Palo Alto Networks ha rilasciato aggiornamenti di sicurezza per risolvere cinque falle di sicurezza che hanno avuto un impatto sui suoi prodotti, tra cui un bug critico che potrebbe causare l’aggiramento dell’autenticazione.

Catalogata come CVE-2024-5910 (punteggio CVSS: 9,3), la vulnerabilità è stata descritta come un caso di autenticazione mancante nel suo strumento di migrazione Expedition che potrebbe portare all’acquisizione di un account amministratore.

“La mancanza di autenticazione per una funzione critica in Palo Alto Networks Expedition può portare all’acquisizione dell’account amministratore di Expedition per gli aggressori con accesso di rete a Expedition”, ha affermato l’azienda in un avviso. “I segreti di configurazione, le credenziali e altri dati importati in Expedition sono a rischio a causa di questo problema”.

Il difetto ha un impatto su tutte le versioni di Expedition precedenti alla versione 1.2.92, che risolve il problema. Brian Hysell del Synopsys Cybersecurity Research Center (CyRC) è stato accreditato per aver scoperto e segnalato il problema. Sebbene non vi siano prove che la vulnerabilità sia stata sfruttata, si consiglia agli utenti di aggiornare il software alla versione più recente per proteggersi da potenziali minacce.

Come soluzione alternativa, Palo Alto Networks consiglia di limitare l’accesso di rete a Expedition a utenti, host o reti autorizzati. L’azienda americana di sicurezza informatica ha inoltre risolto un difetto recentemente scoperto nel protocollo RADIUS denominato BlastRADIUS (CVE-2024-3596), che potrebbe consentire a un malintenzionato in grado di eseguire un attacco Adversary-in-the-Middle (AitM) tra il firewall PAN-OS di Palo Alto Networks e un server RADIUS per eludere l’autenticazione.

L'articolo Palo Alto Networks Risolve Vulnerabilità Critiche di Sicurezza: Aggiornamenti per CVE-2024-5910 e BlastRADIUS proviene da il blog della sicurezza informatica.

In case you haven’t heard, about a month ago MicroPython has celebrated its 11th birthday. I was lucky that I was able to start hacking with it soon after pyboards have shipped – the first tech talk I remember giving was about MicroPython, and that talk was how I got into the hackerspace I subsequently spent years in. Since then, MicroPython been a staple in my projects, workshops, and hacking forays.

If you’re friends with Python or you’re willing to learn, you might just enjoy it a lot too. What’s more, MicroPython is an invaluable addition to a hacker’s toolkit, and I’d like to show you why.

Hacking At Keypress Speed

Got a MicroPython-capable chip? Chances are, MicroPython will serve you well in a number of ways that you wouldn’t expect. Here’s a shining example of what you can do. Flash MicroPython onto your board – I’ll use a RP2040 board like a Pi Pico. For a Pico, connect an I2C device to your board with SDA on pin 0 and SCL on pin 1, open a serial terminal of your choice and type this in:
>>> from machine import I2C, Pin
>>> i2c = I2C(0, sda=Pin(0), scl=Pin(1))
>>> i2c.scan()

This interactivity is known as REPL – Read, Evaluate, Print, Loop. The REPL alone makes MicroPython amazing for board bringup, building devices quickly, reverse-engineering, debugging device library problems and code, prototyping code snippets, writing test code and a good few other things. You can explore your MCU and its peripherals at lightning speed, from inside the MCU.

When I get a new I2C device to play with, the first thing I tend to do is wiring it up to a MicroPython-powered board, and poking at its registers. It’s as simple as this:
>>> for i in range(16):
>>> # read out registers 0-15
>>> # print "address value" for each
>>> print(hex(i), i2c.readfrom_mem(0x22, i))
>>> # write something to a second (0x01) register
>>> i2c.writeto_mem(0x22, 0x01, bytes([0x01]) )

That i2c.scan() line alone replaces an I2C scanner program you’d otherwise have to upload into your MCU of choice, and you can run it within three to five seconds. Got Micropython running? Use serial terminal, Ctrl+C, and that will drop you into a REPL, just type i2c.scan() and press Enter. What’s more, you can inspect your code’s variables from the REPL, and if you structure your code well, even restart your code from where it left off! This is simply amazing for debugging code crashes, rare problems, and bugs like “it stops running after 20 days of uptime”. In many important ways, this removes the need for a debugger – you can now use your MCU to debug your code from the inside.

