Security Boulevard

South Korea’s national security and intelligence agencies have recently issued a joint cybersecurity advisory highlighting a significant cyber threat. State-backed hackers from the Democratic People’s Republic of Korea (DPRK) have exploited vulnerabilities in a VPN software update to deploy sophisticated malware, aiming to breach secure networks. Read on to get the details.  Tell me more about the North Korean information ... Read More

The post North Korean Hackers Exploit VPN Update Flaw to Deploy Malware appeared first on Nuspire.

The post North Korean Hackers Exploit VPN Update Flaw to Deploy Malware appeared first on Security Boulevard.

A report published today by Cato Networks finds three years after its discovery in 2021 there was a 61% increase in attempts to exploit Log4j vulnerabilities in inbound traffic and a 79% increase in the attempted use of Log4j in WANbound traffic in the first half of this year.

The post Cato Network Reports Spike in Attempts to Exploit Log4j Vulnerabilities appeared first on Security Boulevard.

That’s a wrap for Black Hat 2024! We had a great show and met many of you at the booth or on the show floor. I hope you were able to come by, watched a session by Jason Kent, Hacker in Residence at Cequence, or Parth Shukla, Security Engineer at Cequence, and maybe even entered […]

The post Cequence Storms Black Hat with API Security Testing for Generative AI Applications appeared first on Cequence Security.

The post Cequence Storms Black Hat with API Security Testing for Generative AI Applications appeared first on Security Boulevard.

Compliance with SOC 2 assures that the company maintains a high standard of information security, and highlights it among market competitors.

The post How to Prepare for SOC 2 and ISO 27001 Audit? Tips for Jira Admins appeared first on Security Boulevard.

To stay future-proof, organizations are beginning to realize the value of adopting a new way of protecting data assets known as a cyber resilience approach.

The post Three Reasons to Take a New Cyber-Resilient Approach to Data Protection appeared first on Security Boulevard.

Really interesting article on the ancient-manuscript scholars who are applying their techniques to the Voynich Manuscript.

No one has been able to understand the writing yet, but there are some new understandings:

Davis presented her findings at the medieval-studies conference and published them in 2020 in the journal Manuscript Studies. She had hardly solved the Voynich, but she’d opened it to new kinds of investigation. If five scribes had come together to write it, the manuscript was probably the work of a community, rather than of a single deranged mind or con artist. Why the community used its own language, or code, remains a mystery. Whether it was a cloister of alchemists, or mad monks, or a group like the medieval Béguines—a secluded order of Christian women—required more study. But the marks of frequent use signaled that the manuscript served some routine, perhaps daily function...

The post On the Voynich Manuscript appeared first on Security Boulevard.

One often overlooked aspect in the aftermath of a breach is the meticulous examination of firewall rule histories. These records not only reveal how an attacker gained access but can illuminate the path they took within an organization’s network.

The post The Crucial Role of Firewall Rule Histories appeared first on Security Boulevard.

Several security issues have recently been discovered in OpenSSL that could result in denial-of-service attacks. OpenSSL is widely used to secure communications across the internet, making these vulnerabilities a significant concern. In response, Canonical has released security updates to address multiple OpenSSL vulnerabilities across different releases, including Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, and Ubuntu […]

The post Ubuntu Fixes Multiple OpenSSL Vulnerabilities appeared first on TuxCare.

The post Ubuntu Fixes Multiple OpenSSL Vulnerabilities appeared first on Security Boulevard.

This Article What is the Critical Pathway to Insider Risk (CPIR)? was first published on Signpost Six. | https://www.signpostsix.com/

Insider risk remains one of the most challenging threats for organisations to manage. The Critical Pathway to Insider Risk (CPIR) offers a structured approach to understanding and mitigating this threat by examining the pathway of events and factors leading to insider acts. This model is based on extensive research into the behaviours and characteristics of […]

This Article What is the Critical Pathway to Insider Risk (CPIR)? was first published on Signpost Six. | https://www.signpostsix.com/

The post What is the Critical Pathway to Insider Risk (CPIR)? appeared first on Security Boulevard.

