Information Technology

Users of Apache Cassandra are being urged to upgrade their versions after JFrog’s Security Research team disclosed a remote code execution vulnerability that they said is “easy to exploit and has the potential to wreak havoc on systems.”Shachar Menashe, senior director of security research at JFrog, told ZDNet that even though these new vulnerabilities do not affect Apache Cassandra default installations where User Defined Functions (UDFs) are disabled, many Cassandra configurations enable them, causing the instance to be vulnerable to an RCE or DoS attack. “We recommend looking at your Cassandra configuration and — if UDFs are enabled — take the appropriate steps to remediate,” Menashe said.In a blog post, the JFrog’s Security Research team explained that CVE-2021-44521 was given a CVSS of 8.4 but said it only affects non-default configurations of Cassandra.They noted that Netflix, Twitter, Urban Airship, Constant Contact, Reddit, Cisco, OpenX, Digg, CloudKick and more use Cassandra because it is a “highly scalable, distributed NoSQL database that is extremely popular due to the benefits of its distributed nature.””Cassandra offers the functionality of creating user-defined-functions (UDFs) to perform custom processing of data in the database. Cassandra UDFs can be written by default in Java and JavaScript. In JavaScript it uses the Nashorn engine in the Java Runtime Environment (JRE) which is a JavaScript engine that runs on top of the Java Virtual Machine (JVM),” JFrog’s security researchers said. “Nashorn is not guaranteed to be secure when accepting untrusted code. Therefore, any service that allows such behavior must always wrap the Nashorn execution in a sandbox. As we were researching the Cassandra UDF sandbox implementation, we realized that a mix of specific (non-default) configuration options could allow us to abuse the Nashorn engine, escape the sandbox and achieve remote code execution. This is the vulnerability that we reported as CVE-2021-44521.”

Deployments become vulnerable to the issue when the cassandra.yaml configuration file contains certain definitions described in the blog, and JFrog said it also found other issues with those running Cassandra on some non-default configurations.They urged Apache Cassandra 3.0.x users to upgrade to 3.0.26, adding that 3.11.x users should upgrade to 3.11.12 and 4.0.x users should upgrade to 4.0.2. All of the updated versions resolve CVE-2021-44521. There are also several mitigations for those who cannot upgrade their Cassandra instances. Users can disable UDFs, if they are not actively used, by setting enable_user_defined_functions to false, and if UDFs are needed, users can set enable_user_defined_functions_threads to true. Users can also remove the permissions of creating, altering and executing functions for untrusted users by removing the following permissions: ALL FUNCTIONS, ALL FUNCTIONS IN KEYSPACE and FUNCTION for CREATE, ALTER and EXECUTE queries.Netenrich threat hunter John Bambenek said that while this is not as serious as Log4j, it does have the appearance of something that is mobile and potentially widespread. “Even though it requires non-default user configuration settings, I suspect that the settings are common in many applications around the world. Unfortunately, there is no way to know exactly how many installations are vulnerable and this is likely the kind of vulnerability that will be missed by automated vulnerability scanners,” Bambenek said. “Enterprises will have to go into the configuration files of every Cassandra instance to determine what their risk is.”Mike Parkin, an engineer at Vulcan Cyber, noted that any organization using Cassandra should be able to check their configuration easily, especially if they have configuration or risk management software, and correct it if it’s vulnerable. More

