QNAP Warns Users Of Attacks, Moxie Is Stepping Down From Signal,
and Log4Shell Hits VMware Horizon! All that coming up now on ThreatWire.
Greetings!! I’m Shannon Morse and this is ThreatWire for January 11
2022 - this is your summary of the threats to our security,
privacy and Internet freedom. THANK YOU to Christopher S, Nasih, and Perciville for
joining this week on Patreon.com/threatwire. Patrons get a new perk starting this month!
Now, Alliance members on patreon will get early access to the show on youtube. And you keep
this show ad free. We have some surprising news this week so, onto the first story.
It’s pretty common in the news cycle to hear about new vulnerabilities or new attacks surfacing
against network attached storage devices. This week QNAP is warning customers about an ongoing
ransomware attack and a brute force attack that are hitting internet facing NAS devices.
According to Bleeping Computer, QNAP customers are being targeted with ransomware
called QNAPCrypt (AKA eChoraix). It’s unsure what attack vector attackers are using
but this has been happening for a series of weeks. Successful
ransomware infection would lead to demands between $1200 and $3000 worth in bitcoin.
QNAP did not specify in their post whether or not this attack is affiliated with their
recommended mitigation techniques or the attacks they mentioned. So we aren’t 100%
sure if there is a relation between the two. But with that said, you should still
take the proper precautions to ensure your devices don’t get infected with ransomware.
To ensure your device isn’t vulnerable to these attacks, open the Security Counselor
in the security portal on the QNAP NAS, and look for a setting that says
“The System Administration service can be directly accessible from an external
IP address via the following protocols: HTTP”. If that’s enabled, then disable port forwarding
on your router, and disable the UPnP function of the QNAP NAS on the MyQNAPcloud by clicking
Auto Router Configuration and unselect Enable UPnP Port Forwarding. You can also disable
SSH and Telnet connections, and QNAP provided a walkthrough on their site on how to do this.
First off is some big news that it seems like no one is talking about.
Moxie Marlinspike is stepping down as CEO of Signal. Marlinspike has been the company
CEO for about a decade, and he wrote in a blog post yesterday that he’s decided to step down
while still remaining on Signals board. Signal will search for a new CEO and WhatsApp
cofounder Brian Acton is serving as interim CEO until a replacement is found.
Marlinspike mentions in his blog post that up until four years ago he was basically the
bottleneck - something that often happens to businesses - he was writing the code
and was the only person on call who could fix things. So he worked to change that,
and now Signal has 30 people taking on all the different jobs. Marlinspike has
put himself in a position where he can finally take some time off work
and not be on call 24/7. So he decided to replace himself as CEO, which comes as a
surprise to us but not totally unexpected since he’s been working on other endeavors as well.
One of those is MobileCoin, of which Marlinspike is their earliest technical advisor, and Signal
started testing integration with MobileCoin to bring crypto transactions to the platform.
Folks residing in the US haven’t had access to MobileCoin yet,
but that could change in the upcoming months.
Adding cryptocurrency payments had attracted scrutiny because it could give regulators a
reason to be even more anti- E2E encryption, since it could be used for money laundering.
Marlinspike built something important and valuable and he deserves some time off. Whether or not that
has anything to do with the current payment platform possibilities is yet to be known.
Big shoutout to my Hush Puppy perk level patrons for sharing their fur baby
photos and for the support. Let’s finish out today’s episode with some news about Log4J!
The UK’s National Health Service or NHS posted a warning on January 5 about an unknown group of
attacks who’ve been actively targeting VMware Horizon servers which are versions affected
by Log4Shell vulnerabilities. These attacks are being used to gain a persistent foothold
on the vulnerable networks. NHS suspects this attack is being used to do reconnaissance,
with attackers using the Java Naming and Directory Interface (JNDI) via those Log4Shell payloads,
which allows for the infected device to call back to a malicious attacker-controlled server.
The attack is using LDAP to retrieve and execute malicious Java class files
which are injecting web shells onto the VM Blast Secure Gateway service.
That can lead to data exfiltration, ransomware or malicious software deployment.
The NHS determined that attackers are using the vulnerable Apache Tomcat, embedded within VMware
Horizon, to exploit these networks. Tomcat is vulnerable to Log4Shell. Using the simple log4j
payload, this offers up a powershell command for Tomcat. From there, the attack can activate the
implant and start listening or exfiltrating. It allows for persistence and a stable connection.
VMware did release a patch in December to fix the log4shell vulnerabilities,
so if you’re running VMware Horizon, apply the security updates.
Want to see more tech videos from me? Check out my youtube channel - youtube.com/ShannonMorse
for everything from tech reviews to security tutorials. And with that,
don't forget to like and subscribe to Hak5! I'm Shannon Morse, I'll see you on the Internet!