What is a double supply chain attack?
Cisco routers are being hit with attacks, and hiding malicious apps from view!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for April 25, 2023 - this is your summary
of the threats to our security, privacy and Internet freedom!
Big news!
If you haven’t seen recent ThreatWire episodes, I’m about to hit 100,000 subscribers on
my main channel, which is youtube.com/ShannonMorse.
Help me hit that goal by subscribing to my channel, where I post tons of security and
privacy content.
Let’s jump right into the news this week.
A supply chain attack on a VoIP or Voice over IP Provider called 3CX happened last month,
but details are still emerging about the consequences of this attack.
We learned that North Korean attackers from the hacking group Lazarus allegedly were able
to target 3CX installations via a previous supply chain attack.
ESET just published a report as well showing that Mac and Linux users are being targeted
by very similar malware with attackers sending fake job offers via LinkedIn using accounts
that were set up to look like executives at companies, but were actually completely fake.
They got these users to download malware which in turn infected Linux based users - which
ESET reported was also the first they’ve seen Lazarus targeting this OS.
The attack on the VoIP company affected about 600k 3CX business customers, and 12 million
users.
Mandiant, who was hired by 3CX to investigate this breach, found that the compromise actually
started back in 2022, and it is the first time the security company has seen something
like this happen.
See, what makes the 3CX hack unique is how it started.
An employee had downloaded an installer called X_Trader from a stock trading automation company
called Trading Technologies, which was laced with malware in their own compromise in a
separate supply chain attack.
That deployed VeiledSignal, a modular backdoor used by the attackers to inject commands into
the infected computer.
That supply chain attack led to this supply chain attack.
So it was a double supply chain attack.
That employee's credentials were stolen, leading the attackers to hacking 3CX.
The 3CX malware looked for commands from the attacker-controlled server, which would respond
with a password stealer called IconicStealer.
3CX has advised customers to uninstall the Electron Desktop Client and switch to the
web app.
But now that we know how the 3CX attack happened, we can tie it to other attacks as well.
The X Trader supply chain attack also affected critical infrastructure orgs in the US and
Europe.
Symantec published a report detailing more information on how the attack happened and
explained that to date, they’ve discovered two energy sector orgs were also hit, along
with two orgs in the financial trading sector.
Given that this information is new, we’re likely to see more victims come forth as more
investigations take place and are linked to these.
If you have a Cisco router, patch that thing ASAP.
According to the UKs National Cyber Security Centre of GCHQ, the US Cybersecurity and Infrastructure
Agency, the NSA, and the FBI - the Russian state sponsored hacking group called APT28
or Fancy Bear is targeting Cisco IOS routers with custom malware called Jaguar Tooth, which
targets a known (and patched) vulnerability.
This is an old flaw in SNMP that’s been patched for almost 6 years, tracked as CVE-2017-6742.
It allows for remote code execution attacks.
It’s used to steal info from the router and set up a backdoor.
Data is stolen via TFTP.
It’s not persistent though, as it injects itself right into the memory.
APT28 is able to find vulnerable routers by scanning the internet for any devices that
match specific strings of code.
The attackers access the devices via this flaw, then install the malware.
That allows them to access local accounts.
Cisco recommends users and admins update the firmware and switch from SNMP to NETCONF or
RESTCONF for public routers if remote management is necessary.
The company also recommends restricting SNMP access if it needs to be enabled.
Biggest of shoutouts to my Patreon supporters, especially my Golden Smores and their fur
babies, for making this show possible since we don’t have ads on this show at all!
THANK YOU to Adam, MiniMoose, Brian, Veritanuda, and Nunction!
for being a part of the Smores at Patreon.com/shannonmorse.
That’s my new Patreon page for the show, where I’ll be posting all the perks for
patrons, including early access to this video.
If you’re currently a patron on the ThreatWire page, switch over to the new page so you don’t
lose access to your perks.
Let’s finish out today’s episode with my last top story, about ghosttoken!
Shoutout to Joel for sending over this story for ThreatWire.
Google’s Cloud Platform had a vulnerability that could allow an attacker to install a
backdoor on a user's Google account via a malicious OAuth application.
Astrix Security explained in a public report that they’ve dubbed this flaw GhostToken
because of how the malicious application could hide itself from a user.
The company first disclosed the issue to Google in June 2022.
They found that a malicious app could be given permissions access to a Google account via
it’s OAuth token, but an attacker could make the app invisible from the user’s application
management page, which happens to be the only page where users can manage app permissions
and revoke them as necessary.
The vulnerability in the GCP could allow an attacker to hide the app, then unhide it and
use the OAuth permissions to access the account.
They could then hide the app again, making it a “ghost” token.
Hiding malicious apps is apparently quite easy - the attacker would need to delete the
linked GCP project which puts the app in a pending deletion state.
Restoring the project means the app would receive a new access token.
The data accessed would depend entirely on the apps permissions, but could include things
like Gmail, Drive files, Photos, etc.
GhostToken was mitigated by Google via a patch rolled out in April of 2023.
Now, any apps pending deletion will still show up on the app management page, so users
can manually revoke them.
I'm Shannon Morse, I'll see you on the Internet!