The International Committee of the Red Cross (ICRC) released more details about a hack they discovered last month, tying the incident back to an authentication bypass vulnerability in Zoho ManageEngine ADSelfService Plus, a self-service password management and single sign-on solution.Tagged as CVE-2021-40539, the vulnerability was spotlighted by several companies last year, including Microsoft, Palo Alto Networks, and Rapid7. Both the US Cybersecurity and Infrastructure Security Agency (CISA) and the German Federal Office for the Protection of the Constitution (BfV) released warnings that APT groups were exploiting the issue. In a joint advisory from September, CISA, the FBI, and the US Coast Guard Cyber Command said APT actors had already used CVE-2021-40539 to target “academic institutions, defense contractors and critical infrastructure entities in multiple industry sectors — including transportation, IT, manufacturing, communications, logistics, and finance.”In a statement on Wednesday, the ICRC admitted that it failed to apply the patch for CVE-2021-40539 before they were initially attacked on November 9, just one day after Microsoft warned that DEV-0322, a group operating out of China, was exploiting the vulnerability. “The attackers used a very specific set of advanced hacking tools designed for offensive security. These tools are primarily used by advanced persistent threat groups, are not available publicly, and therefore out of reach to other actors. The attackers used sophisticated obfuscation techniques to hide and protect their malicious programs. This requires a high level of skills only available to a limited number of actors,” the ICRC said.”We determined the attack to be targeted because the attackers created a piece of code designed purely for execution on the targeted ICRC servers. The tools used by the attacker explicitly referred to a unique identifier on the targeted servers (its MAC address). The anti-malware tools we had installed on the targeted servers were active and did detect and block some of the files used by the attackers. But most of the malicious files deployed were specifically crafted to bypass our anti-malware solutions, and it was only when we installed advanced endpoint detection and response (EDR) agents as part of our planned enhancement programme that this intrusion was detected.”The organization added that CVE-2021-40539 allows malicious hackers to place web shells and conduct post-exploitation activities such as compromising administrator credentials, conducting lateral movement, and exfiltrating registry hives and Active Directory files.  

Once the hackers were inside the ICRC systems, they used other offensive security tools to hide their identity and masquerade as legitimate users and administrators. The hackers spent 70 days inside the ICRC system before they were discovered in January.The ICRC would not attribute the attack but did say they are still willing to communicate with the hackers. They are currently working with the National Cyber Security Center (NCSC) of Switzerland as well as national authorities in countries where the Red Cross and Red Crescent National Societies are operating. The hack leaked the names and contact information of 515,000 people that are part of the Restoring Family Links program, which works to reconnect missing people and children with their families after wars, violence, or other issues.The personal information includes the names, locations, and more of missing people and their families, unaccompanied or separated children, detainees, and other people receiving services from the Red Cross and Red Crescent Movement as a result of armed conflict, natural disasters, or migration. The login information for about 2,000 Red Cross and Red Crescent staff and volunteers was also been breached. The ICRC said it is still in the process of contacting all of the people involved in the hack, noting that the process “is complex and will take time.””Those most at risk are our top priority. Some of this is being done through phone calls, hotlines, public announcements, letters, and in some cases it requires teams to travel to remote communities to inform people in-person. We are making every effort to contact people who can be difficult to reach, such as migrants,” ICRC said, providing a list of contact details and an FAQ for those who may be affected.  “We also have developed workaround solutions enabling Red Cross and Red Crescent teams worldwide to continue providing basic tracing services for the people impacted by this breach while we rebuild a new digital environment for the Central Tracing Agency.”The US State Department spotlighted the attack in a statement earlier this month, calling on other countries to raise alarms about the incident.  The ICRC expressed concern that the stolen data would be “used by States, non-state groups, or individuals to contact or find people to cause harm.” The ICRC also said the attack would affect their ability to work with vulnerable populations who may no longer trust them with sensitive information. “This attack is an extreme violation of their privacy, safety, and right to receive humanitarian protection and assistance,” the organization said. “We need a safe and trusted digital humanitarian space in which our operational information, and most importantly the data collected from the people we serve, is secure. This attack has violated that safe digital humanitarian space in every way.” More

