Eliana Willis

A new project hopes to beef up the security of V8, a part of the Chrome browser that most users aren’t aware of but that hackers increasingly see as a juicy target.JavaScript makes the web go around and Google has had to patch multiple zero-day or previously unknown flaws in Chrome’s V8 JavaScript engine this year. In April, Google admitted a high severity bug in V8 tracked as CVE-2021-21224 was being exploited in the wild. Chrome has over two billion users, so when zero-day exploits strike Chrome, it’s a big deal. V8, an open source Google project, is a powerful JavaScript engine for Chrome that’s helped advance the web and web applications. V8 also powers the server-side runtime Node.js.    Now Samuel Groß, a member of the Google Project Zero security researchers team, has detailed a V8 sandbox proposal to help protect its memory from nastier bugs in the engine using virtual machine and sandboxing technologies. “V8 bugs typically allow for the construction of unusually powerful exploits. Furthermore, these bugs are unlikely to be mitigated by memory safe languages or upcoming hardware-assisted security features such as MTE or CFI,” explains Groß, referring to security technologies like Microsoft’s Control-flow integrity (CFI) and Intel’s control-flow enforcement technologies (CET). ” As a result, V8 is especially attractive for real-world attackers.”Groß’s comments suggest that even adopting a memory-safe language like Rust — which Google has adopted for new Android code — wouldn’t immediately solve the security problems faced by V8, which is written in C++.  

He also outlines the broad design objectives but, signaling the size of the project, stresses that this sandbox project is in its infancy and that there are some big hurdles to overcome. But V8 is a Google-led open source project and given that V8 has been the source of security vulnerabilities in Chrome, there is a chance that member of GPZ’s proposal could make it across the line.The issues affect how browser software interacts with hardware beyond the operating system and aims to prevent future flaws in V8 from corrupting a computer’s memory outside of the V8 heap. This would allow an attacker to execute malicious code. One consideration for the additional security protections for V8 is the impact on hardware performance. Groß estimates his proposal would cause an overhead of about “1% overall on real-world workloads”. Groß explains the problem with V8 that stems from JIT compilers that can be used trick a machine into emitting machine code that corrupts memory at runtime. “Many V8 vulnerabilities exploited by real-world attackers are effectively 2nd order vulnerabilities: the root-cause is often a logic issue in one of the JIT compilers, which can then be exploited to generate vulnerable machine code (e.g. code that is missing a runtime safety check). The generated code can then in turn be exploited to cause memory corruption at runtime.”He also highlights the shortcomings of the latest security technologies, including hardware-based mitigations, that will make V8 an attractive target for years to come and hence is why V8 may need a sandbox approach. These include:The attacker has a great amount of control over the memory corruption primitive and can often turn these bugs into highly reliable and fast exploitsMemory safe languages will not protect from these issues as they are fundamentally logic bugsDue to CPU side-channels and the potency of V8 vulnerabilities, upcoming hardware security features such as memory tagging will likely be bypassable most of the timeDespite downplaying the likelihood of the new V8 sandbox actually being adopted, the researcher seems upbeat about its prospects for doing its intended job by requiring an attacker chain together two separate vulnerabilities in order to execute code of their choice. “With this sandbox, attackers are assumed to be able to corrupt memory inside the virtual memory cage arbitrarily and from multiple threads, and will now require an additional vulnerability to corrupt memory outside of it, and thus to execute arbitrary code,” he wrote. More

Exabeam and seven other cybersecurity companies announced the creation of the XDR Alliance on Tuesday, touting the effort as a way to help downstream SecOps teams. Google Cloud Security, Mimecast, Netskope, SentinelOne, Armis, Expel and ExtraHop joined Exabeam in founding the alliance centered on XDR — short for extended detection and response framework and architecture. The companies said the end goal of the partnership is to “enable organizations everywhere to protect themselves against the growing number of cyber attacks, breaches, and intrusions” by helping security teams evolve and ensuring interoperability across the XDR security vendor solutions set.The alliance will also work together on campaigns to popularize XDR and assist SecOps teams in integrating “new and evolving applications and technologies.”Gorka Sadowski, chief strategy officer at Exabeam and founder of the XDR Alliance, said the XDR Alliance “brings together the most forward thinking names in cybersecurity to collaborate on building an XDR framework that is open and will make it easier for security operations teams to protect and secure their organizations.””History will look back and declare how well the cybersecurity industry succeeded in putting collaboration above competition to help protect our organizations and institutions,” Sadowski said. “We are at an inflection point with an extremely fragmented industry that requires all of us in the vendor community to come together to strengthen organizations’ SOCs.”The alliance created a three-tier model that focuses on the core components of the XDR technology stack. The three tiers include data sources/control points, XDR Engine, and content.

