TP-Link home routers are being targeted in attacks, stealing master passwords from KeePass,
and these end of life smart plugs can get hacked!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for May 23, 2023 - this is your summary of
the threats to our security, privacy and Internet freedom!
Let’s jump right into the news this week.
A Chinese state-sponsored hacking group called "Camaro Dragon" has been infecting residential
TP-Link routers with a custom malware called "Horse Shell."
The malware is designed to target European foreign affairs organizations by launching
attacks that appear to originate from residential networks.
The attackers gain full access to the compromised routers, allowing them to run commands, transfer
files, and use the routers as a proxy for communication between devices.
The attackers are able to gain persistent access and they can move laterally around
a compromised network.
According to researchers, this malware is firmware agnostic, which means it could be
used to attack other vendors.
The research firm Check Point discovered the Horse Shell TP-Link firmware implant and attributes
it to the "Camaro Dragon" group, which shows similarities and overlap with the previously
reported "Mustang Panda" group.
Mustang Panda has been detailed in reports by both Avast and ESET and while there is
plenty of overlap in the attacks, that does not necessarily mean that they are one in
the same.
The attackers may exploit vulnerabilities or brute-force the administrator's credentials
to install the malicious firmware.
The actual method for deployment is currently unknown but these are the suspected ways.
The malware modifies the router's firmware and web panel, preventing owners from updating
and ensuring the persistence of the infection.
The Horse Shell backdoor connects to a command and control server, allowing the threat actors
to control the compromised devices remotely.
If you own an affected device, you can remediate the issue by applying firmware updates, changing
default passwords, and disabling remote access to the router's admin panel to strengthen
security.
Also, install security patches on edge devices and avoid exposing management consoles publicly
if you’re a network admin.
A major flaw in the popular password manager KeePass was recently discovered by a security
researcher known as vdohney.
This flaw, now tracked as CVE-2023-32784 could allow an attacker to recover a user’s master
password for their KeePass vault in cleartext, minus the first character, from memory.
This works even when the user’s database is locked, and potentially even if the program
is closed.
How does this work?
When a user types their master password, a custom text box field is used, and this entry
field leaves traces of each of the password characters stored in the programs memory.
In order for an attacker to take advantage of this flaw, they would already need to have
compromised the device in some way, such as through physical access or malware, and the
password would need to be typed into the program via keyboard, not copied from a clipboard.
This text box is used in other places within the program, such as when you edit a password,
so those contents could be stolen as well.
Vdohney released a proof of concept of the flaw exploit dubbing it the KeePass Master
Password Dumper, and noted that this affects versions 2.53.1 of KeePass for Windows, MacOS,
and Linux and potentially forks as well.
It is not patched yet, but a new version of KeePass, version 2.54 is expected to drop
in June and users are advised to update to that patch when it is available, as this will
include mitigation techniques such as avoiding the creation of managed strings in [[possibly
jump cut here to cover up my stutter?]]
memory and obfuscating the real key.
In the meantime, you should proceed with caution if using KeePass and be cautious of phishing
attacks or program downloads.
Biggest of shoutouts to my Patreon supporters, especially my Golden Smores and their fur
babies, for making this show possible since we don’t have ads on this show at all!
THANK YOU to Steven for being a part of the Smores at Patreon.com/shannonmorse.
That’s my new Patreon page for the show, where I’ll be posting all the perks for
patrons, including early access to this video.
If you’re currently a patron on the ThreatWire page, switch over to the new page so you don’t
lose access to your perks.
Let’s finish out today’s episode with my last top story, about Wemos!
That Smart Plug you use to turn on a lamp has a pretty serious vulnerability, and the
brand who made the smart plug has no intentions of fixing it.
A severe vulnerability, tracked as CVE-2023-27217, was discovered in January by the Israeli IoT
security firm Sternum and disclosed to Belkin, the manufacturer of popular WeMo smart plugs
that enable convenient remote control of electronic devices via voice, smartphones and tablets
or hubs.
The vulnerable device is the Wemo Mini Smart Plug V2 which is, unfortunately, end of life.
The flaw is a buffer overflow issue which could allow a threat actor to inject arbitrary
code remotely.
They could crash the device, run malicious commands, or take control of the device once
attacked.
Sternum was able to reverse engineer the device and gain firmware access.
They discovered that the issue stems from a feature that allows users to rename the
smart plug, where the character limit is not enforced by the firmware code.
The flaw can be triggered by exceeding the 30-character limit for device names using
third-party tools.
Default names usually show up as something like “Wemo Mini 6F8” but can be changed
by the user to something like “Bedroom Plug 1” to make it easier to identify each plug.
By using a Python module, an attacker can trigger a buffer overflow and crash the device
or execute malicious commands.
Unfortunately, Belkin hasn’t embraced the new protocol for IoT called Matter yet, which
could allow for local-only support instead of relying on a cloud connection.
Belkin also does not plan to address the issue as the device is reaching end-of-life and
has been replaced by newer models.
Users are advised to avoid exposing the vulnerable smart plugs directly to the internet and implement
proper network segmentation in sensitive environments.
I'm Shannon Morse, I'll see you on the Internet!