The Consensus Security Vulnerability Alert

ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html

Supervision and Verification in Vulnerability Management

Published: 2023-06-15

Last Updated: 2023-06-15 03:57:00 UTC

by Yee Ching Tok (Version: 1)

Managing vulnerabilities in operating systems and software can be challenging and even contentious. Opinions are divided among industry peers – some argue that security updates would be unnecessary if developers were held accountable for security vulnerabilities. In contrast, others assert that updating systems as soon as possible (where applicable) was a critical best practice for users. Most clients in my consulting job adopt some form of vulnerability management paradigm (quarterly vulnerability assessments and addressing discovered vulnerabilities to automated vulnerability management programs where identified vulnerabilities are addressed as soon as possible). I noticed some peculiarities while providing consultancy services to a discerning customer's automated vulnerability management program. The automated vulnerability management product will not be discussed here as it is neither the main focal point nor a debate on whether the product is trustworthy. Instead, it was serendipitous and stemmed from just a simple drive to appropriately mitigate identified vulnerabilities in all systems. Together with the client's management support, we worked together to address the vulnerability in question while ensuring it was fully mitigated.

It all started when a new low-risk vulnerability was identified – the Adobe Acrobat Reader software installed on the client's assets (a Windows enterprise environment with a heavy majority of Windows 10 Version 22H2 clients) were identified to have JavaScript enabled. Typically, there is no business need for JavaScript to be enabled in Adobe Reader, especially if users only need to view documents and occasionally fill in simple form fields. As such, the vulnerability management tool advised that JavaScript be disabled and even provided steps to do so. In this case, the recommended action was to set the registry key HKLM\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\bDisableJavaScript to the REG_DWORD value of 1. The change management team approved the configuration change, and the system administrator was tasked to implement the hardening configuration.

Read the full entry: https://isc.sans.edu/diary/Supervision+and+Verification+in+Vulnerability+Management/29952/

Malicious Code Can Be Anywhere

Published: 2023-06-20

Last Updated: 2023-06-20 07:42:18 UTC

by Xavier Mertens (Version: 1)

My Python hunting rules reported some interesting/suspicious files. The files are named with a “.ma” extension. Some of them have very low VT scores. For example, the one with a SHA256 dc16115d165a8692e6f3186afd28694ddf2efe7fd3e673bd90690f2ae7d59136 has a score of 15/59.

The “.ma” extension refers to animation projects created by Autodesk Maya, a 3D modeling and animation program[1]. The files are typically ASCI files that describe the 3D scenes. I’ve absolutely, zero-knowledge of 3D software but after some Google searches, it seems that Maya supports Python![2]. Like the documentation says:

“Python scripting can be used for many tasks in Maya, from running simple commands to developing plug-ins, and several different Maya-related libraries are available targeting different tasks.”

What could go wrong? If attackers (ab)use VBA macros in Microsoft Office, why not (ab)use Python in Maya? I found a reference to this type of malware back in 2020 when people discovered some “strange behaviors” in .ma files.

Read the full entry: https://isc.sans.edu/diary/Malicious+Code+Can+Be+Anywhere/29964/

Analyzing a YouTube Sponsorship Phishing Mail and Malware Targeting Content Creators

Published: 2023-06-21

Last Updated: 2023-06-21 00:02:43 UTC

by Yee Ching Tok (Version: 1)

One of our Stormcast listeners, Kevin, wrote in to share that his friend Jon had received a direct spear-phishing e-mail. We requested for more information, and Jon kindly provided us with the corresponding e-mails and data to analyze. The spear-phishing e-mail sent to Jon masqueraded as an individual representing NordVPN (note: NordVPN had published an advisory about scammers posing as NordVPN representatives earlier this year) and enquired about the possibility of a YouTube sponsorship/collaboration with his YouTube channel. I took the liberty to examine the phishing e-mail and its associated artifacts, noting the details I observed from my analysis.

I first examined the e-mail headers, noting the observation of the mail.ru header in the X-Mailer field. (with reference to Figure 1). The e-mail address that the adversary used was collaboration@nordvpn-media[.]com, which had a very close domain name to the original domain name (nordvpnmedia[.]com) that NordVPN had stated to be genuine.