Oh, again, that i2c.scan()? You can quickly modify it if you need to add features on the fly. Want addresses printed in hex? (hex(addr) for addr in i2c.scan()). Want to scan your bus while you’re poking your cabling looking for a faulty wire? Put the scan into a while True: and Ctrl+C when you’re done. When using a typical compiled language, this sort of tinkering requires an edit-compile-flash-connect-repeat cycle, taking about a dozen seconds each time you make a tiny change. MicroPython lets you hack at the speed of your keyboard typing. Confused the pins? Press the `up` button, edit the line and run the i2c = line anew.

To be clear, all of code is running on your microcontroller, you just type it into your chip’s RAM and it is executed by your MCU. Here’s how you check GPIOs on your Pi Pico, in case you’re worried that some of them have burnt out:
>>> from machine import Pin
>>> from time import sleep
>>> pin_nums = range(30) # 0 to 29
>>> # all pins by default - remove the ones connected to something else if needed
>>> pins = [Pin(num, Pin.OUT) for num in pin_nums]
>>>
>>> while True:
>>> # turn all pins on
>>> for i in range(len(pins)):
>>> pins[i].value(True)
>>> sleep(1)
>>> # turn all pins off
>>> for i in range(len(pins)):
>>> pins[i].value(False)
>>> sleep(1)
>>> # probe each pin with your multimeter and check that each pin changes its state

There’s many things that make MicroPython a killer interpreter for your MCU. It’s not just the hardware abstraction layer (HAL), but it’s also the HAL because moving your code from board to board is generally as simple as changing pin definitions. But it’s all the other libraries that you get for free that make Python awesome on a microcontroller.

Batteries Included

It really is about the batteries – all the libraries that the stock interpreter brings you, and many more that you can download. Only an import away are time, socket, json, requests, select, re and many more, and overwhelmingly, they work the same as CPython. You can do the same r = requests.get("https://retro.hackaday.com"); print(r.text)[:1024] as you would do on desktop Python, as long as you got a network connection going on. There will be a few changes – for instance, time.time() is an integer, not a float, so if you need to keep track of time very granularly, there are different functions you can use.

Say, you want to parse JSON from a web endpoint. If you’re doing that in an Arduino environment, chances are, you will be limited in what you can do, and you will get triangle bracket errors if you mis-use the JSON library constructs because somehow the library uses templates; runtime error messages are up to you to implement. If you parse JSON on MicroPython and you expect a dict but get a list in runtime, it prints a readable error message. If you run out of memory, you get a very readable MemoryError printed out, you can expect it and protect yourself from it, even fix things from REPL and re-run the code if needed.

The user-supplied code is pretty good, too. If you want PIO or USB-HID on the RP2040, or ESP-CPU-specific functions on the ESP family, they are exposed in handy libraries. If you want a library to drive a display, it likely already has been implemented by someone and put on GitHub. And, if that doesn’t exist, you port one from Arduino and publish it; chances are, it will be shorter and easier to read. Of course, MicroPython has problems. In fact, I’ve encountered a good few problems myself, and I would be amiss not mentioning them.

Mind The Scope

In my experience, the single biggest problem with MicroPython is that writing out `MicroPython` requires more of my attention span than I can afford. I personally shorten it to uPy or just upy, informally. Another problem is that the new, modernized MicroPython logo has no sources or high-res images available, so I can’t print my own stickers of it, and MicroPython didn’t visit FOSDEM this year, so I couldn’t replenish my sticker stock.

On a more serious note, MicroPython as a language has a wide scope of where you can use it; sometimes, it won’t work for you. An ATMega328P can’t handle it – but an ESP8266 or ESP32 will easily, without a worry in the world, and you get WiFi for free. If you want to exactly control what your hardware does, counting clock cycles or hitting performance issues, MicroPython might not work for you – unless you write some Viper code.

If you want to have an extremely-low-power MCU that runs off something like energy harvesting, MicroPython might not work – probably. If you need your code run instantly once your MCU gets power, mind the interpreter takes a small bit of time to initialize – about one second, in my experience. If you want to do HDMI output on a RP2040, perhaps stick to C – though you can still do PIO code, there are some nice libraries for it.

