Tag Archives: Technology Tips

Posted on Author Atlantic Computer Services Categories Blog

Enemybot Malware May Go Beyond DDOS Attacks

Unless you’re an IT Security Professional, you may never have heard of EnemyBot.  It is a bit like the Frankenstein of malware threats, a botnet that has borrowed code from multiple different sources.

While that’s not terribly original, it does make it dangerous. The hackers behind the code are actively adding new exploits as newly disclosed critical vulnerabilities come to light in content management systems, IoT devices, Android devices, and web servers.

The botnet was first seen in action in March and is currently being tracked by researchers at Securonix.  By April, newer code samples were acquired, and the researchers found that EnemyBot had already integrated capabilities to attack flaws in more than a dozen processor architectures.

The botnet doesn’t do anything fancy and it mainly relies on DDoS (distributed denial of service) attacks. The latest version spotted has the capability to scan for new target devices and infect them.

According to AT&T’s Alien Labs, the most recent code samples contain several new exploits, including those for:

  • CVE-2022-22954: Critical (CVSS: 9.8) A remote code execution flaw impacting VMware Workspace ONE Access and VMware Identity Manager. PoC (proof of concept) exploit was made available in April 2022.
  • CVE-2022-22947: Another remote code execution flaw in Spring, fixed as zero-day in March 2022, and massively targeted throughout April 2022.
  • And CVE-2022-1388: Critical (CVSS: 9.8) Yet another remote code execution flaw impacting F5 BIG-IP, threatening vulnerable endpoints with device takeover. The first PoCs appeared in the wild in May 2022, and active exploitation began almost immediately.

Enemybot is a genuine threat and proof positive that you don’t have to be original or engage in out of the box thinking to engineer a serious piece of malware.  Watch out for this one because the developers behind it are clearly just getting warmed up.

0
Posted on Author Atlantic Computer Services Categories Blog

Screencastify Issue Could Allow Someone To Steal Recorded Videos

Are you one of the legions of users making use of the Screencastify Chrome extension?  It’s a fantastic Chrome extension that allows you to almost effortlessly create screencasts for a variety of purposes.

Unfortunately, the web extension also suffers from a critical security vulnerability that allows attackers to take control of a user’s webcam and steal recorded videos.

The cross-site scripting (XSS) vulnerability that made this possible was reported by independent security researcher Wladimir Palant and it was reported on Valentine’s Day of this year (February 14, 2022).  The vendor that created the extension responded quickly to the reported flaw and issued a fix just days after the issue was reported to them.

While we applaud the rapid response, unfortunately, the fix didn’t completely address the issue and it may still be possible. Although the threat from external attackers has been eliminated.  Unfortunately, three months later the lingering issues that could allow an unscrupulous insider to make the same kind of attack remain unaddressed.

That’s problematic because Screencastify boasts more than ten million installations worldwide on the Chrome store. The total number of installations may be significantly higher, but the site’s counter only goes to ten million.

The extension’s popularity exploded during the pandemic because it represented such a quick and easy solution to a problem that only emerged when tens of millions of people around the world started working from home.

Mr. Palant sums up the core issue thusly:

“The problem was located in the error page displayed if you already submitted a video to a challenge and were trying to submit another one.  This error page is located under a fixed address, so it can be opened directly rather than triggering the error condition.”

In any case, if you use the extension just be aware of the risks associated with it.  There is no word from the vendor on if or when another fix might be coming.

0
Posted on Author Atlantic Computer Services Categories Blog

 New Phishing Attacks Use HTML Email Attachments

HTML attachments as an attack vector may seem a little old school. However, according to statistics compiled by Kaspersky Lab indicates that in 2022, that form of attack is not just simply still being employed, but hackers are making surprisingly regular use of it.  The security company detected more than two million emails of this kind targeting Kaspersky customers in the first four months of the year (2022).

The specific breakdown of monthly instances looks like this:

  • January 2022: 299,859 instances
  • February 2022: 451,020 instances
  • March 2022: 851,328 instances
  • And April 2022: 386,908 instances

The researchers aren’t clear on exactly what caused the huge spike in March but they note that it returned to expected levels the month following.

Using HTML attachments as an attack vector saw a big spike in 2019 and then it seemed to fall out of favor. The number of instances dropped markedly and prompted some security researchers to conclude that, based on current trajectories, the attack vector was on the way out.

