Q3 2024 saw multiple vulnerabilities discovered in Windows and Linux subsystems that are not standard for cyberattacks. This is because operating system developers have been releasing new security mitigations for whole sets of vulnerabilities in commonly used subsystems. For example, a log integrity check is set to appear in the Common Log Filing System (CLFS) in Windows, so the number of exploits for it will drop. As for Linux, this operating system has the Linux Kernel Runtime Guard (LKRG), implemented as a separate kernel module. Although the first version of LKRG was released back in 2018, it is undergoing constant refinement. And it is becoming more actively used in various Linux builds.

Statistics on registered vulnerabilities

As is customary, this section presents statistics on registered vulnerabilities. The data is taken from cve.org.

Total number of registered vulnerabilities and number of critical ones, Q3 2023 and Q3 2024 (download)

Q3 2024 preserved the upward trend in the number of vulnerabilities detected and registered. As before, the graph shows an increase relative to the same period in 2023 in both the total number of vulnerabilities and the number of critical ones. Notably, the number of discovered vulnerabilities over the three quarters is almost four-fifths of the whole of last year’s figure, further evidence of a marked increase.

Number of vulnerabilities and the shares of those that are critical and of those for which exploits exist, 2019 — 2024 (download)

The total number of first-time publications of PoCs for fresh CVEs rose by 2%, which indicates an acceleration in exploit creation. The rise in the number of PoCs may also be due to the fact that security researchers increasingly are not just commenting on vulnerability detection, but releasing detailed data that includes an exploit. Most PoCs appear within a week of the developers of vulnerable software releasing a patch.

Exploitation statistics

This section presents statistics on exploit usage in Q3 2024. The data is obtained from open sources and our own telemetry.

Windows and Linux vulnerability exploitation

Among the exploits detected by Kaspersky solutions for Windows are ones for relatively new vulnerabilities that are gaining popularity. These include vulnerabilities in WinRAR, Microsoft Office, Windows Error Reporting Service and Microsoft Streaming Service Proxy:

• CVE-2023-38831 – a vulnerability in WinRAR to do with incorrect handling of objects in an archive;
• CVE-2023-23397 – a vulnerability that allows an attacker to steal authentication data from Outlook;
• CVE-2023-36874 – an impersonation vulnerability that allows the CreateProcess function to run under SYSTEM user;
• CVE-2023-36802 – a UAF vulnerability in the mskssrv.sys driver.

Meanwhile, the most common vulnerabilities in Microsoft Office products are quite old ones:

• CVE-2018-0802 – a remote code execution vulnerability in the Equation Editor component;
• CVE-2017-11882 – another remote code execution vulnerability in Equation Editor;
• CVE-2017-0199 – Microsoft Office and WordPad vulnerability that can be used to gain control over the victim system;
• CVE-2021-40444 – a remote code execution vulnerability in the MSHTML component.

Because these old vulnerabilities are leveraged as tools for initial access to user systems, we recommend updating the relevant software.

Dynamics of the number of Windows users who encountered exploits, Q1 2023 — Q3 2024. The number of users who encountered exploits in Q1 2023 is taken as 100% (download)

For Linux, Kaspersky products detected exploits for the following vulnerabilities:

• CVE-2023-2640 – a vulnerability in the OverlayFS kernel module. Allows privileged labels to be applied to files that can be used after mounting the file system;
• CVE-2023-22809 – a vulnerability in the Sudo utility that allows an attacker to run commands under another user in the system. An attacker can bypass initial settings restricting access to the utility’s functionality and act as any user;
• CVE-2023-4911 – a vulnerability in the dynamic loader ld.so to do with a buffer overflow when processing the environment variable GLIBC_TUNABLES;
• CVE-2023-32233 – a UAF vulnerability in the Netfilter subsystem that allows writing and reading data at arbitrary addresses in kernel memory;
• CVE-2023-3269 – a UAF vulnerability in the kernel memory management system that allows an attacker to run arbitrary code;
• CVE-2023-31248 – a UAF vulnerability in nftables that allows an attacker to run arbitrary code when firewall rules are being processed.

Changes in the number of Linux users who encountered exploits in Q1 2023 — Q3 2024. The number of users who encountered exploits in Q1 2023 is taken as 100% (download)

As the detection statistics and the list of common exploits for Linux show, it is critical to update both kernel components and applications that you use regularly.

