Security updates for Thursday

[Ubuntu] Security Team Weekly Summary: August 17, 2017

Google awards student $10k for discovery of App Engine data leak flaw

Google has awarded $10,000 to a high school student for the discovery of a bug in Google's App Engine server which could lead to information disclosure.

Bank-fraud malware not detected by any AV hosted in Chrome Web Store. Twice

A researcher has uncovered an elaborate bank-fraud scam that's using a malicious extension in Google's Chrome Web Store to steal targets' passwords.

Once installed, the Interface Online extension, uploaded at least twice in the past 17 days, surreptitiously monitors all connections made with the Chrome browser. When users visit specific pages programmed into the code, the extension activates a JavaScript routine that logs the user name and password entered into the form. The extension then uploads them to a server controlled by the attackers. This entry in the Google-owned Virus Total service reports the extension was not detected by any of the 58 most widely used anti-malware products at the time this post was going live.

Safety, Security & Open Source in the Automotive Industry

Today’s cars are as much defined by the power of their software as the power of their engines. Almost any car feature you can name is now digitized to provide drivers with easier operation and better information. Technological innovation is accelerating, enabling automobiles to monitor and adjust their position on the highway, alerting drivers if they’re drifting out of their lane, even automatically slowing down when they get too close to another car.

Operationalizing Cybersecurity

Hacker Decrypts Apple's Secure Enclave Processor (SEP) Firmware

The security coprocessor was introduced alongside the iPhone 5s and Touch ID. It performs secure services for the rest of the SOC and prevents the main processor from getting direct access to sensitive data. It runs its own operating system (SEPOS) which includes a kernel, drivers, services, and applications. 

Netsparker Free Open Source Web Applications Security Scans Now Unlimited

Security updates for Wednesday

Red Hat Secures Networking Flaws in OpenStack, the Linux Kernel

Red Hat has fixed an important vulnerability in the OpenStack subsystem that’s used to manage network connectivity to and from virtual machines. If left unpatched, it could allow an attacker to access network resources from virtual machines.

The vulnerability, tracked as CVE-2017-7543 in the Common Vulnerabilities and Exposures (CVE) database, is located in openstack-neutron, a “pluggable, scalable and API-driven” component of the Red Hat OpenStack Platform that’s used to provision networking services to virtual machines.

Atomicorp Releases First Kernel-Level Docker Security and is Available Today Through AWS, Azure and Direct

Shadow Brokers Eternal Exploits expected to remain effective

The Shadow Brokers also leaked exploits such as EternalRomance which is similar to EternalBlue but targets Windows 7 SP1 machines using SMBv2 and targets a vulnerability in the process of handling SMBv1 transactions, EternalSynergy which uses a packet type confusion vulnerability, and EternalChampion which takes advantage of a race condition in transaction hand.

Shadow Brokers EternalPulsar malware: All you need to know about the leaked NSA SMB exploits

Cylance researchers said the DoublePulsar backdoor, which experts previously said had successfully infected around 100,000 computers shortly after the exploit was leaked in April, functions as a backdoor providing hackers with secret access to Windows systems.

IoT Security for Developers

Previous articles focused on how to securely design and configure a system based on existing hardware, software, IoT Devices, and networks. If you are developing IoT devices, software, and systems, there is a lot more you can do to develop secure systems.

The first thing is to manage and secure communications with IoT Devices. Your software needs to be able to discover, configure, manage and communicate with IoT devices. By considering security implications when designing and implementing these functions you can make the system much more robust. The basic guideline is don’t trust any device. Have checks to verify that a device is what it claims to be, to verify device integrity, and to validate communications with the devices.

Powerful backdoor found in software used by >100 banks and energy cos. [Ed: Yet more back doors in proprietary software on Microsoft Windows]

For 17 days starting last month, an advanced backdoor that gave attackers complete control over networks lurked in digitally signed software used by hundreds of banks, energy companies, and pharmaceutical manufacturers, researchers warned Tuesday.

The backdoor, dubbed ShadowPad, was added to five server- or network-management products sold by NetSarang, a software developer with offices in South Korea and the US. The malicious products were available from July 17 to August 4, when the backdoor was discovered and privately reported by researchers from antivirus provider Kaspersky Lab. Anyone who uses the five NetSarang titles Xmanager Enterprise 5.0, Xmanager 5.0, Xshell 5.0, Xftp 5.0, or Xlpd 5.0, should immediately review posts here and here from NetSarang and Kaspersky Lab respectively.

Security updates for Tuesday

Open Source Security Podcast: Episode 59 - The VPN Episode

Update gone wrong leaves 500 smart locks inoperable

Hundreds of Internet-connected locks became inoperable last week after a faulty software update caused them to experience a fatal system error, manufacturer LockState said.

The incident is the latest reminder that the so-called Internet of Things—in which locks, thermostats, and other everyday appliances are embedded with small Internet-connected computers—often provide as many annoyances as they do conveniences. Over the past week, the Colorado-based company's Twitter feed has been gorged with comments from customers who were suddenly unable to lock or unlock their doors normally. Complicating the matter: the affected LockState model—the RemoteLock 6i—is included in an Airbnb partnership called Host Assist. That left many hosts unable to remotely control their locks.

Ransomware Targeting WordPress – An Emerging Threat

Recently, the Wordfence team has seen ransomware being used in attacks targeting WordPress. We are currently tracking a ransomware variant we are calling “EV ransomware.” The following post describes what this ransomware does and how to protect yourself from being hit by this attack.

AWS unveils AI monitoring for Amazon S3

FancyBear Use Leaked NSA “WannaCry” Exploit To Target Hospitality Industry [Ed: The solution to this is simple: don't use Microsoft Windows at hotels]

Microsoft has indicated that a number of different versions of Windows are vulnerable to the EternalBlue exploit, even those currently receiving support. It is imperative that IT teams from all businesses across all industries ensure that the version of Windows that they are using is not vulnerable to EternalBlue and, if so, take the necessary steps to remediate it. With three attacks using this exploit having occurred over just the past few months, we’re likely to see cybercriminals continuing to deploy it until devices are patched and it is no longer an effective vector for them to spread malware.”

Researcher who neutralized WCry pleads not guilty to writing banking malware

Marcus Hutchins, the British security researcher instrumental in neutralizing the virulent WCry ransomware worm that shut down computers worldwide in May, appeared in federal court Monday and pleaded not guilty to unrelated criminal charges that he created and distributed malware that steals banking credentials.

[...]

Hutchins, who works for Kryptos Logic of Los Angeles, is going to live in Los Angeles while awaiting an undetermined trial date. He will be tracked by a GPS monitoring device. He has been ordered not to touch the WCry sinkhole, presumably because if it's shut off, it could possibly make the ransomware start spreading again.

Innovation may be outpacing security in cars [Ed: ITProPortal cites the liars from Black Duck to make it sound as though FOSS is the root of all security issues. Profitable FUD (to them).]

As the UK government’s car cybersec guidelines recognise, innovation may be outpacing security in cars. When you put new technology into cars, you’ll inevitably run into security challenges.

World's first hack using DNA? Malware in genetic code could wreck police CSI work

Russian hackers use NSA exploits to target high-profile hotel guests [Ed: This is Microsoft Windows again]

Russian hackers used leaked NSA hacking tool to spy on hotel guests

NSA tools used to hack hotels; WikiLeaks in CIA Couch Potato dump