A new Linux kernel bug was discovered, DDoS just got huge, and Russia gets hit with cyberattacks
and bans!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for March 15 2022 - this is your summary of
the threats to our security, privacy and Internet freedom.
We’ve got some new attacks to cover this week, so, onto the first story.
A new security vulnerability is affecting Linux distribution kernels, called Dirty Pipe.
It’s CVE is CVE 2022-0847 and it’s pretty severe, with a CVSS score of 7.8.
Dirty Pipe could allow an attacker to overwrite arbitrary data into read only files and could
also allow them to take over an exploited system in a privilege escalation.
This was discovered by Max Kellerman, software developer at IONOS.
Although just discovered, it appears this flaw has been around since version 5.8 released
in August 2020.
It has been fixed in Linux kernel versions 5.16.11, 5.15.25 and 5.10.102.
This happens because an unprivileged process could inject code into root processes.
According to Red Hat, “stale values” could be contained in the kernel due to a couple
of pipe or pipeline functions lacking proper initialization.
An attacker would need to create a pipe, fill it with a bunch of arbitrary data, drain the
pipe, use a read only file to splice this data, then write arbitrary data to the pipe.
A proof of concept has been shared by Kellermann.
Pipelines let processes in Linux send data back and forth between each other as standard
input and standard output.
If that sounds unfamiliar, I did a HakTip video about pipes years ago on this channel.
The problem was patched three days after being reported.
Google merged a fix into the Android kernel back in February as well, though this affects
Android devices running on the affected Linux kernels.
Linux distro users should update and apply these patches ASAP especially given a Proof
of Concept working exploit has been shared.
Let’s talk about DDoS attacks because this is really interesting.
DDoS or Distributed Denial of Service attacks are pretty commonplace now, and are used to
target a website or a network or server with a ton of ping requests and data in order to
slow them down to a crawl to the point where it causes an outage.
During these attacks, there’s an amplification ratio, and the higher that number can get,
the more a target can get overwhelmed.
Insecure devices can be used as reflectors or amplifiers in a DDoS attack and that’s
exactly what is happening here.
Several backbone internet companies including Akamai, Cloudflare, Mitel, and more disclosed
a new vulnerability that causes a packet amplification ratio of 4 billion to 1, from a single packet.
To put this into perspective, previous amplifications have increased a DDoS’s attack volume by
556x, 50x, or 51,000x, so uhhh… this one’s pretty big at 4 billion times.
In this case, a little packet gets reflected over and over again in a closed network until
it reaches its maximum size, then the packet is redirected towards the target.
The CVE for this flaw is CVE-2022-26143 and it exists within the Mitel MiCollab and Mitel
MiVoice Business Express PBX to internet gateway systems.
These systems have test modes that shouldn’t be connected and exposed to the internet,
but very much are via a daemon listening for commands via UDP 10074.
The test mode can be used to send a DDoS attack that lasts for 14 hours via that one single
spoofed packet.
The DDoS attack could be sustained at about 393 Megabits per second.
And this affects around 2600 exposed devices, according to Akamai.
Couldn’t it be flagged as suspicious?
According to researchers at The Shadowserver Foundation, “this single-packet attack initiation
capability has the effect of precluding network operator traceback of the spoofed attack initiator
traffic.
This helps mask the attack traffic generation infrastructure, making it less likely that
the attack origin can be traced compared with other UDP reflection/amplification DDoS attack
vectors."
Mitel systems only send one command at a time, though, so a user could notice that the system
is unavailable for several hours.
Otherwise, the best course of action is to update the Mitel systems and detect and block
strange traffic on UDP port 10074, and disable the test command.
Ports 80 and 443 were affected as well and attacks have been seen in the wild targeting
financial institutions, governments, and logistics companies.
Big shoutout to my Hush Puppy perk level patrons for sharing their fur baby photos and for
the support.
THANK YOU to Kyle C and Kasira for joining on Patreon.com/threatwire and shoutout to
everyone who supports the show.
Let’s finish out today’s episode with my last top story, about Russia getting blocked
and banned.
To follow up to my last few videos regarding the Russian Ukrainian conflict, which actually
affects all of us, y’all have likely heard about the sanctions, right?