Some amount of clock cycles will be spent on niceties that Python brings. Need more performance? There are things you can do. For instance, if you have a color display connected over SPI and you want to reduce frame rendering time, you might want to drop down to C, but you don’t have to ditch MicroPython – just put more of your intensive code into C-written device drivers or modules you compile, and, prototype it in MicroPython before you write it.

As Seen On Hackaday

If you’ve followed the USB-C PD talking series, you must’ve seen that the code was written in MicroPython, and I’ve added features like PD sniffing, DisplayPort handling and PSU mode as if effortlessly; it was just that easy to add them and more. I started with the REPL, a FUSB302 connected to a RP2040, poking at registers and reading the datasheet, and while I needed outside help, the REPL work was so so much fun!

There’s something immensely satisfying about poking at a piece of technology interactively and trying to squeeze features out of it, much more if it ends up working, which it didn’t, but it did many other times! I’ve been hacking on that PD stack, and now I’m slowly reformatting it from a bundle of functions into object-based code – Python makes that a breeze.

Remember the Sony Vaio board? Its EC (embedded controller) is a RP2040, always powered on as long as batteries are inserted, and it’s going to be running MicroPython. The EC tasks include power management, being a HID over I2C peripheral, button and LED control, and possibly forwarding keyboard and trackpoint events to save a USB port from the second RP2040, which will run QMK and server as a keyboard controller. MicroPython allows me to make the firmware quickly, adorn it with a dozen features while I do it, and keep the codebase expandable on a whim. The firmware implementation will be a fun journey, and I hope I can tell about it at some point.

Have you used MicroPython in your projects? What did it bring to your party?

Ticketmaster is having a rough time lately. Recently, a hacker named [Conduition] managed to reverse-engineer their new “safe” electronic ticket system. Of course, they also had the recent breach where more than half a billion accounts had personal and financial data leaked without any indication of whether or not the data was fully encrypted. But we’re going to focus on the former, as it’s more technically interesting.

Ticketmaster’s stated goals for the new SafeTix system — which requires the use of a smartphone app — was to reduce fraud and ticket scalping. Essentially, you purchase a ticket using their app, and some data is downloaded to your phone which generates a rotating barcode every 15 seconds. When [Conduition] arrived at the venue, cell and WiFi service was totally swamped by everyone trying to load their barcode tickets. After many worried minutes (and presumably a few choice words) [Conduition] managed to get a cell signal long enough to update the barcode, and was able to enter, albeit with a large contingent of similarly annoyed fans trying to enter with their legally purchased tickets.

The real kicker here is that since the barcode rotates every 15 seconds, printing it out simply isn’t an option. This alienates anyone who doesn’t have a smartphone, which includes individuals who may not be able to physically operate one. So the problem isn’t simply that users were being forced to install yet another application on their device, but that the system reduces accessibility to entertainment. [Conduition] was dismayed and frustrated with this, and so the reverse-engineering effort began.

Decoding the barcode was actually quite simple. It is a standard PDF417 barcode, which contains a long Base64 string, two six-digit numbers, and a Unix timestamp all concatenated together with colons. The only parts of the string that seemed to change over time were the two six-digit numbers. Hmm, can we think of a common technology which generates six-digit numbers that update seemingly randomly on a fixed cycle? Of course — it’s just a Time-based one-time password (TOTP), the technology behind 2FA authenticator apps!

So where were the secret keys coming from? TOTP only requires two things: a static secret string, and the current time. [Conduition] checked the communication with the Ticketmaster servers and found a particularly interesting request that returned JSON-formatted data, inside which were of course the two secret keys. One seems to be unique per customer, and the other per ticket.
The important data captured from the web traffic
The Ticketmaster API documentation only briefly mentions this feature, but they do state that customers must refresh their ticket barcodes within 20 hours before an event starts. These two pieces of information were enough to allow [Conduition] to whip up a simple app that accepts the secret keys and the ticket ID and pops out the rotating barcodes. This would allow you to sell your tickets in the 20 hours prior to an event, or even just give them away to friends without having to give their personal data to Ticketmaster and allow you to take back control of your tickets.