Cybercriminals are exploiting the growth in popularity of NFTs in efforts designed to trick victims into downloading trojan malware capable of hijacking their PCs while stealing usernames and passwords.Cybersecurity researchers at Fortinet have spotted what’s described as a “peculiar-looking Excel spreadsheet” which purports to contain information about NFTs – but the real purpose of the file is to aid the delivery of BitRAT malware.BitRAT is a remote access trojan (RAT) that first emerged for sale in underground forums in August 2020. What makes it notable is it can bypass User Account Control (UAC), a Windows feature which helps to prevent unauthorised changes to the operating system.The malware comes with various trojan functions, including the ability to steal login credentials from browsers and applications, the ability to log keystrokes and the ability to upload and download files. This edition of BitRAT can also monitor the screen of the victim in real-time, use their webcam and listen to audio through the microphone.It’s not detailed how the malicious Excel file is distributed to victims, but it claims to offer information on forecasts on potential investment returns and the number NFTs available in each series. It also contains links to legitimate Discord channels on NFTs, meaning it’s likely that the intended victims are NFT enthusiasts.SEE: A winning strategy for cybersecurity (ZDNet special report)The Excel file contains a malicious macro, which if enabled, runs a PowerShell script that retrieves and downloads malware, before secretly running it on the compromised machine.

NFTs (non-fungible tokens) are digital tokens that use the blockchain to verify the authenticity of digital content and ownership. The hype surrounding NFT art and other collectables means that they can trade hands for millions of dollars.When there’s hype and money involved, people quickly become interested. But cybercriminals are always looking for new trends and themes to exploit to trick victims into opening phishing emails or downloading malware – and now they’re leveraging the interest in NFTs.In addition to collecting data and snooping on the victim, BitRAT can also install cryptojacking malware on the infected machine, enabling them to secretly use the processing power to mine for Monero cryptocurrency.As NFTs can change hands for large amounts of money, it’s potentially the case that the cybercriminals behind this campaign are financially motivated. But even if the victim doesn’t own NFTs, the amount of personal information that can be stolen with trojan malware can be extremely valuable to the attackers – and damaging for the victim.”Be mindful that attackers often use attractive and trendy subjects as lures. As NFTs become increasingly popular, they will be used to entice victims into opening malicious files or clicking on malicious links,” Fortinet researchers warned. “Standard security practices such as not opening files downloaded from untrusted or suspicious sources can prevent threat actors from gaining access to users’ money and valuable data,” they added.MORE ON CYBERSECURITY More

Hit by a recent spat of SMS phishing scams, OCBC Bank has introduced a “kill switch” that it says will let its customers cut access to all their accounts if they suspect their personal data have been compromised. When activated, the kill switch will immediately freeze all accounts including digital banking, e-payment, ATM access, and credit cards. Customers will need to call the Singapore bank’s hotline and use option “8” to trigger the kill switch, OCBC said in a statement Wednesday. They also will be able to do so via the bank’s network of 500 ATMs next month. “Once the kill switch is activated, no transactions–whether done digitally, via an ATM or at branches–can be made. Even recurring or pre-arranged fund transfers will be disabled,” OCBC said. 

A customer service representative then would contact the customer to remove compromised bank account access or replace compromised cards with new ones. Only a bank branch employee or customer service executive would have the authority to deactivate the switch, according to OCBC. This also would be carried out only after the bank staff received verified instructions from the customer to do so. Access to all accounts as well as settings, including GIRO arrangements and scheduled funds transfers, would be reinstated once the kill switch was deactivated. OCBC added that the new feature would be offered alongside the bank’s fraud hotline, introduced last month, to guide customers who needed assistance in scam incidents, such as in making a police report. 

