Week in review: Social media-enabled cybercrime, fighting credential stuffing, digital signature spoofing
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-20250 | Absolute Path Traversal in RARLAB WinRAR ACE Extraction (UNACEV2.dll) WinRAR versions through 5.61 contain a path traversal flaw (CWE-22, also mapped to CWE-36) in the UNACEV2.dll library used to unpack ACE-format archives: when a crafted archive's filename field contains absolute-path patterns, WinRAR ignores the user-selected extraction destination and writes the file to any absolute path the attacker specifies. It is triggered by inducing a user to open a malicious ACE archive (user interaction required), allowing arbitrary file placement on the endpoint — for example, writing an executable to a Windows startup folder to achieve code execution at next logon, as demonstrated in the original Check Point research. Only RARLAB WinRAR is affected, and the issue was assigned by Check Point acting as CNA, with multiple public proofs of concept available. Exploitation is well established: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2022-02-15) with known ransomware use (e.g., JNEC.a delivered via this exploit), has been linked to targeted-activity by threat actors, and EPSS currently assigns a 96.3% probability of exploitation within 30 days. Because WinRAR lacks an automatic update mechanism, stale installations remained exposed and under active attack long after the vendor fix was published. Do: Apply updates per vendor instructions by upgrading to a WinRAR release newer than 5.61, in which the vulnerable ACE handling is patched or replaced; ensure endpoints actually run the updated build given WinRAR does not auto-update. If patching cannot be done promptly, delete or neutralize UNACEV2.dll (disabling ACE extraction) or unpack ACE archives with a patched alternative, and scrutinize ACE attachments arriving via email. Hunt for unexpected files dropped into auto-run locations (e.g., startup folders) and treat this as a KEV entry with the corresponding federal remediation deadline. | 7.8 | 96% | KEV ransomware PoC ×5 |
| masshundreds of millions of Windows desktop installations (every WinRAR release up to 5.61 is vulnerable) | |
| CVE-2019-1663 | A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco R A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The vulnerability is due to improper validation of user-supplied data in the web-based management interface. An attacker could exploit this vulnerability by sending malicious HTTP requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system of the affected device as a high-privilege user. RV110W Wireless-N VPN Firewall versions prior to 1.2.2.1 are affected. RV130W Wireless-N Multifunction VPN Router versions prior to 1.0.3.45 are affected. RV215W Wireless-N VPN Router versions prior to 1.3.1.1 are affected. NVD description · AI analysis pending | 9.8 | 96% | PoC ×2 |
| — | |
| CVE-2019-6340 | Deserialization RCE in Drupal 8 Core Web Services (CVE-2019-6340) Several field types in Drupal 8.5.x and 8.6.x fail to properly sanitize data arriving from non-form sources (CWE-502, deserialization of untrusted data), which can lead to arbitrary PHP code execution on the server. The flaw is triggered remotely when a site has the Drupal 8 RESTful Web Services (rest) core module enabled and accepts PATCH or POST requests, or when other web services modules are enabled, such as JSON:API on Drupal 8 or the Services and RESTful Web Services contributed modules on Drupal 7. A successful attack yields unauthenticated remote code execution with high impact on confidentiality, integrity, and availability, typically running as the web server user. Only Drupal sites meeting the web-services conditions are affected: Drupal 8 sites running versions before 8.5.11 or 8.6.10, and Drupal 7 sites using the Services or RESTful Web Services contributed modules. The flaw has public proof-of-concept exploits on Exploit-DB, was reported as under active exploitation shortly after disclosure, and is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-25). Do: Upgrade Drupal 8 core to 8.5.11 or later, or 8.6.10 or later, per vendor instructions. If patching is not immediately possible, disable the RESTful Web Services and JSON:API modules or restrict untrusted PATCH/POST requests to their endpoints; Drupal 7 sites using Services or RESTful Web Services should apply the contributed module updates from this advisory. Review web server and module logs for suspicious POST/PATCH requests to REST or JSON:API routes as evidence of compromise. | 8.1 | 92% | KEV PoC ×2 |
| largeroughly 10,000–100,000 sites plausibly exposed (a subset of the hundreds of thousands of Drupal 8 deployments, limited to those with REST/JSON:API web services… |
Full article931 words · extracted from helpnetsecurity.com · click to collapse
Here’s an overview of some of last week’s most interesting news and articles:
How WebAuthn aims to solve the password problem
Rather than tasking users with tracking dozens of separate passwords or requiring them to perform increasingly elaborate tasks to prove their identity, WebAuthn aims to create a standardized approach to authentication that will enable users to securely access web-based applications using their own unique authenticators (and without the additional need for a password).
