More stories

  • in

    Report: CIA most likely behind APT34 and FSB hacks and data dumps

    CIA headquarters in Langley, VA. (Image: file photo)
    BRENDAN SMIALOWSKI/AFP/Getty Images

    Special feature

    Cyberwar and the Future of Cybersecurity
    Today’s security threats have expanded in scope and seriousness. There can now be millions — or even billions — of dollars at risk when information security isn’t handled properly.
    Read More

    US President Donald Trump gave broad powers to the Central Intelligence Agency (CIA) in 2018 to carry out offensive cyber operations across the globe.
    In an exclusive today, Yahoo News reported that the agency used its newly acquired powers to orchestrate “at least a dozen operations” across the world.
    The CIA was already authorized to conduct silent surveillance and data collection, but the new powers allow it to go even further.
    “This has been a combination of destructive things – stuff is on fire and exploding – and also public dissemination of data: leaking or things that look like leaking,” a former US government official told Yahoo News.
    While the former official didn’t go into the specifics of each operation, Yahoo News reporters believe the CIA’s new powers and modus operandi link it to a series of hack-and-dump incidents that took place primarily in 2019, such as:
    Publishing hacking tools (malware) from APT34, an Iranian government hacking unit, on Telegram.
    Doxing Islamic Revolutionary Guard Corps (IRGC) intelligence agents on Telegram by revealing their full names, home addresses, phone numbers, and social media profiles.
    Dumping details about 15 million payment cards from three Iranian banks linked to Iran’s IRGC.
    Hacking two contractors that provide cyber-weapons and surveillance solutions for Russia’s FSB intelligence agency and sharing the data online via a hacktivist group called Digital Revolution.
    Citing former US officials, Yahoo News claims that such operations would have never been approved in the previous administrations, who have always been very cautious when attacking foreign adversaries, fearing blowback.
    However, in 2018, President Trump departed from the White House’s classic stance on the matter and signed a document called a presidential finding, granting the CIA the ability to plan and execute covert offensive cyber operations under its judgment, rather than under the oversight of the National Security Council.
    The document effectively took the decision making and approval process from the White House and the National Security Council and placed it with CIA leadership in an attempt to expedite foreign hacking operations.
    Yahoo News reports that President Trump’s decision split top US intelligence officials.
    Some officials feared repercussions from foreign adversaries, while some feared the lack of NSC oversight. NSC oversight previously kept US intelligence agencies like the CIA in check when it came to orchestrating and approving cyber operations on foreign ground, making sure agencies like the NSA and CIA went through a due process that would sometime take years from the planning to the execution phase.
    However, Yahoo News sources said that some intelligence officials were ecstatic at Trump’s decision, calling it “a needed reform” in order to make the CIA more agile and speed up response times to foreign attacks.
    The locations of these foreign CIA cyber operations are currently classified, along with operational details, but former US officials who have seen the presidential finding said the document listed Russia, China, Iran, and North Korea as targets, but also left the door open for the CIA to carry out operations in other countries at its discretion. More

  • in

    Rust programming language: Crates package API tokens revoked over serious security flaw

    The project behind popular programming language Rust has revoked all API keys from its crates.io package web app. 
    The key revocation addresses a serious vulnerability affecting Rust’s package system due to two factors. First, Rust developers learned that the PostgreSQL random function it used to generate API keys or tokens for crates.io was not a “cryptographically secure” random-number generator. 

    “In theory, an attacker could observe enough random values to determine the internal state of the random-number generator, and use this information to determine previously created API keys up to the last database server reboot,” it states. 
    SEE: Hiring Kit: Python developer (TechRepublic Premium)
    API keys are used by computers to authenticate a user or machine and control what access rights they have. 

    Secondly, the Rust project discovered that the API keys for the packages were being stored in plain text. If attackers breached the database, they would have API access for all current tokens. 
    The Rust project has now rolled out a cryptographically secure random-number generator and implemented a hashing function for storing tokens in the database. 
    “Exploiting either issue would be incredibly impractical in practice, and we’ve found no evidence of this being exploited in the wild. However, out of an abundance of caution, we’ve opted to revoke all existing API keys,” it says in the advisory. 
    Developers who have published crates packages can generate a new API key at the crates.io website. 
    SEE: Programming languages: Developers reveal what they love and loathe, and what pays best
    The crates.io site indicates that there are over 43,000 crates that have been downloaded collectively over three billion times. Crates are a key part of the Rust programming language. Deno, the possible successor to Node.js, was written in Rust and is considered a collection of crates rather than a monolithic program.  
    The Rust project appears to have acted swiftly on the vulnerability report it received on July 11. The issue was fixed and tokens revoked along with a disclosure notice on July 14.  
    More on Rust and programming languages More

  • in

    South Korean regulator fines TikTok over mishandling child data

    Image: TikTok
    Video sharing platform TikTok has been fined by a South Korea regulator for mishandling child data. 
    The Korea Communications Commission (KCC), the country’s telecommunications watchdog, said it has fined the company 186 million won — around $155,000 — for failing to protect users’ private data.
    The fine is equivalent to 3% of the company’s annual sales in South Korea, an amount designated for such violations under local privacy laws. The investigation began last year in October, the KCC said.
    The regulator said TikTok collected the data of children under the age of 14 without consent from their legal guardians.
    A minimum of 6,007 pieces of child data was collected from 31 May 2017 to 6 December 2019, the watchdog said.