Most prevalent exploits

Distribution of exploits for critical vulnerabilities by platform, Q1 2024 (download)

Distribution of exploits for critical vulnerabilities by platform, Q2 2024 (download)

Distribution of exploits for critical vulnerabilities by platform, Q3 2024 (download)

In Q3, vulnerabilities that have workable exploits and are considered the most critical (according to our methodology) were more likely than before to be related to operating system subsystems. This is because researchers, like attackers, give preference to code that is present in the operating system regardless of what software the user prefers. This allows them to target more devices and find new ways to run commands on vulnerable systems.

Vulnerability exploitation in APT attacks

We analyzed which vulnerabilities were most often used in advanced persistent threats (APTs) in Q3. The ranking below is based on our telemetry, research and open sources.

TОР 10 vulnerabilities exploited in APT attacks, Q3 2024

The list of vulnerabilities exploited in APT attacks has changed since last quarter. It now includes vulnerabilities that grant access to systems running web applications and mail servers. Some of the vulnerabilities are quite fresh, with one being registered last year and three this year. That said, most of the listed vulnerabilities are at least three years old. This suggests that developing exploits for new vulnerabilities is a harder task than writing new code for known ones. The longer an issue remains unfixed, the more information about it available to attackers since researchers and vendors publish data on vulnerabilities. In addition, if potential targets fail to patch old vulnerabilities for whatever reason, there is no need for attackers to look for new ones. This only goes to show yet again how important it is to update systems in a timely manner.

Interesting vulnerabilities

This section presents information about vulnerabilities of interest that were registered in Q3 2024.

CVE-2024-47177 (CUPS filters)

The issue was discovered in the Linux version of CUPS, a printing toolkit for Unix-like operating systems, such as iOS, macOS and Linux. Specifically, CUPS helps manage printers on a local network. See below for a flowchart of how it works.

CUPS flowchart

To start any job, the CUPS scheduler creates a job file. The file may contain print setup information and special PostScript commands. One of these commands, FoomaticRIPCommandLine, contains a logical vulnerability that allows arbitrary commands to be run in the operating system shell. To exploit the vulnerability, an attacker just needs to create a malicious printer configuration, but in order to run the code, the user must be persuaded to print any document on that printer. The malicious code automatically executes when printing begins.

The main problem with CUPS is the lack of restrictions on actions that can be performed in the system using this toolkit. To detect an exploitation of the vulnerability, it is essential to monitor commands executed on the part of the foomatic-rip print filter.

CVE-2024-38112 (MSHTML Spoofing)

Discovered in active attacks carried out in May 2024, this vulnerability can be used to run code on a system through an old version of Internet Explorer. It stems from being able to create a malicious .url file that bypasses Microsoft Edge and runs an old version of Internet Explorer. This is achieved by using !x-usc, a special directive that must be handled by the MSHTML protocol. Such sleight of hand recalls to mind the exploitation of another popular vulnerability in Microsoft Office, CVE-2021-40444, which we wrote about here.

While researching the vulnerability, we learned that in early August an exploit with functionality similar to the exploit for CVE-2024-38112 was up for sale on the dark web:

Screenshot of an ad selling an exploit, presumably for CVE-2024-38112 (data provided by Kaspersky Digital Footprint Intelligence)

Such attacks can be prevented by denylisting emails with .url file attachments and, of course, by applying Microsoft patch.

CVE-2024-6387 (regreSSHion)

Security issues with the OpenSSH tool always reverberate far and wide, since many systems run on the Linux kernel, where effectively the main way to remotely access the OS functionality is via an SSH server. In 2023, for instance, the CVE-2023-51385 vulnerability was found to exist in all versions of OpenSSH right up to 9.6 – the dark web was selling an exploit that covered this invulnerable version too, but it may have been a dummy:

Ad selling an exploit for OpenSSH (data provided by Kaspersky Digital Footprint Intelligence)

A new vulnerability, CVE-2024-6387, dubbed regreSSHion, also caused a stir in Q3 2024. The issue arises during SSH authentication. The vulnerable code is located in the SIGALRM handler, which runs asynchronously and uses unsafe functions to interact with memory. This makes it possible to launch an attack on the system at the very stage when the SSH server receives authentication data.

Threat actors have used regreSSHion to attack researchers in a very unconventional way. No sooner had the general principle of the vulnerability been published than there appeared false PoCs and various malware projects that in reality had nothing to do with regreSSHion.

At the time of writing this post, around 105 fake projects had been published online claiming to contain an exploit for CVE-2024-6387. However, a working proof of concept (PoC) for this vulnerability has not yet been published.

