Week in review: Kali Linux gets Purple, Microsoft zero-days get patched
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-23397 | Zero-Click Elevation of Privilege in Microsoft Outlook (Forced NTLM Credential Leak) CVE-2023-23397 is an elevation of privilege vulnerability in Microsoft Outlook caused by improper input validation (CWE-20) combined with authentication bypass via spoofed authentication data on the channel (CWE-294), allowing an attacker to force Outlook to authenticate to an attacker-controlled SMB/WebDAV server. It is triggered when Outlook processes a crafted email or calendar object — for example a meeting or task reminder whose sound property points to an attacker-supplied UNC path — and requires no user interaction. That authentication exchange leaks the victim's NTLM credential hash, which the attacker can crack offline or relay to authenticate as the victim and access resources such as Exchange mailboxes, effectively escalating privileges. Affected software spans Microsoft 365 Apps, Microsoft Office (including the Long Term Servicing Channel), and Microsoft Outlook, which are deployed across enterprises, governments, and militaries worldwide. It is actively exploited in the wild — added to CISA's Known Exploited Vulnerabilities catalog on 2023-03-14 with a 97.4% EPSS — and Microsoft has warned of exploitation by Russia-aligned threat actors in campaigns against government and military mail servers, with patches shipped in Microsoft's March 2023 security updates. Do: Apply Microsoft's March 2023 security updates to Microsoft 365 Apps, Office/LTSC, and Outlook immediately, per CISA's required action. As interim mitigation, enable Extended Protection for Authentication or add accounts to the Protected Users group to block the NTLM credential leak, and audit calendar and task reminder sound properties for UNC paths (Microsoft published an audit/cleanup script for this) while watching for unexpected outbound SMB/WebDAV connections from hosts running Outlook. | 9.8 | 97% | KEV |
| masson the order of hundreds of millions of users (Outlook ships with Microsoft Office/Microsoft 365, the dominant enterprise and government email suite) | |
| CVE-2023-24880 | SmartScreen Security Feature Bypass in Windows 10/11 and Windows Server CVE-2023-24880 is a security feature bypass (incorrect authorization, CWE-863) in Windows SmartScreen: when a user opens a file carrying Mark-of-the-Web — such as an email attachment or a downloaded file — Windows fails to display the SmartScreen 'Open File – Security Warning' prompt that normally precedes execution. An attacker who can get a user to open a crafted malicious file therefore gains the ability to run attacker-chosen code on that machine without the SmartScreen warning, defeating a core client-side defense; the bypass was typically chained with a lure or another flaw to deliver malware, including loaders feeding ransomware operations. Any user or organization running the affected Windows 10, Windows 11, or Windows Server builds is affected, though exploitation requires local access and user interaction (CVSS 4.4, local attack vector). The flaw was a zero-day exploited in the wild before Microsoft patched it in the March 2023 Patch Tuesday release — one of two actively exploited flaws fixed that month — and Google researchers reported a ransomware gang exploited it; CISA added it to the Known Exploited Vulnerabilities Catalog on 2023-03-14 with known ransomware use, and EPSS rates the probability of exploitation within 30 days at 78.2% (100th percentile). No public proof-of-concept is known, but confirmed in-the-wild exploitation means defenders should treat it as actively targeted. Do: Apply the March 2023 Windows security updates to all affected Windows 10 (1607, 1809, 20H2, 21H2, 22H2), Windows 11 (21H2, 22H2), and Windows Server 2016/2019/2022 systems via Windows Update, WSUS, or your patch-management tooling, and verify coverage in your inventory — this is CISA's required action for KEV. Until patched, treat any host whose users open untrusted email attachments or downloads as exposed, since the bypass silently skips the SmartScreen warning; updating is the only complete fix, with no published configuration workaround. | 4.4 | 78% | KEV ransomware |
| masshundreds of millions of Windows endpoints and servers |
Full article1,092 words · extracted from helpnetsecurity.com · click to collapse
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos:
Samsung, Vivo, Google phones open to remote compromise without user interaction
Several vulnerabilities in Samsung’s Exynos chipsets may allow attackers to remotely compromise specific Samsung Galaxy, Vivo and Google Pixel mobile phones with no user interaction.
Top 50 most impersonated brands by phishing URLs
Finance, technology, and telecom brands were the most commonly impersonated industries, notably for the unprecedented access and financial benefit that bank accounts, email and social media, and phone companies can give attackers, according to Cloudflare.
Microsoft patches zero-days used by state-sponsored and ransomware threat actors (CVE-2023-23397, CVE-2023-24880)
It’s March 2023 Patch Tuesday, and Microsoft has delivered fixes for 76 CVE-numbered vulnerabilities, including two actively exploited in the wild (CVE-2023-23397, CVE-2023-24880) by different threat actors.
How ChatGPT is changing the cybersecurity game
The cybersecurity industry can leverage GPT-3 potential as a co-pilot to help defeat attackers, according to Sophos.
