| title | date | draft | logo |
|---|---|---|---|
October 15, 2023 |
2023-10-15 00:00:00 +0545 |
false |
images/infosec/default.png |
{{< toc >}}
Amazon Web Services (AWS), Cloudflare, and Google have taken steps to mitigate record-breaking distributed denial-of-service (DDoS) attacks that exploited a novel technique known as HTTP/2 Rapid Reset. These layer 7 attacks, detected in late August 2023, were coordinated under the CVE-2023-44487 designation with a CVSS score of 7.5. The attacks aimed at Google's cloud infrastructure reached 398 million requests per second, while those targeting AWS and Cloudflare exceeded 155 million and 201 million RPS, respectively.
HTTP/2 Rapid Reset exploits a zero-day flaw in the HTTP/2 protocol, allowing DDoS attacks by sending and rapidly canceling requests in quick succession. This technique overwhelms the server without reaching its configured threshold, effectively taking down websites. Notably, these attacks can be executed using a relatively small botnet, such as 20,000 machines, as observed by Cloudflare.
HTTP/2 is widely used, and the attack's potential impact is significant. Several companies, including Alibaba, Apache Tomcat, Apple Swift, and Microsoft, have released updates to counter this new attack vector. Security experts are urging organizations to proactively protect their systems against this vulnerability.
NGINX HTTP/2 module
https://thehackernews.com/2023/10/http2-rapid-reset-zero-day.html
Update their NGINX configuration
CVE-2023-44487
Two critical security vulnerabilities have been identified in the Curl data transfer library, with the more severe CVE-2023-38545 leading to a heap-based buffer overflow in the SOCKS5 proxy handshake, potentially enabling remote code execution. The issue arises when Curl is asked to transmit a hostname to the SOCKS5 proxy, allowing it to resolve the address, resulting in a buffer overflow if the hostname exceeds 255 bytes. Despite the likelihood of exploitation in the wild, the conditions required for vulnerability are more restrictive, involving triggering code execution through a web app and connection to a SOCKS5 proxy. A less severe vulnerability, CVE-2023-38546, allows unauthorized cookie injection into a program using libcurl, impacting versions 7.9.1 to 8.3.0. Both flaws have been addressed in the recent release of version 8.4.0 on October 11, 2023, ensuring that Curl no longer switches to local resolve mode for overly long hostnames, effectively preventing heap-based buffer overflows. Despite the vulnerabilities, the development team has no immediate plans to migrate Curl to a memory-safe language from its current C framework.
• Curl data transfer library
https://thehackernews.com/2023/10/two-high-risk-security-flaws-discovered.html
• Patches for both flaws are available in version 8.4.0 released on October 11, 2023. Hence, upgrading to the latest version is recommended
Google has released a security update for its Chrome browser, bringing the Stable channels to version 118.0.5993.70 for Mac and Linux, and 118.0.5993.70/.71 for Windows. The Extended Stable channel has also been updated to 118.0.5993.71 for Windows and 118.0.5993.70 for Mac. This update addresses a total of 20 security vulnerabilities, including a critical flaw labeled CVE-2023-5218 related to a "Use after free in Site Isolation." The flaw could have allowed remote attackers to exploit heap corruption through a crafted HTML page, requiring some form of user involvement. Additionally, several medium and low severity vulnerabilities were fixed, each with a corresponding CVE identifier. To stay protected, Google advises users to ensure they are running the latest version of Google Chrome.
• Google Chrome web browser
https://cybersecuritynews.com/google-chrome-critical-flaw/
• Users are strongly encouraged to update their Google Chrome browser to the latest available version
CVE-2023-5218
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently included a significant security flaw in Adobe Acrobat Reader in its list of known exploited vulnerabilities categorized as a use-after-free bug. Exploiting this vulnerability enables an attacker to achieve remote code execution (RCE), operating with the privileges of the affected user.A proof-of-concept (PoC) exploit for the vulnerability was released in January 2023, showcasing the potential for exploiting the flaw. The specifics of the exploitation method and the threat actors utilizing this vulnerablilites are currently undisclosed.
- Acrobat DC - 22.003.20282 (Win), 22.003.20281 (Mac) and earlier versions (fixed in 22.003.20310)
- Acrobat Reader DC - 22.003.20282 (Win), 22.003.20281 (Mac) and earlier versions (fixed in 22.003.20310)
- Acrobat 2020 - 20.005.30418 and earlier versions (fixed in 20.005.30436)
- Acrobat Reader 2020 - 20.005.30418 and earlier versions (fixed in 20.005.30436)
https://thehackernews.com/2023/10/us-cybersecurity-agency-warns-of.html
- Affected users must apply patches provided by the vendor before October 31, 2023, to safeguard their networks and mitigate potential security threats.
CVE-2023-21608
In a recent development, political leaders and military personnel involved in gender equality initiatives within the European Union have become the focal point of a sophisticated cyberattack campaign. This campaign involves the deployment of an updated version of the RomCom Remote Access Trojan (RAT) known as PEAPOD. The attacks are attributed to a threat actor known as Void Rabisu, previously identified as Storm-0978, Tropical Scorpius, and UNC2596, and potentially linked to the Cuba ransomware group. This group operates at the intersection of financially motivated cyberattacks and espionage, with a particular focus on countries supporting Ukraine.
Search Engines mostly Google and Bing
https://thehackernews.com/2023/10/new-peapod-cyberattack-campaign.html
• Ensure that all personnel are well-informed about the risks of spear-phishing emails and are trained in recognizing and avoiding potential threats.