| title | date | draft | logo |
|---|---|---|---|
May 8, 2023 |
2023-05-08 00:00:00 +0545 |
false |
images/infosec/default.png |
{{< toc >}}
The North Korean state-sponsored hacking group Kimsuky, also known as APT43, has been using a new reconnaissance tool called ReconShark in spear-phishing attacks to target individuals in NGOs, think tanks, diplomatic agencies, and other organizations across North America, Asia, and Europe. The malware exfiltrates system information and can deploy additional payloads from a server based on what detection mechanism processes run on infected machines. ReconShark does not save the harvested information on the file system, but instead stores the data in string variables and uploads it to the C2 server by issuing HTTP POST requests. This indicates that the threat actor is evolving its tactics to gather intelligence for extended periods of time and carry out "precision attacks" tailored to targeted environments.
Microsoft Word documents hosted on OneDrive
https://thehackernews.com/2023/05/n-korean-kimsuky-hackers-using-new.html
• Train employees to recognize and report suspicious emails. • Use endpoint protection software. • Keep software and systems up to date. • Implement multi-factor authentication. • Regularly backup important data. • Monitor network traffic and logs. • Consider using a managed security service provider.
Cisco has issued a warning about a critical security flaw (CVE-2023-20126) in the SPA112 2-Port Phone Adapter that could allow remote attackers to execute arbitrary code on affected devices. The vulnerability is caused by a missing authentication process in the firmware upgrade function, which an attacker could exploit by upgrading an affected device to a crafted version of firmware. Despite the severity of the flaw, Cisco will not release any fixes as the devices have reached their end-of-life stage. Instead, Cisco recommends users to switch to the Cisco ATA 190 Series Analog Telephone Adapter, which will receive its last update on March 31, 2024. There have been no known instances of the flaw being exploited maliciously.
SPA112 2-Port Phone Adapter
https://thehackernews.com/2023/05/cisco-warns-of-vulnerability-in-popular.html
• Update software and hardware. • Use strong passwords and change default credentials. • Use network segmentation.
CVE-2023-20126
Threat actors are currently taking advantage of a security flaw in TBK digital video recording (DVR) devices that has remained unpatched for five years. This vulnerability, known as CVE-2018-9995, involves a critical authentication bypass issue that can be leveraged by remote actors to gain elevated permissions. According to Fortinet, the vulnerability arises from an error in how malicious HTTP cookies are handled. Exploiting this flaw enables attackers to bypass authentication, obtain administrative privileges, and gain access to camera video feeds. In April 2023, over 50,000 attempts to exploit TBK DVR devices were observed by Fortinet, even though there are no known fixes that address the vulnerability. The flaw affects TBK DVR4104 and DVR4216 product lines, as well as other rebranded products sold under different names, and could allow a remote attacker to execute arbitrary operating system commands as root.
DVR4104 and DVR4216 product
https://thehackernews.com/2023/05/hackers-exploiting-5-year-old-unpatched.html?m=1
• Conduct a security audit • Encourage customers to apply the patch • Disable remote access until the patch is available • Educate customers on securing their devices • Monitor network traffic for exploitation attempts • Release a patch
CVE-2018-9995
On January 23, 2023, Assetnote researchers discovered a reflected cross-site scripting (XSS) vulnerability in the Advanced Custom Fields (ACF) plugin for WordPress. The vulnerability, tracked as CVE-2023-29489, has a CVSS score of 6.1 and could be exploited by an authenticated attacker to achieve command execution if targeting a logged-in cPanel user. The ACF plugin is a popular WordPress plugin that allows users to quickly and easily add fields to WP edit screens with only the click of a few buttons. As of March 1, 2023, the plugin had over 2 million active installations. The vulnerability exists in the ACF field builder's "ajax_load_more_fields" function. The function is responsible for loading additional fields from the ACF database when a user clicks the "Load more fields" button. The vulnerability is triggered when an attacker can inject malicious JavaScript code into the URL of an ACF field edit screen. When the user clicks the "Load more fields" button, the malicious JavaScript code will be executed in the context of the logged-in user. The attacker can then use the malicious JavaScript code to hijack the user's cPanel session and carry out malicious activities, such as uploading a web shell and gaining command execution.
versions of ACF prior to 5.11.1.
https://securityaffairs.com/145847/hacking/wordpress-advanced-custom-fields-xss.html
• Update the plugin.
The advanced persistent threat (APT) group known as Dragon Breath has been employing a new DLL side-loading technique to enhance their attacks. The technique involves a multi-stage process where a first-stage clean application loads a second clean application, which then loads a malicious loader DLL, and finally executes the payload. Dragon Breath, also known as APT-Q-27 or Golden Eye, has previously used Telegram installers to distribute trojanized Windows installers, and their latest campaigns have expanded to include tampered installers for apps like LetsVPN and WhatsApp. The attacks, observed in countries like the Philippines, Japan, Taiwan, Singapore, Hong Kong, and China, aim to target the online gaming and gambling industries. The payload serves as a backdoor, enabling various malicious activities such as file downloads, command execution, event log clearing, clipboard manipulation, and cryptocurrency theft. The use of DLL side-loading demonstrates the continued effectiveness and appeal of this tactic for threat actors, especially when targeting sectors that receive less security scrutiny.
DLL side-loading
https://thehackernews.com/2023/05/dragon-breath-apt-group-using-double.html
• Ensure that all software is up to date with the latest patches and updates. • Be cautious when downloading software or files from unfamiliar sources.