Newsletter compiled by Jon Munshaw.
Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week.
A lot of people may think that cyber insurance is this new, unexplored field that carries a lot of questions. But did you know that these policies have actually been around since Y2K fever? There are many more misconceptions about these policies, so we aimed to clear some of these up with this cyber insurance FAQ.
If you came out and saw us at DEFCON, chances are you got your hands on our super sweet badges. Unfortunately, there were a few small bugs, but we have a step-by-step guide that shows you how to fix those problems, and we walk through how to set it up to get your own Digispark clone.
This was also a busy week for vulnerabilities. Our discovery of several bugs in Google’s Nest camera has made headlines, since an attacker could use these to leak sensitive information. We also have a breakdown of multiple remote code execution vulnerabilities in different Aspose APIs.
We also have our weekly Threat Roundup, which you can find on the blog every Friday afternoon. There, we go over the most prominent threats we’ve seen (and blocked) over the past week.
Upcoming public engagements with TalosEvent: “DNS on Fire” at Virus Bulletin 2019
Location: Novotel London West hotel, London, U.K.
Date: Oct. 2 - 4
Speaker: Warren Mercer and Paul Rascagneres
Synopsis: In this talk, Paul and Warren will walk through two campaigns Talos discovered targeted DNS. The first actor developed a piece of malware, named “DNSpionage,” targeting several government agencies in the Middle East, as well as an airline. During the research process for DNSpionage, we also discovered an effort to redirect DNSs from the targets and discovered some registered SSL certificates for them. The talk will go through the two actors’ tactics, techniques and procedures and the makeup of their targets.
Event: “It’s never DNS...It was DNS: How adversaries are abusing network blind spots” at SecTor
Location: Metro Toronto Convention Center, Toronto, Canada
Date: Oct. 7 - 10
Speaker: Edmund Brumaghin and Earl Carter
Synopsis: While DNS is one of the most commonly used network protocols in most corporate networks, many organizations don’t give it the same level of scrutiny as other network protocols present in their environments. DNS has become increasingly attractive to both red teams and malicious attackers alike to easily subvert otherwise solid security architectures. This presentation will provide several technical breakdowns of real-world attacks that have been seen leveraging DNS for a variety of purposes such as DNSMessenger, DNSpionage, and more.
Cyber Security Week in Review
- Attackers behind a series of ransomware campaigns targeting more than 20 Texas cities are asking for a combined extortion payment of $2.5 million. One of the towns’ mayors say they will not give into the attackers’ demands.
- This recent wave of ransomware attacks has cities across the U.S. bracing for similar attempts on their systems.
- Controversial data-collection and surveillance company Palantir renewed its contract with U.S. Immigration and Customs Enforcement. The roughly $50 million contract will provide software to ICE used to manage, secure and analyze data, mainly used to identify individuals as they attempt to enter the U.S.
- Security researchers discovered a new type of attack on Bluetooth devices called “KNOB.” If exploited successfully, this vulnerability could allow attackers to spy on the data being shared between two devices via Bluetooth, even if they’ve been paired previously.
- Instagram expanded its bug bounty program to reward researchers who discover third-party apps that steal users’ login information. The program also covers apps that help users get bot followers and produce likes and comments on their posts.
- Bernie Sanders is the first 2020 presidential candidate to formally reject law enforcement agencies’ use of facial recognition technology. Sanders called it “the latest example of Orwellian technology that violates our privacy and civil liberties under the guise of public safety” as part of his formal proposal to overhaul the criminal justice system.
- Twitter banned state-run news agencies from purchasing ads on the platform. The new policy comes after a Chinese news organization ran ads condemning the recent protests in Hong Kong.
- Movie ticket subscription service MoviePass exposed thousands of customers’ MoviePass card and credit card numbers. The company left a critical server unprotected without a password and was found at one point to contain 161 million records.
Notable recent security issues Title: Nest Cam IQ camera open to takeover, data disclosure
Description: Cisco Talos recently discovered multiple vulnerabilities in the Nest Cam IQ Indoor camera. One of Nest Labs’ most advanced internet-of-things devices, the Nest Cam IQ Indoor integrates Security-Enhanced Linux in Android, Google Assistant, and even facial recognition all into a compact security camera. It primarily uses the Weave protocol for setup and initial communications with other Nest devices over TCP, UDP, Bluetooth and 6lowpan. Most of these vulnerabilities lie in the weave binary of the camera, however, there are some that also apply to the weave-tool binary. It is important to note that while the weave-tool binary also lives on the camera and is vulnerable, it is not normally exploitable as it requires a local attack vector (i.e. an attacker-controlled file) and the vulnerable commands are never directly run by the camera.
Snort SIDs: 49843 - 49855, 49797, 49798, 49801 - 49804, 49856, 49857, 49813 - 49816, 49912 (Written by Josh Williams)
Title: Aspose APIs contain bugs that could lead to remote code execution
Description: Cisco Talos recently discovered multiple remote code execution vulnerabilities in various Aspose APIs. Aspose provides a series of APIs for manipulating or converting a large family of document formats. These vulnerabilities exist in APIs that help process PDFs, Microsoft Word files and more. An attacker could exploit these vulnerabilities by sending a specially crafted, malicious file to the target and trick them into opening it while using the corresponding API.
Snort SIDs: 49756, 49757, 49760, 49761, 49852, 49853 (Written by Cisco Talos analysts)