Newsletter compiled by Jon Munshaw.
Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week.
It was all about the bugs this week. Patch Tuesday was especially busy for us, including our usual recap of all the vulnerabilities Microsoft's security update this month (two of which we discovered). On top of that, we also disclosed a remote code execution vulnerability in some Intel graphics drivers and another in Exhibitor’s web user interface.
We also recently discovered a wave of actors using living-off-the-land binaries to keep their malware from being detected. We run through how to detect these so-called “LoLBins,” and walk through some campaigns where we’ve seen them being used in the wild.
And, as always, we have our latest Threat Roundup with runs through the top threats we’ve seen (and blocked) over the past week.
Upcoming public engagements with Talos Event: “It’s Never DNS…. It Was DNS: How Adversaries Are Abusing Network Blind Spots” at SecureWV/Hack3rCon X
Location: Charleston Coliseum & Convention Center, Charleston, WV
Date: Nov. 15 - 17
Speakers: Edmund Brumaghin and Earl Carter
Synopsis: While DNS is one of the most commonly used network protocols in most corporate networks, many organizations don’t give it the same level of scrutiny as other network protocols present in their environments. DNS has become increasingly attractive to both red teams and malicious attackers alike to easily subvert otherwise solid security architectures. This presentation will provide several technical breakdowns of real-world attacks that have been seen leveraging DNS for a variety of purposes such as DNSMessenger, DNSpionage, and more.
Event: “Reading Telegram messages abusing the shadows” at BSides Lisbon
Location: Auditorio FMD-UL, Lisbon, Portugal
Date: Nov. 28 - 29
Speakers: Vitor Ventura
Synopsis: One of the cornerstones of privacy today is secure messaging applications like Telegram, which deploy end-to-end encryption to protect the communications. But several clone applications have been created and distributed with the intent of spying on their users. In this talk, Vitor will demonstrate how the Telegram registration process became abused, allowing message interception on non-rooted Android devices without replacing the official application. This is another example on how encryption is not a panacea, and that side-channel attacks like this are a real problem for otherwise secure applications.
Event: “Signed, Sealed, Compromised: The Past, Present, and Future of Supply Chain Attacks” at CactusCon
Location: Charleston Coliseum & Convention Center, Charleston, WV
Date: Dec. 6 - 7
Speakers: Edmund Brumaghin and Earl Carter
Synopsis: This talk will discuss the common techniques we’re seeing in supply chain attacks. Supply chain attacks are a broad topic, but one that has continued to evolve and mature over the last decade. Nick and Edmund will walk through what a supply chain attack constitutes, the history of how these attacks have evolved, and where we see this attack technique moving in the future.
Cyber Security Week in Review
- Microsoft says it will honor new privacy protections offered in a California law across the entire U.S. Under the California Consumer Privacy Act, companies must inform users of what personal data they’re collecting, if that data is being sold and to whom, and users can opt out of any sales.
- Adobe patched three critical vulnerabilities as part of its monthly security update, including two in Adobe Media Encoder. There were also eight other bugs disclosed that Adobe considered “important.”
- Intel’s Cascade Lake line of CPUs are vulnerable to the Zombieload v2 exploit. The company released a security update this week to address these issues, but the evolution in the attack proves it can target more recent hardware.
- Google reportedly has collected health care data on millions of Americans without their knowledge. The tech giant works with Ascencion health care to to amass records across 21 states in an initiative codenamed “Project Nightengale.”
- Britain’s Labour political party was hit with two cyber attacks this week, both distributed denial-of-service campaigns. Labour officials say they have not confirmed there was any data breach.
- Mexican company Petroleos Mexicanos says it will have to switch to manual billing after a ransomware attack. The company, known as “Pemex,” says its employees still cannot access their emails or internet more than 24 hours later.
- Facebook is expanding its efforts to crack down on spam messages on its platform, shortly after its sister company Instagram did the same. However, attackers have still been successful at compromising accounts, and then using those accounts to purchase thousands of dollars in ad space.
- The U.S. Federal Trade Commission is suing a Utah-based company for failing to detect a data breach for more than 22 months. The infection didn’t become apparent until the targeted company ran out of hard drive space, which was actually stuffed with the attacker’s data archive.
- A new app promises to alert users if their iPhone has been hacked. The software is designed to scan for the “side effects” commonly caused by iPhone hacks and jailbreaks.
- The well-known APT33 hacking group from Iran has established its own VPN and has at least 22 nodes operating. The group is perhaps most well-known for developing the Shamoon disk-wiping malware.