    The KCC added that TikTok failed to notify users of the transfer of personal data overseas.
    According to the investigation, TikTok currently uses four cloud companies to store its data — Alibaba Cloud, Fastly, Edgecast, and Firebase. 
    South Korean user data is stored on servers run by Alibaba Cloud, which are based in the US and Singapore, the KCC said.
    In a statement to the regulator, TikTok said it outsourced data storage to third parties only when needed but that it regretted not properly informing users of this. The company added that it would improve the way it handles user data going forward.
    The fine in South Korea is the latest blow to the Chinese company, which has faced allegations of collecting user data without consent.
    In January, the US army reportedly banned the use of TikTok due to “security concerns”.
    In June, India banned 59 Chinese apps including TikTok, citing national security concerns.
    Earlier this month, the company announced that it was exiting the Hong Kong market after the enforcement of China’s new security laws.
    Related Coverage
    TikTok to cease operation in Hong Kong
    It comes as China imposes its new national security laws in Hong Kong.
    Labor wants to ask TikTok how it approaches Australian privacy laws
    Wants to know how the popular Chinese social media video app uses individuals’ data and what its content moderation policies actually involve.
    India bans 59 Chinese apps, including TikTok, UC Browser, Weibo, and WeChat
    Indian government ban comes after the Indian military has clashed with Chinese forces on the country’s northern border.
    TikTok fixes security flaws that could have let hackers manipulate accounts, access personal data
    Researchers at Check Point uncovered ‘multiple’ security loopholes in one of the world’s most popular mobile apps.
    A strong social media policy can protect your brand and avoid embarrassing posts (TechRepublic)
    It’s a good time to update existing policies to cover the increase in remote work and set clear expectations for employees about using social media during work hours. More

  • in

    Chrome 84 released with support for blocking notification popups on spammy sites

    Image: Google
    Google has released today Chrome 84 to the Chrome official stable channel. Users can update Chrome using the browser’s built-in update feature to move to this new release and get access to new features and security updates.
    Chrome 84 is not a massive release when compared to previous Chrome versions as it contains very few changes to the Chrome UI or with user-facing features. Instead, the vast majority of new additions are to Chrome’s underbelly — its developer tools and Web APIs.
    In this release, we have a new Web OTP API, a new animations control system in the form of the new Web Animations API, and a few experimental features such as the Wake lock API, the Idle Detection API, and the Content Indexing API.
    Furthermore, Chrome 84 is also the first Chrome release that blocks notification popups on websites that are known to abuse this feature, a feature that has already shipped with Firefox to great reviews since late last year.
    Below is a rundown of all the new major features.
    Web OTP API

    The Web OTP API is actually an Apple creation, but which Google eventually agreed to support. It’s a new system through which mobile web browsers can detect incoming SMS messages that contain one-time passcodes (OTP) sent as part of two-factor authentication (2FA) procedures.
    The new API allows Chrome to detect the incoming SMS message and automatically import the one-time code into a web page just by a single screen tap from the user. The API was created as a way to standardize OTP SMS codes, but also as a security feature to protect users from OTP phishing attacks.

    Image: Google
    Web Animations API
    The Web Animations API sounds like a fancy name, but, in reality, is just a collection of new JavaScript functions that developers can use to have much better control of animation sequences that take place inside a web browser.
    Details about this new API are available here.
    Screen Wake Lock API
    This is an experimental feature that was added as a trial inside Chrome. It’s not entirely decided if this will remain in Chrome going forward.
    However, it is a very useful feature, and one that’s very likely to stick around. According to Google, the new Screen Wake Lock API provides a way to prevent devices (smartphones and tablets) from dimming or locking the screen when a Chrome browser needs to keep running.
    Websites need to ask permission from users for this API to be used. Expect the API to be used on cooking websites that show the steps of a recipe; websites that show barcodes, tickets, or other content that needs to be scanned; and for online games were interaction with the screen is not needed all the time but the user is clearly looking at the screen (such as sudoku or other similar puzzle games).
    Idle Detection API
    Another experimental feature added in Chrome, solely for developers to play around with, is the new Idle Detection API. As its name hints, this new developer tool lets website owners and Chrome app developers detect when a user has become idle — such as when Chrome detects a lack of interaction with the keyboard, the mouse, the phone screen, the screensaver becomes active, the phone screen gets locked, or the user moves to a different screen.
    Expect more websites to use this API to shut down or pause CPU-heavy operations and help users save battery life.
    Content Indexing API
    The new Content Indexing API is also an experimental feature. It’s a purely developer tool and is basically a list of resources that Chrome has already cached about a web page or web app.
    Developers will use this feature to create better offline viewing experiences, allowing them to cache content locally with a better accuracy and make sure websites don’t break when there’s no internet connection or the connection has temporarly timed out.
    No more notification spam
    Chrome 84 is also the first Chrome version where notification popups on some sites (with a spammy reputation) are now hidden by default. Notification popups on these sites are now hidden under an icon in the Chrome URL bar.
    See Google’s official explanation on how this new feature works.

    Image: Google
    Chrome removes TLS 1.0 and TLS 1.1
    Google has now removed support for the TLS 1.0 and TLS 1.1 ciphers. These two ciphers are considered insecure. Websites that load via HTTPS and use these two ciphers will be blocked in Chrome by default and users will see an error message like the one below.
    Chrome and all other major browsers have announced plans to dump TLS 1.0 and TLS 1.1 since 2018, so most websites have already updated their HTTPS certificates. However, there’s always sites that lag behind. Users should expect some of these messages to pop up once in a while as they try to access older or unmaintained websites.
    Just like many recent Chrome features, this was actually scheduled to go into effect earlier this year, in Chrome 81, but Google delayed its rollout because of the coronavirus pandemic. Google believed this would have resulted in extra work for webmasters and system administrators who were already busy dealing with new work-from-home schedules.

