Week in review: Kali Linux 2021.3, how to avoid cloud configuration breaches, hybrid digital dexterity
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-30858 | Use-After-Free in WebKit on Apple iOS, iPadOS, and macOS Allows Arbitrary Code Execution CVE-2021-30858 is a use-after-free memory corruption flaw (CWE-416) in the web content processing component (WebKit) of Apple iOS, iPadOS, and macOS, which Apple addressed with improved memory management. An attacker triggers it by getting a victim to process maliciously crafted web content, typically by visiting or being redirected to an attacker-controlled site, and successful exploitation leads to arbitrary code execution on the victim's device (CVSS 3.1: 8.8 High, network vector with user interaction required). Anyone running affected builds of iOS, iPadOS, or macOS, or the affected component on Fedora or Debian Linux per the CPE data, is exposed, since virtually all Apple devices process web content by default. Apple acknowledged that the flaw was being actively exploited, reportedly as part of NSO Group's 'ForcedEntry' targeted zero-day espionage chain, and CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03. No public proof-of-concept is known, but the confirmed in-the-wild use makes rapid patching urgent. Do: Update iPhones and iPads to iOS/iPadOS 14.8 and Macs to macOS Big Sur 11.6 immediately, and on Fedora or Debian apply the distribution's updated WebKit packages. Use MDM or inventory data to confirm no managed devices remain on pre-patch builds, since the flaw was exploited as a zero-day in targeted espionage operations. This is a CISA KEV entry (added 2021-11-03), so the catalog's required action of applying vendor updates is mandatory for federal agencies and strongly recommended for everyone else. | 8.8 | 13% | KEV |
| mass>1 billion users/devices (Apple's 1B+ active device base, all of which carry the vulnerable web-content code path) | |
| CVE-2021-30860 | Integer Overflow in Apple PDF Processing Enables Arbitrary Code Execution (CVE-2021-30860) CVE-2021-30860 is an integer overflow (CWE-190) in PDF processing across Apple's platforms that was addressed with improved input validation. It is triggered when a device processes a maliciously crafted PDF — notably when a PDF is rendered after being received via messaging — and successful exploitation allows arbitrary code execution in the context of the PDF renderer. Affected products include iOS/iPadOS, macOS (Big Sur and Catalina), and watchOS, as well as the Xpdf and Poppler PDF libraries, which share lineage with the vulnerable code. Apple confirmed the issue was being actively exploited in the wild, and public reporting ties it to NSO Group's 'ForcedEntry' exploit chain used to deliver Pegasus spyware; CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03. Given the very high EPSS score (76%, 99th percentile) and confirmed active exploitation, defenders should treat this as a high-priority patch. Do: Update iPhones/iPads to iOS/iPadOS 14.8, Macs to macOS Big Sur 11.6 (or apply Security Update 2021-005 Catalina), and Apple Watch to watchOS 7.6.2 immediately, and patch Poppler/Xpdf through distribution or vendor updates. Because the flaw was exploited via crafted PDFs delivered through messaging (ForcedEntry/Pegasus), organizations and individuals at risk of targeted spyware should also review devices for signs of compromise. CISA KEV requires applying updates per vendor instructions; prioritize internet-connected and high-value user endpoints. | 7.8 | 76% | KEV |
| mass>1 billion active Apple devices (iPhones, iPads, Macs, Apple Watches), plus Poppler present by default on most Linux desktops and servers | |
| CVE-2021-40444 | Remote Code Execution via MSHTML Rendering Engine in Microsoft Windows/Office (CVE-2021-40444) CVE-2021-40444 is a remote code execution vulnerability in the Microsoft MSHTML browser rendering engine, which Microsoft Office documents can load on Windows systems. It is triggered when a user is convinced to open a specially crafted Office document containing a malicious ActiveX control hosted by the MSHTML engine (tracked as a path-traversal-class issue, CWE-22). A successful attacker gains the ability to run arbitrary code in the context of the logged-on user, with greater impact when that user has administrative rights. Any Windows system that can open Office documents is exposed, spanning Windows 7, 8.1, RT 8.1, Windows 10 (1507 through 21H1) and Windows Server 2004/2008. Exploitation is confirmed in the wild: Microsoft observed targeted attacks at disclosure, the flaw is in CISA's KEV with known ransomware use, and Microsoft released security updates on September 14, 2021. Do: Apply Microsoft's security updates released September 14, 2021 for your Windows version immediately; this is a CISA KEV item with known ransomware use, so patching is treated as mandatory. As interim protection, keep Microsoft Defender Antivirus/Defender for Endpoint signatures current (enterprise detection build 1.349.22.0 or newer, with alerts appearing as 'Suspicious Cpl File Execution') and avoid opening untrusted Office documents, since exploitation requires user interaction with a crafted file. | 8.8 | 97% | KEV ransomware PoC ×2 |
| masshundreds of millions of Windows PCs and servers (nearly all Windows desktop/laptop installs on affected versions at disclosure) |
Full article1,156 words · extracted from helpnetsecurity.com · click to collapse
Here’s an overview of some of last week’s most interesting news, articles and interviews:
Apple fixes “zero-click” iMessage zero-day exploited to deliver spyware (CVE-2021-30860)
Apple has released security updates for macOS, iOS, iPadOS, watchOS and Safari that patch two vulnerabilities (CVE-2021-30860, CVE-2021-30858) that are being exploited in attacks in the wild.
Kali Linux 2021.3 released: Kali NetHunter on a smartwatch, wider OpenSSL compatibility, new tools, and more!
Offensive Security has released Kali Linux 2021.3, the latest version of its popular open source penetration testing platform. You can download it or upgrade to it.
