Select Page
Microsoft Exchange Bug Exposes ~100,000 Windows Domain Credentials

Microsoft Exchange Bug Exposes ~100,000 Windows Domain Credentials

An unpatched design flaw in the implementation of Microsoft Exchange’s Autodiscover protocol has resulted in the leak of approximately 100,000 login names and passwords for Windows domains worldwide.

“This is a severe security issue, since if an attacker can control such domains or has the ability to ‘sniff’ traffic in the same network, they can capture domain credentials in plain text (HTTP basic authentication) that are being transferred over the wire,” Guardicore’s Amit Serper said in a technical report.

“Moreover, if the attacker has DNS-poisoning capabilities on a large scale (such as a nation-state attacker), they could systematically syphon out leaky passwords through a large-scale DNS poisoning campaign based on these Autodiscover TLDs [top-level domains].”

The Exchange Autodiscover service enables users to configure applications such as Microsoft Outlook with minimal user input, allowing just a combination of email addresses and passwords to be utilized to retrieve other predefined settings required to set up their email clients.

The weakness discovered by Guardicore resides in a specific implementation of Autodiscover based on the POX (aka “plain old XML”) XML protocol that causes the web requests to Autodiscover domains to be leaked outside of the user’s domain but in the same top-level domain.

images from Hacker News

Urgent Apple iOS and macOS Updates Released to Fix Actively Exploited Zero-Days

Urgent Apple iOS and macOS Updates Released to Fix Actively Exploited Zero-Days

Apple on Thursday released security updates to fix multiple security vulnerabilities in older versions of iOS and macOS that it says have been detected in exploits in the wild, in addition to expanding patches for a previously plugged security weakness abused by NSO Group’s Pegasus surveillance tool to target iPhone users.

Chief among them is CVE-2021-30869, a type confusion flaw that resides in the kernel component XNU developed by Apple that could cause a malicious application to execute arbitrary code with the highest privileges. The Cupertino-based tech giant said it addressed the bug with improved state handling.

Google’s Threat Analysis Group, which is credited with reporting the flaw, said it detected the vulnerability being “used in conjunction with a N-day remote code execution targeting WebKit.”

Two other flaws include CVE-2021-30858 and CVE-2021-30860, both of which were resolved by the company earlier this month following disclosure from the University of Toronto’s Citizen Lab about a previously unknown exploit called “FORCEDENTRY” (aka Megalodon) that could infect Apple devices without so much as a click.

The zero-click remote attack weaponizing CVE-2021-30860 is said to have been carried out by a customer of the controversial Israeli company NSO Group since at least February 2021. The scale and scope of the operation remains unclear as yet.

It relied on iMessage as an entry point to send malicious code that stealthily installed the Pegasus spyware on the devices and exfiltrate sensitive data without tipping the victims off. The exploit is also significant for its ability to get around defenses built by Apple in iOS 14 — called BlastDoor — to prevent such intrusions by filtering untrusted data sent over the texting application.

images from Hacker News

Cisco Releases Patches 3 New Critical Flaws Affecting IOS XE Software

Cisco Releases Patches 3 New Critical Flaws Affecting IOS XE Software

Networking equipment maker Cisco Systems has rolled out patches to address three critical security vulnerabilities in its IOS XE network operating system that remote attackers could potentially abuse to execute arbitrary code with administrative privileges and trigger a denial-of-service (DoS) condition on vulnerable devices.

The list of three flaws is as follows –

  • CVE-2021-34770 (CVSS score: 10.0) – Cisco IOS XE Software for Catalyst 9000 Family Wireless Controllers CAPWAP Remote Code Execution Vulnerability
  • CVE-2021-34727 (CVSS score: 9.8) – Cisco IOS XE SD-WAN Software Buffer Overflow Vulnerability
  • CVE-2021-1619 (CVSS score: 9.8) – Cisco IOS XE Software NETCONF and RESTCONF Authentication Bypass Vulnerability

The most severe of the issues is CVE-2021-34770, which Cisco calls a “logic error” that occurs during the processing of CAPWAP (Control And Provisioning of Wireless Access Points) packets that enable a central wireless Controller to manage a group of wireless access points.

“An attacker could exploit this vulnerability by sending a crafted CAPWAP packet to an affected device,” the company noted in its advisory. “A successful exploit could allow the attacker to execute arbitrary code with administrative privileges or cause the affected device to crash and reload, resulting in a DoS condition.”