    Image: ZDNet
    Chrome blocks downloads for files hosted on HTTP URLs
    Starting today, Chrome will also show visible warnings for files downloaded via HTTP from HTTPS sites.
    Google calls this “mixed content” and it considers it a dangerous practice as it gives users the impression they’re downloading files safely via HTTPS because of the HTTPS in the address bar, but says users might not be aware that the actual download takes place via HTTP.
    This new downloads “alerting” system was planned to go into effect with Chrome 82, but Google delayed it to Chrome 84 after the COVID-19 outbreak messed up Google’s Chrome release timeline and Chrome 82 got canceled altogether.
    The “download warnings/blocks” will start with Chrome 84 and will only a small subset of file types in the beginning (executables in Chrome 84). Google said they’ll cover all the dangerous file types eventually, and plans to add new file types to be blocked with each new Chrome release until Chrome 88. A detailed rollout plan is available here.

    Image: Google
    But we only touched on the major Chrome 84 additions. Users who’d like to learn more about the other features added or removed from the Chrome 84 release can check out the following links for more information.
    Chrome security updates are detailed here.
    Chromium open-source browser changes are detailed here.
    Chrome developer API deprecations and feature removals are listed here.
    Chrome for Android updates are detailed here [to be announced soon].
    Chrome for iOS updates are detailed here.
    Changes to Chrome V8 JavaScript engine are available here.
    Changes to Chrome 84’s DevTools are listed here. More

  • in

    Grandpa, tell me about the days before the Great Distancing

    Photo by Annie Spratt on Unsplash

    In the video game franchise Fallout, the developers postulated a post-nuclear war scenario in which segments of the population survived the conflagration in hidden, fortified underground vaults. The game lets players experience what the world might be like if such a scenario took place.
    Science fiction often starts with a question and then builds a story around the answer. What would it be like if a federation of planets peacefully colonized the galaxy? What would it be like if an alien arrived with powers beyond that of mortal men? What would it be like if a pandemic suddenly forced everyone to isolate or possibly die?
    But that last one isn’t just a premise for a TV show, novel, or a movie. It’s the situation we all find ourselves in now. Below is a story that explores that question assuming that life never does go back to what it was, and it attempts to answer what a new normal might be like.
    It’s been freaky thinking about these possibilities, and I’m sure that whatever I present here will miss the mark by quite a distance. But for whatever good it does, here’s a look into our possible future. My thoughts are with all of us. Be safe, hang in.
    “Hi, Jayla. Are you getting ready for bed?”

