Initial Discovery in Azure Application Insights

Tenable Research initially uncovered the vulnerability within Azure Application Insights, a service designed to monitor and analyze web applications’ performance and availability. The Availability Tests feature of Azure Application Insights, intended to check the accessibility and performance of applications, was found to be susceptible to abuse. Users can control server-side requests in these tests, including adding custom headers and changing HTTP methods. This control can be exploited by attackers to forge requests from trusted services, mimicking a server-side request forgery (SSRF) attack.

Expansion to More Than 10 Other Azure Services

Upon further investigation, Tenable Research found that the vulnerability extends beyond Azure Application Insights to more than 10 other Azure services. These include:

• Azure DevOps
• Azure Machine Learning
• Azure Logic Apps
• Azure Container Registry
• Azure Load Testing
• Azure API Management
• Azure Data Factory
• Azure Action Group
• Azure AI Video Indexer
• Azure Chaos Studio

Each of these services allows users to control server-side requests and has an associated Service Tag, creating potential security risks if not properly mitigated.

How Attackers Can Exploit the Vulnerability

Attackers can exploit the vulnerability in Azure Service Tags by abusing the Availability Tests feature in Azure Application Insights. Below are detailed steps and examples to illustrate how an attacker can exploit this vulnerability:

1. Setting Up the Availability Test:

• Example Scenario: An attacker identifies an internal web service within a victim’s Azure environment that is protected by a firewall rule allowing traffic only from Azure Application Insights.
• Action: The attacker sets up an Availability Test in Azure Application Insights, configuring it to target the internal web service.

2. Customizing the Request:

• Manipulating Headers: The attacker customizes the HTTP request headers to include authorization tokens or other headers that may be expected by the target service.
• Changing HTTP Methods: The attacker can change the HTTP method (e.g., from GET to POST) to perform actions such as submitting data or invoking actions on the target service.
• Example Customization: The attacker configures the test to send a POST request with a custom header “Authorization: Bearer <malicious-token>”.

3. Sending the Malicious Request:

• Firewall Bypass: The crafted request is sent through the Availability Test. Since it originates from a trusted Azure service (Application Insights), it bypasses the firewall rules based on Service Tags.
• Example Attack: The Availability Test sends the POST request with the custom header to the internal web service, which processes the request as if it were from a legitimate source.

4. Accessing Internal Resources:

• Unauthorized Access: The attacker now has access to internal APIs, databases, or other services that were protected by the firewall.
• Exfiltration and Manipulation: The attacker can exfiltrate sensitive data, manipulate internal resources, or use the access to launch further attacks.
• Example Impact: The attacker retrieves confidential data from an internal API or modifies configuration settings in an internal service.

Detailed Example of Exploit

Scenario: An organization uses Azure Application Insights to monitor an internal financial service. The service is protected by a firewall rule that allows access only from the ApplicationInsightsAvailability Service Tag.

1. Deploying an Internal Azure App Service:
   • The organization has a financial application hosted on an Azure App Service with firewall rules configured to accept traffic only from the ApplicationInsightsAvailability Service Tag.
2. Attempted Access by the Attacker:
   • The attacker discovers the endpoint of the internal financial application and attempts to access it directly. The firewall blocks this attempt, returning a forbidden response.
3. Exploiting the Vulnerability:
   • Setting Up the Test: The attacker sets up an Availability Test in Azure Application Insights targeting the internal financial application.
   • Customizing the Request: The attacker customizes the test to send a POST request with a payload that triggers a financial transaction, adding a custom header “Authorization: Bearer <malicious-token>”.
   • Sending the Request: The Availability Test sends the POST request to the internal financial application, bypassing the firewall.
4. Gaining Unauthorized Access:
   • The financial application processes the POST request, believing it to be from a legitimate source. The attacker successfully triggers the financial transaction.
   • Exfiltration: The attacker sets up another Availability Test to send GET requests with custom headers to extract financial records from the application.

Advanced Exploitation Techniques

1. Chain Attacks:

• Attackers can chain multiple vulnerabilities or services together to escalate their privileges and impact. For example, using the initial access gained from the Availability Test to find other internal services or to escalate privileges within the Azure environment.

2. Lateral Movement:

• Once inside the network, attackers can move laterally to compromise other services or extract further data. They might use other Azure services like Azure DevOps or Azure Logic Apps to find additional entry points or sensitive data.

3. Persistent Access:

• Attackers can set up long-term Availability Tests that periodically execute, ensuring continuous access to the internal services. They might use these persistent tests to maintain a foothold within the environment, continuously exfiltrating data or executing malicious activities.

Defensive Measures

To mitigate the risks associated with this vulnerability, Azure customers should implement several defensive measures:

1. Analyze and Update Network Rules:

• Conduct a thorough review of network security rules.
• Identify and analyze any use of Service Tags in firewall rules.
• Assume services protected only by Service Tags may be vulnerable.

2. Implement Strong Authentication and Authorization:

• Add robust authentication and authorization mechanisms.
• Use Azure Active Directory (Azure AD) for managing access.
• Enforce multi-factor authentication and least privilege principles.

3. Enhance Network Isolation:

• Use network security groups (NSGs) and application security groups (ASGs) for granular isolation.
• Deploy Azure Private Link to keep traffic within the Azure network.

4. Monitor and Audit Network Traffic:

• Enable logging and monitoring of network traffic.
• Use Azure Monitor and Azure Security Center to set up alerts for unusual activities.
• Regularly review logs and audit trails.

5. Regularly Update and Patch Services:

• Keep all Azure services and applications up to date with security patches.
• Monitor security advisories from Microsoft and other sources.
• Apply updates promptly to minimize risk.

6. Use Azure Policy to Enforce Security Configurations:

• Deploy Azure Policy to enforce security best practices.
• Create policies that require strong authentication and proper network configurations.
• Use Azure Policy initiatives for consistent application across resources.

7. Conduct Security Assessments and Penetration Testing:

• Perform regular security assessments and penetration testing.
• Engage with security experts or third-party services for thorough reviews.
• Use tools like Azure Security Benchmark and Azure Defender.

8. Educate and Train Staff:

• Provide training on risks and best practices related to Azure Service Tags and network security.
• Ensure staff understand the importance of multi-layered security.
• Equip teams to implement and manage security measures effectively.

The vulnerability discovered by Tenable Research highlights significant risks associated with relying solely on Azure Service Tags for firewall rules. By understanding the nature of the vulnerability and implementing the recommended defensive measures, Azure customers can better protect their environments and mitigate potential threats. Regular reviews, updates, and a multi-layered security approach are essential to maintaining a secure Azure environment.

The post Your Azure Security at Risk? How Hackers Are Exploiting Azure Service Tags (And How to Stop Them)? appeared first on Information Security Newspaper | Hacking News.

The Threat Actors: Volt Typhoon

Volt Typhoon has successfully infiltrated the networks of critical infrastructure sectors, including Communications, Energy, Transportation Systems, and Water and Wastewater Systems, across the continental United States and its territories. The actors’ choice of targets and operational patterns diverge from conventional cyber espionage, indicating a clear intent towards enabling disruption of operational technology (OT) functions.

Tactics, Techniques, and Procedures (TTPs)

Volt Typhoon’s operations are characterized by the use of “living off the land” (LOTL) techniques, leveraging valid accounts and maintaining strong operational security to ensure long-term, undetected persistence within compromised environments. The actors conduct extensive reconnaissance to tailor their TTPs to the victim’s environment and have been observed maintaining access to some IT environments for at least five years.

Key stages of Volt Typhoon’s activity include:

1. Reconnaissance: Volt Typhoon’s operations begin with meticulous reconnaissance, gathering detailed intelligence on target organizations. This phase is critical for understanding the network architecture, security measures, typical user behaviors, and identifying key network and IT staff. The actors use various methods for reconnaissance, including web searches on victim-owned sites and leveraging search engines like FOFA, Shodan, and Censys to find exposed infrastructure. This extensive pre-compromise intelligence gathering is tailored to enhance their operational security and ensure successful penetration and persistence within the target environment.
2. Initial Access: Gaining initial access to the IT network is a pivotal step in Volt Typhoon’s operations. The actors commonly exploit known or zero-day vulnerabilities in public-facing network appliances, such as routers, VPNs, and firewalls. The use of publicly available exploit code for known vulnerabilities is frequent, but the actors are also adept at discovering and exploiting zero-day vulnerabilities. This approach allows them to establish a foothold within the network, from which they can launch further intrusion activities.
3. Credential Access and Privilege Escalation:Once inside the network, Volt Typhoon aims to obtain administrator credentials, often by exploiting privilege escalation vulnerabilities in the operating system or network services. In some instances, credentials are obtained from insecurely stored information on a public-facing network appliance. With these credentials, the actors can move laterally within the network, accessing critical systems and data.
4. Lateral Movement:Using valid administrator credentials, Volt Typhoon moves laterally to the domain controller and other critical devices via remote access services such as Remote Desktop Protocol (RDP). This step is crucial for expanding their access within the network and positioning themselves for further exploitation and disruption.
5. Discovery:Post-compromise, Volt Typhoon conducts discovery activities within the victim’s network, leveraging Living Off the Land (LOTL) binaries for stealth. This includes using PowerShell to perform targeted queries on Windows event logs, focusing on specific users and periods. These queries facilitate the discreet extraction of security event logs, allowing the actors to gather critical information while minimizing detection.
6. Domain Compromise:Achieving full domain compromise is a key objective for Volt Typhoon. The actors frequently employ the Volume Shadow Copy Service (VSS) to access the NTDS.dit file from the domain controller. This file contains critical Active Directory data, including user accounts and passwords (in hashed form), which can be leveraged for further exploitation.
7. Persistence:Volt Typhoon relies on valid credentials for persistence within the compromised environment. This approach allows them to maintain long-term, undiscovered access to the network, enabling them to re-target the same organizations over extended periods.
8. Defense Evasion:The actors’ strong operational security is evident in their primary use of LOTL techniques for defense evasion. By camouflaging their malicious activity with typical system and network behavior, they can circumvent simplistic endpoint security capabilities. Additionally, Volt Typhoon actors obfuscate their malware and engage in targeted log deletion to conceal their actions within the compromised environment.

