Major OpenSSH Vulnerability, TeamViewer Hacked By Russian APT, Google Ads Serve Malware, and more
07/02/2024 - Issue #2
Welcome to the second edition of the MalwareTech Newsletter. Have any feedback or ideas? I’d love to hear from you. You can reach me on [email protected].
Story Of The Week
Major Remote Code Execution Vulnerability Found In OpenSSH
CVE-2024-6387 (dubbed RegreSSHion), is a serious pre-auth remote code execution vulnerability discovered in OpenSSH. Currently, a public proof-of-concept targeting 32-bit Linux is available.
The name “RegreSSHion” comes from security term “regression”, which refers to a situation when a previously patched vulnerability becomes unpatched, typically due to new code additions removing/negating previous security checks, or creating new exploitable code paths. In this case, the original bug appears to be an 18 year old vulnerability listed as CVE-2006-5051.
Now, the severity of this one is really really hard to get a good read on. According to Qualys, the company who found it, there are a lot of unusual caveats. The bug affects glib-c based Linux versions running Portable OpenSSH (i.e. not OpenBSD based systems), which is a fairly large attack surface. However, the company also reports that the vulnerability takes on average around 10,000 attempts to successfully exploit.
By default, OpenSSH puts strict limits on the amount of concurrent pre-auth connections, which restricts the number of exploitation attempts to between 1 and 25 per minute; therefore, successful exploitation could take anywhere from 6 hours to 1 week of constant SSH connections. It’s worth noting that multiple systems could be exploited concurrently, but the timeframe for each system is still prohibitively high.
Another major caveat is the time-to-exploitation is calculated based on 32-bit Linux systems with weak exploit mitigations running under lab conditions. It’s likely that exploitation of real-world systems could take significantly longer, being hampered by network lag, background noise from SSH scanners, and rate-limiting systems like Fail2Ban. Due to stronger ASLR on 64-bit systems, exploitation might require chaining multiple vulnerabilities or could be practically impossible within realistic time constraints.
I think the greatest risk for this vulnerability is likely to be embedded systems such as routers/firewalls, IoT Cameras, and Network Attached Storage. These systems often run 32-bit versions of Linux which lack appropriate exploit mitigations, use older OpenSSH versions, and are difficult to update. Of course, it’s worth installing the patch everywhere and anywhere possible, but special attention should be paid towards embedded systems. It’s also possible this vulnerability could be used for local priveledged escalation, even on 64-bit Linux.
Scanning for vulnerable systems is as simple as performing a banner grab and looking for OpenSSH versions between 8.5p1 and 9.8p1 (excluding 9.8p1). Versions prior to 4.4p1 are also vulnerable, but only if they’re not patched for CVE-2006-5051 and CVE-2008-4109.
An example version scanner by Alexander Hagenah can be found here.
Chinese And North Korean APTs Increasingly Engaging In Ransomware Attacks
An interesting report by Recorded Futures and SentinelOne discusses a rising trend of APT actors observed deploying ransomware. Whilst ransomware is typically the work of for-profit criminal threat actors, these lines can get extremely blurry.
Many state intelligence agencies often outsource grunt work to corporate contractors, and in some cases, cybercrime groups (if you can’t beat ‘em, join ‘em). This creates huge problems when it comes to attribution, as it’s extremely difficult to tell when these groups are doing regular cybercrime vs espionage.
A state-sponsored attack against military or civilian infrastructure could be seen as an act of war or terrorism, but a ransomware attack by a cybercriminal group, is just seen as business as usual.
With criminal actors moonlighting as spies and spies moonlighting as criminals, it become increasingly difficult to determine which is which and when. Given the lack of collaboration between intelligence agencies & law enforcement, especially within the US, it also decreases the likelihood of anyone having the full picture.
In last week’s edition we talked about how Polyfill’s JavaScript library was backdoored, putting over 100,000 websites at risk. Well, since then, Polyfill has responded, and their response was pretty downright unhinged. The company went on a long Twitter tirade, doing everything from accusing the media of baseless slander, to claiming Cloudflare mirroring Polyfill’s CDN with a non-malicious version of their library is anti-competitive.
Polyfill also encourages customers to move over to their new web address, as their previous one was suspended for distributing malware. The company then went on to claim they’re committing to putting Cloudflare out of business by starting a better version of their product.
Notably absent from any of their statements was any sort of explanation as to how their library ended up distributing malicious code, or what they’re doing to remedy the situation.
While I generally favor the phrase “never attribute to malice that which can easily be explained by incompetence”, I’m going to make an exception here. Polyfill’s completely absurd reaction, coupled with their total lack of accountability, makes me think that they’re either complicit or at best displaying weapons grade incompetence.
Genuine “Stingray” Cellphone Interception Device Finds Its Way Onto eBay
404 Media report that they came across an original StingRay cellsite simulator listed for sale on eBay, along with its original user manual, for the hefty price of $100,000. Although the listing has now been removed, the fact that these devices are highly illegal and only sold to law enforcement and military raises a lot of questions as to how it got there.
StingRays are used to intercept and track cell phones by acting as a mobile cell tower. Their capabilities include triangulating and tracking the movement of nearby cell phones, intercept communications such as text messages and phone calls, as well as creating blackout regions in which cellphones are completely inoperable. It’s certainly not the type of hardware you’d expect to see for sale on a consumer auction site.