The safeguards come in the heels of a recent spate of SMS phishing scams, which wiped out SG$13.7 million ($10.17 million) from the accounts of 790 OCBC Bank customers. Scammers had manipulated SMS Sender ID details to push out messages that appeared to be from OCBC, urging the victims to resolve issues with their bank accounts. They then were redirected to phishing websites and instructed to key in their bank login details, including username, PIN, and One-Time Password (OTP).  Describing the incident as the country’s most serious phishing scam involving spoofed SMSes impersonating banks, Singapore’s Minister for Finance Lawrence Wong said Tuesday that various steps would be taken to better mitigate the risks of such scams. These would span the entire ecosystem, including banks, telecommunications, law enforcement, and consumer education.Banks, for example, would be working to further bolster their fraud monitoring capabilities to better identify suspicious and anomalous transactions, including credit card transactions. They would develop more versatile algorithms employing AI and machine learning to detect suspicious transactions. Wong said. “Such algorithms should be based on multiple sources of information, including customer profile and vulnerabilities, past transaction patterns, account activity, and mobile device identification.”In addition, SMS service providers and telcos would be required to check against the national Sender ID registry and only send through messages when the sender details match the registry records. All organisations also must have a valid UEN (unique entity number) if they want to send SMS messages through registered IDs, to phone subscribers in Singapore. All major retail banks in Singapore are required to register their Sender ID details with the registry, as are government agencies.Wong on Tuesday had eluded to the possibility of a kill switch for customers to freeze their own accounts without needing to contact the banks. RELATED COVERAGE More

Apple has supported

Macs

 for many years, but inevitably the day will come when the support plug is pulled, and security patches dry up.

ZDNet Recommends

The best Macs

Apple’s Mac lineup can be confusing as the company transitions from Intel processors to its own Apple Silicon processors. But we’re here to help.

Read More

And once that happens, it’s the beginning of the end.And then it’s time for the scrap heap.Well, if you’re someone who didn’t send their old Mac off to the scrap heap (or, as it would be today, the recycling center), then you might be able to give the system a new lease of life thanks to Google.Yes, you read that, right. Google. Chrome OS Flex is Google’s latest project, and it brings Chrome OS to

Macs

 and PCs. Aimed at businesses and schools, it is currently in the early access stage and has been designed to be installed in minutes and will look and feel the same as Chrome OS.Google has published a certified models list of systems that will run Chrome OS Flex, and on that list are a number of Macs that are either verified to work or will work but with minor issues.

Also: Apple’s M1 Pro MacBook Pro is an amazing Windows 11 laptopHere’s the listing:Macs supported by Google Chrome OS FlexWe can decipher this list into something a bit more useful, and we can see that they span 2009 to 2015:iMac 21.5-inch Midv2010iMac 21.5-inch Mid 2011/Late 2011iMac 20-inch Early 2009/Mid 2009Mac Mini Late 2014MacBook 13-inch Early 2009/Mid 2009MacBook 13-inch Late 2009MacBook 13-inch Mid 2010MacBook Air 11-inch Mid 2012MacBook Air 11-inch Mid 2013/Early 2014MacBook Pro 13-inch Mid 2009MacBook Pro 13-inch Mid 2012As you can see, a lot of Macs here going back over a decade. Macs that Apple has long forgotten.Oh, and Chrome OS Flex also runs on a variety of PCs from vendors ranging from Acer, ASUS, Dell, HP, Microsoft, Toshiba, and many more.It’s an interesting project and a good way to offer a new lease of life for older macs. That said, I wonder just how many Macs are still around from the 2009 to 2015 era. More

The ongoing situation in Ukraine means organisations around the world should be prepared to defend their networks against cyberattacks originating from Russia – although the potential impact of aggressive cyber activity shouldn’t be overestimated. “Concerns are reasonable and valid; Russia has a well-established history of aggressively using their considerable cyber capabilities in Ukraine and abroad,” said Sandra Joyce, executive vice president of global intelligence at cybersecurity company Mandiant, which regularly tracks hostile Russian cyber activity.

Russia is suspected of being behind offensive cyber campaigns against other countries, including cyberattacks against Georgia, as well as attacks that took down Ukrainian power grids in December 2015.SEE: A winning strategy for cybersecurity (ZDNet special report)International consensus has also accused the Russian military of being behind the widespread and disruptive NotPetya malware attack of June 2017.NotPetya was designed to target organisations in the Ukrainian financial, energy and government sectors, but powered by EternalBlue – a leaked NSA hacking tool – the self-replicating virus quickly spread to organisations around the world. It wiped networks and caused what was estimated as billions of dollars in damages as victims across Europe, Asia and the Americas were impacted by a cyberattack that wasn’t directly aimed at them. Mandiant warned that this type of incident could potentially happen again.