Mitigation and Recommendations

The advisory urges critical infrastructure organizations to apply recommended mitigations and actively hunt for similar malicious activity. These measures are primarily intended for IT and OT administrators and include updating to the latest security patches, enhancing monitoring and detection capabilities, and applying best practices for identity and access management.

International Implications

While the direct threat to Canada’s critical infrastructure from PRC state-sponsored actors is assessed as lower than that to the U.S., the interconnected nature of critical infrastructure means that disruptions in the U.S. could have cascading effects on Canada and potentially other allied nations. Australian and New Zealand critical infrastructure is also considered vulnerable to similar activities from PRC state-sponsored actors.

The advisory from CISA, NSA, and FBI, supported by international cybersecurity agencies, highlights the sophisticated and persistent threat posed by PRC state-sponsored cyber actors to U.S. critical infrastructure. The detailed analysis of Volt Typhoon’s activities underscores the necessity for vigilance, proactive security measures, and international cooperation to mitigate the risks of disruptive or destructive cyberattacks against critical infrastructure sectors.

For organizations within the targeted sectors, adherence to the recommended mitigations and engagement with cybersecurity authorities for incident response and reporting is crucial. As geopolitical tensions continue to influence the cyber threat landscape, the resilience of critical infrastructure against state-sponsored cyber threats remains a top priority for national security.

The post How to Infiltrate Industrial OT Networks and Stay Undetected for Half a Decade appeared first on Information Security Newspaper | Hacking News.

Integrity Attacks: A Threat to AI’s Core

Integrity attacks affecting Generative AI systems are a type of security threat where the goal is to manipulate or corrupt the functioning of the AI system. These attacks can have significant implications, especially as Generative AI systems are increasingly used in various fields. Here are some key aspects of integrity attacks on Generative AI systems:

1. Data Poisoning:
   • Detail: This attack targets the training phase of an AI model. Attackers inject false or misleading data into the training set, which can subtly or significantly alter the model’s learning. This can result in a model that generates biased or incorrect outputs.
   • Example: Consider a facial recognition system being trained with a dataset that has been poisoned with subtly altered images. These images might contain small, imperceptible changes that cause the system to incorrectly recognize certain faces or objects.
2. Model Tampering:
   • Detail: In this attack, the internal parameters or architecture of the AI model are altered. This could be done by an insider with access to the model or by exploiting a vulnerability in the system.
   • Example: An attacker could alter the weightings in a sentiment analysis model, causing it to interpret negative sentiments as positive, which could be particularly damaging in contexts like customer feedback analysis.
3. Output Manipulation:
   • Detail: This occurs post-processing, where the AI’s output is intercepted and altered before it reaches the end-user. This can be done without directly tampering with the AI model itself.
   • Example: If a Generative AI system is used to generate financial reports, an attacker could intercept and manipulate the output to show incorrect financial health, affecting stock prices or investor decisions.
4. Adversarial Attacks:
   • Detail: These attacks use inputs that are specifically designed to confuse the AI model. These inputs are often indistinguishable from normal inputs to the human eye but cause the AI to make errors.
   • Example: A stop sign with subtle stickers or graffiti might be recognized as a speed limit sign by an autonomous vehicle’s AI system, leading to potential traffic violations or accidents.
5. Backdoor Attacks:
   • Detail: A backdoor is embedded into the AI model during its training. This backdoor is activated by certain inputs, causing the model to behave unexpectedly or maliciously.
   • Example: A language translation model could have a backdoor that, when triggered by a specific phrase, starts inserting or altering words in a translation, potentially changing the message’s meaning.
6. Exploitation of Biases:
   • Detail: This attack leverages existing biases within the AI model. AI systems can inherit biases from their training data, and these biases can be exploited to produce skewed or harmful outputs.
   • Example: If an AI model used for resume screening has an inherent gender bias, attackers can submit resumes that are tailored to exploit this bias, increasing the likelihood of certain candidates being selected or rejected unfairly.
7. Evasion Attacks:
   • Detail: In this scenario, the input data is manipulated in such a way that the AI system fails to recognize it as something it is trained to detect or categorize correctly.
   • Example: Malware could be designed to evade detection by an AI-powered security system by altering its code signature slightly, making it appear benign to the system while still carrying out malicious functions.

Privacy attacks on Generative AI

Privacy attacks on Generative AI systems are a serious concern, especially given the increasing use of these systems in handling sensitive data. These attacks aim to compromise the confidentiality and privacy of the data used by or generated from these systems. Here are some common types of privacy attacks, explained in detail with examples:

1. Model Inversion Attacks:
   • Detail: In this type of attack, the attacker tries to reconstruct the input data from the model’s output. This is particularly concerning if the AI model outputs something that indirectly reveals sensitive information about the input data.
   • Example: Consider a facial recognition system that outputs the likelihood of certain attributes (like age or ethnicity). An attacker could use this output information to reconstruct the faces of individuals in the training data, thereby invading their privacy.
2. Membership Inference Attacks:
   • Detail: These attacks aim to determine whether a particular data record was used in the training dataset of a machine learning model. This can be a privacy concern if the training data contains sensitive information.
   • Example: An attacker might test an AI health diagnostic tool with specific patient data. If the model’s predictions are unusually accurate or certain, it might indicate that the patient’s data was part of the training set, potentially revealing sensitive health information.
3. Training Data Extraction:
   • Detail: Here, the attacker aims to extract actual data points from the training dataset of the AI model. This can be achieved by analyzing the model’s responses to various inputs.
   • Example: An attacker could interact with a language model trained on confidential documents and, through carefully crafted queries, could cause the model to regurgitate snippets of these confidential texts.
4. Reconstruction Attacks:
   • Detail: Similar to model inversion, this attack focuses on reconstructing the input data, often in a detailed and high-fidelity manner. This is particularly feasible in models that retain a lot of information about their training data.
   • Example: In a generative model trained to produce images based on descriptions, an attacker might find a way to input specific prompts that cause the model to generate images closely resembling those in the training set, potentially revealing private or sensitive imagery.
5. Property Inference Attacks:
   • Detail: These attacks aim to infer properties or characteristics of the training data that the model was not intended to reveal. This could expose sensitive attributes or trends in the data.
   • Example: An attacker might analyze the output of a model used for employee performance evaluations to infer unprotected characteristics of the employees (like gender or race), which could be used for discriminatory purposes.
6. Model Stealing or Extraction:
   • Detail: In this case, the attacker aims to replicate the functionality of a proprietary AI model. By querying the model extensively and observing its outputs, the attacker can create a similar model without access to the original training data.
   • Example: A competitor could use the public API of a machine learning model to systematically query it and use the responses to train a new model that mimics the original, effectively stealing the intellectual property.

Segmenting Attacks

Attacks on AI systems, including ChatGPT and other generative AI models, can be further categorized based on the stage of the learning process they target (training or inference) and the attacker’s knowledge and access level (white-box or black-box). Here’s a breakdown:

By Learning Stage:

1. Attacks during Training Phase:
   • Data Poisoning: Injecting malicious data into the training set to compromise the model’s learning process.
   • Backdoor Attacks: Embedding hidden functionalities in the model during training that can be activated by specific inputs.
2. Attacks during Inference Phase:
   • Adversarial Attacks: Presenting misleading inputs to trick the model into making errors during its operation.
   • Model Inversion and Reconstruction Attacks: Attempting to infer or reconstruct input data from the model’s outputs.
   • Membership Inference Attacks: Determining whether specific data was used in the training set by observing the model’s behavior.
   • Property Inference Attacks: Inferring properties of the training data not intended to be disclosed.
   • Output Manipulation: Altering the model’s output after it has been generated but before it reaches the intended recipient.

