Newsletter compiled by Jon Munshaw.
Good afternoon, Talos readers.
We hope everyone had some well-deserved, relaxing time off over the holidays. Unfortunately, we are all back now and Log4j is still an issue.
And even though it seems like Log4j has already been in the news for a year, it's actually only been a few weeks. There were several other stories worth taking a look back in 2021, from the fallout of SolarWinds to the Kaseya supply chain attack. Take a look back with us to see what we can learn from the past year with our Year in Review.
We also released a new video walkthrough, which you can watch above, that covers how to safely and securely set up a new IoT assistant. Many of you may have received a new Google Home or Alexa smart device. And while these devices certainly come with inherent cybersecurity risks, there are many ways to set them up with privacy settings to keep you secure. Follow along with me and leave any feedback in the comments you have about what settings you use with your IoT devices.
Cybersecurity week in review
- The Log4Shell exploit in Log4j continues to be top-of-mind for defenders across the globe heading into 2022. Everyone from state-sponsored actors to the average cybercriminal is using this exploit in the wild to carry out hands-on keyboard attacks and drop remote shells on targeted machines.
- The U.S. Federal Trade Commission is warning it could take legal action against companies that don't appropriately patch for Log4j. The agency said in a statement the vulnerability poses a “severe risk to millions of consumer products to enterprise software and web applications.”
- Google released a security update for its Chrome browser, fixing 37 vulnerabilities. Chrome 97.0.4692.71 includes a patch for one critical use-after-free vulnerability identified as CVE-2022-0096.
- A New York State investigation found that 1.1 million accounts have been compromised as part of credential-stuffing attacks affecting 17 companies. The State's Attorney General said the companies are “well-known online retailers, restaurant chains and food delivery services."
- Missouri's governor is still planning to pursue legal action against a local reporter who reported a security vulnerability in the state's education department website. The reporter viewed the source code of the page in a browser, revealing an issue that left sensitive information unprotected.
- The U.S. Cybersecurity and Infrastructure Security Agency is establishing a network of cybersecurity liaisons in each state. The federal representatives will help states establish cybersecurity policies and plans, test them and help them apply for federal grants.
- A coding error in Microsoft Exchange Server shut down on-premise email delivery briefly to kick off the year. Exchange Server did not properly accommodate the year 2022 in dates, leading some to jokingly refer to the issue as "Y2K22."
- Some medical licenses in Maryland are being delayed after a December cyber attack on the state's Department of Health website. Some first-time applicants had to delay start dates at new jobs by weeks waiting for the appropriate approvals.
- Attackers are exploiting a vulnerability in Google Docs' commenting feature to send phishing links to Microsoft Outlook users. By using the comments as the attack vector, it makes it easier for the links to slip through email filters and scanners.
Notable recent security issues
Log4j continues to haunt defenders even after holiday break
A critical vulnerability in Log4j is still under active exploitation weeks after it was initially disclosed. Microsoft released a warning this week that its customers are still seeing state-sponsored actors and cyber criminals target the widely used library. The vulnerability could allow an attacker to completely take over an affected server. Log4Shell, the nickname given to this vulnerability, will likely take years to remediate because of how widely the software component is used in applications and services. It can be leveraged in default configurations by an unauthenticated remote attacker to target applications that make use of the Log4j library. This vulnerability, tracked as CVE-2021-44228, received a CVSS severity score of a maximum 10.0, and is widely believed to be easy to exploit. This library may also be used as a dependency by a variety of web applications found in enterprise environments, including Elastic. Due to the nature of this vulnerability, Cisco Talos believes this will be a widely exploited vulnerability among attackers moving forward, and users should patch affected products and implement mitigation solutions as soon as possible.
Snort SIDs: 58722 - 58744, 58751, 58784 - 58790, 58795, 58801 and 58811-58814
Snort 3 SIDs: 300055 - 300058
ClamAV signatures:
- Java.Exploit.CVE_2021_44228-9914600-1
- Java.Exploit.CVE_2021_44228-9914601-1
- Java.Exploit.CVE_2021_44228-9914600-2
- Java.Exploit.CVE_2021_44228-9914601-4
- Java.Exploit.CVE_2021_44228-9915330-0
- Java.Malware.CVE_2021_44228-9915820-0
- Java.Malware.CVE_2021_44228-9915819-0
- Java.Malware.CVE_2021_44228-9915818-0
- Java.Malware.CVE_2021_44228-9915817-0
- Java.Malware.CVE_2021_44228-9915816-0
- Java.Malware.CVE_2021_44228-9915813-0
- Java.Malware.CVE_2021_44228-9915812-0
- PUA.Java.Tool.CVE_2021_44228-9916978-0
Vulnerabilities in metal detector peripheral could allow attackers to manipulate security devices
Cisco Talos recently discovered multiple vulnerabilities in a device from Garrett Metal Detectors that could allow remote attackers to bypass authentication requirements, manipulate metal detector configurations, and even execute arbitrary code on the device. The vulnerabilities specifically exist in the Garrett iC module, which provides network connectivity to the Garrett PD 6500i or Garrett MZ 6100 walk-through metal detectors commonly used at security checkpoints. An attacker could manipulate this module to remotely monitor statistics on the metal detector, such as whether the alarm has been triggered or how many visitors have walked through. They could also make configuration changes, such as altering the sensitivity level of a device, which potentially poses a security risk to users who rely on these metal detectors.
Snort SIDs: 58013 - 58017
Most prevalent malware files this week
MD5: a5e345518e6817f72c9b409915741689
Typical Filename: swupdater.exe
Claimed Product: Wavesor SWUpdater
Detection Name: W32.1B259D8CA9.Wavesor.SSO.Talos
MD5: 34560233e751b7e95f155b6f61e7419a
Typical Filename: SAntivirusService.exe
Claimed Product: A n t i v i r u s S e r v i c e
Detection Name: PUA.Win.Dropper.Segurazo::tpd
MD5: cbd421ed5799f498e42ec6c598dc0aef
Typical Filename: N/A
Claimed Product: N/A
Detection Name: W32.Auto:0fa5cf6590.in03.Talos
MD5: fe3659119e683e1aa07b2346c1f215af
Typical Filename: SqlServerWorks.Runner.exe
Claimed Product: SqlServerWorks.Runner
Detection Name: W32.8639FD3EF8-95.SBX.TG
MD5: 3f75eb823cd1a73e4c89185fca77cb38
Typical Filename: signup.png
Claimed Product: N/A
Detection Name: Win.Dropper.Generic::231945.in02
Keep up with all things Talos by following us on Twitter. Snort, and ClamAV also have their own accounts you can follow to keep up with their latest updates. You can also subscribe to the Beers with Talos podcast here and Talos Takes here (as well as on your favorite podcast app). And, if you’re not already, you can also subscribe to the weekly Threat Source newsletter here.
0 Comments