    “Yes, Grandpa. Can you tell me a story?”
    “Sure, honey. That’s why I’m here. Do you have a particular story in mind?”
    “Grandpa, can you tell me about the Great Distancing again. Were you really around BC?”
    “I was, Jayla. I was about as old as your mom and dad. It all changed in about a month. There were previous outbreaks of something like the distancing virus a couple of decades earlier, but they didn’t affect our part of the world very much. But COVID-19? That changed the world.”
    “Mommy and Daddy let me watch a lot of the old videos. Is it really true that you went to those restar… resty? What did they call them?”
    “They were called restaurants. We did. Today, of course, we have service kitchens within homes, factories, and warehouse complexes. So we can still have yummy food delivered to us if we don’t want to cook. But we don’t go there anymore. Instead, robots, automated cars, and our brave delivery folks bring the food to those of us who are permanently sheltered in place.
    “Restaurants, though, were among our greatest pleasures. There were millions of people working in the restaurant industry. Some of those moved into delivery and others started the service kitchens, but many were left without work. And, of course, the millions of us who loved not only the special foods but the camaraderie of sharing a meal with friends lost that privilege forever.”
    “Eeew! That sounds so gross! How could you stand being near anyone but grandma? How could you concentrate on eating when anyone at the table could be carrying the Reaper?”
    “Well, we didn’t have the Reaper back then. Sure, everyone died. But it was often after seventy or eighty years of living. Back then we called death the Grim Reaper, and that’s where the Reaper you know got its name. But enough of that scary talk. Do you want me to continue the story?”
    “Sure. Can you tell me about what your days were like back then? In the videos, it looks like people worked right next to each other without wearing comfort suits. Wasn’t that a hassle, figuring out all those different outfits? Besides, weren’t you scared someone would breathe on you?”
    “We wore all kinds of clothing back then. I was a writer, so I worked from home before that became the way we did things. And yes, people went to offices and factories and other job sites every day, working side-by-side with other people.”
    “Grandpa, I understand why you had people in factories and construction sites, but why would anyone go to an office?”
    “Well, that was before working in an office was made illegal. Governments decided that everything that could be done in an office could just as easily be done at home using conferencing and collaboration software and sharing everything in the cloud. We were fortunate that when the Great Distancing happened, we already had really excellent cloud-based computing, so it was relatively easy for office-bound commuters to switch to working from home.”
    “What’s a com… a commoo…?”
    “A commuter. Those were people who drove to work every day. They’d take cars, trains, buses, bikes, or even walked. Think of it as if everyone had a Critical Travel Pass and didn’t need to file a transit plan before leaving home. I never liked commuting, which is why I worked from home BC.”
    “Were people naked in factories and hospitals, too?”
    “Naked? No, no one went to work without clothes. But you’re really talking about people not wearing comfort suits. Almost nobody outside a special room called a ‘clean room’ wore comfort suits back then. Today, of course, everyone who has to be anywhere near anyone other than immediate family has to wear disposable outer clothing that covers every part of your body. That’s why they’re called comfort suits. They keep you warm and cozy, and people are comfortable when they know they’re probably safe around each other.
    “You asked about the early days. It took a couple of years to ramp up the manufacturing of comfort suits. It also took a few years for all places where people have to come in contact to develop entrance and exit scrubbers to make sure the comfort suits are clean when entering or leaving something like a factory or data center.”
    “Mommy said people went crazy.”
    “Well, Jayla, right after it hit, it was tough all around. You have to understand. The world then wasn’t anything like the world today. We humans had been social creatures for 10,000 years or more. It was, quite literally, human nature. To have that ability to connect in person taken away from us in a matter of weeks caused huge psychological pain.”
    “Did you also live through the Battle of the Badges? Mommy said that was really bad.”
    “It was a great idea that failed miserably. The idea was that everyone would wear a badge indicating their testing status, so folks who were verifiably Reaper-free could congregate together. If anyone verified as virus-free moved near anyone who wasn’t tested or was infected, an alarm would sound. They also tried ankle bracelets and smartphone tracking, but it all failed.
    “There were a couple of problems. First, you could only be verified as Reaper-free for a limited time. If you walked near someone whose badge wasn’t reporting Reaper-free, you’d suddenly lose your Reaper-free status. It was worse, though, because a lot of people refused to wear the badges, which meant the Reaper-free status of those wearing the badges wasn’t reliable.
    “And then, of course, there were the hackers. They posted instructions and code online that unlocked the badges and allowed their owners to set any status. As you might imagine, millions who had the Reaper but wanted to go to work or just go out hacked their status. So did folks who didn’t want to take the tests.”
    “And that’s how we got inside people and outside people?”
    “Don’t ever call them that, Jayla. We’re all people. Some of us do our duty in the war against the Reaper by staying home. For folks who remember the times before COVID-19, what you kids call BC, staying home, staying sane, and getting by was as much of a challenge as going out in the world.
    “Companies and governments have done their best to make the lives of those who work outside the home as safe as possible. They built dorms and barracks for workers, so they didn’t ever take a chance on getting their families back homesick.
    “Eventually, the dorms and barracks, the service kitchens, and all the converted big box stores were combined. That way, folks working away from home got great food and excellent rent-free living conditions, making the inconvenience of wearing comfort suits all day a bit more worthwhile.
    “To keep those workers safe, companies started to group them into squads, kind of like small departments. Squads were anywhere from about four to twenty people and they worked and lived together, usually isolated from members of other squads so if one person in a squad got sick, it didn’t spread to the other squads.
    “For young folks and those without families, the squads became substitute family units and, with a few highly publicized exceptions, worked out very well for everyone — especially because of the great food. But for older folks and those with families, the squad system was a burden.”
    “Grandpa, what’s a big box store?”
    “Back BC, before the Great Distancing, we had warehouse-sized stores that people went to and shopped. Places like Home Depot, Lowes, Walmart, and more. If you wanted to do home repairs, you could go to, say, Home Depot and fill your car or truck with tools and supplies, come home, and do the work.
    “When the Internet started to take off, Amazon made it hard for smaller stores to stay open, but because of the convenience of the big box stores, they still thrived. Of course, after the Great Distancing, folks couldn’t go out and shop, so we all started ordering everything online.
    “Here’s something you probably won’t believe. I know your mom and dad are Amazon Prime members and love the videos they offer. But did you know that back in the day, being a Prime member got you free shipping? Can you imagine? Free shipping?”
    “But shipping is our lifeblood. It’s the foundation of modern capitalism. We learned that in virtual school. Why would they give away shipping? Was Amazon socialist back then?”
    “Hah! No Jayla. Amazon was never, ever socialist. In the early days, their analytics showed that those people who had free shipping through Prime bought twice as much as those who didn’t. Of course, back then, those who didn’t pay the annual fee for free shipping could shop at local stores.
    “But once public stores were banned, Amazon didn’t see the need to give away shipping anymore. That’s what helped cause the great boom of 2021 when the value of shipping and delivery companies shot up like a rocket.
    “Okay, it’s getting late. How about one more question before bed?”
    “When you were a boy, did you kiss a lot of girls?”
    “That’s a pretty personal question, but I see where you’re going here. I wouldn’t say it was a lot, but I did date a bit. Dating was both stressful and fun. Like today, the idea for most folks was to find someone to share their life with.
    “But rather than dating online until you’re ready to make the ‘Til Death Do You Meet decision, we were face-to-face and side-by-side most of the time. If we were both attracted to each other, we kissed. There were certain diseases you could get from being close to people, but there was nothing like the Reaper.

    “When you are ready to start dating, you’ll meet boys or girls online and date them mostly in VR. Only once you’re ready to move in and feel you’re ready to shelter in place 24×7 together will you do ‘Til Death Do You Meet. You’ll both get tested immediately before you’ll sign your lease and then lockdown, hopefully happily ever after.”
    “You look sad, honey. What’s up?”
    “Grandpa, when you were a little boy, did your grandma and grandpa give you hugs? Were they nice?”
    “They did.”
    “But I can’t ever get a hug from you can I?”
    “No sweetie, you can’t. We’re not locked down together. But you can still get hugs from your mom and dad. I know they love that. Someday though, you’ll meet a boy or a girl who you fall in love with and are willing to risk your life to touch them for the first time.
    “When that happens, you’ll leave your mom and dad’s home and start your own. Of course, once that happens you’ll be grown, so you won’t mind never getting hugs from your mom and dad again. But like with me, you’ll still have them in VR.
    “I see that yawn. It looks like you’re about to fall asleep. Take off your visor and tuck yourself in. You know I love you.”
    So, yeah, that could happen. It would have been a sweet little sci-fi story if it also didn’t represent our possible future. It deeply saddens me that the Great Distancing is one of our possible futures. Hopefully, though, we’ll all help flatten the curve, stay sheltered in place as much as possible, wash hands, and keep physical distance enough that in a few months, or — worst case — a few years, we’ll all be able to hug each other again.
    You know how much I care about all of you. Best wishes. Hang in. Try not to get too crazy. Think about the parts of your day that are nice, and don’t dwell on all the possible scary outcomes because we just don’t have any way of knowing what will happen.
    How are you holding up? Tell us anything you need to. Share in the comments below. Personally, I’ve been finding the comments sections of articles I read and write much more important to me. It’s a way of connecting in a world that’s suddenly become disconnected. So please post below. Connect, if only a little bit and for a short moment. We all could use the shared connection.
    You can follow my day-to-day project updates on social media. Be sure to follow me on Twitter at @DavidGewirtz, on Facebook at Facebook.com/DavidGewirtz, on Instagram at Instagram.com/DavidGewirtz, and on YouTube at YouTube.com/DavidGewirtzTV.