The last four months seem to have disproved that notion and HTML attachments are back in fashion in the underbelly of the web.

It’s important to remember that merely opening these files is in many cases enough to have JavaScript run on your system. That could lead to the target system being hijacked using a malware-assembly-on-disk scheme that could allow it to bypass antivirus software entirely.

This isn’t something that gets mentioned very often in employee email safety training, but it should be.

As ever, the best defense against any type of phishing attack is to treat any incoming email message from a sender you don’t know with a healthy dose of skepticism. If that email contains an attachment, those attachments should be treated even more skeptically.

0
Posted on Author Atlantic Computer Services Categories Blog

Update VMWare Apps Now For Critical Security Vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an advisory that serves as a stark warning.

If you’re using VMware products that are impacted by recently disclosed critical security flaws, either patch them immediately or remove them from your network.

CISA issued the dire warning because the last time critical security flaws were discovered in VMware products, hackers began exploiting them within 48 hours after they were disclosed.

In this case, the two recently disclosed issues are being tracked as CVE-2022-22972 and CVE-2022-22973, with severity scores of 9.8 and 10, respectively.

The flaws impact the following:

  • VMware Workspace ONE Access (Access)
  • VMware Identity Manager (vIDM)
  • VMware vRealize Automation (vRA)
  • VMware Cloud Foundation
  • and vRealize Suite Lifecycle Manager

Patches that protect against exploitation of these flaws are already available and VMware is likewise advising customers using the impacted products to apply them as soon as possible, describing the ramifications of delaying as “serious.”

This isn’t the first time VMware’s products have been in the spotlight.  Just last month, there were two other flaws (tracked as CVE-2022-22954 and CVE-2022-22960), which impacted the same products.

Although VMware moved quickly in that instance, releasing a patch very quickly, hackers were able to reverse engineer those patches and exploit the flaws anyway.

Worst of all, the security firm Rapid7 has already seen evidence of the exploitation of these flaws in the wild. So every day you don’t patch, you’ve essentially got a target on your back.

CISA has issued the same warning to federal agencies, saying:

“CISA expects threat actors to quickly develop a capability to exploit these newly released vulnerabilities in the same impacted VMware products. Exploiting the above vulnerabilities permits attackers to trigger a server-side template injection that may result in remote code execution (CVE-2022-22954); escalate privileges to ‘root’ (CVE-2022-22960 and CVE-2022-22973); and obtain administrative access without the need to authenticate (CVE-2022-22972).”

Serious issues indeed.  Update as soon as possible.

0
Posted on Author Atlantic Computer Services Categories Blog

New Phishing Attack Delivers Three Types Of Malware To Victims

Phishing campaigns get more effective the more closely they can imitate a trusted source.  Recently, security researchers at Fortinet discovered evidence of a phishing campaign that specifically targets Microsoft Windows users and installs three different types of malware on the systems it manages to infect.

Among other things, this campaign gives the hackers behind it the ability to steal usernames, passwords, banking details, and more. That is in addition to leveraging the infected system to secretly mine for cryptocurrency, which finds its way into a wallet controlled by the hackers.

To lure victims into infecting themselves, the Phishing campaign’s contact emails are all designed to appear as a payment report from a legitimate trusted source, which contains an attached Microsoft Excel document. It is conveniently included for the recipient’s review. Naturally, anyone opening the attached document dooms themselves, as it is poisoned and contains scripts designed to install malicious payloads in the background.

Phishing campaigns remain one of the most popular infection methods in the hacking world.  They tend to gravitate to those techniques that work and require relatively little in the way of effort.

Phishing fits that bill perfectly.  It’s usually a trivial matter to create an email that’s virtually identical to one you might get from a trusted source, and hackers have been poisoning Microsoft Excel files since the earliest days of the internet.

As ever, the best defense against these types of attacks is vigilance and mindfulness.  A quick phone call to the trusted source that supposedly sent you the email communication is almost always enough to verify whether it is real. Shockingly, few users take this step.

In a similar vein, clicking on embedded links in an email or downloading files should be done with a healthy dose of caution. That includes another phone call to the trusted source to be sure they did in fact send you something.

Unfortunately, that’s a lot easier to teach than it is to implement, as employees don’t have a good track record with either of those things.

0
1 2 3 4 5 6 … 11