“We are concerned that, as the situation escalates, serious cyber events will not merely affect Ukraine,” said Joyce.”But while we are warning our customers to prepare themselves and their operations, we are confident that we can weather these cyberattacks. We should prepare, but not panic because our perceptions are also the target,” she added.Organisations that fell victim to NotPetya did so because they hadn’t yet applied critical security updates, which were released months before and were designed to protect networks against EternalBlue.Meanwhile, cyber criminals and nation state-backed hackers continue to take advantage of security issues like the vulnerabilities in Microsoft Exchange, which received critical security updates last year but, in many cases, still haven’t been applied by businesses or consumers.Applying security patches in a timely manner can go a long way to protecting networks and infrastructure against intrusions.”We are imploring our customers and community to prepare for disruptive and destructive attacks, similar to those that have recently transpired in Ukraine,” said Joyce. “Many of the same steps defenders might take to harden their networks against ransomware crime will serve to prepare them from a determined state actor – if they take them now”.SEE: Cloud security: A business guide to essential tools and best practices Mandiant also warned that part of the strategy behind offensive cyber activity is designed to create worry and uncertainty. By ensuring that networks are as well-defended against attacks as possible, the damage done by attacks can be minimised, avoiding the panic that adversaries hope to generate.”Cyberattacks can be costly for individual organisations and may even seem frightening to some, but their real target is our perceptions. The purpose of these cyberattacks is not simply to wipe hard drives or turn out the lights, but to frighten those who cannot help but notice,” said Joyce.”The audience of these attacks is broad, but it is also empowered to determine how effective they are. While these incidents can be quite serious for many, we must remain mindful of their limitations. We only do the adversary a service by overestimating their reach.”Mandiant’s warning follows a similar warning from the UK’s National Cyber Security Centre in January, which urged organisations to take action to bolster their cyber resilience as a result of the ongoing tensions around Russia and Ukraine.In recent weeks, Ukraine has faced DDoS attacks affecting government services as well as banks, while government websites have been defaced. Nobody has yet explicitly claimed responsibility for the attacks.MORE ON CYBERSECURITY More

To perform a ransomware attack successfully, cybercriminals must first obtain access to their victim’s PC or network. Gone are the days when ransomware was confined to malware that targeted individuals with fake threats from organizations like the FBI or IRS, demanding payment through a PC pop-up following encryption. 

Now, while individuals may still encounter ransomware — especially when antivirus programs are not in use — companies are the big game that criminals hunt.  Time is money in the corporate world, and ransomware has exploded in recent years to become an almost separate cybercriminal business of its own. As a result, ‘sub’ services have emerged that assist ransomware developers in the deployment of their illicit creations — ranging from language services to handle ransom payment negotiation to Initial Access Brokers (IABs) who offer the covert access to a network required in the first stage of a ransomware attack.  As noted in new research conducted by KELA, the ransomware-as-a-service (RaaS) economy relies on IABs to reduce the need for extended reconnaissance or the time to find a method for entry.  On average, IABs sell initial access for $4600, and sales take between one and three days to finalize. In the cases identified by the cybersecurity firm, once access has been purchased, it takes up to a month for a ransomware attack to take place — and potentially for the victim to be subsequently named and shamed on a leak site. 
KELA
At the very least, five known Russian-speaking ransomware operators are using IABs: LockBit, Avaddon, DarkSide, Conti, and BlackByte.