    Coronavirus More

  • in

    Google's Confidential VMs may change the public cloud market

    At Google Cloud’s virtual Cloud Next ’20 event, Google announced its newest cloud security program: Confidential VMs (virtual machines). The idea is simple: As we put more and more of our work and data on the cloud, we need data not just to be encrypted at-rest and in-transit but to be encrypted in memory while being processed. The results in the public cloud market may be profound. 
    Encrypting data in and out of memory, as you might imagine, takes a lot of CPU power. Without sufficient processing power, encrypting and decrypting data in and out of memory would be prohibitively slow. To pull this off, Confidential VMs rely on second-generation AMD EPYC processors. 
    These chips were designed to be fast enough to loosen Intel’s heretofore iron grip on data center processors. AMD has pulled this off. In addition to being the foundation of Google’s secure Confidential VMs, Oracle’s new Cloud E3 platform and AWS’s Elastic Compute Cloud (EC2) C5a instances are both on top of the second-generation AMD EPYC CPUs. 
    Google’s Confidential VMs use the AMD EPYC secure encrypted virtualization (SEV) to keep VM memory encryption while still delivering good performance. It locks down the memory with a dedicated per-VM instance key. This key is generated and managed by the EPYC processor. These keys, in turn, are generated by the AMD Secure Processor during VM creation and reside solely within it. This means neither Google nor any other VMs running on the host can read your data. 
    Must read:

    For this security, though, you do pay a performance penalty. How much of a hit, depends on your application. According to AMD benchmarks on Confidential VMs, you can expect to see slowdowns of between 1% and 6%. For example, the NGINX web server and load-balancer are slower by 1% to 4%, while the MySQL DBMS applications can expect to see less than a 5% performance slowdown. Google and the AMD Cloud Solution engineering team are working together to speed up workload performance. 
    Raghu Nambiar, AMD’s corporate vice president for Data Center Ecosystem, said: “For the new Google Compute Engine Confidential VMs in the N2D series, we worked with Google to help customers both secure their data and achieve performance of their workloads. We’re thrilled to see the Confidential VMs demonstrate similar levels of high performance, for various workloads, as the standard N2D VMs.”
    Besides tuning the interaction between Confidential VMs and the EYPC processors, the Google Cloud developers have added support for improved open-source storage and network traffic drivers: nvme and Google Virtual NIC (gVNIC). These help overall VM performance by offering higher throughput than older protocols.
    Confidential VMs are built on top of Google’s Shielded VMs. These are hardened by security controls to help defend against rootkits and bootkits. This is done by hardening your operating system image and verifying your firmware, kernel binaries, and drivers’ integrity. Google-offered Shield VM images include Ubuntu v18.04, Ubuntu 20.04, Google’s own Linux/Chrome OS distro Container Optimized OS (COS v81), and Red Hat Enterprise Linux (RHEL) 8.2. Google is working with CentOS, Debian, and other Linux distributors to offer additional confidential OS images.
    These secured VMs are built on the open-source, confidential computing Asylo framework. This Google project works with emerging trusted execution environments (TEEs) to lock down systems. Asylo provides:
    The ability to execute trusted workloads in an untrusted environment, inheriting the confidentiality and integrity guarantees from the security backend, i.e., the underlying enclave technology.
    Ready-to-use containers, an open-source API, libraries, and tools so you can develop and run applications that use one or more enclaves.
    A choice of security backends.
    Portability of your application’s source code across security backends.
    All these technical security details are hidden. Google claims its goal is to: “Make Confidential Computing easy. The transition to Confidential VMs is seamless — all GCP workloads you run in VMs today can run as a Confidential VM. One checkbox — it’s that simple.”
    While still a beta, Confidential VMs look very promising. Google is right when it states it’s the “first major cloud provider to offer this level of security and isolation while giving customers a simple, easy-to-use option for newly built as well as ‘lift and shift’ applications.”
    Besides simply securing your data for yourself, it can also enable you to share confidential data sets and collaborate on research in the cloud while preserving confidentiality. Confidential VMs can also be useful for organizations that need to preserve privacy for HIPPA. CCPA, and GDPR, and other regulatory requirements.  
    When it comes to public clouds, there’s seldom a single feature that makes one cloud stand above the others. Google Cloud with Confidential VMs has found such a standout feature.

