CyberWire Daily: Episode Summary

Title: When Exploits Go Wild and Patches Race the Clock
Host: Dave Buettner, N2K Networks
Release Date: December 11, 2024

Introduction

In the December 11, 2024 episode of CyberWire Daily, host Dave Buettner delves deep into the latest cybersecurity threats, vulnerabilities, and responses shaping the industry. From critical zero-day exploits to significant law enforcement actions, the episode offers a comprehensive overview of the current cybersecurity landscape. A notable segment includes an enlightening interview with Malachi Walker, Security Strategist at Domain Tools, discussing the newly established Sentinel Horizon program under the Office of the Director of National Intelligence (ODNI).

Critical Vulnerabilities and Patch Updates

1. Microsoft Confirms Critical Windows Zero-Day Vulnerability

Microsoft has officially acknowledged a severe zero-day vulnerability affecting all Windows editions back to Server 2008. This flaw, a heap-based buffer overflow in the Windows Common Log File System (CLFS) driver, carries a CVSS score of 7.8, posing significant risks such as full system compromise. Notably, this vulnerability is actively exploited in the wild.

Expert Insight:

"This is a critical issue that demands immediate attention," emphasized CISA, urging all Windows users to patch their systems promptly.

Although Microsoft released a fix during December's Patch Tuesday, experts warn that the aging CLFS codebase necessitates a comprehensive overhaul to prevent similar vulnerabilities in the future. The broader Patch Tuesday update addressed 16 critical vulnerabilities, including nine in Windows Remote Desktop Services and three in Lightweight Directory Access Protocol (LDAP), one of which has a staggering CVSS score of 9.8.

2. Atlassian and Splunk Address Multiple Vulnerabilities

Atlassian has patched 10 high-severity flaws across products like Bamboo, BitBucket, and Confluence, addressing issues in third-party components such as Apache Commons and AWS SDK. Similarly, Splunk resolved 15 vulnerabilities, including a high-severity deserialization flaw in Secure Gateway that permits remote code execution. While no active exploitation has been reported, updating systems is strongly recommended to mitigate potential risks.

3. Google Chrome Releases Critical Updates

Google has rolled out a critical Chrome update targeting three high-severity vulnerabilities, including a type confusion flaw in the V8 JavaScript engine and a use-after-free bug in the Translate feature. These patches are essential to prevent exploitation during the rollout phase.

4. Industrial Control Systems (ICS) Patch Tuesday

The December 2024 ICS Patch Tuesday brought vital security updates from CISA and leading industrial automation companies:

• Schneider Electric: Fixed a critical flaw in Modicon controllers and a high-severity vulnerability in Harmony and Proface HMI products.
• Siemens: Released 10 advisories addressing high-severity issues in Rugged COM Rox 2 devices and Simatic S7 products.
• Rockwell Automation: Disclosed high-severity code execution flaws in its Arena software.
• Phoenix Contact: Warned of security issues in PLCnext firmware.

While some vulnerabilities lack immediate patches, mitigations have been provided to enhance security posture.

Law Enforcement Actions

Operation Power Off: Dismantling DDoS Platforms

Global law enforcement agencies successfully dismantled 27 Distributed Denial of Service (DDoS) platforms in a coordinated effort named Operation Power Off. This operation led to the arrests of three administrators in France and Germany and the identification of over 300 users. The crackdown targeted booter and stressor websites notorious for enabling cybercriminals and hacktivists to disrupt websites with illegal traffic.

Preventative Measures:
Europol and partner agencies employed analytical and forensic support, complemented by online ad campaigns on platforms like YouTube and Google Ads, issuing over 250 warning letters and 2,000 emails to deter future misuse.

Hardware Vulnerabilities

AMD 'Bad ram' Exploit Compromises Virtual Machines

Researchers uncovered a vulnerability named Bad ram impacting AMD's Secure Encrypted Virtualization (SEV) feature in EPYC processors. This flaw allows attackers to bypass memory protections by tampering with the SPD chip on DRAM modules, exposing sensitive data and compromising SEV-protected virtual machines. While primarily a threat to cloud environments, insider threats or unlocked BIOS settings could facilitate attacks without physical access.

Mitigation:
AMD has responded by releasing firmware updates to validate memory configurations at boot. Organizations are strongly advised to update their processors to safeguard against potential exploits.

Software Vulnerabilities

Ivanti's Critical Vulnerabilities

Ivanti has identified three critical vulnerabilities in its Cloud Services application:

• Authentication Bypass (CVSS 10.0): Allows unauthenticated attackers to gain administrative privileges via the admin web console.
• Command Injection (CVSS 9.1): Enables remote code execution.
• SQL Injection (CVSS 9.1): Permits arbitrary SQL commands.

Patches are available, and while no evidence of exploitation exists, Ivanti urges immediate updates to prevent potential breaches.

Sophisticated Phishing Campaign

Researchers have exposed a sophisticated phishing campaign targeting employees across 30 companies in 12 industries, including energy, finance, and government sectors. Utilizing trusted domains, dynamic company branding, and document platform impersonation, attackers successfully bypass email security measures to steal login credentials through over 200 malicious links. Stolen credentials are transmitted in real-time to attackers via C2 servers or Telegram Bots.

Mitigation Strategies:
IB researchers recommend implementing multifactor authentication, advanced email filters, and comprehensive employee training to mitigate these sophisticated phishing risks.

Active Exploitation of Zero-Day in Clio's Software

A zero-day vulnerability in Clio's managed file transfer software is under active exploitation, affecting products like Harmony, VlTrader, and Lexicom. This flaw permits unrestricted file uploads and remote code execution, effectively bypassing a previous patch from October. Attackers deploy PowerShell commands to steal data, deploy web shells, and compromise systems, with over 390 exposed servers globally, predominantly in the U.S.