KELA conducted an examination of past security incidents involving these ransomware groups. First up is LockBit, of which an attack began against Bangkok Airways due to AnyConnect VPN access offered by a threat actor called “babam.”While it isn’t clear exactly who purchased Bangkok Airways access, on August 23, 2021 — not yet a month after access was offered in underground forums — the airline became infected by ransomware. Two days later, Bangkok Airways appeared on the LockBit leak site. “Bangkok Airways did not disclose any investigation details, but based on the timeline, it is highly possible that the attack was performed using the bought access,” the researchers noted. 
KELA
In an attack conducted by Avaddon, access to a UAE steel product supplier was found to be up for sale on a forum in a post dated March 8, 2021. Three weeks later, the company appeared on the Avaddon domain. (This group has reportedly closed down and a tool has been made available to generate decryption keys.)DarkSide is infamous for an attack on Colonial Pipeline that caused fuel panic-buying in the United States. However, in a separate incident taking place on January 16, 2021, the same “babam” IAB tried to sell access to mining technology firm Gyrodata.  Two days later, access was declared as sold, and between January 16 and February 22, an unauthorized actor was lurking on the firm’s networks. On February 20, DarkSide published the company’s name as a victim.  In another case, access to a US manufacturer was sold on October 8, 2021, for $800. Within two weeks, Conti exposed the firm on its leak site and some stolen data was also published online.   Ransomware attacks against high-profile targets won’t be going away anytime soon. Just before the Super Bowl kicked off, the San Francisco 49ers became the latest victim of BlackByte, who also named the organization on a leak website. Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Amazon Web Services (AWS) has updated the ‘detectors’ in its CodeGuru Reviewer tool to seek out log injection flaws like the recently disclosed Log4Shell bug in the popular Java logging library Log4J.The critical Log4J bugs, collectively dubbed Log4Shell after their disclosure in December, jolted the tech industry and end-user organizations into mass remediation efforts that may have averted major attacks to date, but are expected to lurk in systems for years.

At the time, AWS released several tools to help customers protect resources, such as new web application firewall rules, and updates to its Inspector tool to detect the vulnerability in EC2 VM instances.SEE: Cybersecurity: Let’s get tactical (ZDNet special report)AWS has now announced two new features for CodeGuru Reviewer, AWS’s scanner that uses machine learning to check code during reviews for bugs and to suggest improvements for security issues. The tool aims to improve code reviews in the context of continuous integration and development (CI/CD) processes for developers with code. After developers commit code to say, GitHub or Bitbucket, they can add CodeGuru Reviewer as a code reviewer.The new features help flesh out the service’s security checks. Last year, it added the CodeGuru Reviewer Secrets Detector, which detects risky hardcoded secrets in source code and configuration files for Java and Python applications, like passwords and API access keys.The brand-new features for CodeGuru Review are a new Detector Library for several common security flaws affecting Java and Python web applications, as well as several new security detectors specifically aimed at Log4Shell-like log injection flaws.

The Detector Library contains a list of several detectors for various flaws common to Java and Python programming, such as unauthenticated LDAP requests in Java code. It offers details about each security issue, their severity and impact on an application, and one case of non-compliant and compliant code for each issue. The library currently contains 91 Java detectors and 69 Python detectors.AWS notes that CodeGuru “uses machine learning and automated reasoning” to identify possible issues, so each detector can find a range of defects on top of the example on the detector’s description page.In response to Log4Shell, AWS introduced a more general detector for similar flaws that check if developers are logging data that “is not sanitized and possibly executable”. If it finds an example of such code, it warns that “user-provided inputs must be sanitized before they are logged. An attacker can use unsanitized input to break a log’s integrity, forge log entries, or bypass log monitors.” It then provides examples of non-compliant and compliant code. “These detectors work with Java and Python code and, for Java, are not limited to the Log4j library,” AWS notes. “They don’t work by looking at the version of the libraries you use, but check what you are actually logging. In this way, they can protect you if similar bugs happen in the future.”The service comes at a cost, but might help alleviate issues for organizations facing developer or security skills shortages. The new features are available where CodeGuru Reviewer is available, which includes select US, Europe and Asia Pacific AWS regions. Pricing for CodeGuru Reviewer starts at $10 a month for the first 100,000 lines of code in onboarded repositories, and charges $30 a month for each additional 100,000 lines of code.   More