    Google Cloud More

  • in

    Microsoft July 2020 Patch Tuesday fixes 123 vulnerabilities

    The monthly security updates for Microsoft products — also known as Patch Tuesday — are out for the month of July 2020.
    This month, Redmond fixed 123 security flaws across 13 products. None of the security bugs fixed this month have been observed being exploited in the real world.
    The most severe bug patched this month is a bug (CVE-2020-1350) in the Windows Server DNS component. Discovered by Check Point researchers, the bug received a 10 out of 10 severity rating, and researchers say the bug can be easily weaponized to create wormable (self-propagating) malware.
    See ZDNet’s separate coverage for this bug, codenamed SigRed, here.
    Other important bugs patched this month also include remote code vulnerabilities in:
    The RemoteFX vGPU component of Microsoft’s Hyper-V hypervisor technology (CVE-2020-1041, CVE-2020-1040, CVE-2020-1032, CVE-2020-1036, CVE-2020-1042, CVE-2020-1043)
    The Jet Database Engine included with some Office applications (CVE-2020-1400, CVE-2020-1401, CVE-2020-1407)
    Microsoft Word (CVE-2020-1446, CVE-2020-1447, CVE-2020-1448)
    Microsoft Excel (CVE-2020-1240)
    Microsoft Outlook (CVE-2020-1349)
    Microsoft Sharepoint (CVE-2020-1444)
    Windows LNK shortcut files (CVE-2020-1421)
    Various Windows graphics components (CVE-2020-1435, CVE-2020-1408, CVE-2020-1412, CVE-2020-1409, CVE-2020-1436, CVE-2020-1355)
    These “remote code execution” vulnerabilities are the most severe, as they allow hackers to execute code on a system in remote attack scenarios.
    Since Patch Tuesday updates are delivered in monthly blocks, system administrators can’t select which patches to apply and which they don’t. System administrators are advised to review the threat posed by the RCE vulnerabilities listed above and decide the urgency for patching to each of their respetive organizations.
    System administrators who manage large fleets of computers — such as those deployed across enterprises and government organizations — are also advised to test today’s updates for any bugs before deploying them to production systems.
    Malware authors are known to follow Microsoft’s monthly security updates, select the most useful/dangerous bugs, and patch-diff the security updates packages to find the exact bug Microsoft fixed — so they can weaponize them for upcoming attacks.
    Below is some useful information about today’s Patch Tuesday, but also the security updates released by other companies this month, which sysadmins might also need to address as well, besides Microsoft’s batch.
    Microsoft’s official Security Update Guide portal lists all security updates in a filterable table.
    ZDNet has published this file listing all this month’s security advisories on one single page.
    Adobe’s security updates are detailed here.
    SAP security updates are available here.
    VMWare security updates are available here.
    Oracle’s quarterly patches (for Q2 2020, July edition) are available here.
    Chrome 84 security updates are detailed here.
    The Android Security Bulletin for July 2020 is detailed here. Patches started rolling out to users’ phones last week.
    Tag
    CVE ID
    CVE Title
    Windows IIS
    ADV200008
    Microsoft Guidance for Enabling Request Smuggling Filter on IIS Servers
    .NET Framework
    CVE-2020-1147
    .NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability
    Azure DevOps
    CVE-2020-1326
    Azure DevOps Server Cross-site Scripting Vulnerability
    Internet Explorer
    CVE-2020-1432
    Skype for Business via Internet Explorer Information Disclosure Vulnerability
    Microsoft Edge
    CVE-2020-1433
    Microsoft Edge PDF Information Disclosure Vulnerability
    Microsoft Edge
    CVE-2020-1462
    Skype for Business via Microsoft Edge (EdgeHTML-based) Information Disclosure Vulnerability
    Microsoft Graphics Component
    CVE-2020-1355
    Windows Font Driver Host Remote Code Execution Vulnerability
    Microsoft Graphics Component
    CVE-2020-1468
    Windows GDI Information Disclosure Vulnerability
    Microsoft Graphics Component
    CVE-2020-1351
    Microsoft Graphics Component Information Disclosure Vulnerability
    Microsoft Graphics Component
    CVE-2020-1436
    Windows Font Library Remote Code Execution Vulnerability
    Microsoft Graphics Component
    CVE-2020-1435
    GDI+ Remote Code Execution Vulnerability
    Microsoft Graphics Component
    CVE-2020-1412
    Microsoft Graphics Components Remote Code Execution Vulnerability
    Microsoft Graphics Component
    CVE-2020-1409
    DirectWrite Remote Code Execution Vulnerability
    Microsoft Graphics Component
    CVE-2020-1408
    Microsoft Graphics Remote Code Execution Vulnerability
    Microsoft Graphics Component
    CVE-2020-1397
    Windows Imaging Component Information Disclosure Vulnerability
    Microsoft Graphics Component
    CVE-2020-1381
    Windows Graphics Component Elevation of Privilege Vulnerability
    Microsoft Graphics Component
    CVE-2020-1382
    Windows Graphics Component Elevation of Privilege Vulnerability
    Microsoft JET Database Engine
    CVE-2020-1407
    Jet Database Engine Remote Code Execution Vulnerability
    Microsoft JET Database Engine
    CVE-2020-1400
    Jet Database Engine Remote Code Execution Vulnerability
    Microsoft JET Database Engine
    CVE-2020-1401
    Jet Database Engine Remote Code Execution Vulnerability
    Microsoft Malware Protection Engine
    CVE-2020-1461
    Microsoft Defender Elevation of Privilege Vulnerability
    Microsoft Office
    CVE-2020-1445
    Microsoft Office Information Disclosure Vulnerability
    Microsoft Office
    CVE-2020-1446
    Microsoft Word Remote Code Execution Vulnerability
    Microsoft Office
    CVE-2020-1349
    Microsoft Outlook Remote Code Execution Vulnerability
    Microsoft Office
    CVE-2020-1439
    PerformancePoint Services Remote Code Execution Vulnerability
    Microsoft Office
    CVE-2020-1240
    Microsoft Excel Remote Code Execution Vulnerability
    Microsoft Office
    CVE-2020-1458
    Microsoft Office Remote Code Execution Vulnerability
    Microsoft Office
    CVE-2020-1442
    Office Web Apps XSS Vulnerability
    Microsoft Office
    CVE-2020-1449
    Microsoft Project Remote Code Execution Vulnerability
    Microsoft Office
    CVE-2020-1447
    Microsoft Word Remote Code Execution Vulnerability
    Microsoft Office
    CVE-2020-1448
    Microsoft Word Remote Code Execution Vulnerability
    Microsoft Office SharePoint
    CVE-2020-1456
    Microsoft Office SharePoint XSS Vulnerability
    Microsoft Office SharePoint
    CVE-2020-1454
    Microsoft SharePoint Reflective XSS Vulnerability
    Microsoft Office SharePoint
    CVE-2020-1342
    Microsoft Office Information Disclosure Vulnerability
    Microsoft Office SharePoint
    CVE-2020-1443
    Microsoft SharePoint Spoofing Vulnerability
    Microsoft Office SharePoint
    CVE-2020-1450
    Microsoft Office SharePoint XSS Vulnerability
    Microsoft Office SharePoint
    CVE-2020-1444
    Microsoft SharePoint Remote Code Execution Vulnerability
    Microsoft Office SharePoint
    CVE-2020-1451
    Microsoft Office SharePoint XSS Vulnerability
    Microsoft OneDrive
    CVE-2020-1465
    Microsoft OneDrive Elevation of Privilege Vulnerability
    Microsoft Scripting Engine
    CVE-2020-1403
    VBScript Remote Code Execution Vulnerability
    Microsoft Windows
    CVE-2020-1406
    Windows Network List Service Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1410
    Windows Address Book Remote Code Execution Vulnerability
    Microsoft Windows
    CVE-2020-1085