By Attacker’s Knowledge and Access:

1. White-Box Attacks (Attacker has full knowledge and access):
   • Model Tampering: Directly altering the model’s parameters or structure.
   • Backdoor Attacks: Implanting a backdoor during the model’s development, which the attacker can later exploit.
   • These attacks require deep knowledge of the model’s architecture, parameters, and potentially access to the training process.
2. Black-Box Attacks (Attacker has limited or no knowledge and access):
   • Adversarial Attacks: Creating input samples designed to be misclassified or misinterpreted by the model.
   • Model Inversion and Reconstruction Attacks: These do not require knowledge of the model’s internal workings.
   • Membership and Property Inference Attacks: Based on the model’s output to certain inputs, without knowledge of its internal structure.
   • Training Data Extraction: Extracting information about the training data through extensive interaction with the model.
   • Model Stealing or Extraction: Replicating the model’s functionality by observing its inputs and outputs.

Implications:

• Training Phase Attacks often require insider access or a significant breach in the data pipeline, making them less common but potentially more devastating.
• Inference Phase Attacks are more accessible to external attackers as they can often be executed with minimal access to the model.
• White-Box Attacks are typically more sophisticated and require a higher level of access and knowledge, often limited to insiders or through major security breaches.
• Black-Box Attacks are more common in real-world scenarios, as they can be executed with limited knowledge about the model and without direct access to its internals.

Understanding these categories helps in devising targeted defense strategies for each type of attack, depending on the specific vulnerabilities and operational stages of the AI system.

Hacking ChatGpt

The ChatGPT AI model, like any advanced machine learning system, is potentially vulnerable to various attacks, including privacy and integrity attacks. Let’s explore how these attacks could be or have been used against ChatGPT, focusing on the privacy attacks mentioned earlier:

1. Model Inversion Attacks:
   • Potential Use Against ChatGPT: An attacker might attempt to use ChatGPT’s responses to infer details about the data it was trained on. For example, if ChatGPT consistently provides detailed and accurate information about a specific, less-known topic, it could indicate the presence of substantial training data on that topic, potentially revealing the nature of the data sources used.
2. Membership Inference Attacks:
   • Potential Use Against ChatGPT: This type of attack could try to determine if a particular text or type of text was part of ChatGPT’s training data. By analyzing the model’s responses to specific queries, an attacker might guess whether certain data was included in the training set, which could be a concern if the training data included sensitive or private information.
3. Training Data Extraction:
   • Potential Use Against ChatGPT: Since ChatGPT generates text based on patterns learned from its training data, there’s a theoretical risk that an attacker could manipulate the model to output segments of text that closely resemble or replicate parts of its training data. This is particularly sensitive if the training data contained confidential or proprietary information.
4. Reconstruction Attacks:
   • Potential Use Against ChatGPT: Similar to model inversion, attackers might try to reconstruct input data (like specific text examples) that the model was trained on, based on the information the model provides in its outputs. However, given the vast and diverse dataset ChatGPT is trained on, reconstructing specific training data can be challenging.
5. Property Inference Attacks:
   • Potential Use Against ChatGPT: Attackers could analyze responses from ChatGPT to infer properties about its training data that aren’t explicitly modeled. For instance, if the model shows biases or tendencies in certain responses, it might reveal unintended information about the composition or nature of the training data.
6. Model Stealing or Extraction:
   • Potential Use Against ChatGPT: This involves querying ChatGPT extensively to understand its underlying mechanisms and then using this information to create a similar model. Such an attack would be an attempt to replicate ChatGPT’s capabilities without access to the original model or training data.

Integrity attacks on AI models like ChatGPT aim to compromise the accuracy and reliability of the model’s outputs. Let’s examine how these attacks could be or have been used against the ChatGPT model, categorized by the learning stage and attacker’s knowledge:

Attacks during Training Phase (White-Box):

• Data Poisoning: If an attacker gains access to the training pipeline, they could introduce malicious data into ChatGPT’s training set. This could skew the model’s understanding and responses, leading it to generate biased, incorrect, or harmful content.
• Backdoor Attacks: An insider or someone with access to the training process could implant a backdoor into ChatGPT. This backdoor might trigger specific responses when certain inputs are detected, which could be used to spread misinformation or other harmful content.

Attacks during Inference Phase (Black-Box):

• Adversarial Attacks: These involve presenting ChatGPT with specially crafted inputs that cause it to produce erroneous outputs. For instance, an attacker could find a way to phrase questions or prompts that consistently mislead the model into giving incorrect or nonsensical answers.
• Output Manipulation: This would involve intercepting and altering ChatGPT’s responses after they are generated but before they reach the user. While this is more of an attack on the communication channel rather than the model itself, it can still undermine the integrity of ChatGPT’s outputs.

Implications and Defense Strategies:

• During Training: Ensuring the security and integrity of the training data and process is crucial. Regular audits, anomaly detection, and secure data handling practices are essential to mitigate these risks.
• During Inference: Robust model design to resist adversarial inputs, continuous monitoring of responses, and secure deployment architectures can help in defending against these attacks.

Real-World Examples and Concerns:

• To date, there haven’t been publicly disclosed instances of successful integrity attacks specifically against ChatGPT. However, the potential for such attacks exists, as demonstrated in academic and industry research on AI vulnerabilities.
• OpenAI, the creator of ChatGPT, employs various countermeasures like input sanitization, monitoring model outputs, and continuously updating the model to address new threats and vulnerabilities.

In conclusion, while integrity attacks pose a significant threat to AI models like ChatGPT, a combination of proactive defense strategies and ongoing vigilance is key to mitigating these risks.

While these attack types broadly apply to all generative AI systems, the report notes that some vulnerabilities are particularly pertinent to specific AI architectures, like Large Language Models (LLMs) and Retrieval Augmented Generation (RAG) systems. These models, which are at the forefront of natural language processing, are susceptible to unique threats due to their complex data processing and generation capabilities.

The implications of these vulnerabilities are vast and varied, affecting industries from healthcare to finance, and even national security. As AI systems become more integrated into critical infrastructure and everyday applications, the need for robust cybersecurity measures becomes increasingly urgent.

The NIST report serves as a clarion call for the AI industry, cybersecurity professionals, and policymakers to prioritize the development of stronger defense mechanisms against these emerging threats. This includes not only technological solutions but also regulatory frameworks and ethical guidelines to govern the use of AI.

In conclusion, the report is a timely reminder of the double-edged nature of AI technology. While it offers immense potential for progress and innovation, it also brings with it new challenges and threats that must be addressed with vigilance and foresight. As we continue to push the boundaries of what AI can achieve, ensuring the security and integrity of these systems remains a paramount concern for a future where technology and humanity can coexist in harmony.

The post 11 ways of hacking into ChatGpt like Generative AI systems appeared first on Information Security Newspaper | Hacking News.

Kubernetes and GKE Overview: Kubernetes, the most widely adopted open-source container platform, is used for application deployment and management. GKE, Google’s Kubernetes Engine, offers additional features and capabilities, enhancing the deployment and management of Kubernetes clusters. However, the complexity of Kubernetes environments often makes them susceptible to security breaches due to misconfiguration and excessive privileges.

Issues in FluentBit and Anthos Service Mesh:

• FluentBit: The default configuration of FluentBit, a lightweight log processor and forwarder, includes a volume mount that provides unnecessary access to the pod directory, including projected service account tokens.
• Anthos Service Mesh (ASM): ASM’s Container Network Interface (CNI) DaemonSet retains excessive permissions post-installation, which can be exploited to create a new pod with elevated privileges.

FluentBit Flaw

The vulnerability described in the FluentBit container within a Kubernetes cluster is a significant issue. This vulnerability arises from the way FluentBit is configured to access volumes within the cluster. Let’s break down this vulnerability and its implications:

Understanding the Vulnerability

1. FluentBit’s Volume Mount Configuration:
   • Misconfiguration: FluentBit is mounted with access to the /var/lib/kubelet/pods volume. This directory contains subdirectories for each pod running on a node.
   • Access to Sensitive Data: Within each pod’s directory, there is a kube-api-access volume that stores projected service account tokens. These tokens are used for authenticating with the Kubernetes API and are highly sensitive.
2. Exploitation of the Misconfiguration:
   • Compromise of FluentBit: If an attacker gains access to the FluentBit container, they can exploit this misconfiguration.
   • Access to Tokens: The attacker can access any service account token of the pods on the same node.
   • Impersonation and Unauthorized Access: Using these tokens, the attacker can impersonate pods with varying levels of privileges, potentially gaining unauthorized access to the Kubernetes API server.
3. Scope of the Attack:
   • Mapping the Cluster: The attacker could potentially list all running pods in the cluster (get pods command), allowing them to map the entire cluster.
   • Potential for Privilege Escalation: Depending on the permissions associated with the compromised tokens, the attacker could escalate their privileges within the cluster.
   • Harmful Actions: The attacker could perform various harmful actions, such as data theft, service disruption, or further exploitation of cluster resources.

The Role of the Sidecar Container

• Functionality of Sidecar Container: In a typical Kubernetes setup, a sidecar container like FluentBit is used for log collection. It operates within the context of its pod, collecting, parsing, and forwarding logs from the main application container.
• No Direct API Access Needed: The sidecar container generally doesn’t require direct access to the Kubernetes API server. It uses the Kubernetes infrastructure to access log files and container runtime metadata.