PALO ALTO, Calif. – August 13, 2024 – TuxCare, a global innovator in cybersecurity for Linux, today announced the launch of its TuxCare Oracle Linux 7 Extended Lifecycle Support (ELS) that enables enterprises to confidently maintain the security of their systems for up to four years following Oracle Linux 7’s end of life that is […]

The post TuxCare Offers Four Years of Precision-Engineered Security Updates for Oracle Linux 7 appeared first on TuxCare.

The post TuxCare Offers Four Years of Precision-Engineered Security Updates for Oracle Linux 7 appeared first on Security Boulevard.

Application Security Posture Management (ASPM) arose a few years ago as a strategy to help software developers and security teams continually improve the security of business applications.

Related: Addressing rising cyber compliance pressures

At Black Hat USA 2024,… (more…)

The post Black Hat Fireside Chat: Here’s how ‘Active ASPM’ is helping to triage and remediate coding flaws first appeared on The Last Watchdog.

The post Black Hat Fireside Chat: Here’s how ‘Active ASPM’ is helping to triage and remediate coding flaws appeared first on Security Boulevard.

LAS VEGAS — Ransomware attacks are escalating in scale and frequency. But one recent payout, a record  $75 million by a victimized Fortune 50 company, trumped a surge in extortion attacks that are likely to only increase, according to a new report from Zscaler Inc.’s ThreatLabz research. “Stolen data and extortion is going up exponentially,”..

The post Ransomware Attack Fetched A Record $75 Million appeared first on Security Boulevard.

Authors/Presenters:Kevin Morio, Ilkan Esiyok, Dennis Jackson, Mozilla; Robert Künnemann

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – Automated Security Analysis of Exposure Notification Systems appeared first on Security Boulevard.

The DOJ shut down another "laptop farm" link to a North Korean fake IT worker scam that the country uses to illegally bring in money for its nuclear and ballistic weapons program and to steal information from unsuspecting companies in the United States and elsewhere.

The post DOJ Shuts Down Another North Korean ‘Laptop Farm’ appeared first on Security Boulevard.

IntroductionOn August 5, 2024, researchers at SonicWall discovered a zero-day security flaw in Apache OFBiz tracked as CVE-2024-38856. The vulnerability, which has been assigned a CVSS score of 9.8, allows threat actors to perform pre-authentication remote code execution (RCE). While testing a patch for CVE-2024-36104, SonicWall researchers discovered that unauthenticated access was permitted to the ProgramExport endpoint, potentially enabling the execution of arbitrary code. These vulnerabilities arise from a flaw in the override view functionality, which can be exploited by unauthorized threat actors through maliciously crafted requests, leading to the remote code execution.

RecommendationsZscaler ThreatLabz strongly advises users of the Apache OFBiz application to promptly upgrade to version 18.12.15, as this version contains fixes to mitigate the security vulnerabilities identified in CVE-2024-38856 and CVE-2024-36104.

Affected VersionsThe following versions of Apache OFBiz are affected by the disclosed vulnerabilities and should be updated immediately:

All versions 18.12.13 and below are impacted by CVE-2024-36104
All versions 18.12.14 and below are impacted by CVE-2024-38856

BackgroundApache OFBiz is an open-source Enterprise Resource Planning (ERP) system that provides business solutions for various industries. This includes tools to manage operations like customer relationships, order processing, human resource functions, warehouse management, and more.

During the analysis of CVE-2024-36104, a vulnerability disclosed on June 3, 2024, SonicWall researchers discovered the ControlServlet and RequestHandler functions received different endpoints when handling the same request. Ideally, both functions should process the same endpoint. CVE-2024-38856 allows unauthenticated access to the ProgramExport endpoint, which should have been restricted.

How It WorksIn the previous vulnerability, CVE-2024-36104, Apache OFBiz was found to have a flaw that enabled remote attackers to access system directories due to inadequate validation of user requests. Exploiting this flaw involved sending a malformed URL containing '..' sequences, which could result in the execution of arbitrary code on the system.

An example of a malformed POST request and request-body is shown below.

POST /webtools/control/forgotPassword/;%2e%2e/ProgramExport

POST-Body: groovyProgram=throw new Exception('whoami'.execute().text);

In the figure below, the example malformed request is shown. This request includes a command 'whoami' that is being executed, and the resulting output of the command is displayed in the error message. The output of the command is highlighted in the green box.