CISA warns CI operators about vulnerabilities on their networks exploited by ransomware gangs
Organizations in critical infrastructure sectors whose information systems contain security vulnerabilities associated with ransomware attacks are being notified by the US Cybersecurity and Infrastructure Security Agency (CISA) and urged to implement a fix.
Kali Linux 2023.1 released – and so is Kali Purple!
OffSec has released Kali Linux 2023.1, the latest version of its popular penetration testing and digital forensics platform, and the release is accompanied by a big surprise: a technical preview of Kali Purple, a “one stop shop for blue and purple teams.” The company has also updated its Penetration Testing with Kali Linux (PEN-200) course to incorporate the latest ethical hacking tools and techniques.
Security in the cloud with more automation
Are you looking for more automation to apply CIS best practices to your workloads in AWS?
Fighting financial fraud through fusion centers
Keeping up with financial fraud is incredibly difficult because accurate fraud detection requires a deep, real-time analysis of all the events surrounding a transaction.
SVB account holders targeted with phishing, scams
After news broke late last week about Silicon Valley Bank’s bank run and collapse, security researchers started warning SVB account holders about incoming SVB-related scams and phishing attempts.
So, you want to deploy air-gapped Kubernetes, huh?
One of the reasons Kubernetes deployments in such environments so often struggle or outright fail is because many organizations don’t properly plan in advance for what the architecture should look like.
Virtual patching: Cut time to patch from 250 days to <1 day
Timely patching is an important aspect of managing vulnerabilities but is not always achievable in every circumstance.
The rise of AI threats: Is your business prepared to face ChatGPT?
In this Help Net Security video, Rodman Ramezanian, Global Cloud Threat Lead at Skyhigh Security, discusses how ChatGPT can strengthen business defenses.
The SVB demise is a fraudster’s paradise, so take precautions
For those who haven’t followed the drama, Silicon Valley Bank has been shut down by the California Department of Financial Protection and Innovation, after a bank run that followed an insolvency risk and a stock crash.
New algorithm may change the future of secure communication
Researchers have made a significant breakthrough in secure communication by developing an algorithm that conceals sensitive information so effectively that it is impossible to detect anything hidden.
Best practices for securing the software application supply chain
In this Help Net Security video, Uri Dorot, Sr. Security Solutions Lead at Radware, discusses how without proper client-side protection, organizations are flying blind.
We can’t wait for SBOMs to be demanded by regulation
A SBOM is a list of all the open source and third-party components present in a piece of software, but also more than that: it contains the version numbers, the licenses, and the patch status of each component.
TSA issues additional cybersecurity rules for the aviation sector
The Transportation Security Administration (TSA) issued a new cybersecurity amendment to the security programs of certain TSA-regulated (airport and aircraft) operators in the aviation sector, following similar measures announced in October 2022 for passenger and freight railroad carriers.
How two-step phishing attacks evade detection and what you can do about it
In this Help Net Security video, Ofek Ronen, Software Engineer at Perception Point, discusses two-step phishing attacks, which are not only dangerous but also evasive, making them even more challenging to detect and avoid.
Understanding password behavior key to developing stronger cybersecurity protocols
Passwords are still the weakest link in an organization’s network, as proven by the analysis of over 800 million breached passwords, according to Specops Software.
Cyber attribution: Vigilance or distraction?
Cyber attribution is a process by which security analysts collect evidence, build timelines and attempt to piece together evidence in the wake of a cyberattack to identify the responsible organization/individuals.
Exfiltration malware takes center stage in cybersecurity concerns
While massive public data breaches rightfully raise alarms, the spike in malware designed to exfiltrate data directly from devices and browsers is a key contributor to continued user exposure, according to SpyCloud.
How healthcare CISOs can automate cloud security controls
In the case of treating infrastructure as code, native and third-party cloud management platforms enable users to templatize security configuration for infrastructure and store those templates for easy use every time a new environment needs to be stood up.
Data loss prevention company hacked by Tick cyberespionage group
ESET researchers have uncovered a compromise of an East Asian data loss prevention (DLP) company.
Organizations need to re-examine their approach to BEC protection
BEC attacks are growing year over year and are projected to be twice as high as the threat of phishing in general, according to IRONSCALES and Osterman Research.
How Mirel Sehic relies on simplicity to focus on product security
If you are developing a modern medical, manufacturing, or logistics facility, there’s no doubt that a large portion of your investment was made into the electronic aspects of your device.
Webinar: Tips from MSSPs to MSSPs – starting a vCISO practice
Watch this panel discussion to hear from MSSP leaders who already sell vCISO services as they discuss why they have expanded into offering vCISO services and share expert tips and recommendations.
Product showcase: Permit.io – Application-level permissions with a no-code UI
Managing user access in applications has always been a headache for any developer. Implementing policies and enforcing them can prove to be quite complex, and very time-consuming.
New infosec products of the week: March 17, 2023
Here’s a look at the most interesting products from the past week, featuring releases from Atakama, Elevate Security, Hornetsecurity, HYPR, and ReversingLabs.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/03/19/week-in-review-kali-linux-gets-purple-microsoft-zero-days-get-patched/