Anthos Service Mesh (ASM) Flaw

Imagine you are managing a Kubernetes cluster that utilizes Anthos Service Mesh (ASM) with Istio’s CNI plugin. The cluster hosts various applications critical to your organization.

Initial Setup

• ASM Installation: During the setup of ASM, the Istio-cni-node DaemonSet is installed on the cluster.
• DaemonSet’s Role: This DaemonSet is responsible for installing the Istio CNI plugin on each node. It also has a repair mode to handle misconfigured pods.

The Flaw

• Excessive Permissions: After the installation, the Istio-cni-node DaemonSet retains high-level permissions, which are no longer necessary for its daily operation. This is where the flaw lies.

Exploitation Example

1. Attacker’s Entry: An attacker, who already has limited access to the cluster (maybe as a low-privileged user), discovers the excessive permissions of the Istio-cni-node DaemonSet.
2. Creating a Powerful Pod:
   • The attacker creates a new pod in the cluster, assigning it the same permissions as the Istio-cni-node DaemonSet. This is possible due to the excessive permissions that the DaemonSet still holds.
   • This new pod, which we can call a “powerful pod,” now has abilities far beyond what a regular pod should have.
3. Misuse of Permissions:
   • The attacker uses the powerful pod to perform actions that are normally restricted, like accessing sensitive data or modifying critical configurations.
   • The pod could also manipulate other pods or services, disrupt operations, or even spread to other nodes, escalating the attack’s impact.
4. Privilege Escalation:
   • Leveraging the capabilities of the powerful pod, the attacker escalates their privileges to that of a cluster administrator.
   • With admin-level access, they gain complete control over the Kubernetes cluster, leading to a severe security breach.

The Privilege Escalation Chain

The combination of these two issues can be exploited in a second-stage attack to gain full control of a Kubernetes cluster. The attack involves exploiting FluentBit permissions to read projected service account tokens and then leveraging ASM’s post-installation permissions to escalate privileges.

Let’s break down this attack chain to understand how an attacker could escalate privileges to become a cluster admin:

Step-by-Step Breakdown of the Attack Chain

1. Initial Access via FluentBit Container

• Prerequisite: The attacker needs the Anthos Service Mesh feature to be enabled in the Kubernetes cluster.
• Exploiting FluentBit: The attacker gains control of the FluentBit container. FluentBit, being a logging tool, often has extensive access within a cluster for log collection purposes.
• Mounting Sensitive Volume: The attacker exploits FluentBit to mount the /var/lib/kubelet/pods volume, which contains the kube-api-access-<random-suffix> directory. This directory holds tokens from all pods on a node.

2. Token Harvesting Across the Cluster

• Leveraging DaemonSet Nature of FluentBit: Since FluentBit runs as a DaemonSet (a pod on every node), the attacker replicates the initial compromise on each node.
• Mapping the Cluster: By doing so, the attacker can access mounted tokens of other pods across the cluster.
• Targeting Istio-Installer-container Token: Among these tokens, the attacker specifically looks for the Istio-Installer-container token.

3. Exploiting ASM CNI DaemonSet’s Permissions

• Creating a New Pod: Utilizing the ASM CNI DaemonSet’s retained permissions, the attacker creates a new pod in the kube-system namespace.
• Targeting a Powerful Service Account: The aim is to associate this pod with a service account that has extensive privileges.

4. Choosing the CRAC Service Account

• Selecting CRAC: The ClusterRoleAggregationController (CRAC) service account is a prime target due to its ability to add permissions to cluster roles.
• Updating Cluster Role: The attacker modifies the cluster role bound to the CRAC service account to gain full privileges.

5. Final Steps to Gain Cluster Admin Access

• Mounting CRAC Token: The CRAC service account token is mounted onto the newly created pod.
• Exploiting FluentBit Again: The attacker then exploits the FluentBit misconfiguration to extract the CRAC token from their pod.
• Using CRAC Token: With the CRAC token, which has cluster admin permissions, the attacker can operate with full control over the Kubernetes cluster.

Google’s Response and Fixes:

Google addressed these configuration issues on December 14, 2023, with the release of GCP-2023-047. The fixes involved removing the /var/lib/kubelet/pod volume mount from the Fluent Bit pod and modifying ASM’s ClusterRole to remove excessive RBAC permissions.

Fixes and Mitigations Implemented

1. FluentBit Configuration Update

• Issue: Initially, FluentBit had excessive access due to a hostPath volume mount of the /var/lib/kubelet/pods directory, which included access to sensitive service account tokens.
• Fix: Google’s security team restricted FluentBit’s access, removing the unnecessary volume mount. This change ensures that FluentBit can only access the logs it requires for its operation, significantly reducing the risk of token compromise.

2. Anthos Service Mesh (ASM) Permissions Adjustment

• Issue: ASM’s CNI DaemonSet had high privileges, as identified in an internal report.
• Action Taken: Before the external report, Google was already working on reducing these permissions.
• Fix: Google modified the ASM’s ClusterRole and restructured some functionalities to eliminate unnecessary RBAC permissions. This change addresses the excessive permissions that previously allowed for potential exploitation.

Impact of the Fixes

• Security Hardening: These updates significantly enhance the security of both FluentBit and ASM within Kubernetes clusters, mitigating the specific vulnerabilities and strengthening the overall security posture against similar threats.
• Preventing Privilege Escalation: By rectifying these issues, Google has effectively closed the attack vector that allowed for escalation to cluster admin privileges.
• Proactive Vulnerability Management: Google’s response, especially their pre-emptive work on ASM’s permissions, highlights the importance of ongoing security assessments and proactive vulnerability management.

Broader Implications for Kubernetes Security

• Continuous Monitoring and Auditing: Kubernetes environments should be continuously monitored and audited for misconfigurations and excessive permissions, especially for components with wide-ranging access like DaemonSets.
• Principle of Least Privilege: This principle should be rigorously applied to all Kubernetes components, ensuring that each component has only the permissions necessary for its function.
• Prompt Patching and Updates: Regularly updating Kubernetes and its associated components is crucial for maintaining security, as vulnerabilities can be discovered and exploited rapidly.

This discovery highlights the importance of vigilant security practices in cloud environments. Kubernetes, while powerful, can be vulnerable to sophisticated attacks due to misconfigurations and excessive privileges in system pods. The proactive response from Google and the detailed analysis by Palo Alto Networks underscore the ongoing need for robust security measures in cloud infrastructures.

The post How to hack Google Kubernetes Engine (GKE)? Securing against GKE threats appeared first on Information Security Newspaper | Hacking News.

1. Sending and Receiving Servers: SMTP involves at least two servers: the sending mail server and the receiving mail server. The sending server initiates the process.
2. SMTP Ports: Commonly, SMTP uses port 25 for non-encrypted communication and port 587 for encrypted communication (STARTTLS). Some servers also use port 465 for SSL/TLS encrypted communication.
3. SMTP Commands and Responses: SMTP communication is based on commands and responses. Common commands include HELO (or EHLO for Extended SMTP), MAIL FROM to specify the sender, RCPT TO for the recipient, and DATA for the body of the email. Responses from the server indicate success or failure of these commands.
4. MIME (Multipurpose Internet Mail Extensions): Although SMTP is limited to sending text, MIME standards enable SMTP to send other types of data like images, audio, and video by encoding them into text format.
5. SMTP Authentication: This is used to authenticate a user who wants to send an email. It helps in preventing unauthorized access to the email server.
6. SMTP Relay: This refers to the process of transferring an email from one server to another. When an SMTP server forwards an email to another server for further delivery, it’s called relaying.
7. SMTP in Email Clients: Email clients (like Outlook, Thunderbird) use SMTP to send emails. These clients require configuration of SMTP settings (server address, port, authentication) to send emails.
8. Limitations and Security: SMTP itself does not encrypt email content; it relies on other protocols (like SSL/TLS) for security. Also, SMTP does not inherently include strong mechanisms to authenticate the sender, which has led to issues like spam and phishing.
9. Interaction with Other Protocols: SMTP is typically used alongside POP3 or IMAP, which are protocols used for retrieving emails from a mail server.
10. Use in Modern Email Systems: Despite its age, SMTP remains a fundamental part of the email infrastructure in the Internet and is used in virtually all email systems today.

SMTP Smuggling

SMTP Smuggling refers to a technique used in network security to bypass security measures by exploiting vulnerabilities in the Simple Mail Transfer Protocol (SMTP). SMTP is the standard protocol used for sending emails across the Internet. Smuggling in this context typically involves manipulating the SMTP conversation in a way that allows an attacker to inject malicious commands or payloads into an email message. These payloads might be overlooked by security systems that are not properly configured to handle anomalous SMTP traffic.

There are several ways SMTP smuggling can be executed:

1. Command Injection: By inserting additional SMTP commands into message fields (like the ‘MAIL FROM’ or ‘RCPT TO’ fields), an attacker might trick a server into executing commands it shouldn’t.
2. CRLF Injection: SMTP commands are typically separated by a carriage return and line feed (CRLF). If an attacker can inject CRLF sequences into a message, they might be able to append additional commands or modify the behavior of the email server.
3. Content Smuggling: This involves hiding malicious content within an email in a way that evades detection by security systems, which might scan emails for known threats.