    Windows Function Discovery Service Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1402
    Windows ActiveX Installer Service Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1330
    Windows Mobile Device Management Diagnostics Information Disclosure Vulnerability
    Microsoft Windows
    CVE-2020-1431
    Windows AppX Deployment Extensions Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1405
    Windows Mobile Device Management Diagnostics Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1404
    Windows Runtime Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1438
    Windows Network Connections Service Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1430
    Windows UPnP Device Host Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1429
    Windows Error Reporting Manager Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1463
    Windows SharedStream Library Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1437
    Windows Network Location Awareness Service Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1434
    Windows Sync Host Service Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1427
    Windows Network Connections Service Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1413
    Windows Runtime Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1333
    Group Policy Services Policy Processing Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1428
    Windows Network Connections Service Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1249
    Windows Runtime Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1267
    Local Security Authority Subsystem Service Denial of Service Vulnerability
    Microsoft Windows
    CVE-2020-1399
    Windows Runtime Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1365
    Windows Event Logging Service Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1366
    Windows Print Workflow Service Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1359
    Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1363
    Windows Picker Platform Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1370
    Windows Runtime Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1373
    Windows Network Connections Service Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1374
    Remote Desktop Client Remote Code Execution Vulnerability
    Microsoft Windows
    CVE-2020-1371
    Windows Event Logging Service Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1372
    Windows Mobile Device Management Diagnostics Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1356
    Windows iSCSI Target Service Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1420
    Windows Error Reporting Information Disclosure Vulnerability
    Microsoft Windows
    CVE-2020-1421
    LNK Remote Code Execution Vulnerability
    Microsoft Windows
    CVE-2020-1350
    Windows DNS Server Remote Code Execution Vulnerability
    Microsoft Windows
    CVE-2020-1418
    Windows Diagnostics Hub Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1422
    Windows Runtime Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1353
    Windows Runtime Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1354
    Windows UPnP Device Host Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1347
    Windows Storage Services Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1352
    Windows USO Core Worker Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1375
    Windows COM Server Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1390
    Windows Network Connections Service Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1391
    Windows Agent Activation Runtime Information Disclosure Vulnerability
    Microsoft Windows
    CVE-2020-1386
    Connected User Experiences and Telemetry Service Information Disclosure Vulnerability
    Microsoft Windows
    CVE-2020-1387
    Windows Push Notification Service Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1395
    Windows Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1398
    Windows Lockscreen Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1393
    Windows Diagnostics Hub Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1394
    Windows Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1385
    Windows Credential Picker Elevation of Privilege Vulnerability
    Microsoft Windows
    CVE-2020-1384
    Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
    Open Source Software
    CVE-2020-1469
    Bond Denial of Service Vulnerability
    Skype for Business
    CVE-2020-1025
    Microsoft Office Elevation of Privilege Vulnerability
    Visual Studio
    CVE-2020-1416
    Visual Studio and Visual Studio Code Elevation of Privilege Vulnerability
    Visual Studio
    CVE-2020-1481
    Visual Studio Code ESLint Extention Remote Code Execution Vulnerability
    Windows Hyper-V
    CVE-2020-1041
    Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability
    Windows Hyper-V
    CVE-2020-1040
    Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability
    Windows Hyper-V
    CVE-2020-1032
    Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability
    Windows Hyper-V
    CVE-2020-1036
    Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability
    Windows Hyper-V
    CVE-2020-1042
    Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability
    Windows Hyper-V
    CVE-2020-1043
    Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability
    Windows Kernel
    CVE-2020-1367
    Windows Kernel Information Disclosure Vulnerability
    Windows Kernel
    CVE-2020-1396
    Windows ALPC Elevation of Privilege Vulnerability
    Windows Kernel
    CVE-2020-1336
    Windows Kernel Elevation of Privilege Vulnerability
    Windows Kernel
    CVE-2020-1419
    Windows Kernel Information Disclosure Vulnerability
    Windows Kernel
    CVE-2020-1426
    Windows Kernel Information Disclosure Vulnerability
    Windows Kernel
    CVE-2020-1358
    Windows Resource Policy Information Disclosure Vulnerability
    Windows Kernel
    CVE-2020-1388
    Windows Elevation of Privilege Vulnerability
    Windows Kernel
    CVE-2020-1389
    Windows Kernel Information Disclosure Vulnerability
    Windows Kernel
    CVE-2020-1357
    Windows System Events Broker Elevation of Privilege Vulnerability
    Windows Kernel
    CVE-2020-1411
    Windows Kernel Elevation of Privilege Vulnerability
    Windows Shell
    CVE-2020-1415
    Windows Runtime Elevation of Privilege Vulnerability
    Windows Shell
    CVE-2020-1360
    Windows Profile Service Elevation of Privilege Vulnerability
    Windows Shell
    CVE-2020-1414
    Windows Runtime Elevation of Privilege Vulnerability
    Windows Shell
    CVE-2020-1368
    Windows Credential Enrollment Manager Service Elevation of Privilege Vulnerability
    Windows Subsystem for Linux
    CVE-2020-1423
    Windows Subsystem for Linux Elevation of Privilege Vulnerability
    Windows Update Stack
    CVE-2020-1392
    Windows Elevation of Privilege Vulnerability
    Windows Update Stack
    CVE-2020-1346
    Windows Modules Installer Elevation of Privilege Vulnerability
    Windows Update Stack
    CVE-2020-1424
    Windows Update Stack Elevation of Privilege Vulnerability
    Windows WalletService
    CVE-2020-1344
    Windows WalletService Elevation of Privilege Vulnerability
    Windows WalletService
    CVE-2020-1364
    Windows WalletService Denial of Service Vulnerability
    Windows WalletService
    CVE-2020-1369
    Windows WalletService Elevation of Privilege Vulnerability
    Windows WalletService
    CVE-2020-1361
    Windows WalletService Information Disclosure Vulnerability
    Windows WalletService
    CVE-2020-1362
    Windows WalletService Elevation of Privilege Vulnerability More

