July 23, 2024 - Issue #4

Have any feedback or ideas? I’d love to hear from you. You can reach me on [email protected].

Story Of The Week

Crowdstrike Software Glitch “Bricks” 8.5 Million Windows Systems

A malformed configuration update led to Crowdstrike’s Falcon driver crashing, resulting in a Blue Screen of Death on any affected system. Due to the nature of anti-malware drivers, which start automatically during boot, this resulted in affected systems being sent into an infinite loop of crashing, rebooting, then crashing again. In order to fix the issue, each system needed to be manually booted into safe mode and have the malformed update file deleted.

Channel files are similar to antivirus definition updates in that they tell the product how to detect and stop new security threats. What appears to have happened here is the update file was malformed, causing the driver responsible for parsing it to encounter an error and crash. Whenever kernel drivers crash, this typically brings down the whole system via a “kernel panic”, known colloquially on Windows as the “Blue Screen of Death”. As of now, it’s currently unclear what caused the channel file to be malformed, or how it made its way onto customer systems.

Interesting, Microsoft took the opportunity to take shots at the EU regulators, issuing a statement claiming that this never would have happened if the EU hadn’t hit them with antitrust legislation in 2009. Anyone who was working in the antimalware space in 2009 will probably find the accusation laughable, but it’s worth breaking down for those who weren’t or don’t remember.

In 2009 Microsoft got into hot water with the EU over several anti-competitive moves, including trying to force people to use Internet Explorer, as well as attempting to lock antivirus companies out of the Windows kernel. At the time the latter was a huge deal, because it would have essentially defanged security products, making them useless.

Microsoft’s argument was that security products were patching the Windows kernel, leading to stability issues and a frequent BSODs, which Microsoft was getting blamed for. This much was true, but what they failed to mention is why security products were doing this in the first place. Nobody wants to write kernel drivers or deal with the stability issues that come from tampering with kernel memory, it was simply the only option available at the time. Microsoft never provided safe or reliable ways for security products to gather the information they needed, so they had no choice but to tamper with the Windows kernel.

The EU didn’t even enforce that Microsoft continue to allow kernel mode access to third party software, they only asked that Microsoft simply level the playing field and give third party security providers access to the same capabilities their own tools get. Microsoft, like the majority of antimalware companies at the time, knew that user mode security products weren’t viable, so conceded and gave everyone kernel access so that they themselves could have it.

In fact, even with kernel mode access, Microsoft’s own security products were effectively useless. It took them over a decade to develop an effective endpoint security solution. Had Microsoft gotten their way in 2009, they would have vaporized the entire antivirus industry, without offering any viable alternative. Furthermore, even on the latest version of Windows 10, Microsoft’s own security products are still heavily reliant on kernel mode functionality.

Kernel development is not something one does by choice, only necessity.

US Sanctions Members of Russia-Aligned Hacktivist Group Targeting Critical Infrastructure

The US Treasury has sanctioned two leading members of the “Cyber Army of Russia Reborn” (CARR), a Russian-government aligned hacktivist group. Mandiant believe that CARR was previously set up by, and used as a front for, “Sandworm”, a hacking division within the GRU (Russia’s military intelligence agency).

Previous the group has attempted destructive attacks against US critical infrastructure, including an intrusion into a Texas water-treatment plant which caused water tanks to overflow and flood the surrounding area. It’s unclear the exact level of involvement the GRU still has with CARR, but it would be highly unusual for Russia to risk a serious escalation by sanctioning attacks against US civilian infrastructure.

I personally suspect that if CARR was set up by the GRU, it’s probably since been handed over to a civilian hacktivist group, or such a group has co-opted the name. Given the unsophisticated nature of their attacks, excessive exaggeration of the consequences, and their willingness to target US critical infrastructure, it seems highly unlikely these attacks were done at the explicit direction of the state.

KnowBe4 Security Reports They Were Infiltrated By North Korean Worker

This article is an interesting one because it goes into details about what prompted the company to investigate one of their remote workers, concluding that they were a North Korean resident posing as a US citizen.

