Raspberry Robin spotted using two new 1
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-29360 | Untrusted Pointer Dereference in Microsoft Streaming Service Grants SYSTEM Privileges CVE-2023-29360 is an untrusted pointer dereference (CWE-822) in the Microsoft Streaming Service, the kernel-level streaming component that ships with Windows. A local attacker who can run code on an affected system can trigger the flaw to dereference an attacker-controlled pointer, elevating their privileges from an ordinary user to SYSTEM. Successful exploitation gives the attacker full control of the host, making it a useful post-compromise step for threat actors, including in ransomware chains (CISA notes ransomware use as unknown). Any Windows system that includes the Microsoft Streaming Service is affected; the vulnerability was addressed by Microsoft's security updates in 2023. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-02-29, and EPSS estimates a 22.1% probability of exploitation in the next 30 days (98th percentile). Do: Apply Microsoft's June 2023 (or later) security updates on all Windows client and server hosts, per the CISA required action to apply vendor mitigations or discontinue use; there is no indication of a workaround, so patching is the primary mitigation. Prioritize systems where local privilege escalation has real impact — multi-user endpoints, RDP-exposed servers, and hosts with evidence of prior compromise — since exploitation requires local execution. Confirm patch levels against Microsoft's advisories and treat the KEV listing as a remediation deadline for your environment. | 8.4 | 22% | KEV |
| masseffectively the global Windows installed base | |
| CVE-2023-36802 | Use-After-Free Privilege Escalation in Microsoft Streaming Service Proxy CVE-2023-36802 is a use-after-free vulnerability (CWE-416) in the Microsoft Streaming Service Proxy, a component that ships with Windows, that allows an attacker to escalate privileges. It is triggered by a local attacker who can already execute code on a target machine and interacts with the streaming service proxy component in a way that mishandles freed memory. Successful exploitation typically yields elevated (SYSTEM/kernel-level) privileges, giving an attacker full control of the host and making it a common link in chained attack sequences alongside other exploits. Any Windows system carrying the affected component is potentially affected, which in practice means a very broad installed base of Windows client and server machines. The flaw is being actively exploited — CISA added it to the Known Exploited Vulnerabilities catalog on 2023-09-12 — though no public proof-of-concept is known and Microsoft's severity scoring was not yet available in the source data; EPSS estimates a high 27.5% chance of exploitation within 30 days (98th percentile). Do: Apply Microsoft's security updates for this vulnerability via the vendor's mitigation instructions (Windows Update/patch channel), as required by the CISA KEV listing, prioritizing internet-reachable and multi-user Windows hosts. Since exploitation requires local access, limit who can run code on Windows systems and review endpoints for signs of local privilege escalation activity; confirm the patch landed by checking installed updates against Microsoft's advisory. | 7.8 | 28% | KEV |
| mass≈hundreds of millions of Windows devices (the Streaming Service Proxy component ships with Windows, so exposure broadly mirrors the Windows install base) |
Full article657 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
February 11, 2024
Raspberry Robin continues to evolve, it was spotted using two new one-day exploits for vulnerabilities either Discord to host samples.
Raspberry Robin is a Windows worm discovered by cybersecurity researchers from Red Canary, the malware propagates through removable USB devices.
The malicious code uses Windows Installer to reach out to QNAP-associated domains and download a malicious DLL. The malware uses TOR exit nodes as a backup C2 infrastructure.
The malware was first spotted in September 2021, the experts observed it targeting organizations in the technology and manufacturing industries. Initial access is typically through infected removable drives, often USB devices.
The malware uses cmd.exe to read and execute a file stored on the infected external drive, it leverages msiexec.exe for external network communication to a rogue domain used as C2 to download and install a DLL library file.
Checkpoint researchers now detailed the evolution of the threat, Raspberry Robin authors integrated two new 1-day LPE (local privilege escalation) zero-day exploits. The experts believe that the operators have access to an exploit seller or the malware authors have developed the exploits.
The researchers noticed that Raspberry Robin is continually updated with new features and supports new evasion capabilities.
The malicious code also changed its communication method and lateral movement to avoid detection.
Raspberry Robin is now spreading by disguising itself as a legitimate Windows component.
“Since last October, we have seen large waves of attacks against our customers worldwide. Since our last report, it is clear that Raspberry Robin hasn’t stopped implementing new features and tricks that make it even harder to analyze.” reads the report published by Checkpoint. “Most importantly, Raspberry Robin continues to use different exploits for vulnerabilities either before or only a short time after they were publicly disclosed. Those 1-day exploits were not publicly disclosed at the time of their use. An exploit for one of the vulnerabilities, CVE-2023-36802, was also used in the wild as a 0-day and was sold on the Dark Web.”
The vulnerability CVE-2023-36802 is a Type Confusion issue in Microsoft Streaming Service Proxy. A local attacker can exploit the flaw to escalate privileges to SYSTEM (Local Privilege Escalation). The vulnerability is triggered when one of the following IOCTLs.
The vulnerability was disclosed on September 12, but researchers reported it had been exploited in the wild for some time before becoming a zero-day. Researchers from cybersecurity Cyfirma reported that an exploit for CVE-2023-36802 was available for sale on Dark Web forums in February 2023, while Microsoft and CISA warned about its exploitation in September.
Raspberry Robin started using an exploit for CVE-2023-36802 in October 2023. In 2023: Valentina Palmiotti published details of CVE-2023-36802 and its exploitation.
The analysis of the samples before October, revealed that the operators also used an exploit for CVE-2023-29360. The exploit for the vulnerability CVE-2023-29360 was publicly disclosed in June, and Raspberry Robin employed it in August.
“Even though this is a pretty easy vulnerability to exploit, the fact that the exploit writer had a working sample before there was a known exploit in GitHub is impressive as is how quickly Raspberry Robin used it.” continues the report.
The researchers conclude that Raspberry Robin operators have purchased the 1-day exploits from an exploit developer for the following reasons:
- “The exploits are used as an external 64-bit executable. If the Raspberry Robin authors were the developers of the exploits, then they would have probably used the exploits in the main component itself. In addition, the exploits would be packed in the same way and have the same format as the different stages of the main component.“
- The exploits are only available for 64-bit.
- The exploits are not heavily obfuscated and don’t have Control flow flattening and variable masking as in Raspberry Robin’s main component.
The report includes Indicators of Compromise (IoCs) for this threat.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – Hacking, malware)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/158969/malware/raspberry-robin-1-day-exploits.html