Email authentication mechanisms

Email authentication mechanisms like SPF, DKIM, and DMARC are crucial in the fight against email spoofing and phishing. They help verify the authenticity of the sender and ensure the integrity of the message. Here’s a basic overview of each:

1. SPF (Sender Policy Framework)

• Purpose: SPF is used to prevent sender address forgery. It allows the domain owner to specify which mail servers are permitted to send email on behalf of their domain.
• How It Works: The domain owner publishes SPF records in their DNS. These records list the authorized sending IP addresses. When an email is received, the receiving server checks the SPF record to verify that the email comes from an authorized server.
• Limitations: SPF only checks the envelope sender (return-path) and not the header (From:) address, which is often what the recipient sees.

2. DKIM (DomainKeys Identified Mail)

• Purpose: DKIM provides a way to validate a domain name identity that is associated with a message through cryptographic authentication.
• How It Works: The sending server attaches a digital signature linked to the domain to the header of the email. The receiving server then uses the sender’s public key (published in their DNS) to verify the signature.
• Advantages: DKIM verifies that parts of the email (including attachments) have not been altered in transit.

3. DMARC (Domain-based Message Authentication, Reporting, and Conformance)

• Purpose: DMARC builds on SPF and DKIM. It allows the domain owner to specify how an email that fails SPF and DKIM checks should be handled.
• How It Works: DMARC policies are published in DNS. These policies instruct the receiving server what to do with mail that doesn’t pass SPF or DKIM checks (e.g., reject the mail, quarantine it, or pass it with a note).
• Benefits: DMARC also includes reporting capabilities, letting senders receive feedback on how their email is being handled.

Combined Effectiveness

• Complementary Roles: SPF, DKIM, and DMARC work together to improve email security. SPF validates the sending server, DKIM validates the message integrity, and DMARC tells receivers what to do if the other checks fail.
• Combat Spoofing and Phishing: By using these mechanisms, organizations can significantly reduce the risk of their domains being used for email spoofing and phishing attacks.
• Adoption and Configuration: Proper configuration of these protocols is critical. Misconfiguration can lead to legitimate emails being rejected or marked as spam.

Implementation

• DNS Records: All three require DNS records to be set up. SPF and DMARC are text records, while DKIM uses a TXT record for the public key.
• Email Servers and Services: Many email services and servers support these protocols, but they usually require manual setup and configuration by the domain administrator.

Overall, SPF, DKIM, and DMARC are essential tools in the email administrator’s toolkit for securing email communication and protecting a domain’s reputation.

In a groundbreaking discovery, Timo Longin, in collaboration with the SEC Consult Vulnerability Lab, has unveiled a novel exploitation technique in the realm of email security. This technique, known as SMTP smuggling, poses a significant threat to global email communication by allowing malicious actors to send spoofed emails from virtually any email address.

Discovery of SMTP Smuggling: The concept of SMTP smuggling emerged from a research project led by Timo Longin, a renowned figure in the cybersecurity community known for his work on DNS protocol attacks. This new technique exploits differences in how SMTP servers interpret protocol rules, enabling attackers to bypass standard email authentication methods like SPF (Sender Policy Framework).

How SMTP Smuggling Works: SMTP smuggling operates by exploiting the interpretation differences of the SMTP protocol among various email servers. This allows attackers to ‘smuggle’ or send spoofed emails that appear to originate from legitimate sources, thereby passing SPF alignment checks. The research identified two types of SMTP smuggling: outbound and inbound, affecting millions of domains and email servers.

Technical Insights: Understanding SMTP Smuggling in Depth

SMTP Smuggling Exploited: SMTP smuggling takes advantage of discrepancies in how different email servers interpret the SMTP protocol. Specifically, it targets the end-of-data sequence, which signifies the end of an email message. In a standard SMTP session, this sequence is represented by a line with only a period (.) character, preceded by a carriage return and a line feed (<CR><LF>.<CR><LF>). However, variations in interpreting this sequence can lead to vulnerabilities.

Outbound and Inbound Smuggling: The research identified two types of SMTP smuggling: outbound and inbound. Outbound smuggling involves sending emails from a compromised server, while inbound smuggling pertains to receiving emails on a server that misinterprets the end-of-data sequence. Both types can be exploited to send spoofed emails that appear to come from legitimate sources.

Exploiting SPF Alignment Checks:

The concept of “Exploiting SPF Alignment Checks” in the context of SMTP smuggling revolves around manipulating the Sender Policy Framework (SPF) checks to send spoofed emails. SPF is an email authentication method designed to prevent sender address forgery. Here’s a detailed explanation of how SPF alignment checks can be exploited through SMTP smuggling:

Understanding SPF:

1. SPF Basics: SPF allows domain owners to specify which mail servers are permitted to send emails on behalf of their domain. This is done by publishing SPF records in DNS. When an email is received, the recipient server checks the SPF record to verify if the email comes from an authorized server.
2. SPF Check Process: The SPF check typically involves comparing the sender’s IP address (found in the SMTP envelope) against the IP addresses listed in the domain’s SPF record. If the IP address matches one in the SPF record, the email passes the SPF check.

Exploitation through SMTP Smuggling:

1. Manipulating the ‘MAIL FROM’ Address: In SMTP smuggling, attackers manipulate the ‘MAIL FROM’ address in the SMTP envelope. This address is used for SPF validation. By carefully crafting this address, attackers can pass the SPF check even when sending from an unauthorized server.
2. Discrepancy between ‘MAIL FROM’ and ‘From’ Header: There’s often a discrepancy between the ‘MAIL FROM’ address in the SMTP envelope (used for SPF checks) and the ‘From’ header in the email body (which the recipient sees). SMTP smuggling exploits this by setting the ‘MAIL FROM’ address to a domain that passes the SPF check, while the ‘From’ header is spoofed to appear as if the email is from a different, often trusted, domain.
3. Bypassing SPF Alignment: The key to this exploitation is the difference in how various mail servers interpret and process SMTP protocol rules. By smuggling in additional commands or data, attackers can make an email appear to come from a legitimate source, thus bypassing SPF alignment checks.
4. Consequences: This exploitation can lead to successful phishing attacks, as the email appears to be from a trusted source, despite being sent from an unauthorized server. Recipients are more likely to trust and act upon these emails, leading to potential security breaches.

Technical Experimentation

The “Technical Experimentation” aspect of the SMTP smuggling research conducted by SEC Consult involved a series of methodical tests and analyses to understand how different email servers handle SMTP protocol, particularly focusing on the end-of-data sequence.

Objective of the Experimentation:

The primary goal was to identify discrepancies in how outbound (sending) and inbound (receiving) SMTP servers interpret the SMTP protocol, especially the end-of-data sequence. This sequence is crucial as it signifies the end of an email message.

Experiment Setup:

1. Selection of Email Providers: The researchers selected a range of public email providers that support mail submissions via SMTP. This included popular services like Outlook.com, Gmail, GMX, iCloud, and others.
2. SMTP Analysis Server: A specialized SMTP analysis server was set up to receive emails from these providers. This server played a critical role in observing how different SMTP servers handle various SMTP commands and sequences.
3. SMTP Analysis Client: An SMTP analysis client was used to send emails through the outbound SMTP servers of the selected providers. This client was configured to vary the SMTP commands and sequences used in the emails.

Key Areas of Focus:

1. End-of-Data Sequence Variations: The researchers experimented with different end-of-data sequences, such as <LF>.<LF> (Line Feed) instead of the standard <CR><LF>.<CR><LF> (Carriage Return, Line Feed). The goal was to see if outbound servers would process these non-standard sequences differently.
2. Server Responses to DATA Command: Different responses from email providers to the DATA SMTP command were observed. These responses provided insights into how each server might handle end-of-data sequences.
3. Operating System Differences: The experiment also considered how different operating systems interpret “a line by itself.” For example, Windows uses <CR><LF> to denote the end of a line, while Unix/Linux systems use <LF>. This difference could affect how email servers process the end-of-data sequence.

Experiment Execution:

1. Sending Test Emails: The SMTP analysis client sent test emails through the outbound SMTP servers of the selected providers, using various end-of-data sequences.
2. Observing Responses: The inbound SMTP analysis server received these emails and recorded how each outbound server handled the different sequences.
3. Identifying Anomalies: The researchers looked for anomalies where outbound servers did not correctly interpret or filter non-standard end-of-data sequences, and inbound servers accepted them as valid.

Findings:

The experimentation revealed that some SMTP servers did not conform to the standard interpretation of the SMTP protocol, particularly in handling end-of-data sequences. This non-conformity opened the door for SMTP smuggling, where attackers could insert additional SMTP commands into email content.

Case Study – GMX SMTP Server

A notable example of SMTP smuggling was demonstrated using GMX’s SMTP server. The researchers were able to send an email with a specially crafted end-of-data sequence that the GMX server did not filter out. This allowed them to insert additional SMTP commands into the email content, which were then executed by the recipient server, effectively ‘smuggling’ malicious commands or content.

