Cyberattacks are being Timed With Real World Attacks, microsoft finds two new linux vulnerabilities,
and Google bolsters android security!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for May 3 2022 - this is your summary of the
threats to our security, privacy and Internet freedom.
Announcement!
I have a new Patreon perk to share with y’all.
You know how I always cover three headline stories on the show?
Well, now patreon supporters will be able to listen to a fourth story over on the patreon
page.
The link to support and get access to perks is in the description below, and now onto
the first news story.
Even though folks aren’t talking about the war between Russia and Ukraine as much as
they were a month ago, that doesn’t mean it’s ended.
Cyberwarfare is still occurring between the two countries and their allies.
According to Microsoft, six separate Russian state sponsored cybergroups launched more
than 237 operations against Ukraine starting just before the invasion occurred.
These started on February 23 and continued through April 8.
This was a part of Microsoft’s release of a Special Report titled “An Overview of
Russia’s Cyberattack Activity in Ukraine”.
Microsoft details how these attacks include targeting of critical infrastructure and citizens,
with 32% targeting government orgs and 40% targeting infrastructure, malware meant to
cause downtime and disruption, espionage and intelligence campaigns, disinformation campaigns,
and limited activity that involves other NATO member states.
38 of the attacks were file and data wipers.
Attacks started in March 2021 and stemmed from GRU, SVR, and FSB linked groups like
Sandworm, EnergeticBear, UNC2452 and more.
Some of the attacks seem to be coordinated assaults that are timed alongside military
sieges or missile strikes.
The company also named some of the malware being used in these attacks, many of which
I’ve mentioned on the show before.
These include WhisperGate, FoxBlade, CaddyWiper, DoubleZero and more.
Some of them overwrite data or encrypt it or make a machine unbootable.
Others delete data entirely.
Microsoft believes continued attacks on Ukraine may increase in severity, so they provided
some recommendations for mitigation including leveraging anti-malware, endpoint detection,
and identity protection solutions; using best practices for defenses like security internet
facing devices and access, minimizing credential theft by implementing 2FA and detection tools.
They also recommend setting up some kind of investigatory and recovery response plan.
You can read the full in depth report via my links on patreon or on Microsoft’s blog
site.
Microsoft disclosed a group of Linux vulnerabilities in a report posted last week that explains
how these can be exploited in attacks to escalate privileges and deploy malware from backdoors
and infect devices with ransomware.
The flaws are dubbed NimbusPwn and they’re tracked as CVE-2022-29799 and 29800.
The problem resides in networkd-dispatcher, which is a component in linux that sends connection
status changes.They include directory traversal, symlink race, and time of check time of use
race condition issues.
The researchers who found these flaws were listening to messages on the system bus, and
this cause them to look into the code flow for networkd-displatcher.
They quickly discovered that the tool runs at boot with root privileges and this daemon
uses a script called Run_Hooks_For_State to detect the network state.
But this script has security issues including the three issues listed.
That directory traversal, symlink race, and TOCTOU race condition could be linked together
to allow an attacker to escalate their privileges.
The directory traversal flaw means the component doesn’t sanitize the patch for the script
correctly so an attacker could exploit this to “break out” of the base directory.
The symlink race flaw means the processes use symbolic links.
The time of check time of use race condition means an attacker could abuse the timeframe
between scripts being discovered and being run to replace the data without the OS noticing
a difference.
An attacker could plant lots of malicious scripts during that time until one does succeed,
and the researcher noted that their own test of this exploit worked after three attempts
were made.
The maintainer of networkd-dispatcher has already released updates to patch NimbusPwn,
so Linux users should make sure to patch ASAP whenever these updates are rolled out for
your specific distro.
Big shoutout to my Hush Puppy perk level patrons for sharing their fur baby photos and for
the support.
THANK YOU to Rob, Jeremy, and Autumn Dew for joining the alliance on Patreon.com/threatwire.
I have a fourth story to cover, which is only available to the Patreon Alliance so check
that out if you’re interested.
Let’s finish out today’s episode with my last top story, about Android updates.
Google has started sharing more information about Android 13 security with us, including
this news for Bug Bounty hunters.
If you’re a security researcher looking into Android 13 vulnerabilities via their
Vulnerability Rewards Program, you can get a 50% bonus on top of the regular reward payout
through May 26.
That gives you a little less than a month to find any flaws with Android 13 Beta and
get them reported.
The max payout is $1.5 million for an RCE chain on the Titan M chipset.
This doesn’t include any vulnerabilities that aren’t exclusive to Android 13 or reproducible
on other versions of Android.
Google has paid out over $29 million in rewards since January 2010 when it first launched
the program.
Google has also launched a first look at the developer preview for the Privacy Sandbox
for Android 13, including some peeks at the SDK Runtime and Topics API.
Their beta release should happen at the end of this year.
The SDK Runtime will run 3rd party code, like ads and analytics in apps, in a dedicated
sandbox while the Topics API was their recently updated tool for interest based advertising
without cross site or app tracking.
Special thanks to Cyberhound.tech on Patreon for sharing this google-centric story with
me which fits in perfectly with the other Androidy news we got this week.
Google is also rolling out their new Data Safety section for the Play Store and apps
available through it.
Google announced this in May 2021, so it shouldn’t come as a surprise, but this will include
something similar to Apple’s Privacy Nutrition Labels, which give consumers a user friendly
way of quickly determining how apps are using their data.
You’ll be able to see how apps are using your data, for what purpose, data handling,
and if it’s shared with third parties.
This Data Safety section can also show you the apps security practices including info
on if they encrypt data in transit, and if you can ask for data to be deleted.
Developers will have to complete the section by July 20 and keep the info up to date if
there’s ever any changes.
That means you might see the section start to appear now, but devs might not fill it
out until the deadline.
This section will work on a trusted system, assuming that devs will fill out the info
appropriately.
So if an app developer lies when filling out that info, Google can block updates or remove
the app entirely from the Play Store.
This section will not only give users a clearer picture of how their data is used, but it’ll
also give Google a way to enforce the new policy.
Want to see more tech videos from me?
Check out my youtube channel - youtube.com/ShannonMorse for everything from tech reviews to security
tutorials..
And with that, don't forget to like and subscribe to Hak5!
I'm Shannon Morse, I'll see you on the Internet!