Thanks to [Chrischi] for the tip!

Il gruppo di cybercriminali SiegedSec, che ha guadagnato notorietà durante l’invasione russa dell’Ucraina, ha recentemente annunciato la sua dissoluzione. Questo gruppo, guidato da “YourAnonWolf,” ha rapidamente consolidato il suo potere aumentando il numero delle sue vittime. Descrivendosi come “hacker gay furry,” SiegedSec è noto per i suoi slogan divertenti e il linguaggio volgare. Le loro attività principali includono attacchi di defacing, illeciti di dati sensibili e accessi non autorizzati a database e email.

La Storia di SiegedSec

SiegedSec è emerso come una forza significativa nel panorama della cybercriminalità, sfruttando il caos e l’incertezza creati dalla guerra in Ucraina. Il gruppo ha guadagnato rapidamente notorietà attraverso una serie di attacchi di alto profilo contro aziende di diversi settori, tra cui sanità, IT, assicurazioni, diritto e finanza. Le loro operazioni hanno colpito aziende in paesi come India, Indonesia, Sud Africa, Stati Uniti, Filippine e Messico.

Motivazioni e Dichiarazione di Scioglimento

Il 10 luglio 2024, SiegedSec ha attirato l’attenzione con un annuncio sorprendente: “È tempo per SiegedSec di sciogliersi.” Nel post pubblicato, hanno dichiarato: “Sì, questo è un annuncio improvviso. Avevamo pianificato di scioglierci oggi o domani, ma date le circostanze, crediamo sia meglio farlo ora. Per la nostra sanità mentale, lo stress della pubblicità di massa e per evitare gli occhi dell’FBI.”

Il leader del gruppo, noto come YourAnonWolf, ha riflettuto sul suo desiderio di abbandonare il cybercrimine e ha affermato che gli altri membri hanno concordato che fosse il momento giusto per lasciar riposare SiegedSec per sempre. In passato, aveva tentato di abbandonare il cybercrimine diverse volte senza successo, ma questa volta spera di riuscire a stare lontano da queste attività per il suo benessere.

Attacchi Noti e Conseguenze

SiegedSec ha portato a termine numerosi attacchi di successo contro aziende di varie industrie. Questi attacchi includevano defacing di siti web, furti di dati sensibili e accessi non autorizzati a database e email. Hanno colpito aziende in paesi come India, Indonesia, Sud Africa, Stati Uniti, Filippine, Messico e altri, causando danni significativi e attirando l’attenzione dei media e delle autorità.

Nella loro dichiarazione finale, hanno affermato di aver postato l’ultimo dei loro attacchi e di aver inviato alcune violazioni private ai giornalisti per la gestione delle divulgazioni. Il canale del gruppo, tutte le violazioni e le chat della comunità rimarranno aperti.

La Community e il Futuro

SiegedSec ha ringraziato la sua comunità per il supporto e ha invitato i membri a rimanere attivi nei loro canali di comunicazione. Hanno citato una frase del rapper Ytcracker: “Might as well quit while I’m a free man … a clean slate, just a chance to start fresh” (“Tanto vale smettere finché sono un uomo libero … un nuovo inizio, solo una possibilità di ricominciare da capo”).

In conclusione, mentre SiegedSec non sarà più un gruppo di cybercriminali attivo, il suo spirito vivrà nella comunità che hanno costruito. I membri continueranno a supportare gli ideali del gruppo e a lottare per i diritti degli altri.

Immagini di Commiato

Il gruppo ha condiviso un’immagine ASCII emotiva che rappresenta tre gatti con i nomi “vio,” “kry,” e “kit,” seduti su una recinzione sotto un cielo stellato, con un’epigrafe che recita: “Grazie a tutti. Ogni stella è un altro membro, tutti sono ricordati. Riposa in pace. I nostri membri caduti saranno ricordati per sempre.”

SiegedSec ha lasciato un segno indelebile nel mondo della cybercriminalità e della sicurezza informatica, e il loro annuncio di scioglimento segna la fine di un’era.

L'articolo Fine di un’Era: SiegedSec, il Gruppo di Hacker, Annuncia la Sua Dissoluzione proviene da il blog della sicurezza informatica.