The employee applied for a remote security job using a stolen US passport, along with an AI altered photo. They were able to pass a 4 round interview process and get the job. Shortly after, suspicious activity from the employee’s laptop triggered a SOC alert and an investigation began.

It looks like what happened is the employee had their company issue laptop mailed to a “laptop mule” (someone residing within the US who would operate the laptop on their behalf). The laptop mule then installed remote access software, allowing the real worker to control the laptop remotely from North Korea. By having the laptop physically present in the US and connecting from a US IP address, they had hoped to avoid raising suspicion.

Fortunately, the laptop was running an EDR, which raised an alert when the mule attempted to tamper with it (likely in an attempt to install the remote access software). The SOC began investigating the security incident, and attempted to contact the employee, who became evasive.

This isn’t the first time this has happened, it’s been an ongoing problem, and has even led to the indictment of several individuals based in the US and abroad for assisting the scheme.

Amusingly, the primary “scam” seems to be that the employees actually do their job. By legitimately working high paid US tech jobs, the workers are able to bring significant revenue into North Korea, despite international sanctions. But of course, it’s almost certain that said employees are also passing any sensitive information back to their government.

Dragos Reports APT Group Were Responsible For ICS Attack Against Ukrainian Civilian Infrastructure

According to Dragos, a threat actor dubbed FrostyGoop (we’ve really got to talk about these threat actor naming conventions at some point), was able to gain access to the systems of a Ukrainian energy provider and disable heating to over 600 apartment buildings for two days during subzero temperatures.

The threat actors had spent over 10 months inside the provider’s network mapping systems and gathering credentials. They first downgraded the firmware on one of the ICS controllers to an older version that lacked monitoring capabilities in order to hamper analysis. They then reconfigured the controller to report inaccurate measurement data, leading to system failure.

Whilst Dragos doesn’t point fingers at who they believe to be behind the attack, the list of threat actors targeting Ukrainian civilian infrastructure in an attempt to weaken morale during Russia’s attempted invasion isn’t particularly long.

Second Suspect Arrested in MGM Hack

A 17-year-old UK resident has been arrested in connection with last september’s massive hack against casino operator MGM. The group, known as “Scattered Spider”, is believed to primarily gain access to systems via a technique known as sim-swapping.

Sim swapping is an attack that often involves social engineering cell provider employees into transferring a target’s phone number to a new sim card, which is controlled by the threat actor. This methodology can be used to gain access to the victim’s account if they have their phone set up as the account recover device.

This is the second arrest related to the MGM hack, the first of which was in June. Spanish authorities picked up 22-year-old Tyler Buchannan, who was trying to board a flight from Spain to Italy. According to KrebsOnSecurity, Tyler had fled the UK after a rival sim-swapping group attempted to obtain the keys to his cryptocurrency wallet by hiring thugs to break into his home and threaten him with a blowtorch.

This isn’t the first time that these types of cybercrime actors have resorted to real-world violence. In 2022 a Miami based teenager involved in sim-swapping was kidnapped, beaten, then held for a $200k ransom [1].

Top Phishing Domain Put On Notice By ICANN

Top Level Domain (TLD) ‘.top’ has been given a formal breach of contract notice by internet authority ICANN. The complaint alleges that the Chinese company in control of the domain isn’t doing enough to stop malicious use of their service. The ‘.top’ TLD has long been plagued with cybercrime, and has perhaps the highest ratio of malicious to non-malicious domain usage. The ‘.top’ TLD, along with ‘.xyz’, is often considered to be of such low quality that many organizations (and even major security products) simply just block ever domain that uses it.

It’s unclear what led to so many top level domains being badly mismanaged and becoming havens for hackers. It could be due to ICANN’s 2012 decision to drop almost all the restrictions on new TLD creation and simply just sell gimmicky TLDs to whoever is willing to pay for them, or it could be something else.