Figure 1: An example of a POST request related to CVE-2024-36104. The request includes an encoded request body, along with its corresponding output.

The most recent vulnerability, CVE-2024-38856, permits unauthorized access to the ProgramExport endpoint without the need for a path traversal vector. This means that access is granted even when it should have been restricted.

The figure below shows an attack chain exploiting CVE-2024-38856.

Figure 2: The attack chain depicting an attacker exploiting CVE-2024-38856.

The figure below shows the malformed request, without a path traversal vector, being executed, and the resulting output of the command is displayed in the error message.

Figure 3: An example of a POST request related to CVE-2024-38856. The request includes an encoded request body, and the output associated with it.

Further investigation revealed that unauthenticated access to the ProgramExport endpoint was possible by combining it with any other endpoint that does not require authentication. Examples of such endpoints include:

forgotPassword
showDateTime
TestService
view
main

URLs that could be used to exploit this vulnerability are:

POST /webtools/control/forgotPassword/ProgramExport
POST /webtools/control/showDateTime/ProgramExport
POST /webtools/control/TestService/ProgramExport
POST /webtools/control/view/ProgramExport
POST /webtools/control/main/ProgramExport

ConclusionTo protect against CVE-2024-38856, it is important to update Apache OFBiz systems to version 18.12.15 as soon as possible. Neglecting to upgrade promptly exposes systems to significant security risks, which could enable threat actors to manipulate login parameters and execute arbitrary code on the target server.

Zscaler CoverageThe Zscaler ThreatLabz team has deployed the following.

Zscaler Advanced Threat Protection

App.Exploit.CVE-2024-38856
App.Exploit.CVE-2024-36104

Zscaler Private Access AppProtection

HTML.Exploit.CommandInjection:6000004

For more details, visit the Zscaler Threat Library.

The post CVE-2024-38856: Pre-Auth RCE Vulnerability in Apache OFBiz appeared first on Security Boulevard.

via the comic & dry wit of Randall Munroe, creator of XKCD

Permalink

The post Randall Munroe’s XKCD ‘Vice President First Names’ appeared first on Security Boulevard.

Torrance, Calif., Aug. 12, 2024, CyberNewsWire — Criminal IP, an expanding Cyber Threat Intelligence (CTI) search engine from AI SPERA, has recently completed its technology integration with Maltego, a global all-in-one investigation platform that specializes in visualized analysis … (more…)

The post News alert: Criminal IP and Maltego team up to broaden threat intelligence data search first appeared on The Last Watchdog.

The post News alert: Criminal IP and Maltego team up to broaden threat intelligence data search appeared first on Security Boulevard.

In today’s rapidly evolving digital landscape, ensuring the security of web applications is essential to ensure revenue growth and a positive business reputation. One critical aspect of this security is the management of SSL/TLS certificates. The AppViewX AVX ONE platform is a comprehensive solution designed to automate and streamline the end-to-end lifecycle of digital certificates […]

The post AppViewX Automated Certificate Management for PingAccess appeared first on Security Boulevard.

Authors/Presenters:Feng Dong, Liu Wang Xu Nie, Fei Shao, Haoyu Wang, Ding Li, Xiapu Luo, Xusheng Xiao

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – DISTDET: A Cost-Effective Distributed Cyber Threat Detection System appeared first on Security Boulevard.

Threat Intelligence Report

Date: August 12, 2024

Prepared by: David Brunsdon, Threat Intelligence - Security Engineer, HYAS

Threat Actors Exploiting Legitimate Services to Disguise Traffic

Recently, the HYAS Threat Intelligence team has noticed an increase in malware communicating with subdomains under the ply.gg domain. The domain is a part of Playit.gg’s infrastructure, which is a service for computer gamers used to facilitate online play. Although intended for games like Minecraft, it provides a free domain name and a reverse proxy, which is a tool a threat actor can use to hide their malicious infrastructure.

This article demonstrates how threat actors will use legitimate services to disguise their traffic and hide their true location from investigators. It also draws attention to the ply.gg domain as a potential threat vector for malware-based attacks on organizations and individuals.