CVE-2024-3183 (Free IPA)

A vulnerability found inside the open-source FreeIPA, which provides centralized identity management and authentication for Linux systems. The issue occurs during Kerberos authentication. A user with minimal privileges on the network can sniff ticket encryption data and use it to carry out a Kerberoasting attack, which attackers have previously done to gain access to Windows-based infrastructure.

Most interesting of all, this vulnerability can be exploited by performing a minimal update of the toolkit used for Kerberoasting attacks on Windows Active Directory systems.

An effective countermeasure is this patch, but if for some reason installation isn’t possible, you need to monitor ticket requests for users (principals) that are on the FreeIPA network and are different from the user making the request.

CVE-2024-45519 (Zimbra)

A vulnerability in the postjournal service allowing an attacker to manipulate email messages. What the vulnerability essentially allows is an OS Command Injection attack in its simplest form. An attacker with the ability to send emails to the server can specify in the To field of a message a payload to run in the target service. The command will be executed with the privileges of the mail user.

You can guard against this vulnerability by disabling the postjournal service or updating the mail server to the latest version. At the time of posting, it was no longer possible to install the vulnerable postjournal. Instead, the patched version is automatically loaded when deploying the mail server.

CVE-2024-5290 (Ubuntu wpa_supplicant)

Wpa_supplicant is a set of tools for handling wireless security protocols. It includes utilities with graphical and terminal interfaces.

These interfaces can be used either directly through the command line, or through RPC mechanisms. The Ubuntu operating system uses D-Bus to describe RPC functions. This technology can be used to communicate with an application and leverage its functionality. It was a misconfigured RPC interface that caused the wpa_supplicant vulnerability: the default settings allowed a regular user to access quite critical functionality.

Through this vulnerability, any .so file could be loaded into process memory, with its path specified by the user when interfacing with wpa_supplicant via D-Bus.

Conclusion and advice

The number of discovered vulnerabilities for which there are working PoCs continues to grow. Some exploits are sold on the dark web, others are in the public domain. Moreover, threat actors leverage not only real PoCs, but also interest in the topic of high-profile vulnerabilities. For instance, they create fake exploits to attack security researchers: while the victim is studying the behavior of the pseudo-exploit, an entirely different malicious payload compromises their system.

To stay safe, it is essential to respond promptly to the evolving threat landscape. Also, make sure that you:

• Never research exploits for vulnerabilities outside of a secure virtual environment.
• Know your way around and closely monitor your infrastructure, paying special attention to the perimeter.
• Wherever possible, install patches for vulnerabilities as soon as they become available. Specialized solutions such as Vulnerability Assessment and Patch Management and Kaspersky Vulnerability Data Feed can automate and simplify vulnerability and patch management.
• Use comprehensive solutions that feature not only basic malware protection, but incident response scenarios, employee awareness training and an up-to-date database of cyberthreats. Our Kaspersky NEXT line of solutions ticks all these boxes and more.

securelist.com/exploits-and-vu…

If you’ve wanted to get in on the “fuzzy skin” action with 3D printing but held off because you didn’t want to fiddle with slicer post-processing, you need to check out the paint-on fuzzy skin generator detailed in the video below.

For those who haven’t had the pleasure, fuzzy skin is a texture that can be applied to the outer layers of a 3D print to add a little visual interest and make layer lines a little less obvious. Most slicers have it as an option, but limit the wiggling action of the print head needed to achieve it to the XY plane. Recently, [TenTech] released post-processing scripts for three popular slicers that enable non-planar fuzzy skin by wiggling the print head in the Z-axis, allowing you to texture upward-facing surfaces.

The first half of the video below goes through [TenTech]’s updates to that work that resulted in a single script that can be used with any of the slicers. That’s a pretty neat trick by itself, but not content to rest on his laurels, he decided to make applying a fuzzy skin texture to any aspect of a print easier through a WYSIWYG tool. All you have to do is open the slicer’s multi-material view and paint the areas of the print you want fuzzed. The demo print in the video is a hand grip with fuzzy skin applied to the surfaces that the fingers and palm will touch, along with a little bit on the top for good measure. The print looks fantastic with the texture, and we can see all sorts of possibilities for something like this.

youtube.com/embed/cNkHfydnUCI?…

Thanks for the tip, [John].

hackaday.com/2024/12/06/non-pl…

Negli ultimi anni, i pagamenti contactless hanno rivoluzionato il modo di effettuare transazioni, rendendole più rapide e comode. Tuttavia, queste innovazioni hanno attirato l’attenzione di truffatori e criminali informatici. Una delle minacce più insidiose emerse di recente è il “Ghost Tap”, una sofisticata truffa che sfrutta le tecnologie NFC per bypassare i sistemi antifrode tradizionali.
Scoperta dai ricercatori di ThreatFabric, questa tecnica consente di utilizzare carte di credito rubate associate a servizi come Apple Pay e Google Pay per eseguire transazioni fraudolente senza possedere fisicamente la carta o il dispositivo della vittima.

