Microsoft Discloses Zero Day, Apple Patches Zero Days, and Twilio Discloses Another Breach!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for November 1 2022 - it’s my birthday month!
- this is your summary of the threats to our security, privacy and Internet freedom.
I’m having an exclusive q&a live stream for patreon supporters later this week for
anyone who signs up before Friday.
Let’s jump right into the news this week.
According to reports from last weekend, active ransomware attacks are hitting Windows via
a newly discovered zero day, which can bypass Mark of the Web, or MOTW security warnings.
The ransomware uses malicious javascript files to bypass this feature.
Mark of the Web is a Windows security feature which will prompt a user with a warning whenever
a file has been downloaded straight from the internet and could potentially be malicious.
The flag can be viewed in Notepad as a special identifier for files and it includes three
markers: a Zone ID, a referrer, and the file’s URL.
The Windows security warning for an average user is just a simple popup that asks if they
want to open the file, and what publisher it is from.
The user will see a warning that says the file could “potentially harm their computer”.
These new attacks use downloaded javascript files which are signed with a malformed key,
according to Will Dormann of Analygence, a cyber solutions firm.
The malformed key bypasses the MOTW flag, so a user isn’t faced with any security
warning or prompt, so the script would open and execute automatically, which then installs
Magniber ransomware.
The issue can also persist in exe files, not just js javascript ones, due to the ability
to modify hex code in the file.
Dormann posits that this issue affects Windows 10’s SmartScreen feature.
Microsoft is aware of the zero day but hasn’t released a patch.
Luckily, though, an unofficial patch from the opatch micro patching service is now available,
which fixes the SmartScreen problem.
According to opatch, it stems from SmartScreen’s “inability to parse the malformed signature
in a file”.
So, users can use the opatch agent to install an unofficial patch, or wait for one to become
available from Microsoft.
In either case, be very cautious when downloading files from email attachments or from the web.
Apple released a slew of updates to their line of products and software, some of which
were actively exploited in the wild.
iPadOS and iOS received a patch to fix a zero day which is ID’ed as CVE-2022-42827, is
an out of bounds write issue within the kernel, allowing an attacker to execute arbitrary
code with escalated privileges.
The problem was disclosed by an anonymous researcher and very few technical details
are known.
We do know this affects all models of iPad Pros, iPad Air 3rd gen, iPad 5th gen, iPad
mini 5th gen, and iPhone 8 and later models of the above.
Apple updated their patch to be backported to even more versions of their OS’s after
the initial release, to later include iPhone 6s, iPad Air 2, ipad 5th gen, ipad mini 4th
gen, and ipod touch 7th gen.
The advisory was also updated to reflect the newly discovered issues, now to include iOS
15.7.1 and iPadOS 15.7.1.
Other zero days were also fixed in this newest update, 19 total, which affect a variety of
firmware including the kernel, webkit, bluetooth, IOkit, sandbox, and more.
The full list contained within the security update for iOS 16.1 and iPadOS 16 include
some interesting new disclosures:
Researchers discovered: an issue with audio which could allow an attacker to craft an
audio file that could lead to information disclosure; a issue in Core Bluetooth in which
an attacker could record audio using a pair of connected Airpods; many issues that could
allow an attacker to execute code with kernel privileges; and a Sandbox issue in which an
app could access user sensitive data.
The full list is disclosed in their update documentation.
Biggest of shoutouts to my Hush Puppy perk level patrons for sharing their fur baby photos
and for the support.
THANK YOU to my newest patrons including Homie for joining on Patreon.com/threatwire.
My youtube channel is youtube.com/ShannonMorse for everything from tech reviews to security
tutorials including a whole slew of privacy videos this month..
Don't forget to like and subscribe to Hak5 as well!
Let’s finish out today’s episode with my last top story, about Twilio!
Twilio disclosed yet another data breach that happened earlier this year.
According to their new disclosure, this one happened on June 29, with an attacker using
social engineering to steal employee credentials via a voice phishing attack (also called vishing).
These creds were used to access customer data, and the attacker’s access was revoked in
12 hours.
Affected customers were notified on July 2.
Twilio didn’t disclose exactly how many customers were affected in this data breach.
The company also shared more findings about the August hack in the same public disclosure
which came just a few days ago.
To reiterate what happened, this attack happened when an attacker accessed customer data on
an administrative portal via a targeted SMS based phishing attack to steal employee credentials.
This was also the same campaign that hit Cloudflare, MailChimp, and many other companies.
In some cases, like with Cloudflare, the attempts were blocked because companies had administered
FIDO2 compliant hardware security keys, which the attacker couldn’t steal remotely.
We now have some numbers associated with the August breach.
In this event, 209 customers and 93 Authy end users were affected.
As we know, this attack occured due to a SMS phishing attack, but Twilio also confirmed
that the attackers had access for two whole days after their first disclosure, which came
on August 7.
The breach did not affect any API keys, console account creds, or authentication tokens.
Twilio has over 75 million users on Authy, which is used for two factor authentication
codes, and over 270,000 customers using the tool for authenticating users.
So the impacted customer base was relatively small, but important.
Twilio responded by resetting credentials for compromised employee accounts and distributing
FIDO2 hardware tokens to employees to upgrade their two factor authentication.
I'm Shannon Morse, I'll see you on the Internet!