About Reverse Proxies

A reverse proxy is a server that sits between client devices and a server, intercepting requests from clients and forwarding them to the intended server. It functions as an intermediary that enhances the performance, security, and reliability of services.

Typical Uses of Reverse Proxies

1. Load Balancing:

Reverse proxies distribute incoming traffic across multiple servers to ensure no single server becomes overwhelmed. This improves the availability and reliability of applications, particularly those experiencing high traffic volumes.

2. Enhanced Security:

By hiding the backend servers' IP addresses, reverse proxies add an additional layer of security. They can also block malicious requests, protect against Distributed Denial-of-Service (DDoS) attacks, and serve as a first line of defense in a network security strategy.

3. SSL Termination:

Reverse proxies can manage SSL/TLS encryption and decryption, relieving backend servers from the computational load of handling these tasks. This is particularly useful for improving the performance of HTTPS websites.

4. Web Acceleration:

By caching content, reverse proxies can reduce the load on backend servers and speed up response times for users. This is beneficial for delivering static content such as images, stylesheets, and scripts more efficiently.

5. Content Filtering:

Reverse proxies can inspect and filter incoming requests to ensure they meet predefined criteria. This is useful for content filtering, enforcing security policies, and preventing access to restricted areas.

6. Compression:

They can compress outbound data to reduce the amount of bandwidth used, which can be particularly beneficial for users with slow internet connections.

Reverse Proxies in Malicious Activities

While reverse proxies serve many legitimate purposes, they can also be exploited by threat actors to conceal malicious activities. Cybercriminals use reverse proxies to:

• Hide Malicious Infrastructure: By routing traffic through a reverse proxy, attackers can mask the true location of their command-and-control (C2) servers, making it difficult for investigators to trace and shut them down.
• Bypass Security Measures: Reverse proxies can help bypass IP-based security controls, allowing attackers to evade detection and maintain persistent access to compromised systems.
• Proxy for Anonymity: Using reverse proxies helps cybercriminals maintain anonymity by preventing the exposure of their actual IP addresses during malicious campaigns.

By leveraging services like Playit.gg, threat actors can blend their traffic with legitimate gaming traffic, complicating efforts to detect and block malicious communications. Recognizing and understanding the use of reverse proxies is crucial for enhancing cybersecurity measures and thwarting such threats.

How Threat Actors Could Utilize Playit.gg

Threat actors could exploit the Playit.gg service to hide their malicious infrastructure and facilitate Command and Control (C2) operations. Here's a step-by-step breakdown of how this can be achieved:

1. Account Creation and Verification:

• The threat actor creates an account on Playit.gg by providing an email address.
• The email address is verified through a confirmation process, granting access to the service.

2. Download and Setup:

• An application is downloaded from Playit.gg and installed on a server controlled by the threat actor.
• The application is linked to the Playit.gg account, often requiring verification through the website.

3. Establishing and Hardening the C2 Server:

• The C2 server is configured to ensure it can only be accessed by the operators and through the Playit.gg proxy network.
• Security measures, such as IP allowlisting and authentication, are implemented to harden the C2 server against unauthorized access.

4. Configuring the Malware:

• The port number and the assigned domain name (provided by Playit.gg) are entered into the malware's configuration. These details are embedded in the malware, which is then deployed to victim devices.

5. Routing Malware Communications:

• Once the malware is active on victim devices, it initiates communication with the C2 server.
• All communications between the malware and the C2 server are routed through the Playit.gg proxy network.
• This setup masks the true location of the threat actor's server, making it challenging for defenders to trace and block the malicious infrastructure.

By leveraging Playit.gg, threat actors can seamlessly integrate their C2 infrastructure within legitimate gaming traffic. This not only obfuscates their activities but also complicates detection efforts by cybersecurity professionals, as the traffic appears to come from a well-known and trusted service.

(Image: Warning during configuration of playit.gg service)

Playit.gg clearly recognizes the potential for misuse on the platform and expressly forbids it from being used in such a way.

Recommendations

1. Restrict Access to the ply.gg Domain:
Organizations should consider blocking access to the ply.gg domain at the network level. This can be achieved through protective DNS solutions, or firewall rules to prevent potential malware communications from reaching their command-and-control (C2) servers.