“Data sources/control points refers to the security tooling that generates telemetry, logs and alerts, and that act as control points for response. The XDR Engine tier is the engine that ingests all the collected data and performs broad threat detection, investigation and response for SOC operations,” the alliance said in a statement.  “The Content tier includes the pre-packaged content and workflows that allow security organizations to deliver on required use cases with maximum efficiency and automation.”Part of what drew the cybersecurity companies to the alliance is that each represents one of the subcategories under SecOps, which include network detection and response, security information and event management, security analytics, identity management and more.Sunil Potti, Google Cloud VP and GM of Cloud Security, explained that security operations teams are demanding more from their tools as the threat landscape continues to grow. Organizations now need a platform to cost effectively store and analyze all of their security data in one place and investigate and detect threats with speed and scale, Potti said, adding that enterprises now need the ability to store vast amounts of data, analyze and correlate the data from siloed solutions in order to adequately detect and respond to emerging threats within their environments.”We are looking forward to joining the XDR Alliance to help build an inclusive and open XDR framework that gives our joint customers a pathway to the best-in-class Security Operations Centers (SOCs) in the Cloud,” Potti said. There is an XDR Alliance member application page for organizations interested in joining. Exabeam CEO Michael DeCesare added that many of the companies share customers and are looking to improve the SOC experience. The emergence of “covert AI and automated attacks” as well as other threats prompted the companies to unite, DeCesare explained.  More

Raccoon Stealer has been upgraded by its developer in order to steal cryptocurrency alongside financial information. 

On Tuesday, Sophos released new research into the stealer-as-a-service, a bolt-on for threat actors to use as an additional tool for data theft and revenue. In a new campaign tracked by the team, the malware was spread not through spam emails — the usual initial attack vector linked to Raccoon Stealer — but, instead, droppers disguised as installers for cracked and pirated software.  Samples obtained by Sophos revealed that the stealer is being bundled with malware including malicious browser extensions, cryptocurrency miners, the Djvu/Stop consumer ransomware strain, and click-fraud bots targeting YouTube sessions.  Raccoon Stealer is able to monitor for and collect account credentials, cookies, website “autofill” text, and financial information that may be stored on an infected machine. However, the upgraded stealer also has a “clipper” for cryptocurrency-based theft. Wallets, and their credentials, in particular, are targeted by the QuilClipper tool, as well as Steam-based transaction data. “QuilClipper steals cryptocurrency and Steam transactions by continuously monitoring the system clipboard of Windows devices it infects, watching for cryptocurrency wallet addresses and Steam trade offers by running clipboard contents through a matrix of regular expressions to identify them,” the researchers noted. 

The stealer operates through a Tor-based command-and-control (C2) server to handle data exfiltration and victim management. Each Raccoon executable is tied with a signature specific to each client.  “If a sample of their malware shows up on VirusTotal or other malware sites, they can trace it back to the customer who may have leaked it,” Sophos says.  Raccoon is offered as a stealer-for-hire, with the developers behind the malware offering their creation to other cybercriminals for a fee. In return, the malware is frequently updated.  Usually found in Russian underground forums, Raccoon has also been spotted for the last few years in English language forums, too — for as little as $75 for a weekly subscription. According to the researchers, over a six-month period, the malware was used to steal at least $13,000 in cryptocurrency from its victims, and when bundled with miners, a further $2,900 was stolen.  The developer earned roughly $1200 in subscription fees, together with a cut of their user’s proceeds.  “It’s these kinds of economics that make this type of cybercrime so attractive — and pernicious,” Sophos says. “Multiplied over tens or hundreds of individual Raccoon actors, it generates a livelihood for Raccoon’s developers and a host of other supporting malicious service providers that allows them to continue to improve and expand their criminal offerings.” Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

These are dangerous times for our data. We not only need to protect our files from our own carelessness but also our sensitive information from being stolen online. The Lifetime Backup & Security Subscription Bundle covers all of that, so we never need to worry about it again.

