100,000 credentials leaked due to an autodiscover flaw, 3 Apple zero days were published online,
and the FBI secretly held a ransomware decryptor key!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for September 28, 2021!
This is your weekly summary of the threats to our security, privacy and Internet freedom.
BTW, THANK YOU to Kevin and Kevin for joining this week.
Lol that’s never happened before.
Patreon.com/ThreatWire as always to keep this show ad free.
We have some excellent stories to get into today so..
Onto the news!!
What is Autodiscover in terms of Windows Exchange, and how does that pertain to this show?
Well, a security researcher discovered a flaw that allowed for a leak of 100,000 login names
and passwords for Windows domains.
Oops!
So Autodiscover helps users set up their mail clients, like Microsoft Outlook, to automatically
determine mail settings, say for an organization.
But Amit Serper of Guardicore’s Security Research team discovered a flaw in how Autodiscover
works.
If, for example, a user inputs their email address and password, Outlook would authenticate
this with the Exchange Autodiscover URLs, and the username and password are sent automatically
to that Autodiscover URL.
That URL is determined based on the email address from the client device.
So if your email was Shannon@test . com, the autodiscovered URLs could be something like
autodiscover . test . com.
Sounds fine so far.
But here’s the flaw: The client and Microsoft Exchange server get matched with one of these
URLs for the connection to be authenticated.
If authentication fails, the mail client may try to create some more URLs to authenticate
with based on the user email address, like autodiscover.com, .uk, . fr, . es… whatever
the email address ends with.
If that happens, sometimes the mail client might authenticate with untrusted domains.
That means those credentials could be sent to a malicious domain.
Guardicore ended up registering a bunch of autodiscover domains as honeypots with web
servers to test this.
They registered autodiscover domains like autodiscover.fr, .it, .uk, .xyz, .online,
etc.
Serper discovered that mail clients that use the Autodiscover protocol were in fact sending
account credentials to these domains, based on the email addresses of users.
Even when the clients sent creds using OAUTH or NTLM, the researcher was able to downgrade
the authentication via a request from the exchange server to simple HTTP so the creds
were then sent back in plaintext base 64.
Guardicore got hundreds of thousands of authentication requests from various clients, including credentials
for major companies and infrastructure organizations.
They also got over 96,000 unique credentials from Outlook and other mobile email clients
and applications that work with Exchange server.
This test took place from April 2021 to August 2021.
Bleeping Computer has pointed out that this was first brought to light via a Black Hat
Asia 2017 talk, but Microsoft says they’ve just learned about this.
They also stated the issue wasn’t reported to them before presented to the media by the
researcher marketing team, so they learned about the claims after it went public.
At time of reporting at least 60+ autodiscover TLDs have been registered by Microsoft.
It’s possible others have already been registered by malicious actors as well, since some of
the TLD owners are hidden behind WHOIS privacy restrictions.
Serper recommends that organizations block top level domains at the firewall or DNS server
and use Guardicores list of TLDs to create access rules for mail clients.
Disable basic authentication as this allows for cleartext credentials to be sent.
Since this is not just an outlook issue, other applications will have to take steps to mitigate
it as well.
On Thursday last week, a security researcher who was frustrated with Apple’s vulnerability
disclosure and bug bounty program, dropped 3 zero days for updated Apple iOS devices
along with a blog post detailing why.
According to the researcher who goes by the name Illusion of Chaos, four different vulnerabilities
were reported to Apple following their disclosure and bug bounty program.
One of these problems was fixed in iOS 14.7, which could allow for arbitrary user installed
apps to access iOS analytics data without permissions granted by the user.
That data included apple watch medical data.
That data could be available to any apps even if the iOS Share Analytics setting was disabled.
This problem was disclosed on April 29.
Apple responded the next day but didn’t continue communications til June 3, then fixed
the problem in 14.7 on July 19.
Illusion of Chaos wasn’t acknowledged in the update, nor was the patched issue.
Apple told them they’d be credited in the next update but that didn’t happen.
Now we’re all updating to iOS 15.0, and illusion of chaos has still receiving no acknowledgement
in those updates for disclosing these flaws.
The researcher threatened to release the 3 other flaws that have gone unpatched to the
public out of frustration with Apple.
And they followed through.
Each of these zero days have to do with access to data that apps shouldn’t have nor have
they been granted access to.
They all include proof of concepts on Github.
The first is a Gamed Zero day, which can expose the Apple ID email and name, exploit Apple
ID authentication tokens, and read databases.
This could be used by an attacker to steal PII or grab info about user interactions,
including contact lists, who is contacted and when, and to potentially steal attachments
from messages.
The second zero day is a Nehelper WiFi flaw, which exposes the wifi info to apps that shouldn’t
have access nor have they been granted that access.
This exposes credentials used to access a WiFi network or could be used to track a user.
The third is a Nehelper Enumerate zero day, which exposes info about the apps installed.
This could allow applications to determine if other apps are installed on a device, such
as anti-virus or security apps.
Illusion of chaos stated they’d waited at least a month and in one case at least half
a year to publicly disclose these flaws.
The full timelines for each of these flaws is included in their detailed blog post, linked
from this story.
One day after the public disclosure, apple did reply to the researcher, saying they were
investigating the issues.
In the meantime a jailbreak developer claimed to have released a fix for all three zero
days.
I love it when y’all send me these adorable pictures of your pets so these are a few from
my hush puppy Patreon Alliance members.
Y’all, we currently have 860 active patrons on the ThreatWire Alliance.
I would love to see that hit 870.
You can always support this content and keep it ad free for as little as $2 / month, and
get a slew of perks at the same time.
With that, now onto the third story.
Back in the summertime, I reported on the REvil ransomware attacks that were going on,
how the hacking group went dark, and the master key to decrypt locked devices was released
by Kaseya to help at least 1500 victims, all of whom were customers of their IT firm.
The REvil group made waves earlier this year by hacking into Colonial Pipeline on the east
coast along with several other major companies and orgs.
Many companies, hospitals, and schools were also affected.
At the time, spokespersons stated the key was given to Kaseya by a trusted third party
but we didn't know who originally had the key.
Last week we learned that the FBI had the key, but withheld it for three weeks before
releasing it to victims for fear of tipping off the hacking group.
Unfortunately for the FBI, that didn’t matter, since the REvil group went dark on July 13,
with the FBI releasing the key on July 21.
So why the wait after the group went dark?
It’s likely victims had to spend millions of dollars to recover what they could after
being affected by ransomware, and deploying this decryptor key could’ve helped.
Some victims reported to journalists that having the tool earlier would’ve helped
as they’d already begun the work to restore systems completely or replace them - both
of which involve tons of time and expenses.
According to the FBI, withholding the key was an agreement made between multiple agencies.
As of this month, REvil is back at it and has already attacked 8 new victims.
Bitdefender had released a decryptor tool as of September 16, but this one only works
for victims who were hit with ransomware before REvil went dark.
We can assume this means REvil has changed their ransomware and a new decryptor tool
would be needed to help these new victims.
I can understand the FBI withholding the key while planning a sting operation to not tip
off the attackers, but once the group disappeared and went dark…
I am curious why it still took another week to release it.
I’m wondering if the group was already tipped off.
Maybe that’s why they went dark.
What are your theories?
Leave ‘em in the comments below.
Now that the studio is finished I’m back to filming content at youtube.com/ShannonMorse.
I just posted a timelapse video of moving into this new youtube studio, so check out
my channel for that behind the scenes content.
Don't forget to like and subscribe to this channel as well!
I'm Shannon Morse, I'll see you on the Internet!