An enterprise vulnerability has public exploits, big brands are going passwordless, and install
this android security patch asap!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for May 10 2022 - this is your summary of
the threats to our security, privacy and Internet freedom.
Announcement!
I have a new Patreon perk to share with y’all.
You know how I always cover three headline stories on the show?
Well, now patreon supporters will be able to listen to a fourth story over on the patreon
page.
The link to support and get access to perks is in the description below, and now onto
the first news story.
A vulnerability, tracked as CVE 2022 1388 is being exploited to drop malicious payloads
on several different versions of F5 BIG IP modules.
This was first made publicly known last week when F5 disclosed the remote code execution
flaw and told admins to update to the newest security updates to patch it.
The problem resides in the BIG IP iControl REST Authentication component, wherein an
attacker could bypass any authentications usually required to execute malicious commands
on a vulnerable F5 device with elevated privileges.
According to F5, quote “This vulnerability may allow an unauthenticated attacker with
network access to the BIG-IP system through the management port and/or self IP addresses
to execute arbitrary system commands, create or delete files, or disable services.
There is no data plane exposure; this is a control plane issue only.”
And while this problem only affects the management side of these devices, which shouldn’t be
exposed to the internets, some still are - in fact Rapid7 security researcher Jacob Baines
did a scan and found 2500 exposed.
F5 is a cloud security and application delivery network or ADN and their BIG IP products are
commonly used in enterprise networks.
Several groups of security researchers were able to create working exploits within days
based on the mitigation information F5 posted, and since it was trivial to do so, a series
of warnings were shared on social media and across security networks to update devices
ASAP.
With exploits now being leaked online just shortly after and made available publicly,
anyone could use them.
So patch immediately, and if you can’t update: Block all access to the iControl REST interface
thru self IP addresses, set up restrictions for access to only include users and devices
through the management interface, and modify the BIG IP httpd config.
Passwordless authentication is coming soon to a device near you!
Apple, Microsoft, and Google will be introducing passwordless authentication, which will allow
users to sign in across multiple devices and websites in a more seamless experience, and
will increase security at the same time.
Support will be coming to Google’s Android and Chrome web browser, Apple’s iOS, MacOS
and Safari, and Windows Edge browser plus operating system.
The standard, which is developed by the world wide web consortium or W3C and the FIDO alliance,
is another step towards helping users be more secure online while offering an easier approach
for convenience.
This will work via the protocol called Fast IDentity Online, or FIDO for short, which
can allow a user to unlock their phone to sign into a website or application on their
computer instead of requiring a password.
A prompt will be displayed on the computers browser for example telling you to check your
phone and requiring you to unlock your phone - which can be done like you normally do every
day - by using your thumbprint, a face unlock action, or a PIN code on your phone.
Your phone will be sent a prompt to verify it’s you by unlocking.
FIDO works by storing a cryptographically secured passkey on a phone, and that is used
to authenticate a user on an account after you successfully unlock your phone.
After that happens, you don’t need to unlock your accounts again - you can just unlock
them by unlocking your computer.
You may be wondering what happens if your phone is stolen or lost?
Your passkey can be synced to a new phone from a cloud backup.
This can also allow for cross platform compatibility.
For example, Microsoft explained in a post that you could sign into Google Chrome on
a Windows PC by using a passkey on an iPhone.
This also means you wouldn’t have to re enroll every account you log into on every
device.
And how is this more secure than passwords?
Phishing is a serious problem, as is password reuse, so removing passwords altogether helps
remove that factor as a potential vulnerability.
Also, legacy 2FA like SMS is still overused and SMS can also be phished.
In this format, the phone needs to be within proximity of the pc or laptop that a user
is trying to log into, potentially defeating the possibility of a remote attacker stealing
your phone and using it to sign in.
The authenticating device also checks to make sure the URL is legitimate, and not a phishing
website.
Obviously local attacks could still happen if an attacker somehow gained access to your
phone and you used a pin, not a biometric, to unlock.
The 3 companies are planning to implement this within the next year but developers of
websites and applications will also have to adopt and implement this new feature.
Big shoutout to my Hush Puppy perk level patrons for sharing their fur baby photos..
Or a feather baby video! and for the support.
THANK YOU to Cyphernaut for joining the alliance on Patreon.com/threatwire.
We officially have over 800 Patreon Alliance members who get access to a fourth story,
check that out if you’re interested.
Let’s finish out today’s episode with my last top story, about a linux kernel vulnerability.
An android kernel vulnerability was just patched by google, so make sure to update your devices
because this one is being actively exploited.
Google’s Android is built on Linux, and since android uses a modified linux kernel,
it’s also affected by this privilege escalation issue that could allow a local attacker with
access to the device to exploit the flaw.
It’s tracked as CVE 2021-22600, and was originally disclosed back in January by Google's
own researchers to Linux vendors along with a fix, but Android has just put out their
own patch this month.
Linux distros like Debian, Red Hat, and Ubuntu patched the issue in the December to January
2022 timeframe.
It’s a double free vulnerability, existing within the packet network protocol implementation
of the linux kernel.
Flaws like this can cause memory corruption denial of service or arbitrary code executions.
Google has stated via their may android security bulletin that it may be under limited targeted
exploitation, and CISA also stated it was being actively exploited back in April.
Android 9 users should update to a newer OS so they can get access to these patches as
well.
Want to see more tech videos from me?
Check out my youtube channel - youtube.com/ShannonMorse for everything from tech reviews to security
tutorials..
And with that, don't forget to like and subscribe to Hak5!
I'm Shannon Morse, I'll see you on the Internet!