CVE-2021-34727, on the other hand, concerns an insufficient bounds check when accepting incoming network traffic to the device, thus allowing an attacker to transmit specially-crafted traffic that could result in the execution of arbitrary code with root-level privileges or cause the device to reload. 1000 Series Integrated Services Routers (ISRs), 4000 Series ISRs, ASR 1000 Series Aggregation Services Routers, and Cloud Services Router 1000V Series that have the SD-WAN feature enabled are impacted by the flaw.

Lastly, CVE-2021-1619 relates to an “uninitialized variable” in the authentication, authorization, and accounting (AAA) function of Cisco IOS XE Software that could permit an authenticated, remote adversary to “install, manipulate, or delete the configuration of a network device or to corrupt memory on the device, resulting a DoS.”

Also addressed by Cisco are 15 high-severity vulnerabilities and 15 medium-severity flaws affecting different components of the IOS XE software as well as Cisco Access Points platform and Cisco SD-WAN vManage Software. Users and administrators are recommended to apply the necessary updates to mitigate any potential exploitation risk by malicious actors.

images from Hacker News

Google Warns of a New Way Hackers Can Make Malware Undetectable on Windows

Google Warns of a New Way Hackers Can Make Malware Undetectable on Windows

Cybersecurity researchers have disclosed a novel technique adopted by a threat actor to deliberately evade detection with the help of malformed digital signatures of its malware payloads.

“Attackers created malformed code signatures that are treated as valid by Windows but are not able to be decoded or checked by OpenSSL code — which is used in a number of security scanning products,” Google Threat Analysis Group’s Neel Mehta said in a write-up published on Thursday.

The new mechanism was observed to be exploited by a notorious family of unwanted software known as OpenSUpdater that’s used to download and install other suspicious programs on compromised systems. Most targets of the campaign are users located in the U.S. who are prone to downloading cracked versions of games and other grey-area software.

The findings come from a set of OpenSUpdater samples uploaded to VirusTotal at least since mid-August.

While adversaries in the past have relied on illegally obtained digital certificates to sneak adware and other unwanted software past malware detection tools or by embedding the attack code into digitally signed, trusted software components by poisoning the software supply chain, OpenSUpdater stands out for its intentional use of malformed signature to slip through defenses.

images from Hacker News

Apple’s New iCloud Private Relay Service Leaks Users’ Real IP Addresses

Apple’s New iCloud Private Relay Service Leaks Users’ Real IP Addresses

A new as-yet unpatched weakness in Apple’s iCloud Private Relay feature could be circumvented to leak users’ true IP addresses from iOS devices running the latest version of the operating system.

Introduced as a beta with iOS 15, which was officially released this week, iCloud Private Relay aims to improve anonymity on the web by employing a dual-hop architecture that effectively shields users’ IP address, location, and DNS requests from websites and network service providers.

It achieves this by routing users’ internet traffic on the Safari browser through two proxies in order to mask who’s browsing and where that data is coming from in what could be viewed as a simplified version of Tor.

However, the feature is available only to iCloud+ subscribers running iOS 15 or macOS 12 Monterey and above.

“If you read the IP address from an HTTP request received by your server, you’ll get the IP address of the egress proxy,” FingerprintJS researcher Sergey Mostsevenko said. “Nevertheless, you can get the real client’s IP through WebRTC.”

WebRTC, short for Web Real-Time Communication, is an open-source initiative aimed at providing web browsers and mobile applications with real-time communication via APIs that enable peer-to-peer audio and video communication without the need for installing dedicated plugins or apps.

This real-time media exchange between two endpoints is established through a discovery and negotiation process called signaling that involves the use of a framework named Interactive Connectivity Establishment (ICE), which details the methods (aka candidates) that can be used by the two peers to find and establish a connection with one another, irrespective of the network topology.

The vulnerability unearthed by FingerprintJS has to do with a specific candidate dubbed “Server Reflexive Candidate” that’s generated by a STUN server when data from the endpoint needs to be transmitted around a NAT (Network Address Translator). STUN — i.e., Session Traversal Utilities for NAT — is a tool used to retrieve the public IP address and port number of a networked computer situated behind a NAT.

images from Hacker News