Exploitation Technique:

• Manipulating End-of-Data Sequence: The researchers experimented with different end-of-data sequences, such as <LF>.<LF> instead of the standard <CR><LF>.<CR><LF>.
• Observing GMX Server Response: It was observed that when a specific sequence (<LF>.<CR><LF>) was sent to the GMX outbound SMTP server, it passed this sequence unfiltered to the inbound SMTP server.

Successful SMTP Smuggling:

• Breaking Out of Message Data: By using the <LF>.<CR><LF> sequence, the researchers were able to ‘break out’ of the message data at the inbound SMTP server. This meant that anything following this sequence could be interpreted as a separate SMTP command or additional email content.
• Demonstration of Vulnerability: This technique allowed the researchers to effectively insert additional SMTP commands into the email content, demonstrating a successful SMTP smuggling attack.

The research team’s first successful SMTP smuggling exploit was demonstrated using GMX’s SMTP server. This breakthrough confirmed the feasibility of the technique and its potential to compromise email security on a large scale. SMTP smuggling represents a new frontier in email spoofing, challenging existing security measures and highlighting the need for continuous vigilance in the cybersecurity domain. The discovery underscores the importance of regular security audits and updates to protect against emerging threats. The discovery of SMTP smuggling has significant implications for email security. Vulnerabilities were identified in major email services, including Microsoft and GMX, which were promptly addressed. However, SEC Consult has issued a warning to organizations using Cisco Secure Email, urging them to update their configurations to mitigate this vulnerability.

Technical and Security Mitigations:

1. Patch and Update Systems: Regularly update and patch email servers and related software. Providers should ensure their systems are up-to-date with the latest security patches that address known vulnerabilities, including those related to SMTP smuggling.
2. Enhance Email Authentication: Implement and enforce advanced email authentication protocols like DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting, and Conformance). These protocols provide additional layers of verification, ensuring that the email’s sender is legitimate and that the message content hasn’t been tampered with.
3. Configure Email Servers Correctly: Ensure that email servers, especially those handling outbound and inbound emails, are configured correctly to handle SMTP protocol standards, particularly the end-of-data sequence. This involves strict adherence to protocol specifications to prevent any ambiguity in interpretation.
4. Use Advanced Email Filtering Solutions: Employ advanced email filtering solutions that can detect and block spoofed emails. These solutions often use machine learning and other advanced techniques to identify anomalies in email messages that might indicate a spoofing attempt.
5. Regular Security Audits: Conduct regular security audits of email infrastructure to identify and rectify potential vulnerabilities. This should include a review of server configurations, authentication mechanisms, and update protocols.

SMTP smuggling represents a significant advancement in the understanding of email protocol vulnerabilities. It challenges the existing security paradigms and calls for a reevaluation of email security strategies. As the cybersecurity community works to address these vulnerabilities, this discovery serves as a crucial reminder of the dynamic and evolving nature of cyber threats.

The post How to send spoof emails from domains that have SPF and DKIM protections? appeared first on Information Security Newspaper | Hacking News.

Let’s consider a hypothetical example to understand the implications of CVE-2023-36052:

Suppose a development team uses Azure CLI for managing their Azure resources and automates their deployment process using GitHub Actions. During their routine operations, they execute various Azure CLI commands which generate logs. These logs, by default, include plaintext credentials such as usernames and passwords.

An external attacker, aware of this vulnerability, could access the public repository where the team’s GitHub Actions are configured. By examining the CI/CD logs published there, the attacker could find and extract these plaintext credentials. With these credentials, the attacker could gain unauthorized access to the team’s Azure resources, potentially leading to data breaches, unauthorized modifications, or even service disruptions.

This scenario underscores the critical nature of CVE-2023-36052, where seemingly benign logs could inadvertently become a source of significant security breaches. The mitigation steps provided by Microsoft, including updating Azure CLI and implementing best practices for log management and key rotations, are essential to prevent such unauthorized access.

Mitigation

Microsoft implemented several measures to address this vulnerability. These include:

1. Azure CLI Update: Advising customers to update Azure CLI to the latest release.
2. Securing Logs: Avoiding exposure of Azure CLI output in logs or publicly accessible locations and implementing guidance for masking environment variables.
3. Regularly Rotating Keys and Secrets: Encouraging regular rotation of keys and secrets.
4. Reviewing Security Best Practices: Providing guidance on secrets management for Azure services and GitHub Actions, and ensuring GitHub repositories are private unless necessary to be public.
5. Securing Azure Pipelines: Offering guidance for securing Azure Pipelines.
6. Enhancing Default Configurations: Introducing a new default configuration in Azure CLI to prevent accidental disclosure of sensitive information. This included restricting the presentation of secrets in output from update commands and broadening credential redaction capabilities across GitHub Actions and Azure Pipelines.

Workaround

Without patching, the primary alternative way to mitigate the risks associated with CVE-2023-36052 involves several best practices and security measures:

1. Secure Logging Practices: Ensure that logs do not contain sensitive information. This might involve custom scripts or tools to filter out or obfuscate credentials and other sensitive data before they are logged.
2. Access Control on Logs: Restrict access to CI/CD logs. Ensure that only authorized personnel can view these logs, and they are not publicly accessible.
3. Frequent Credential Rotation: Regularly change credentials and secrets to reduce the window of opportunity for an attacker to use compromised credentials.
4. Monitoring and Alerting: Implement monitoring to detect unusual access patterns or usage of credentials, which might indicate a compromise.
5. Environment Segmentation: Segregate development, testing, and production environments. Limit the scope of what each environment can access to minimize potential damage.

However, these measures are more complex and potentially less effective than updating the Azure CLI to a patched version. Patching directly addresses the vulnerability at its source, providing a more comprehensive and straightforward solution.

The post Azure CLI stores credentials in plaintext in logs. A easy technique to hack cloud environments appeared first on Information Security Newspaper | Hacking News.

1. Initial Access

• Example: A phishing email is sent to an employee in the OT/ICS environment. The email contains a seemingly harmless document that, when opened, executes a PowerShell script (a native Windows tool) to create a backdoor.

2. Lateral Movement

• Example: Once inside the network, attackers might use legitimate system administration tools like Windows Management Instrumentation (WMI) or Remote Desktop Protocol (RDP) to move laterally across the network, searching for critical OT/ICS components.

3. Elevation of Privileges

• Example: Attackers might use built-in tools like Netstat to identify security software or firewall settings and then use other native scripts or commands to disable these defenses, or to elevate their access privileges within the system.

4. Discovery and Information Gathering

• Example: Tools like Tasklist or Systeminfo (native to Windows) are used to gather information about the system, such as running processes, installed software, or network configurations relevant to the OT/ICS environment.

5. Exploitation and Manipulation

• Example: In an ICS environment, attackers might use standard industrial communication protocols like Modbus or DNP3 (which are legitimate and essential for normal operations) to send malicious commands to control systems, potentially disrupting physical processes like power generation or water treatment.

6. Persistence and Exfiltration

• Example: Attackers could use standard data transfer tools like FTP or even Windows BITS (Background Intelligent Transfer Service) to exfiltrate stolen data, or to maintain persistence by regularly updating malware or downloading additional tools.

7. Cleanup

• Example: To erase their tracks, attackers might use native cleanup tools or scripts to delete logs or any evidence of their activities, making detection and forensics much more difficult.

In late 2022, a significant cyber-physical incident occurred in Ukraine, attributed to the Russia-linked threat actor Sandworm. This event targeted Ukrainian critical infrastructure and utilized a multi-event cyber attack strategy, incorporating innovative techniques to impact industrial control systems (ICS) and operational technology (OT). The Sandworm actor employed OT-level living-off-the-land (LotL) techniques, likely causing a substation’s circuit breakers to trip and resulting in an unplanned power outage. This outage coincided with mass missile strikes across Ukraine’s critical infrastructure. Additionally, Sandworm executed a second disruptive event by deploying a new variant of CADDYWIPER malware in the victim’s IT environment.

This attack exemplifies the latest advancements in Russia’s cyber-physical attack capabilities, particularly visible since Russia’s invasion of Ukraine. The techniques used indicate a maturing offensive OT arsenal, capable of identifying novel OT threat vectors, developing new capabilities, and leveraging various types of OT infrastructure for attacks. Utilizing LotL techniques likely reduced the time and resources required for the cyber-physical attack. Although the initial intrusion point remains undetermined, the rapid development of the OT component of this attack suggests the actor’s ability to swiftly create similar capabilities against other OT systems globally.

Sandworm, active since at least 2009, is a versatile threat actor conducting espionage, influence, and attack operations, primarily supporting Russia’s Main Intelligence Directorate (GRU). The group’s primary focus has been Ukraine, where it has orchestrated disruptive and destructive attacks using wiper malware, especially during Russia’s re-invasion in 2022. However, Sandworm’s activities extend globally, underlining the Russian military’s extensive ambitions and interests in various regions. The group’s global threat activity and novel OT capabilities necessitate proactive measures from OT asset owners to mitigate potential risks.

