Greetings!!
I’m Shannon Morse and this is ThreatWire for December 14, 2021!
This is your weekly summary of the threats to our security, privacy and Internet freedom.
THANK YOU to long time patron David for the upgrade, and to Bry for joining this week
on Patreon.
Patreon.com/ThreatWire as always to keep this show ad free.
And if you want to support the show but don’t wanna join on Patreon, you can grab your own
ThreatWire merch for the holidays at the link below.
Use the coupon code Turkey for 15% off!.
With that, onto the news!!
I know y’all are all here for this Log4Shell attack so let’s get right into it.
On Thursday last week this new vulnerability started showing up online via news sources
and within the infosec community.
By the weekend, it’d become widely known to be a huge concern given it’s ease of
attack and the potential for compromising servers given it’s attack surface is relatively
ubiquitous and used across millions of apps.
Log4Shell is tracked as CVE 2021-44228 and is the nickname given to a critical zero day
vulnerability, and it has a maximum severity score of 10, meaning it’s a problem.
A big problem.
This attack was first noted in the wild to be used against a Minecraft server in a remote
code exploitation but the reason the Minecraft server was compromised also affects millions
of other apps and servers because the source of this problem is used by so many.
The source is called Log4j.
Log4j is an open source Java utility by Apache built into a bunch of apps that easily logs
user input and performs network lookups within the JNDI (or Java Naming and Directory Interface),
to obtain services from LDAP (or the Lightweight Directory Access Protocol).
Log4j captures a message as a URL, fetches the correct response, and can execute code
with full privileges.
So researchers found out this can be exploited in text by using a specific syntax - an attacker
could scan for vulnerable servers, find one, and use a text box to enter a line of code
to trigger the log4j utility to start a lookup.
But instead of just allowing you to do something like a user would - i.e. logging into your
apple id, connecting to a minecraft server, whatever… this would allow them to do things
like install crypto miners, grow a botnet, or exfiltrate data from the targeted server.
A great example of this is changing your iphones name on your iphone to the delegated syntax,
which triggers the vuln on apple’s servers as this red teamer shared.
Yesterday Tom Anthony, CTO of searchpilot, pointed out that if you don’t close the
payload with a closing bracket, it’ll just keep exfiltrating data until the next bracket
comes along.
So that’s great.
Just great.
So what’s the explanation you can tell your fam when they see TV news mention it in a
one liner to freak everyone out?
CTO of SonaType Iikka Turunen gave me this comparison: it’s like a captains log on
a ship but for software.
This allows programs to record what happens when it runs, and usually when a user enters
something simple into a text form, it’s boring stuff (like changing your iphones name).
But someone, somewhere found out you can enter that code into these text fields to make the
app do weird stuff.
For admins, they gotta update the app… and anything else they use written in java, and
a lot of companies just don’t know what components go where so they gotta look at
literally everything to make sure each and every bit is patched.
That’s what makes this so serious.
Even though it was publicly disclosed last week, Matthew Prince, cofounder and ceo of
cloudflare, tweeted they saw evidence of it being used in the wild as early as December
1.
That means it’s been used for a while before anyone knew about the problem.
A Github page shows potential impact and while not verified, includes a slew of potentially
affected brands including Twitter, Steam, Apple, Tesla, Amazon, Unifi, Webex, LinkedIn
and more.
There’s also an extensive list of responses from brands linked on github as well.
Researchers have explained that if you use Apache Struts, you’re likely vulnerable.
Sadly, users can’t do much since this requires app configurations and server updates for
programs and websites you use.
The best users can do is alert the industries they rely on to check for the vulnerable utility
and update.
Services should update log4j to version 2.15.0, but it’s kind of like putting out a ton
of little fires - one app can use a ton of additional backend programs to run - and each
of those might use log4j too.
Microsoft and Sophos both have intensive articles explaining how you can prevent, detect, and
hunt down any exploitation of this vulnerability.
And many companies have already started patching.
Please treat your fellow infosec employees and admins with some empathy and patience
through this holiday season.
I’m sure a lot of folks are working overtime to patch this problem with zero thanks so
let me be the one to say thank you for your hard work.
You deserve a raise for all you do to keep users protected.
Botnets are still alive and well at the end of 2021, but Google has stepped in to disrupt
one botnet that has infected 1 million devices.
This botnet is coined Glupteba and it infects Windows machines.
Operators were using google services to distribute the botnet, so, with the help of the CyberCrime
Investigation Group, Google’s Threat Analysis Group terminated 63 million google docs, 1183
google accounts, 908 cloud projects and 870 google ads that were being using.
But Glupteba is still being spread using the bitcoin blockchain as it’s command and control
server for resilience.
Google TAG also worked with hosting and infrastructure providers to remove servers hosting the botnet
and put a warning page in front of malicious domains.
Google has taken it a step further by filing a lawsuit against who they allege are behind
the operation of this botnet.
Google filed a lawsuit in the southern district of new york against two Russian defendants,
stating they’ve infiltrated over a million computers and devices to create this botnet
for illicit purposes such as stealing google users’ login credentials.
But that’s not all!
Glupteba was being used to steal account information, vend credit cards to create fraudulent purchases
via Google Ads, serve up pop up ads on compromised machines, and mine cryptocurrency.
This botnet was first documented a decade ago and it just keeps going.
This disruption will help, but it likely won’t be the end of it’s spread.
I love it when y’all send me these adorable pictures of your pets so these are a few from
my hush puppy Patreon Alliance members.
You can always support this content and keep it ad free for as little as $2 / month, and
get a slew of perks at the same time!
Each alliance member gets over 10 perks as soon as you sign up at patreon.com/threatwire.
With that, now onto the third story.
The open source package repository called NPM was being used to distribute 17 malicious
packages that are being used to steal credentials and information on discord servers.
While discord is usually used for user communication and community, it’s also used as Command
and Control channels for botnets, as well as a proxy for downloading data.
Attackers appear to have used a series of techniques to trick devs into downloading
the malicious package instead of a legitimate one.
They’re able to do this because repositories are trusted by devs and machines, so no flags
are raised whenever comms happen between the repo and the dev platform.
Automated installation such as using the NPM client also create a “ripe attack vector”,
according to two jFrog researchers who discussed this attack vector via a post published on
Wednesday.
The malicious NPM packages work in a variety of ways.
A few are purported to be the discord.js library but actually include malicious code.
Another acts like a discord bot that fixes errors but actually steals credit card information.
A third example includes a remote access trojan.
While these specific packages have been removed from NPMs repositories, if you download a
lot of open source packages, it’s crucial to only download them from legitimate sources.
Want more tech content?
Subscribe at youtube.com/ShannonMorse for my gift guides.
Don't forget to like and subscribe to this channel as well!
Next week is my annual Biggest hacks video, then I’ll be out for the holidays and back
in January.
I'm Shannon Morse, I'll see you on the Internet!