CVE-2021-40444 exploitation: Researchers find connections to previous attacks
The recent targeted attacks exploiting the (at the time) zero-day remote code execution vulnerability (CVE-2021-40444) in Windows via booby-trapped Office documents have been delivering custom Cobalt Strike payloads, Microsoft and Microsoft-owned RiskIQ have shared.
Microsoft announces passwordless authentication option for consumers
After offering the passwordless authentication option to enterprise customers in March 2021, Microsoft has now started rolling it out to its consumer segment of users.
Third-party cloud providers: Expanding the attack surface
In this interview with Help Net Security, Fred Kneip, CEO at CyberGRX, talks about the lack of visibility into third-party risk, how to address this issue, and what companies should consider when choosing the right cloud provider.
Only 30% of enterprises use cloud services with E2E encryption for external file sharing
A recent study of enterprise IT security decision makers conducted by Tresorit shows that majority of enterprises use additional encryption methods to boost the security of cloud collaboration and file transfer, however, tools with built-in end-to-end encryption are still less frequent despite the growing popularity of this privacy and security enhancing technology.
Mobile app creation: Why data privacy and compliance should be at the forefront
In today’s mobile app landscape, providing customers with the most tailored and personal experience possible is essential to edging out competitors. But creating such a custom-made experience requires collecting personal data – and when considering the criticism massive tech companies are garnering for their misuse of sensitive information – mobile app developers must prioritize data privacy and compliance.
Network security market growth driven by remote work popularity and security needs
Frost & Sullivan’s recent analysis of the Asia-Pacific (APAC) network security (NWS) market finds that the increasing acceptance of remote work and adoption of cloud, the remote workplace, collaboration, and security are driving growth.
How to achieve digital dexterity with a predominantly hybrid workforce
DEX is the way employees interact with the IT department and any technology capabilities within their workspace. The best way to enhance DEX is by adopting a digital experience management (DEM) solution that can help monitor and simplify the end-user experience.
46% of all on-prem databases are vulnerable to attack, breaches expected to grow
46% of all on-prem databases globally are vulnerable to attack, according to a research by Imperva. A five-year longitudinal study comprising nearly 27,000 scanned databases discovered that the average database contains 26 existing vulnerabilities.
Healthcare cybersecurity: How to prevent the compromise of patient records?
Year after year, the number of data breaches affecting entities in the healthcare industry rises, and 2020 was no exception. The 616 data breaches reported this past year to the US Department of Health & Human Services (DHHS) have resulted in the exposure / compromise of 28,756,445 healthcare records.
Ransomware preparedness is low despite executives’ concerns
86.7% of C-suite and other executives say they expect the number of cyberattacks targeting their organizations to increase over the next 12 months, according to a recent Deloitte poll.
How to evaluate the security risk of your databases
This article can help you quantify the level of security of your databases on a scale of 1 to 10. CISOs and database administrators (DBAs) can use it to determine their security maturity level and identify steps to improve it further.
Most Fortune 500 companies’ external IT infrastructure considered at risk
Nearly three quarters of Fortune 500 companies’ IT infrastructure exists outside their organization, a quarter of which was found to have a known vulnerability that threat actors could infiltrate to access sensitive employee or customer data, a Cyberpion research reveals.
OSI Layer 1: The soft underbelly of cybersecurity
As traditional cybersecurity solutions improve, they push cyberattackers toward alternative paths. Layer 1 of the OSI model (i.e., the physical layer) has become a fertile ground for attacks and, effectively, the soft underbelly of cybersecurity.
Highest paying IT certifications in 2021
A report on the skills and salaries of professionals in the technology sector reveals the true value of certification. It also identifies the number one reason for leaving a job is a lack of career growth and professional development.
Three ways to keep your organization safe from cyberattacks
Cyberattacks continue making headlines as more companies fall victim to ransomware. Throughout the past year, we saw some of the largest breaches, leaks, and real-world attacks to date.
9 tips to avoid cloud configuration conundrums
The recent T-Mobile breach is reported to be the result of a misconfiguration that made an access point publicly accessible on the internet. Luckily, there are tactics one can deploy to avoid cloud configuration breaches and prevent error from both technology and humans.
Keys to the cloud: Unlocking digital transformation to enhance national security
According to recent research, federal spending on cloud computing is anticipated to grow from $6.8 billion in 2020 to nearly $7.8 billion in 2022. As this adoption accelerates, the information environment remains highly distributed and riddled with duplicative information, hindering decision makers with limited access to authoritative data, poor data integration across disparate systems, and low-quality data.
The digital identity imperative
The ever-evolving shift to digital means that most of our day-to-day activities are carried out online. We’re now accustomed to simply toggling through a few apps to book a ride, order dinner and scroll through content from friends and public figures alike. Each of these actions requires a basic premise of trust and safety online which starts with identities needing to be verified and authenticated.
CCSP practice quiz: It’s time to test your knowledge
Studying for the CCSP exam? The CCSP practice quiz is a great (FREE) study tool that allows you to quickly identify any knowledge gaps you might have in each domain. Your quiz results will allow you to refine your study strategy, so you can show up on test day ready to take the CCSP exam with confidence.
Whitepaper: Cobalt Strike – a toolkit for pentesters
The cybercrime underground’s adoption of Cobalt Strike correlates with the rise in ransomware activity over the past few years. Cobalt Strike is a commercial tool used by legitimate penetration testers. However, many open source reports show the suite also is used by state-sponsored actors and cybercriminals.
New infosec products of the week: September 17, 2021
Here’s a look at the most interesting product releases from the past week, featuring releases from Alation, IDrive, Hornetsecurity, Palo Alto Networks, Qualys, ThreatConnect and Titania.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2021/09/19/week-in-review-kali-linux-2021-3-how-to-avoid-cloud-configuration-breaches-hybrid-digital-dexterity/