Read the full entry: https://isc.sans.edu/diary/Analyzing+a+YouTube+Sponsorship+Phishing+Mail+and+Malware+Targeting+Content+Creators/29966/

Malware Delivered Through .inf File (2023.06.19)

https://isc.sans.edu/diary/Malware+Delivered+Through+inf+File/29960/

Brute-Force ZIP Password Cracking with zipdump.py (2023.06.18)

https://isc.sans.edu/diary/BruteForce+ZIP+Password+Cracking+with+zipdumppy/29948/

Formbook from Possible ModiLoader (DBatLoader) (2023.06.17)

https://isc.sans.edu/diary/Formbook+from+Possible+ModiLoader+DBatLoader/29958/

Another RAT Delivered Through VBS (2023.06.16)

https://isc.sans.edu/diary/Another+RAT+Delivered+Through+VBS/29956/

CVE-2023-35036-June-9-2023">https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-CVE-2023-35036-June-9-2023CVE-2023-26133 - All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js. Product: Progressbar.Js Project CVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-26133NVD References: https://security.snyk.io/vuln/SNYK-JS-PROGRESSBARJS-3184152CVE-2023-34581 - Sourcecodester Service Provider Management System v1.0 is vulnerable to SQL Injection via the ID parameter in /php-spms/?page=services/view&id=2Product: Service Provider Management System Project CVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-34581NVD References: - https://github.com/ashikkunjumon/cve-reports/blob/main/README.md- https://packetstormsecurity.com/files/172559/Service-Provider-Management-System-1.0-SQL-Injection.html- https://vulners.com/packetstorm/PACKETSTORM:172559- https://www.exploit-db.com/exploits/51482CVE-2022-36331 -  The Western Digital My Cloud and SanDisk ibi devices had an impersonation vulnerability that could expose user data.Product: Western Digital My CloudCVSS Score: 10.0NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-36331NVD References: https://https://www.westerndigital.com/support/product-security/wdc-22020-my-cloud-os-5-my-cloud-home-ibi-firmware-updateCVE-2023-1897 - Atlas Copco Power Focus 6000 web server stores login info in an insecure way, enabling attackers with computer access to steal controller credentials.CVE-2023-1898 - Atlas Copco Power Focus 6000 web server allows attackers to retrieve data from an active user's session using session ID numbers.CVE-2023-1899 - Atlas Copco Power Focus 6000 web server allows an attacker to gain sensitive information through unsecured network traffic.Product: Atlas Copco Power Focus 6000CVSS Score: 9.4NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-1897NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-1898NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-1899NVD References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-159-01CVE-2023-33625 - D-Link DIR-600 (B5, 2.18) suffers from a command injection flaw through the ST parameter in lxmldbc_system().Product: D-Link DIR-600CVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-33625NVD References:- https://github.com/naihsin/IoT/blob/main/D-Link/DIR-600/cmd%20injection/README.md- https://github.com/naihsin/IoT/tree/main/D-Link/DIR-600/cmd%20injection- https://hackmd.io/@naihsin/By2datZD2- https://www.dlink.com/en/security-bulletin/CVE-2023-33626 - D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a stack overflow via the gena.cgi binary.Product: D-Link DIR-600CVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-33626NVD References: https://github.com/naihsin/IoT/blob/main/D-Link/DIR-600/overflow/README.mdNVD References: https://github.com/naihsin/IoT/tree/main/D-Link/DIR-600/overflowNVD References: https://www.dlink.com/en/security-bulletin/CVE-2023-2278 - The WP Directory Kit plugin for WordPress up to version 1.1.9 is vulnerable to Local File Inclusion via 'wdk_public_action', allowing unauthenticated attackers to execute arbitrary PHP code on the server.Product: WP Directory Kit plugin for WordPressCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-2278NVD References: - https://plugins.trac.wordpress.org/browser/wpdirectorykit/tags/1.1.8/vendor/Winter_MVC/core/mvc_loader.php#L91- https://plugins.trac.wordpress.org/changeset/2904689/wpdirectorykit/trunk/vendor/Winter_MVC/core/mvc_loader.php- https://www.wordfence.com/threat-intel/vulnerabilities/id/87399a07-d2d8-42cd-81f0-9060f6cfff48?source=cveCVE-2023-25910 - SIMATIC PCS 7, SIMATIC S7-PM, and SIMATIC STEP 7 V5 versions prior to V5.7 allow remote users to execute code with elevated privileges in the database management system's server.Product: Siemens SIMATIC PCS 7, SIMATIC S7-PM, SIMATIC STEP 7 V5CVSS Score: 9.9NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-25910NVD References: https://cert-portal.siemens.com/productcert/pdf/ssa-968170.pdfCVE-2023-26204 - FortiSIEM allows an attacker with access to user DB content to impersonate an admin user via plaintext password storage.Product: Fortinet FortisiemCVSS Score: 9.8NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-26204NVD References: https://fortiguard.com/psirt/FG-IR-21-141CVE-2023-29129 - Mendix SAML versions 1.16.4 to 1.18.0 and versions 2.2.0 to 2.4.0, and versions 3.1.8 to 3.6.1, have an insufficient verification of SAML assertions vulnerability that allows unauthenticated remote attackers to bypass authentication and access the application.Product: Mendix SAMLCVSS Score: 9.1NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-29129NVD References: https://cert-portal.siemens.com/productcert/pdf/ssa-851884.pdfCVE-2023-3047 - TMT Lockcell before 15 allows SQL Injection due to improper neutralization of special elements in an SQL command.CVE-20…