Patching Exchange Servers, Book Reviews, Rockwell, & Forgotten AM Broadcasts – PSW #685

I am not the only one who finds this book to be, well, just horrible on so many levels. Props to Robert for actually getting through the whole thing, I could not... On a positive note, Perlroth's colleague, David Sanger, did a nice job with "The Perfect Weapon". I did not do a complete fact-check on Sanger's book, but I did enjoy listening to it. There is also Halvar's review, which also points out several more inaccuracies and hyperbole: http://addxorrol.blogspot.com/2021/02/book-review-this-is-how-they-tell-me.html

Interesting snippets: "Some suspect it’s a sneaky way to encourage customers to dump on-prem Exchange and use Office 365 instead." and "Alright, just finished patching our server. Started documenting at 9AM, had all steps ready at [noon], and it’s now exactly midnight, only because I’ve never updated Exchange server before and nobody else that’s left in IT knows how to do it."

"I'm going to tell you one of the dirty secrets of enterprise cybersecurity. There are a lot of practitioners that secretly wish their company would get attacked. Because at least then, someone would listen to them. These people tend to reside on what we frequently refer to as the blue team."

The rabbit hole is even deeper than this: "The fact that Microsoft chose to patch these flaws out-of-band rather than include them as part of next week’s Patch Tuesday release leads us to believe the flaws are quite severe even if we don’t know the full scope of those attacks,” Satnam Narang, staff research engineer at Tenable, said via email."

Interesting: "The vulnerability was found during the resolution of a support case and there is no evidence that it has been exploited in malicious attacks."

LOL: "The founder and director of Infatica — a resident of Biysk, Russia named Vladimir Fomenko — did not respond to multiple requests for comment."

Also, Thycotic and Centrify have been merged. If you predicted there would be consolidation in cybersecurity, you'd be correct.

You go Alyssa Miller, go on with ya bad self (we got your back too): "Using the term “hacker” to describe cyber criminals is an unfortunate habit that plagues modern media. The accompanying imagery of hoodie-clad individuals hunched over computer displays in darkened rooms exacerbates the issue. The predominance of associating hacker with cyber criminals has exploded as cyber-attacks and breaches have become regular topics in mainstream media. However, using “hacker” in such a pejorative manner is perilous, both for its lack of precision and the counter-productive impact it can have on society." BRAVO! (See also: https://securityweekly.com/shows/unraveling-your-software-bill-of-materials-alyssa-miller-esw-186/)

Official statements from Qualys highlight their response: "Speaking of the actions the firm took to remediate, Qualys's CISO, Ben Carr, said: "The zero-day vulnerability affecting Accellion was discovered by Accellion in another customer’s environment and a hotfix to remediate the vulnerability was released on December 21, 2020. The Qualys IT team applied the hotfix to secure our Accellion FTA server on December 22, 2020."

"Analysis of images of home-working environments has revealed work email inboxes, internal emails, names of individuals in emails, private web pages, potentially sensitive internal business correspondence, software installed on computers and internal identification numbers of devices"

Wondering how this transfers, or if it transfers, to other Chromium-based browsers, such as Chromium and Edge. I'm actually running Edge on Linux. And I actually like it so far.

Amazing write-up, if you are interested in reverse engineering and/or exploit development, this is the post for you. Also, really neat how they were able to reverse the protocol and make changes in the management client.

Yikes: “Any affected Rockwell Logix controller that is exposed on the Internet is potentially vulnerable and exploitable,” said Sharon Brizinov, principal vulnerability researcher at Claroty, one of three organizations Rockwell credited with independently discovering the flaw. “To successfully exploit this vulnerability, an attacker must first obtain the secret key and have the knowledge of the cryptographic algorithm being used in the authentication process.” - SAY WHAT? - "Brizinov said that Claroty notified Rockwell of the vulnerability in 2019. Rockwell didn’t disclose it until Thursday."

A misconfigured, unsecured AWS S3 bucked belonging to U.S.-based telemarking firm CallX has been found exposed online containing some 114,000 files that include personally identifiable information (PII) belonging to "thousands of customers."

Microsoft has released out-of-band security updates to address four vulnerabilities in Exchange Server: CVE-2021-26855 allows an unauthenticated attacker to execute arbitrary code on vulnerable Exchange Servers, enabling the attacker to gain persistent system access, as well as access to files and mailboxes on the server and to credentials stored on that system.

Microsoft and outside researchers say the China-linked cyber espionage group "Hafnium" has been exploiting four previously undetected vulnerabilities affecting different versions of Microsoft's mail server software in a hacking campaign designed to steal emails from targeted mailboxes. Microsoft and outside researchers say the China-linked cyber espionage group "Hafnium" has been exploiting four previously undetected vulnerabilities affecting different versions of Microsoft's mail server software in a hacking campaign designed to steal emails from targeted mailboxes. The four newly disclosed vulnerabilities in Microsoft Exchange enable malicious actors to bypass authentication, remotely access email accounts, and deploy additional malware and are being tracked as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065.

Rockwell recommends users requiring setup or deployment guidance for CIP Security should refer to the deployment reference guide. Users can also refer to Rockwell Automation’s System Security Design Guidelines (https://literature.rockwellautomation.com/idc/groups/literature/documents/rm/secure-rm001_-en-p.pdf) on how to use Rockwell Automation products to improve the security of their industrial automation systems. The authentication vulnerability does not affect CIP Security.

Researchers have identified a critical authentication bypass vulnerability (CVE-2021-22681) affecting the Logix Designer software used in Rockwall Automation's programmable logic controllers (PLCs) that could be exploited by unauthenticated, remote attackers to bypass verification mechanisms, connect to Logix controllers, and alter a controller's configuration.

The U.S. National Security Agency (NSA) has issued a document titled "Embracing a Zero Trust Security Model" to provide guidance to security professionals on how they can adopt and implement a "Zero Trust" security model to more adequately secure sensitive data.

Working exploits targeting Linux and Windows systems not patched against Spectre were found by security researcher Julien Voisin on VirusTotal. The exploits require local access and a non-patched system.

French boat maker Groupe Beneteau is working on restoring operations after falling victim to a cyber-attack roughly ten days ago. After discover they reported the deployment of a backup application and systems.

Indian government websites have inadvertently leaked the COVID-19 test results of more than eight million West Bengali citizens, according to researchers and Bleeping Computer. Malicious actors have leveraged the pandemic to enhance social engineering campaigns, and the publicly leaked PII in this incident could be used to advance these operations.