2. Monitor Network Traffic for Anomalies:
Regularly monitor network traffic for any unusual or unauthorized connections to the ply.gg domain. Implementing advanced threat detection systems can help identify and alert on suspicious traffic patterns associated with C2 communication.

3. Implement Threat Intelligence Feeds:
Incorporate threat intelligence feeds that include indicators of compromise (IoCs) related to ply.gg and other similar domains. This can help in detecting and blocking known malicious activities associated with these services.

4. Educate Employees on Potential Threats:
Raise awareness among employees about the risks of accessing unauthorized or suspicious domains, including those related to gaming services like Playit.gg. Training should focus on recognizing phishing attempts and avoiding the installation of unauthorized software.

5. Enhance Endpoint Security:
Ensure that endpoint protection solutions are up-to-date and capable of detecting and blocking malware that may attempt to use ply.gg for C2 communication. Advanced endpoint detection and response (EDR) solutions can provide additional layers of protection.

6. Engage in Regular Security Audits:
Conduct regular security audits and vulnerability assessments to identify any weaknesses in your network that could be exploited by threat actors using reverse proxies like those provided by Playit.gg.

7. Collaborate with Threat Intelligence Providers:
Work closely with threat intelligence providers like HYAS, to stay informed about emerging threats and to receive timely updates on domains and services being exploited by cybercriminals.

By implementing these measures, organizations can significantly reduce the risk of malware using the ply.gg domain as a vector for attacks, thereby enhancing their overall cybersecurity posture.

Recent Example IOCs

Domain: ads-jeremy.gl.at.ply[.]gg
MD5: 36a75d896d48d43a54a8792fd92f3912
Family: asyncrat

Domain: paris-itself.gl.at.ply[.]gg
MD5: 9b2b8770c462d91bcf4d915cbea54202
Family: asyncrat

Domain: tax-sri.gl.at.ply[.]gg
MD5: b0198f2d25536cb8efb928857f696c1b
Family: nanocore

Domain: dead-he.gl.at.ply[.]gg
MD5:ad0314c9588f196a9a752b6732cf9612
Family: xworm

Domain: western-requires.gl.at.ply[.]gg
MD5:553326c1417f4220586311bae847d37b
Family: xworm

Domain: to-reconstruction.gl.at.ply[.]gg
MD5: ca312e982c9e4e5664ef45e8cb2be9cf
Family: xworm

Disclaimer: This Threat Intelligence Report is provided “as is” and for informational purposes only. HYAS disclaims all warranties, express or implied, regarding the report’s completeness, accuracy, or reliability. You are solely responsible for exercising your own due diligence when accessing and using this Report's information. The analyses expressed in this Report reflect our current understanding of available information based on our independent research using the HYAS Insight platform. The Report’s inclusion of any companies, organizations, or ASNs does not imply any wrongdoing on their part; it is simply an indication of where digital threat activities have been observed. HYAS reserves the right to update the Report as additional information is made known to us.

Learn More About HYAS Insight

An efficient and expedient investigation is the best way to protect your enterprise. HYAS Insight provides threat and fraud response teams with unparalleled visibility into everything you need to know about the attack.This includes the origin, current infrastructure being used and any infrastructure.

Read how the HYAS Threat Intelligence team uncovered and mitigated a Russian-based cyber attack targeting financial organizations worldwide.

Want more threat intel on a weekly basis?
Follow HYAS on LinkedIn
Follow HYAS on X

Sign up for the (free!) HYAS Insight Intel Feed

Read Recent HYAS Threat Reports:

The Prevalence of DarkComet In Dynamic DNS
Caught in the Act: StealC, the Cyber Thief in C
HYAS Protects Against Polyfill.io Supply Chain Attack with DNS Safeguards
StealC & Vidar Malware Campaign Identified

More from HYAS Labs

Polymorphic Malware Is No Longer Theoretical: BlackMamba PoC.
Polymporphic, Intelligent and Fully Autonomous Malware: EyeSpy PoC.

The post HYAS Investigates Threat Actors Hidden In Gaming Services appeared first on Security Boulevard.