Recommended Actions:
Huntress researchers advise immediate mitigations, including firewall restrictions, disabling autorun features, and scanning for malicious files. Clio has pledged to release a patch soon.

US Sanctions Chinese Firm for Firewall Exploit

The US government has sanctioned Sichuan Silence, a Chinese firm, and its employee Guan Taifeng for exploiting a firewall vulnerability in a 2020 attack. This breach affected 81,000 devices globally, including critical US infrastructure. The attackers utilized the Asnarok Trojan to steal credentials and attempted to deploy Ragnarok ransomware, posing risks of severe damage and potential loss of life, such as oil rig malfunctions.

Consequences:
Sanctions include freezing their US assets, and a $10 million reward has been offered for further information.

Legislative Developments: FCC Cybersecurity Regulation

Senator Ron Wyden has introduced legislation compelling the Federal Communications Commission (FCC) to regulate telecom cybersecurity under the 1994 Communications Assistance for Law Enforcement Act (CALEA). This initiative responds to the SALT Typhoon breach, where Chinese-linked hackers infiltrated US telecom networks, conducting long-term espionage campaigns.

Key Provisions of the Bill:

• Mandates FCC action within a year.
• Requires input from CISA and the Office of the Director of National Intelligence (ODNI).
• Includes annual testing of telecom systems for vulnerabilities.
• Requires independent audits to ensure compliance.

Support and Criticism:
Wyden criticized the FCC for previously allowing telecom companies to self-regulate cybersecurity, deeming it ineffective against foreign espionage. The legislation aims to enhance telecom security, building on FCC efforts and addressing national security concerns raised by incidents like SALT Typhoon.

Interview with Malachi Walker: Sentinel Horizon Program

Guest: Malachi Walker, Security Strategist at Domain Tools
Timestamp: [15:58] - [21:46]

Malachi Walker provides an in-depth look into Domain Tools' pivotal role in ODNI's newly established Sentinel Horizon program. This landmark initiative aims to merge intelligence from the private sector with public sector capabilities to bolster cybersecurity defenses across the nation.

Key Highlights:

1. Program Objectives:

   • Integration of Intelligence: Combining private sector insights with public sector reach to enhance visibility into cybersecurity incidents.
   • Policy and Protection: Informing policy decisions, tracking malicious actors, and safeguarding America from state-sponsored threats.

2. Domain Tools' Contribution:

   • Data Integration: Feeding data related to DNS and malicious domains as they are created, offering visibility into infrastructure development.
   • Enhanced Visibility: Providing insights into associated IP addresses and their connections to known malicious infrastructure.
   • Collaborative Efforts: Supporting the Intelligence Community (IC) with comprehensive data to protect against diverse threats.

3. Public-Private Partnerships:

   • Mutual Benefits: Emphasizing the necessity of collaboration between public and private sectors to eliminate blind spots and prioritize threats effectively.
   • Collective Security: Highlighting that cybersecurity is a shared responsibility, where each entity's strengths contribute to a unified defense mechanism.

Notable Quotes:

• On the Program's Impact:

  "[Sentinel Horizon] is going to be a great program to foster some more of those public-private partnerships to get more information on cybersecurity incidents and really collect information on every niche of cybersecurity to better inform policy decisions."
  — Malachi Walker [15:58]

• On Domain Tools' Role:

  "We have a view of infrastructure as that infrastructure is being developed. So before it even enters the network there's going to be some visibility there into different domains, their associated IP addresses and how they might relate to known malicious infrastructure."
  — Malachi Walker [16:46]

• On Public-Private Collaboration:

  "Public-private partnerships take that concept at the organizational level and expand it to a countrywide level where there's going to be more visibility into what threats should be prioritized."
  — Malachi Walker [20:01]

Persistence of Spartan Warriors in Phishing Operations

Despite a recent crackdown, the Spartan Warriors phishing scam group continues to operate with remarkable resilience. Known for distributing over 300 phishing kits targeting industries such as financial services, retail, delivery, and social media, the group swiftly adapted after their primary Telegram channel was shut down on November 21, which had amassed 5,300 subscribers. Within hours, they launched a new channel, re-engaging former subscribers and attracting new recruits.

Operational Tactics:

• Effective Phishing Kits: Offering tools that facilitate credential theft, captcha prompts, and redirects to legitimate-looking websites.
• Data Exfiltration: Utilizing Telegram's API to steal and transmit data, enhancing the sophistication of their attacks.
• Resource Provision: Providing access to compromised websites and email spamming tools, entrenching their presence in the phishing ecosystem.

Adaptability:
Although Telegram promised stricter crackdowns on criminal channels following the arrest of its CEO, Pavel Durov, in August, Spartan Warriors have demonstrated adaptability by modifying their operations to evade further disruptions. Their commitment to distributing free kits for popular brands underscores their determination and persistence in the cybercriminal arena.

Conclusion

The December 11th episode of CyberWire Daily underscores the relentless pace at which cyber threats evolve and the critical need for timely patches, robust law enforcement actions, and strategic public-private collaborations. The insights shared by Malachi Walker highlight the importance of integrated intelligence efforts to fortify national cybersecurity defenses. Meanwhile, the enduring activities of groups like Spartan Warriors serve as a stark reminder of the persistent challenges faced by cybersecurity professionals. Staying informed and proactive remains paramount in navigating the complex and dynamic cybersecurity landscape.

Stay Informed:
To keep abreast of the latest in cybersecurity, subscribe to CyberWire Daily and ensure you’re always a step ahead in safeguarding your digital assets.