Trojan Source affects source code, attackers are using Squid Game to lure in victims,
and watch out for this new spam campaign! All that coming up now on ThreatWire.
Greetings!! I’m Shannon Morse and this is ThreatWire for November 2,
2021! This is your weekly summary of the threats to our security, privacy and Internet freedom.
THANK YOU to Adam, Josh, Jass, Chris, Alyssa, Deal fate, Duplex Mismatch,
Mitchell, CappeDiem, and Ron for joining this week on Patreon.
Patreon.com/ThreatWire as always to keep this show ad free. With that, onto the news!!
Props to Joel on Patreon for sending this story my way. Researchers at the University
of Cambridge published a really interesting paper yesterday, November 1, describing how attackers
could hide malicious source code so that a human eye would see harmless code, but a compiler would
compile the malicious data. The researchers have published proof of concepts for attacks in C,
C++, JavaScript, Rust, Java, Go, Python, and C# and they’ve noted
it could probably work against most modern languages that they haven’t tried as well.
How does it work? According to Nicholas Boucher and Ross Anderson, the two researchers,
this Trojan Source attack “exploits subtleties in text-encoding standards such as Unicode to produce
source code whose tokens are logically encoded in a different order from the one in which they are
displayed, leading to vulnerabilities that cannot be perceived directly by human code reviewers”.
There are two CVEs for the issue. One is CVE-2021-42574
which affects the Unicode bidirectional algorithm through Version 14.0.
Unicode BiDi algorithm determines which way text should be displayed for different languages - like
left to right or right to left. If code is written more than one language, a computer
can fix any conflicts by allowing an override that is different from the logical encoding.
But this can also be used in attacks called RLOs or Right to left override techniques.
This attack uses comments or strings, which are ignored by compilers, since a compiler
would throw up a syntax error if there was an odd BiDi override character outside of those strings.
But Bidirectional overrides still work as a part of the code even if they’re in the comments or a
string, so they can be secretly added into source code so that a compiler would still accept them.
The other is CVE-2021-42694, and it affects the use of homoglyphs,
which are similar looking characters. An example is changing a capital O to a Zero
or a capital I to a lower case l. Etc. In this case, an attacker could use the BiDi
FLO attack alongside switching to homoglyphs to make it even harder for an attack to be flagged.
Due to the severity of this issue, they did a coordinated disclosure
with 19 different organizations, who are releasing updates in their own compilers,
interpreters, code editors and repos to patch the vulnerability.
Unfortunately though not all orgs responded so swiftly. Some dismissed the disclosure.
There aren’t any defenses against these attacks so it’s a very real threat that supply chain
attacks could occur using these techniques. The researchers haven’t found any proof of
the exploits in the wild so far, and compiler and code editing apps are working on patches.
Just as Halloween hit, security research firm Proofpoint ID’d a threat group called
TA575 as the actors behind new malware being used to spread Dridex malware.
And what is this group using? Squid Game.
They pretend to be from Netflix, and send emails promising users early access to the next season
of Squid Game or they could be recruited as part of the cast. The emails promise you can “watch
the season before anyone else!” or get access to the “new season with talent cast schedule”.
In either case, the target would need to fill out an attached document, which is
actually an Excel document with macros, which if enabled, download the Dridex banking trojan.
That trojan can steal data or download additional malware like ransomware onto the target machine.
Proofpoint notes that they’ve been tracking TA575 as affiliated with Dridex since late 2020,
and they send thousands of emails to impact hundreds of organizations per campaign.
They also use the Discord CDN to host and distribute Dridex.
Proofpoint included several indicators of compromise for these attacks on their blog post.
Kaspersky also found several dozen malicious files scattered across the web that used Squid
Game to lure in unsuspecting targets with themed scams and malware. A lot of these are malicious
trojan downloaders that install malware. One would show an animated version of the first game, while
a trojan was downloaded that could steal browser data. They’ve also seen digital versions of the
games online that promise cryptocurrency prizes, but in actuality when a user signs up to play,
they hand over personal data that could result in identity theft or malware infections. Kaspersky
recommends looking for misspelled words, double checking URLs and checking for HTTPS connections,
and if looking to download a video, don’t download one that ends in .exe, .pkg, .dmg, or .msi.
I love it when y’all send me these adorable pictures of
your pets so these are a few from my hush puppy Patreon Alliance members.
You can always support this content and keep it ad free for as little as $2 / month,
and get a slew of perks at the same time! Each alliance member gets over 10 perks as soon as
you sign up at patreon.com/threatwire. With that, now onto the third story.
Cisco Talos is warning about a new malware loader being used via spam campaigns to drop
malware onto infected machines. It’s called SquirrelWaffle, a new tool that was discovered
and is being used as a replacement to Emotet, after the Emotet botnet was disrupted in January
this year. What SquirrelWaffle does is dependent on the attackers - they could be used to infect a
system with malware like Qakbot or used to infect a system with Cobalt Strike,
a penetration testing tool that’s been abused for use in attacks in recent years. Cisco
Talos believes this new threat will be around for quite some time so organizations should be aware.
This first appeared in September and uses stolen reply chain email campaigns in English along with
portions in French, German, Dutch, and Polish, to spread. The email includes a link to a malicious
ZIP file which includes a malicious .doc or .xls file. If opened, those contain code that drops the
malware onto the target computer. The attackers have been known to use Docusign to get recipients
to enable macros in MS Office. A script is executed and SquirrelWaffle is sent to the
target machine from a site hosted by the attackers as a DLL file. Then the malware is deployed.
SquirrelWaffle isn’t detected as it includes an IP blocklist for security research firms
along with antibot scripts that analysis. Cisco Talos included some indicators of compromise
in their report. One of which is the domains being used for the malware campaigns.
The other is a list of SHA256 hashes for files associated with the malware. They recommend
companies employ comprehensive defense in depth security controls to prevent, detect,
and respond to Squirrel Waffle accordingly.
Check out my channel for that video. Don't forget to like and subscribe to this channel as well!
I'm Shannon Morse, I'll see you on the Internet!