La scoperta del Ghost Tap

Il Ghost Tap è stato identificato analizzando forum underground dove venivano condivise metodologie per sfruttare le funzionalità NFC dei dispositivi mobili. I criminali descrivevano come associare carte rubate a dispositivi sotto il loro controllo, consentendo transazioni fraudolente in più località contemporaneamente.

La tecnica del Ghost Tap si sviluppa in due fasi principali: raccolta dei dati della carta di credito e sfruttamento dei dati rubati tramite relay NFC.

Raccolta dei dati della carta di credito

I criminali ottengono le informazioni sensibili delle vittime utilizzando tecniche consolidate:

• Phishing: Messaggi ingannevoli che spingono le vittime a fornire credenziali e dati delle carte.
• Malware bancari: Software malevoli che intercettano informazioni sensibili e codici OTP (One-Time Password), sovrapponendosi alle app di pagamento.
• Overlay attack: Interfacce fraudolente che imitano applicazioni bancarie legittime per carpire i dati.

NFCGate: lo strumento del relay NFC

Per sfruttare i dati raccolti, i truffatori utilizzano NFCGate, un’applicazione open-source progettata per analizzare e testare la sicurezza delle comunicazioni NFC. Originariamente sviluppata per scopi accademici, NFCGate è stata adattata per creare un ponte (relay) tra un terminale POS e un server remoto.

Nel contesto del Ghost Tap, NFCGate consente di:

• Intercettare richieste di pagamento NFC da un terminale POS.
• Trasmettere queste richieste a un server controllato dal criminale.
• Simulare la presenza fisica della carta su un dispositivo in una posizione geografica diversa, gestito da complici.

Come funziona il Ghost Tap

Caricamento della carta rubata su un dispositivo

I dati della carta di credito rubata vengono caricati su un dispositivo mobile (iPhone o Android) e associati a un’app Wallet, come Apple Pay o Google Pay.

Relay NFC tramite NFCGate

Un secondo dispositivo Android, su cui è installata NFCGate, intercetta le richieste NFC inviate dal terminale POS. Queste richieste vengono inoltrate a un server remoto, che funge da centro di controllo per l’attacco.

Server centrale

Il server elabora i dati intercettati e li trasmette a un dispositivo gestito da un complice, noto come money mule, situato vicino a un altro terminale POS.

Simulazione della carta al terminale POS

Il dispositivo del money mule, configurato per emulare i dati della carta rubata, invia il segnale NFC al terminale POS. Questo terminale interpreta la transazione come legittima, poiché il segnale emula una carta fisicamente presente.

Autorizzazione del pagamento

Il terminale POS conclude la transazione, autorizzando il pagamento. Grazie alla simulazione accurata dei dati NFC e all’utilizzo di importi bassi, il sistema di pagamento non rileva anomalie.

Perché è difficile da rilevare

• Apparenza legittima: Le transazioni sembrano provenire da dispositivi reali e account verificati.
• Micro-pagamenti: Importi ridotti non attivano le soglie di allarme bancarie.
• Distribuzione geografica: La rete di money mule permette transazioni da località diverse, complicando la rilevazione di schemi sospetti.

Implicazioni e rischi

• Perdite economiche: Micro-transazioni ripetute su vasta scala causano danni finanziari ingenti.
• Evasione antifrode: Tecniche avanzate e operazioni distribuite rendono inefficaci i sistemi di rilevamento tradizionali.
• Riciclaggio di denaro: Gli acquisti illeciti vengono convertiti in beni facilmente rivendibili.

Come proteggersi

• Vigilanza sulle comunicazioni
  Non fornire informazioni personali tramite email, SMS o chiamate non verificate.
• Protezione dei dispositivi
  Installare software antivirus e mantenerlo aggiornato per evitare l’installazione di malware.
• Aggiornamenti regolari
  Tenere sempre aggiornati sistema operativo e applicazioni per correggere vulnerabilità note.
• Monitoraggio delle transazioni
  Controllare frequentemente gli estratti conto e segnalare attività sospette alla banca.
• Autenticazione a due fattori (2FA)
  Implementare la 2FA per aggiungere un ulteriore livello di protezione agli account.
• Educazione alla sicurezza
  Informarsi sulle tecniche di frode emergenti e applicare le migliori pratiche per proteggere i propri dati.

