize key systems and processes.”

Final Thoughts

Jim Love wraps up the episode by reiterating the importance of vigilance and proactive security measures in the face of evolving cyber threats. He encourages listeners to stay informed and prioritize both security and operational stability within their organizations.

Notable Quotes:

• “[05:30] This evidence strongly suggests a coordinated effort to frame Bell, exploiting the ease with which impersonation can occur on platforms like GitHub.”
• “[10:15] While the attack was thwarted, it underscores the persistent vulnerabilities in our software supply chains and the critical need for robust code review processes.”
• “[22:10] Exploitation could lead to significant systems compromise, making prompt updates essential.”
• “[30:55] FRAG utilizes tactics consistent with Akira and FOG ransomware groups, indicating a possible overlap or shared methodologies among these attackers.”
• “[42:35] It’s a challenging situation where the necessity of early patching is pitted against the operational risks of disrupted core functionalities.”
• “[45:00] It’s difficult to fault organizations for delayed patching when updates can jeopardize key systems and processes.”

This comprehensive summary encapsulates the key discussions, insights, and conclusions from the November 18, 2024 episode of Cybersecurity Today, providing listeners and non-listeners alike with a thorough understanding of the latest cybersecurity threats and responses.