Bug in Cobalt Strike pentesting tool used to identify malicious servers
An extraneous space in the HTTP responses of webservers run by a variety of malicious actors allowed Fox-IT researchers to identify them pretty easily for the past year and a half.
Sessions and events to check out at RSA Conference 2019
RSA Conference 2019 takes place next week in San Francisco. Here’s a brief overview of what to check out while you’re at the conference.
Most IoT devices are being compromised by exploiting rudimentary vulnerabilities
Cybercriminals are looking for ways to use trusted devices to gain control of Internet of Things (IoT) devices via password cracking and exploiting other vulnerabilities, such as through the exploitation via voice assistants, according to the latest Mobile Threat Report unveiled by McAfee.
New privacy-breaking attacks against phones on 4G and 5G cellular networks
Three new attacks can be used to track the location and intercept calls of phone users connected to 4G and 5G cellular networks, researchers from Purdue University and The University of Iowa have revealed.
Enterprises are blind to over half of malware sent to their employees
As the use of SSL grows to the point where it’s the standard protocol, cybercriminals are increasingly using encryption to conceal and launch attacks. This has become possible because SSL certificates, which used to be difficult to obtain, are now readily available at no charge.
How to combat delivery ramifications after a data breach
The legal ramifications of a data breach and the notifications that might need to be sent to past unsubscribed users could be significant. While laws like CAN-SPAM and CASL allow for notification-type emails to be sent in this scenario, the content requirements need to be carefully considered to avoid a potential violation.
40% of malicious URLs were found on good domains
While tried-and-true attack methods are still going strong, new threats emerge daily, and new vectors are being tested by cybercriminals, according to the 2019 Webroot Threat Report.
Phishing, software supply chain attacks greatest threats for businesses
Phishing attacks have become increasingly polymorphic, which means attackers don’t use a single URL, domain, or IP address to send mail, but make use of a varied infrastructure with multiple points of attack.
Cisco SOHO wireless VPN firewalls and routers open to attack
Cisco has released security fixes for several models of wireless VPN firewalls and routers, plugging a remote code execution flaw (CVE-2019-1663) that can be triggered via a malicious HTTP request.
ICANN calls for wholesale DNSSEC deployment
In light of the recent DNS hijacking attacks, the Internet Corporation for Assigned Names and Numbers (ICANN) is urging domain owners and DNS services to implement DNSSEC post-haste.
Fighting credential stuffing attacks is an uphill battle
Hackers directed credential abuse attempts at retail sites more than 10 billion times from May to December last year, making retail the most targeted segment studied, according to the Akamai 2019 State of the Internet / Security: Retail Attacks and API Traffic report.
Social media-enabled cybercrime is generating $3.25 billion a year
One in five organizations have been infected with malware distributed via social media.
Increasing security measures are driving cybercriminals to alter their techniques
As a result, two major shifts occured, including decreased reliance on malware and a decline in ransomware.
PDF viewers, online validation services vulnerable to digital signature spoofing attacks
Academics from Ruhr University Bochum have proven that the majority of popular PDF viewer apps and online digital signature validation services can be tricked into validating invalid signatures or validating signatures on documents that have been modified after having been signed.
Latest WinRAR, Drupal flaws under active exploitation
CVE-2018-20250, a WinRAR vulnerability that allows attackers to extract a malicious executable to one of the Windows Startup folder to be executed every time the system is booted, and CVE-2019-6340, the remote execution flaw affecting the popular Drupal CMS, have been spotted being exploited by attackers.
Many computers are vulnerable to hacking through common plug-in devices
Attackers can compromise an unattended machine in a matter of seconds through devices such as chargers and docking stations.
Healthcare industry: Key trends and cybersecurity challenges
Each year, Bitglass analyzes data from the U.S. Department of Health and Human Services’ “Wall of Shame,” a database containing information about breaches of protected health information (PHI) that affected 500 or more individuals.
Blocking compromised passwords from the Collection leak
It all started with Collection #1, a monster breach dubbed as the biggest data dump in history with its 773 million unique email addresses, and 22 million unique passwords. Next came Collection #2-5 with three times as many unique records. How does the Collection leak put your organization at risk?
Accidental data breaches are often compounded by a failure to encrypt
Accidental data breaches are often compounded by an organizational failure to encrypt data prior to it being shared – both internally and externally – putting their organizations at risk of non-compliance with major data privacy regulations, such as NYDFS Cybersecurity Regulation 23 NYCRR 500, GDPR, HIPAA and the emerging California Privacy Act (AB375).
New infosec products of the week: March 1, 2019
A rundown of infosec products released last week.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/03/03/week-in-review-social-media-enabled-cybercrime-fighting-credential-stuffing-digital-signature-spoofing/