As per mandiant research, the 2022 intrusion began or prior to June 2022, culminating in two disruptive events on October 10 and 12. Sandworm accessed the OT environment via a hypervisor hosting a SCADA management instance for a substation, potentially having SCADA system access for up to three months. On October 10, Sandworm used an optical disc (ISO) image, “a.iso,” to execute a native MicroSCADA binary, likely for malicious control commands to switch off substations. The attackers, got into the operational technology (OT) system through a key piece of software (a hypervisor) that managed the control system (SCADA) of a power substation. This means they had access to the system that controls how the power substation works. For up to three months, they could have been inside this system without being detected. On October 10, they used a special file (an ISO image named “a.iso”) to run a command in the control system that was likely intended to turn off power substations.

This case underscores the evolving nature of cyber threats, particularly in critical infrastructure sectors. The increasing sophistication and rapid development of such attacks highlight the need for enhanced cybersecurity measures, continuous monitoring, and preparedness against novel and complex cyber threats in OT and ICS environments.

In OT/ICS environments, such LotL attacks are particularly concerning because they:

• Are harder to detect due to the use of legitimate tools.
• Can cause significant physical and operational damage.
• May bypass traditional security measures that don’t account for malicious use of native tools.

Defending against such attacks requires a combination of robust cybersecurity practices, including employee training, network segmentation, constant monitoring for anomalous behaviors, and regular updating and patching of all systems.

The post How Living-off-the-land (LotL) technique is used to hack into power grids & cause power outages appeared first on Information Security Newspaper | Hacking News.

“Looney Tunables” allows bad actors to exploit a buffer overflow within the ld.so dynamic loader of the GNU C Library (glibc). This exploitation path provides local attackers with a mechanism to elevate their privileges to root level, thereby gaining unparalleled access and control over the system. Given that root privileges allow complete control over a system, attackers can execute a variety of malicious activities, from accessing sensitive information to altering system settings and functionalities, underscoring the critical nature of this security flaw.

The GNU C Library, or glibc, is fundamentally integral to the operation of a majority of systems based on the Linux kernel. This crucial library facilitates numerous system calls, from elementary functions like open, malloc, and printf to more complex ones such as exit, serving as the operational backbone for these systems. As such, glibc plays a pivotal role in the functionality and performance of Linux-based systems, making any vulnerability within this library particularly concerning for system administrators and users alike.

Within glibc, the ld.so dynamic loader is an element of paramount importance. This component is tasked with the significant responsibility of initializing and running programs on Linux systems that rely on glibc for their operation. Its role is crucial as it ensures the smooth execution of various applications and services on a Linux system, making it an indispensable part of the operating environment. Given its central function, any vulnerability within the ld.so dynamic loader is a matter of serious concern as it could potentially compromise the security and stability of a wide range of systems.

In light of the discovery of “Looney Tunables”, it is imperative for organizations and users utilizing Linux-based systems to acknowledge and address this security vulnerability swiftly to safeguard their systems against potential exploits. Immediate mitigation steps, including the application of security patches and updates, should be undertaken to protect systems from the risks associated with this high-severity vulnerability. Users and administrators should stay vigilant and monitor any security advisories and updates issued by the Linux community and cybersecurity experts to ensure timely and effective protection against this newly identified threat.

Furthermore, it would be prudent for organizations to adopt and enforce a set of security best practices. These might include the regular updating and patching of systems, the use of reliable security solutions, conducting cybersecurity awareness and training programs for employees, and implementing network segmentation strategies. These proactive measures can significantly enhance the security posture of an organization, providing robust defense mechanisms against “Looney Tunables” and other similar security threats that might emerge in the future.

The GNU C Library’s ld.so dynamic loader was found to include the security flaw, which exposed a crack in the armor. During the processing of the ‘GLIBC_TUNABLES’ environment variable, this security hole might manifest itself. To put it more simply, a hostile attacker on the local network who has some dexterity and cunning may insert text into the ‘GLIBC_TUNABLES’ environment variable. The attacker is able to execute code with dangerously high privileges if they do this while beginning binaries that have the SUID permission.

This vulnerability was discovered by the observant members of the Qualys Threat Research Unit. According to an investigation into the origin of the vulnerability, it was first discovered in April 2021, when glibc version 2.34 was being distributed. Ironically, the commit was made with the intention of improving security by correcting the behavior of SXID_ERASE in setuid applications.

It is important to keep in mind that attackers, even those with just the most basic privileges, are able to take advantage of this severe gap. since of their simplicity and since they don’t need any input from the user, these assaults are particularly alarming.

There is a solution available for those who are unable to update their software promptly and do not have the Secure Boot capability. A SystemTap script has been made available, and once it is enabled, it will immediately stop any setuid application that has been launched with the ‘GLIBC_TUNABLES’ environment variable present. To securely call the setuid program thereafter, one just has to unset or remove the ‘GLIBC_TUNABLES’ environment variable, for instance by executing the command ‘GLIBC_TUNABLES= sudo’.

According to Saeed Abbasi, who is the Product Manager at Qualys’ Threat Research Unit, “Our successful exploitation, leading to full root privileges on major distributions like Fedora, Ubuntu, and Debian, underscores the profound and ubiquitous nature of this vulnerability.”

While the Qualys team has indicated that they will not release its exploit code at this time, the inherent simplicity of transforming the buffer overflow into a data-only assault suggests that other research teams may soon take up the challenge.

Systems that are running Debian 12 and 13, Ubuntu 22.04 and 23.04, or Fedora 37 and 38 are vulnerable to the CVE-2023-4911 flaw and should be avoided at all costs. The extent of the possible harm might be enormous due to the widespread use of the glibc library in Linux’s many different distributions. Distributions such as Alpine Linux, which use the musl libc library instead of the glibc library, are given a little bit of wiggle room.

The post Hacking Debian 12, 13, Ubuntu 22.04, 23.04 & Fedora 37, 38 servers using a single vulnerability appeared first on Information Security Newspaper | Hacking News.

However, if it is not set and maintained effectively, it presents the opportunity for spying, lateral movement, and persistence assaults by malicious actors. CTS makes it possible to add people from another tenancy to a target tenant by syncing their user accounts.
It is possible to migrate laterally from a compromised tenant to another tenant of the same or a different company by exploiting a CTS setting that has been setup in a lax manner and that may be abused by an attacker. It is possible to install a malicious CTS configuration and utilize it as a backdoor approach in order to keep access to a Microsoft tenancy that is controlled by an external attacker.

Vectra AI, a cybersecurity company, recently produced a research in which it elaborated on how threat actors might use this capability to propagate laterally to related tenants or even employ this feature for persistence.

However, they also caution that in order to abuse this functionality, a threat actor must first either compromise a privileged account or acquire privilege escalation in a Microsoft cloud environment that has already been compromised. The first method detailed in Vectra AI’s paper entails evaluating the CTS settings in order to find target tenants linked via these policies and, more particularly, searching for tenants with the ‘Outbound Sync’ feature enabled, which enables synchronizing with other tenants.

After discovering a tenant that satisfies those requirements, the attacker finds the application that is used for CTS synchronization and adjusts its settings in order to include the compromised user inside its sync scope. This gives the attacker access to the network of the other tenant. Because of this, it is possible for the threat actor to accomplish lateral movement without the need for fresh user credentials.

The second method that Vectra demonstrates includes establishing a rogue CTS configuration in order to maintain permanent access to the tenants that are the focus of the attack. It should be emphasized once again that in order for this strategy to work, the threat actor must have already succeeded in compromising a privileged account inside the tenant.

To get more specific, the attacker installs a new CTS policy and activates ‘Inbound Sync’ and ‘Automatic User Consent,’ which gives them the ability to push new users from their external tenancy to the target at any moment.

Because of the way this arrangement is configured, the attacker will always have access to the target tenancy via the external account.

Even if the rogue accounts are deactivated, the attacker may still create and “push” new users at anytime, obtaining instant access to the resources of the target tenancy. This is the reason why the researchers refer to this as a “backdoor.”

Defense

The methods of attack described in this article presume the presence of a compromise. The continued implementation and enforcement of security best practices inside businesses is required to continue lowering the chance of accounts being compromised.

CTS Target residents are required to:

It is best to steer clear of the practice of establishing a default inbound CTA setup if at all possible, since this would allow any users, groups, and apps from the source tenancy to sync inbound.

Implement an incoming CTA setup that is less inclusive, such as specifically designating accounts (if it’s at all feasible) or groups that can receive access via CTS.

In order to block access by unauthorized users, combine the CTA policy with any additional Conditional Access Policies.

Tenants of CTS Source are required to:

Ensure that all privileged groups, including those that are permitted access to other tenants through CTS, are subject to the appropriate levels of regulation and monitoring.

The post New Azure AD Cross-Tenant Synchronisation (CTS)  Attack allows hacking tenants laterally appeared first on Information Security Newspaper | Hacking News.