The US along with allies and partners have imposed sanctions on Russia and Belarus, making
it much harder for these two countries to conduct business internationally.
In an alert shared by the Treasury Department's Financial Crimes Enforcement Network, or FinCEN,
financial firms should keep an eye out for any attempts made to thwart those sanctions.
FinCEN has specifically warned that sanctions could be bypassed via money laundering techniques
tied to payments from ransomware attacks.
This also means we might see more attacks targeting US companies or its partners used
to lower some of that economic impact that Russia may see.
FinCEN notes that some red flags that could indicate sanction evasion include using cryptocurrency
payments.
If a customer conducts multiple quick trades then an off platform transaction, that could
be a sign of someone trying to obfuscate a transaction.
Cryptocurrency mixing or transactions that have been related to ransomware could also
be signs.
As such, FinCEN is planning to create compliance guidelines for cryptocurrency orgs and President
Biden signed an executive order last week about evading sanctions with digital assets.
Civilians in Russia are experiencing downed sites due to those sanctions, because websites
can’t renew their TLS certificates and browsers could block expired ones, so Russia created
its own trusted TLS Certificate Authority to get around this problem.
The Russian Ministry of Digital Development provides this service when a cert is revoked
or expires, but since it takes a while for these to be approved by international browsers
like Chrome, Firefox, etc, users are told to use the Yandex or Atrom products instead
since these are Russian based.
The concern is that these certificates could be used by the Russian government to perform
man in the middle attacks against those using them, which would render them invalid in most
browsers, leading to them being blocked or included in the CRL (certificate revocation
list).
Meanwhile, the cyber battle rages on.
Several Russian sites belonging to federal agencies have experienced supply chain attacks
which were used to compromise said sites and replace their content with Pro-Ukraine imagery.
A state owned Russian aerospace and defense site called Rostec was taken down in a DDoS
attack - this one was attributed to the Ukrainian IT Army.
Lumen Technologies, a company based here in the US who is in charge of routing lots of
internet traffic, announced they won’t be routing internet traffic for any orgs based
in Russia anymore.
The company mentioned that they haven’t seen any direct disruptions but there is a
security risk to doing business with Russian based organizations and as such, they’ve
ceased these operations.
Two other big internet backbones are Cloudflade and Akamai, who’ve both stated that they’ll
continue operating in Russia.
Both companies argue that pulling the plug on the internet access for Russian citizens
would do more harm than good, stating people need access to worldwide media and world news,
not just whatever media Russia provides.
Both companies also condemn the Russian invasion of Ukraine and are taking steps to help, such
as ramping up defenses and joining partner orgs like Crowdstrike to provide free resources
for cybersecurity.
Akamai is ceasing sales efforts in the country of Russia.
Cloudflare removed customer encryption keys from data centers in the conflicting countries
and deployed Keyless SSL technology instead.
They’re also “bricking” servers that go offline in Ukraine, Belarus, or Russia
due to power loss or internet disruption and they can only be unblocked if a specific key
for that machine is inputted, but those keys are not stored on site.
Russia is banning Instagram a week after also disabling Facebook and Twitter access, in
response to parent company Meta allowing posts calling for violence against Russian soldiers
if the posts originate from certain countries.
The country gave users 48 hours to move off of Instagram before the social media platform
would be disabled.
Cisco Talos posted a threat advisory on Wednesday about a DDoS tool making rounds that is being
circulated for Ukrainian activists, but this tool is actually a trojan called the Phoenix
infostealer.
Phoenix has been around for a couple of years and is actually a keylogger, so it can be
used to steal cryptocurrency as well as creds.
Google’s Threat Analysis Group has also seen phishing campaigns happening that originate
from Russian state sponsored groups like FancyBear and Ghostwriter which are targeting the Ukrainian
media company URKNet.
TAG alerted authorities to their findings.
If you see something happening that I haven’t touched on with regards to the cyberattacks,
feel free to leave a comment so I can keep everyone updated as much as possible on this
ongoing battle between countries.
Want to see more tech videos from me?
Check out my youtube channel - youtube.com/ShannonMorse for everything from tech reviews to security
tutorials.
And with that, don't forget to like and subscribe to Hak5!
I'm Shannon Morse, I'll see you on the Internet!