Dirty Pipes Vuln, OSHEAN, Samsung Source Code, Root Through Azure, & Article 45.2 – PSW #731

"Unit 42 researchers disclosed several vulnerabilities and attack techniques in GKE Autopilot to Google. Users able to create a pod could have abused these to (1) escape their pod and compromise the underlying node, (2) escalate privileges and become full cluster administrators, and (3) covertly persist administrative access through backdoors that are completely invisible to cluster operators."

More Linux exploit fun: "Tracked as CVE-2022-0847, the vulnerability came to light when a researcher for website builder CM4all was troubleshooting a series of corrupted files that kept appearing on a customer's Linux machine. After months of analysis, the researcher finally found that the customer's corrupted files were the result of a bug in the Linux kernel." All the details here: https://dirtypipe.cm4all.com/ and neat exploit here: https://haxx.in/files/dirtypipez.c

"“By exploiting the vulnerabilities disclosed, attackers can leverage them to perform privileged code execution in firmware, below the operating system, and potentially deliver persistent malicious code that survives operating system re-installations and allows the bypass of endpoint security solutions (EDR/AV), Secure Boot and Virtualization-Based Security isolation.” reads the analysis published by Binarly."

This is a leap: "The email was sent to soccer clubs with legitimate video files and YouTube links showing training and match highlights. Victims who were intrigued by the video footage were instructed to download and enable a Microsoft Excel document infected with malware." In this case, better to pre-text that you can see everyone who was promoted or fired, that'll get em' to click: "some recipients received a message informing them that their employment was terminated, while others got news of a promotion or that they received a holiday bonus. By downloading the Excel file and clicking “enable content,” resulted in a Trojan being dropped on the victims’ computer." And this is just too classic: "A fraudster attempted to weave an email like this last year, posing as a Chief Justice of Canada, also adding in the email that the recipient had won additional lottery winnings, and the Bank of Canada has come to collect the money. The attacker claimed all of it could be resolved for the modest sum of just $100 and once the payment was received, the winnings would be available in the form of an ATM visa card."

"Because the hack uses Alexa functionality to force devices to make self-issued commands, the researchers have dubbed it "AvA," short for Alexa vs. Alexa. It requires only a few seconds of proximity to a vulnerable device while it’s turned on so an attacker can utter a voice command instructing it to pair with an attacker’s Bluetooth-enabled device. As long as the device remains within radio range of the Echo, the attacker will be able to issue commands."

The breakdown: "CVE-2022-22806 – TLS authentication bypass: A state confusion in the TLS handshake leads to authentication bypass, leading to remote code execution (RCE) using a network firmware upgrade. CVE-2022-22805 – TLS buffer overflow: A memory corruption bug in packet reassembly (RCE). These vulnerabilities can be triggered via unauthenticated network packets without any user interaction (ZeroClick attack). The third vulnerability is a design flaw in which the firmware updates on affected devices are not cryptographically signed in a secure manner. "

Clipper chip anyone? This is the new version of it: "Proposed EU legislation threatens to disrupt this balance. Article 45.2 of the eIDAS Regulation mandates support for a new kind of certificate called a Qualified Website Authentication Certificate (QWAC). Under this regulation, QWACs would be issued by Trust Service Providers (another name for CAs), with those TSPs being approved not by the browsers but rather by the governments of individual EU member states. Browsers would be required to trust certificates issued by those TSPs regardless of whether they would meet Root Program security requirements, and without any way to remove misbehaving CAs. "

"With some of its key recommendations now law — such as the creation of the Office of the National Cyber Director in the White House — the remnant of the congressionally created panel is turning its attention to tracking how those ideas are implemented, while studying some of the issues it didn’t get to fully examine before releasing its final report. Those areas of study include protecting the water, maritime transport and health care sectors, as well as strengthening the federal and private sector workforce and ensuring plans to avert disruptions to the economy caused by cyberattacks."

No details that I could find, however, I believe there is an API that was looked at very closely: "Earlier this year, as part of my ongoing security research into the ServiceNow platform, I discovered external interfaces exposed to the public that may be utilized by a malicious actor to extract data from records. AppOmni’s analysis of ServiceNow instances, similar to our earlier analysis of other SaaS providers like Salesforce, showed that nearly 70% of tested ServiceNow instances were vulnerable to this misconfiguration, which could allow an unauthenticated user to extract data. Further investigation into these findings highlight that the root causes for data exposure are a combination of misconfigured Access Control Lists (ACL) and overprovisioning of permissions to guest users."

"Schneider Electric has issued patches while the researchers advised changing default network management card passwords where applicable and installing publicly-signed SSL certificates. Access control lists are also said to help."

These are 10 signs of poor leadership in general...

The Russian army in Ukraine has knocked down the 3G towers that it needs for its secure phones to work and are now using insecure comms, which get intercepted.

Russia lost a Major General outside of Kharkiv. The FSB officer who reported this had to do it on a phone with a local sim card because the Russian secure comms system has completely broken down.

While it assesses new, tough laws designed to crack down on Russian "fake news" about Russian armed forces following the invasion of Ukraine, Chinese-owned TikTok says it has suspended live streaming and new content on the platform as of March 4. The Russian government objects to the conflict in Ukraine being called a "war" rather than a "special military operation."

The Security Service of Ukraine (SSU) revealed yesterday that "enemy" hackers are now leveraging compromised local government and regional authorities' websites to push disinformation claiming the Ukraine government has surrendered and signed a peace agreement with Russia.

U.S. Department of Treasury levied sanctions against Russian organizations and oligarchs for actively spreading disinformation and supporting Putin's war in Ukraine

Hackers are now leveraging two stolen NVIDIA code-signing certificates to sign malware in order to make it appear trustworthy and load malicious drivers in Windows.

A Linux kernel flaw, tracked as CVE-2022-0492 , can allow an attacker to escape a container to execute arbitrary commands on the container host. A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

Cisco this week announced patches that address a couple of critical vulnerabilities in its Expressway Series and TelePresence Video Communication Server (VCS) unified communications products that could be exploited by remote, authenticated attackers to write files or launch code with root privileges on the underlying operating system.

The short explanation is that having Contributor access to an Azure Resource Manager (ARM) API Connection would allow you to create arbitrary role assignments as the connected user. Per the Author: "In October 2021, I was performing an Azure penetration test. By the end of the test, I had gained Owner access at the Root level of the tenant."