Organizations who do not have the essential capabilities to protect themselves against cloud-based attacks may benefit from the tools that are supplied by CISA. These technologies may assist users in securing their cloud resources from data theft, information exposure, and information theft respectively.
The Cloud Industry Security Alliance (CISA) stated that companies should use the security features supplied by Cloud Service Providers and combine them with the free tools that were recommended by the CISA in order to defend themselves from these attacks. The following is a list of the tools that the CISA provides:

1. Cybersecurity Evaluation Tool (CSET).
2. The SCuBAGear tool.
3. The Untitled Goose Tool
4. Decider Tool
5. Memory Forensic on Cloud (JPCERT/CC) is an offering of Japan CERT.

The Cybersecurity Evaluation Tool, also known as the CSET.

For the purpose of assisting enterprises in the assessment of their cybersecurity posture, the CISA created this tool, which makes use of standards, guidelines, and recommendations that are widely accepted in the industry. Multiple questions about operational rules and procedures, as well as queries on the design of the system, are asked by the tool.This information is then utilized to develop a report that gives a comprehensive insight into the strengths and shortcomings of the businesses, along with suggestions to remedy them. The Cross-Sector Cyber Performance Goals (CPG) are included in the CSET version 11.5. These goals were established by the National Institute of Standards and Technology (NIST) in collaboration with the Computer Security Industry Association (CISA).

The CPG is able to give best practices and guidelines that should be followed by all organizations. This tool may assist in the fight against prevalent and significant TTPs.

M365 Secure Configuration Baseline Assessment Tool, SCuBAGear

SCuBAGear is a tool that was developed as a part of the SCuBA (Secure Cloud Business Applications) project. This project was started as a direct reaction to the Supply Chain hack that occurred with SolarWinds Orion Software. SCuBA is a piece of automated software that does comparisons between the Federal Civilian Executive Branch (FECB) and the M365 Secure configurations of the CISA. CISA, in conjunction with SCuBAGear, has produced a number of materials that may serve as a guide for cloud security and are of use to all types of enterprises. This tool resulted in the creation of three different documents:

SCuBA Technical Reference Architecture (TRA) — Offers fundamental building blocks for bolstering the safety of cloud storage environments. Cloud-based business apps (for SaaS models) and the security services that are used to safeguard and monitor them are both included in the purview of TRA.
The Hybrid Identity Solutions Architecture provides the best possible methods for tackling identity management in an environment that is hosted on the cloud.
M365 security configuration baseline (SCB) — offers fundamental security settings for Microsoft Defender 365, OneDrive, Azure Active Directory, Exchange Online, and other services.This application generates an HTML report that details policy deviations outlined in the M365 SCB guidelines and presents them.

Untitled Goose Tool

The tool, which was created in collaboration with Sandia National Laboratories, is designed to assist network defenders in locating harmful behaviors in Microsoft Azure, Active Directory, and Microsoft 365. Additionally, it enables the querying, exporting, and investigating of audit logs.Organizations who do not import these sorts of logs into their Security Incident and Event Management (SIEM) platform will find this application to be quite helpful. It was designed as an alternative to the PowerShell tools that were available at the time since those tools lacked the capability to gather data for Azure, AAD, and M365.

This is a tool that Network Defenders may use to,

Extraction of cloud artifacts from Active Directory, Microsoft Azure, and Microsoft 365
The Unified Audit Logs (UAL) should have time bounding performed on them.
Collect data making use of the time-bounding feature of the MDE (Microsoft Defender Endpoint) data Decider Tool.
Incident response analysts may find it useful to map malicious actions using this tool in conjunction with the MITRE ATT&CK methodology. In addition to this, it makes their methods more accessible and offers direction for laying out their actions in the appropriate manner.

Decider Tool

This tool, much like the CSET, asks a number of questions in order to give relevant user inquiries for the purpose of selecting the most effective identification technique. Users now have the ability to, given all of this information:

Export heatmaps from the ATT&CK Navigator.
Publish reports on the threat intelligence you have collected.
Determine and put into effect the appropriate preventative measures.
Prevent Exploitation
In addition, the CISA has given a link that describes how to use the Decider tool.

Memory Forensic on Cloud (JPCERT/CC)

It was built for constructing and analyzing the Windows Memory Image on AWS using Volatility 3, which was the reason why it was developed. In addition, Memory Forensics is necessary when it comes to the recently popular LOTL (Living-Off-the-Land) attacks, which are also known as fileless malware. 
Memory image analysis may be helpful during incident response engagements, which often call for the use of high-specification equipment, a significant amount of time, and other resources in order to adequately prepare the environment.

The post Top 5 free cloud security tools, that can protect your AWS & Azure cloud data from hackers appeared first on Information Security Newspaper | Hacking News.

Even though it would be upsetting to get phone calls from people professing to work at the bank, the likelihood that every incoming call you get throughout the day is coming from a con artist is incredibly high. During the course of their routine investigations into potential dangers, they came across a previously unknown collection of malicious programs that were quite similar to those that Kaspersky had identified.

“Letscall” is the name given to this toolset by the threat actor group that is responsible for these campaigns. At the moment, the victims of these campaigns are people living in South Korea. In a purely technical sense, there is nothing stopping them from expanding the scope of the assault to include nations inside the European Union. In other words, we are dealing with a framework that is completely functional and ready to be utilized. This framework has all of the instructions and tools necessary to run the afflicted devices and to connect with the victims. It is possible for any threat actor to use this framework.

Most likely included in this group are:

1. Android developers who are conversant with the contemporary notion of VOIP traffic routing. They refer to participants in one of the phases as “developers” since they noticed command name discrepancies throughout that stage.
2. Designers who are accountable for the web pages, iconography, and content of the administrative panel, phishing web sites, and mobile harmful apps they create.
   Frontend developers that are proficient in JavaScript programming and have experience with the processing of VOIP communications.
3. Backend developers that are experienced with the methods used to safeguard the backend API against unauthorized access.
4. Call operators who are proficient in a variety of languages and have experience in conducting voice-based social engineering attacks.
   

The attack is divided into three phases, which are as follows:

Phishing takes place when a victim accesses a website that has been designed to seem to be the Google Play Store. The first malicious program in the chain is downloaded by the victim from that URL, which is the first step in the chain.

This first step, which we will refer to as the downloader, will access the phishing web page, execute preparations on the device, gain the appropriate rights, and install the second stage malware, which will be downloaded from the control server.

The second step of the attack is a strong spyware program that the attacker will use to both exfiltrate data and enroll the infected device in a peer-to-peer voice over Internet Protocol (P2P VOIP) network that will be used to connect with the victim through audio or video conversations. Additionally, a third step, the subsequent link in the chain, is removed by this application. Letscall makes advantage of WEBRTC technologies in order to redirect the VOIP traffic and establish a connection between the victim and call-center operators. Letscall employs STUN/TURN technologies, including Google STUN servers, to circumvent network address translation (NAT) and firewalls to obtain the highest possible quality for phone or video calls.

The third stage is a companion program that extends some of the functionalities of the second stage malware. It has phone call capability, which is used to divert the call from the victim device to the contact center that is controlled by the attacker.

After conducting an investigation into the “Letscall” malware operations, they discovered a cybercriminal organization that is well-versed in Android security as well as contemporary voice routing technology. The researchers demonstrated that social engineering assaults that are technically sound but poorly executed may nevertheless pose a significant risk.

It is evident that technical features are just as vital as social engineering, which is supported by the care the group devotes to creating phony Google Play sites, stolen logos of the existing Korean apps, along with a novel approach employing nanoHTTPD to drop the payload. This is obvious evidence that technical features are just as important as social engineering.

Theft of resident registration numbers (or IDs) may open numerous doors for cybercriminals, and we anticipate this attack vector only increasing as more and more electronic ID solutions are used by governments as well as private businesses and public organizations. It is not uncommon for Asian threat groups to make use of an evasive method that has already been used by other actors. It’s probable that certain software engineers in one location do work for more than one cybercrime organization, even if they aren’t physically located next to one other in the same office building.

The post VoIP phishing call to rob a bank. New Letscall attack technique appeared first on Information Security Newspaper | Hacking News.

This technique is used to send and receive encrypted emails between internal and external users without revealing any information about their correspondence.

Due to the weakness, malicious third parties may get access and be able to decrypt encrypted emails, revealing private user communications. The secrecy of the communications is compromised since the ECB divulges their structural information.

WithSecure was able to decrypt an image’s AES-encrypted data during analysis. The underlying issue, according to researchers, is the ECB mode, not AES. When WithSecure alerted Microsoft, the business said the report didn’t fulfill the criteria for security servicing and doesn’t qualify as a breach, according to information given by WithSecure.

“Neither a breach nor a notification were deemed to fulfill the standards for security servicing. Since there was no code modification, there was no CVE for this report.

Microsoft
Even though WithSecure demonstrated that there was a chance of exploitation, it also cited NIST’s response, in which the organization acknowledged that the ECB mode was in fact defective. However, until Microsoft provides a remedy or a better alternative is available, users should exercise caution and companies employing OME for email encryption should avoid adopting it as the exclusive source of email secrecy.

The post Message Encryption (OME) used by Office 365 can easily be broken to read encrypted emails via MiTM appeared first on Information Security Newspaper | Hacking News.