Rabbitude (a group focused on jailbreaking the Rabbit R1) came into possession of several critical API keys while reverse engineering the device. These keys allowed them to access logs of every response sent from the assistant to its user, as well as potentially brick all devices. What’s worse, they claim to have informed the company, which allegedly acknowledged the issue, yet chose to ignore it.
Only after Rabbitude went public with their findings did Rabbit finally release a disclosure and revoke (some of) the API keys. However, Rabbitude found that they were still able to send emails from Rabbit’s internal email server, which the CEO allegedly tried to downplay, imply the emails could have been spoofed.
Overall, Rabbit’s handling of the security breach leaves a lot to be desired, but it’s unfortunately not even the worst one today.
Popular ID Verification Provider AU10TIX Breached, Potentially Exposing Identity Documents
AU10TIX, an identity and age verification service used by the likes of Uber, TikTok, and Twitter, was found to have exposed administrator credentials to the internet. The credentials allowed access to a logging platform, which contains PII related to users who performed verification through the service, as well as photos of identity documents, including US drivers licenses.
The company claims no user data was leaked and that the credentials were revoked upon access, but security researcher Mossab Hussein, who discovered the breach, has responded stating that the credentials were still active as of last month. Considering that the leak first occurred over 18 months ago, and the credentials have reportedly been found passed around several Telegram channels frequented by hackers, I’m not so sure. I’d take the “no user data accessed” claims with a a grain (or perhaps an ocean)of salt, and maybe throw in a few of those fancy Himalayan salt lamps just for good measure.
The company behind popular remote administration software TeamViewer reports that its corporate network was breached by a Russian GRU-affiliated threat actor often referred to as APT29, Cozy Bear, or Midnight Blizzard.
TeamViewer’s discloser states that they currently believe the incident is confined to their internal corporate environment, and thus doesn’t affect their production network, software, or any customer systems/data.
This may come as a surprise, but of all the “no customer data accessed” claims in today’s issue, this is the one I’m most inclined to believe. Given the level of detail and transparency in the company’s discloser, and the speed at which alerts were sent out, it does seem like the company is on top of things.
That said, news of the breach did become public before TeamViewer’s official statement. It could simply be that the company issued a private notification to security providers as a heads up while they complete their internal investigation, which is standard operating procedure, and not typically a sign of ill-intent.
Most importantly, this is still a developing story, and TeamViewer’s investigation is currently ongoing. Given that APT29 is a highly sophisticated nation-state threat actor, and that their end goal was presumably targeting downstream customers, it’s worth taking appropriate precautions and keeping an eye out for any new developments.
This is part of an increasing trend where attackers leverage search engine ads to trick users into downloading malware. The technique exploits the fact that search engines such as Google allow advertisers to pay to have their website displayed as the top search result for specific search term.
Threat actors will create replicas of popular software product websites, which they’ll then host on a similar looking domain. By purchasing keyword ads for the product’s name, the attackers can ensure that their fake site ranks above the real one in Google search results. The download page will then usually direct the user to download malware, which is sometime bundled with a legitimate version of the software to avoid raising suspicion.
I suspect the large uptick we’re seeing in malware groups leveraging search ads is part of a larger shift withing the cybercrime economy. Threat actors have increasingly been favoring credential stealers over tradition malware, likely due to the high cost associated with maintaining persistent access to infected systems. With millions of these stolen credentials for sale, it’s trivial for threat actors to purchase logins or API tokens for brand accounts used to run Google Ads.
As a longtime proponent of search engine ads, I’m personally overjoyed by the idea that on top of receiving completely irrelevant search results, I can now get malware for free too. Search ads really are the gift that keeps on giving.
This vulnerability allows attackers to retrieve configuration files (including those containing user credentials) from affected routers. Not only is the vulnerability being actively exploited in the wild, but the devices are past End-of-life and therefore unable to receive security updates.
Hacked routers are often popular with threat actors due to their ability to act as proxies, either masking attacker IP addresses or C2 infrastructure. However, the DIR-859 doesn’t appear to support any features that could be used to enable proxies or shell access. So, it’ll be interesting to see what attackers plan to do with the stolen credentials and config files.
It may be that attackers are simply storing credentials in case they’re needed for a future post-auth RCE vulnerability, or they may attempt to find a way to load custom firmware onto the device.
Ranked with a CVSS score of 10.0 (the maximum possible), this vulnerability allows a complete takeover of affected Juniper routers running in high-availability redundant configurations.
I’m going to be honest, I don’t know a thing about enterprise routers, or what half of these words mean. So you’re on your own with this one.
CVE-2024-20399 - Cisco NX-OS Command Injection Vulnerability Exploited By Chinese APT As Zero-day
This vulnerability allows an attacker in possession of administrator credentials to escape the Cisco NX-OS environment, enabling execution of code on the underlying system, also bypassing syslog. Whilst affected devices are typically not internet-facing, and exploitation required admin credentials, this one is worth taking not of due to in-the-wild exploitation.
Such exploitation is part of an increasing trend in which sophisticated nation-state actors will breach target networks before pivoting onto edge devices, such as routers and firewalls. By backdooring network hardware, which is seldom checked for malware, threat actors can maintain a foothold within networks, even if the initial attack vector is found and patched. Not only do network devices often have priveledged access, but they can also be used to covertly intercept communication.