  • in

    SigRed: A 17-year-old 'wormable' vulnerability for hijacking Microsoft Windows Server

    Researchers have warned organizations to patch their Microsoft Windows Server builds to protect their networks against a critical wormable vulnerability that has existed in the system’s code for 17 years. 

    Now resolved as part of Microsoft’s Patch Tuesday security update on July 14, the bug, tracked as CVE-2020-1350, has been awarded a CVSS severity score of 10.0. 
    Discovered by Check Point researcher Sagi Tzaik, the bug relates to Microsoft Windows DNS, the domain name system service on Windows operating systems, and Server software.
    Dubbed “SigRed,” the cybersecurity team says the vulnerability is of particular importance to the enterprise as it is wormable — or self-propagating — and as such, is able to jump across vulnerable machines without any user interaction, potentially compromising an entire organization’s network of PCs in the process. 
    See ZDNet’s full July Patch Tuesday coverage here: Microsoft July 2020 Patch Tuesday fixes 123 vulnerabilities

    By exploiting the flaw, “a hacker [can] craft malicious DNS queries to Windows DNS servers, and achieve arbitrary code execution that could lead to the breach of the entire infrastructure,” the team says. 
    CVE-2020-1350 affects all Windows Server versions from 2003 to 2019.
    The vulnerability exists due to how Windows DNS server parses an incoming DNS query, as well as how forwarded DNS queries are handled. Specifically, sending a DNS response with a SIG record over 64KB can “cause a controlled heap-based buffer overflow of roughly 64KB over a small allocated buffer,” the team says. 
    “If triggered by a malicious DNS query, it triggers a heap-based buffer overflow, enabling the hacker to take control of the server and making it possible for them to intercept and manipulate users’ emails and network traffic, make services unavailable, harvest users’ credentials and more,” Check Point says. 
    As the service runs in elevated privileges, if it is compromised, an attacker is also granted Domain Administrator rights. In limited scenarios, the vulnerability can be triggered remotely through browser sessions. 
    CNET: Google targets stalkerware in updated ad policy
    Check Point has discussed exploitation primitives in the firm’s technical analysis, but at Microsoft’s request, has withheld some information to give system administrators time to patch their systems. 
    The cybersecurity firm disclosed its findings to Microsoft on May 19. Following triage and verification of the issue, the Redmond giant issued CVE-2020-1350 on June 18, and by July 9, Microsoft acknowledged the security flaw was wormable and set the bug with a high severity score.
    Microsoft has issued a fix as of Patch Tuesday.
    “This issue results from a flaw in Microsoft’s DNS server role implementation and affects all Windows Server versions. Non-Microsoft DNS Servers are not affected,” Microsoft says. 
    “Wormable vulnerabilities have the potential to spread via malware between vulnerable computers without user interaction,” the company added. “Windows DNS Server is a core networking component. While this vulnerability is not currently known to be used in active attacks, it is essential that customers apply Windows updates to address this vulnerability as soon as possible.”
    While there is no evidence at present that the vulnerability has been exploited in the wild, the issue has been hidden in Microsoft’s code for 17 years. As a result, Check Point told us, they “can’t rule out” the possibility that it has been abused during this time. 
    TechRepublic: Software-defined perimeters may be the solution to remote work security concerns
    “We believe that the likelihood of this vulnerability being exploited is high, as we internally found all of the primitives required to exploit this bug,” the company added. “Due to time constraints, we did not continue to pursue the exploitation of the bug (which includes chaining together all of the exploitation primitives), but we do believe that a determined attacker will be able to exploit it.”
    If a temporary workaround is required, Check Point recommends setting the maximum length of a DNS message over TCP to 0xFF00. Microsoft has also provided a workaround guide. 
    ZDNet has reached out to Microsoft with additional queries and will update when we hear back. 

    Previous and related coverage
    Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More