Conclusione

Il Ghost Tap evidenzia l’evoluzione delle frodi digitali che sfruttano le tecnologie moderne per colpire consumatori e istituzioni. Strumenti come NFCGate, nati per scopi legittimi, possono essere trasformati in potenti armi da chi opera nel crimine informatico.
La combinazione di consapevolezza, strumenti di sicurezza aggiornati e il miglioramento dei sistemi antifrode può ridurre i rischi. La prevenzione resta fondamentale per contrastare queste minacce sofisticate e proteggere il sistema finanziario globale

L'articolo Ghost Tap: La nuova minaccia che sfrutta le NFC per colpire il mondo dei pagamenti digitali proviene da il blog della sicurezza informatica.

Un nuovo e pericoloso zero-day minaccia la sicurezza di tutti i moderni sistemi Windows, dalle Workstation ai Server. Questa vulnerabilità consente agli aggressori di rubare le credenziali NTLM degli utenti con un livello di interazione minimo, sollevando un campanello d’allarme per aziende e privati.

La Vulnerabilità

Il problema interessa una vasta gamma di versioni Windows, da Windows 7 e Server 2008 R2 fino a Windows 11 (v24H2) e Server 2022. È sufficiente che un utente visualizzi un file malevolo in Windows Explorer: non è necessario aprirlo o eseguirlo. Un attacco può essere scatenato da azioni apparentemente innocue, come aprire una cartella condivisa, inserire una chiavetta USB o navigare nella cartella Download.

Il rischio è amplificato dall’uso del protocollo NTLM, vulnerabile agli attacchi “pass-the-hash”. Questo metodo consente agli hacker di sfruttare gli hash NTLM rubati per impersonare gli utenti senza bisogno delle loro password in chiaro, esponendo intere reti aziendali a potenziali compromissioni.

In attesa di una patch ufficiale da Microsoft, i ricercatori hanno rilasciato micropatch gratuite attraverso la piattaforma 0patch, già disponibili per sistemi legacy come Windows 7 e Server 2008 R2 e per le versioni più recenti come Windows 11 e Server 2022. Questi aggiornamenti temporanei rappresentano l’unica soluzione immediata per mitigare il rischio.

Questa è la terza vulnerabilità zero-day recentemente scoperta dagli stessi ricercatori, che segue problemi legati ai file Windows Theme e al sistema Mark of the Web. È un segnale chiaro: la sicurezza nei sistemi Windows continua a essere messa a dura prova.

Fino a quando il colosso di Redmond non rilascerà una patch ufficiale, è cruciale adottare misure proattive come installare le micropatch di 0patch per i sistemi supportati, evitare di interagire con file o cartelle non verificati, implementare meccanismi di autenticazione alternativi al protocollo NTLM e monitorare costantemente le attività sospette nei sistemi.

Conclusione

Questa vulnerabilità zero-day mette in evidenza, ancora una volta, quanto sia critica una gestione proattiva della sicurezza informatica. Affidarsi a protocolli obsoleti come NTLM espone le reti a rischi sempre più difficili da contenere.

L’implementazione immediata di micropatch come quelle offerte da 0patch, unita a una maggiore consapevolezza degli utenti e all’adozione di tecnologie di autenticazione più sicure, rappresenta la strada più efficace per proteggere dati e infrastrutture.

La sicurezza non è solo una questione tecnica, ma una responsabilità condivisa: ogni azione tempestiva oggi può prevenire una compromissione domani.

L'articolo Allarme Zero-Day su Windows: Le Tue Credenziali a Rischio con un Semplice Click! proviene da il blog della sicurezza informatica.

Cyber Eagle 2024, l'esercitazione di Cyber Warfare dell'Aeronautica Militare, in più di tre mesi ha coinvolto 4 reparti e 150 operatori.

The post IA, supercalcolo… Con Cyber Eagle 2024 l’Aeronautica Militare affila le armi per guerra cibernetica appeared first on InsideOver.

Va bene la sicurezza e l'innovazione, pero mi pare ci si stia legando un po troppo mani e piedi ad un dispositivo che dopo breve tempo diventa obsoleto ... e rifiuto.

ilsoftware.it/il-tuo-dispositi…

ilsoftware.it/android-app-banc…