As always, we need to be careful about backing up our files, to avoid the chaos that would result from losing them. And the easier that chore is, the more likely we are to perform it. Degoo Premium: Lifetime 10TB Backup Plan not only provides high-speed data transfers with the ultimate security of 256-bit AES encryption, but it duplicates your backup even as you are performing it, giving you twice the amount of protection against data loss. Best of all, the generous 10TB storage will save you from the frustration of constantly having to purge files because you’re running out of space.Degoo has a 4.4 out of 5-star rating among more than 595,000 reviews on Google Play and a rating of 4.5 out of 5 stars from 6,500 reviewers on the App Store.The second part of this bundle is KeepSolid VPN Unlimited: Lifetime Subscription (5 Devices). KeepSolid is the bestselling VPN of all time for good reason. It has no limits on speed or bandwidth and offers access to over 500 servers in more than 80 locations around the world, plus the utmost security and privacy. You get military-grade encryption, a kill switch, and a strict zero-logging policy.KeepSolid VPN is well-loved by both users and reviewers. The service has over 10 million customers worldwide, PCMag named it Top VPN and Laptop Review Pro awarded it “Best VPN for Laptop”. Tech.Co explains why: “From its simple interface to its genuinely practical features, VPN Unlimited has plenty to recommend it.”The services in this would normally cost $3,799. For a limited time only, get The Lifetime Backup & Security Subscription Bundle for $62.99 with code ANNUAL30.

ZDNet Recommends More

The European Union Agency for Cybersecurity (ENISA) has analyzed 24 recent software supply chain attacks and concluded that strong security protection is no longer enough. Recent supply chain attacks in its analysis include those through SolarWinds Orion software, CDN provider Mimecast, developer tool Codecov, and enterprise IT management firm Kaseya. ENISA focuses on Advanced Persistent Threat (APT) supply chain attacks and notes that while the code, exploits and malware was not considered “advanced”, the planning, staging, and execution were complex tasks. It notes 11 of the supply chain attacks were conducted by known APT groups. 

“These distinctions are crucial to understand that an organization could be vulnerable to a supply chain attack even when its own defences are quite good and therefore the attackers are trying to explore new potential highways to infiltrate them by moving to their suppliers and making a target out of them,” ENISA notes in the report. SEE: Network security policy (TechRepublic Premium)The agency expects supply chain attacks to get a lot worse: “This is why novel protective measures to prevent and respond to potential supply chain attacks in the future while mitigating their impact need to be introduced urgently,” it said.ENISA’s analysis found that attackers focused on the suppliers’ code in about 66% of reported incidents. The same proportion of vendors were not aware of the attack before it was disclosed. 

“This shows that organisations should focus their efforts on validating third-party code and software before using them to ensure these were not tampered with or manipulated,” ENISA said, although this is something easier said than done.As the Linux Foundation highlighted in the wake of the SolarWinds disclosure, even reviewing source code – for both open source and unaudited proprietary software – probably wouldn’t have prevented that attack. ENISA is calling for coordinated action at an EU level and has outlined nine recommendations that customers and vendors should take. Recommendations for customers include:identifying and documenting suppliers and service providers;defining risk criteria for different types of suppliers and services such as supplier and customer dependencies, critical software dependencies, single points of failure;monitoring of supply chain risks and threats;managing suppliers over the whole lifecycle of a product or service, including procedures to handle end-of-life products or components;classifying of assets and information shared with or accessible to suppliers, and defining relevant procedures for accessing and handling them.ENISA recommends suppliers:ensure that the infrastructure used to design, develop, manufacture, and deliver products, components and services follows cybersecurity practices;implement a product development, maintenance and support process that is consistent with commonly accepted product development processes;monitor security vulnerabilities reported by internal and external sources, including third-party components;maintain an inventory of assets that includes patch-relevant information.The SolarWinds attack for example rattled Microsoft whose president Brad Smith said it was the “largest and most sophisticated attack the world has ever seen” and that it probably took 1,000 engineers to pull off. Alleged Russian intelligence hackers compromised SolarWinds’ software build system for Orion to plant a backdoor that was distributed as a software to several US cybersecurity firms and multiple federal agencies. SEE: The cybersecurity jobs crisis is getting worse, and companies are making basic mistakes with hiringThe US Department of Justice (DoJ) revealed last week that 27 districts’ Microsoft Office 365 email systems were compromised for at least six months beginning in May 2020.The rise of state-sponsored supply chain attacks and criminal ransomware attacks that combine supply chain attacks, such as the Kaseya incident, has shifted the focus of discussions between the US and Russia. US president Joe Biden last week said a major cyberattack would be the likely cause of the US entering a “real shooting war” with another superpower.  More