Jiuma's Security Digest

  Source:  Zoom Announces Post-Quantum End-to-End Encryption for Meetings (cybersecuritynews.com) One of the most widely used videoconferencing platforms worldwide, namely Zoom, has recently announced the implementation of its engineering team's groundbreaking encryption innovation into meetings conducted by its end users via the software. Known commonly as post-quantum end-to-end encryption (E2EE), it will be employed as a critical safeguard of confidentiality for meetings held via the platform for the foreseeable future and will play a tangible role in allaying customer fears regarding the potential of future cyber threats.  This  is because such an enhancement will allow Zoom to protect its users better from present and future quantum decryption capabilities, ensuring that meetings held via its site aren't dependent on weak or potentially vulnerable encryption algorithms.  Zoom's engineering team has been working in a proverbial race against the clock, trying...

 Source:  APT Hackers Attacking Manufacturers With Keyloggers, Infostealers, & Proxy Tools (cybersecuritynews.com) South Korean manufacturers have recently appeared as the prime target behind attacks conducted by the Andariel Advanced Persistent Threat (APT) group.  Its attackers centered around  the use of  keyloggers, proxy tools, and infostealers to target manufacturers, construction firms, and educational institutions  all  throughout South Korea.   The attack methodology  is initiated  by  the exploitation of  preexisting vulnerabilities within Apache Tomcat servers to install backdoors such as Nestdoor, which affords the attackers several different privileges on victim systems,  which include  remote control, data exfiltration, and command execution.   This attack  bears a resemblance to  previous campaigns and other APT groups that have been linked to the North Korean government, as research ...

 Source:  Evolution of AI Technologies Fueling the Social Engineering Attacks (cybersecuritynews.com) The rapid emergence of AI as a significant player in the field of technology  more broadly,  and cybersecurity, more specifically, has had a substantial and disruptive impact on many aspects within those fields. When taking a closer look at its cybersecurity implications, one of the major areas where AI's revolutionizing impact has taken hold has been within the landscape of social engineering attacks. Here, its usage has had a tangible impact by making social engineering operations more sophisticated and effective. Cybercriminals, APTs, and other threat actors alike are all able to leverage AI to enhance their tactics, techniques, and procedures, such as Business Email Compromise (BEC), spear phishing, and many more. This results in heightened risks for corporations and government entities surrounding potential cyberattacks and necessitates the need for mitigation a...

  Source:  Evolution of AI Technologies Fueling the Social Engineering Attacks (cybersecuritynews.com) The rapid emergence of AI as a significant player in the field of technology  more broadly,  and cybersecurity, more specifically, has had a substantial and disruptive impact on many aspects within those fields. When taking a closer look at its cybersecurity implications, one of the major areas where AI's revolutionizing impact has taken hold has been within the landscape of social engineering attacks. Here, its usage has had a tangible impact by making social engineering operations more sophisticated and effective. Cybercriminals, APTs, and other threat actors alike are all able to leverage AI to enhance their tactics, techniques, and procedures, such as Business Email Compromise (BEC), spear phishing, and many more. This results in heightened risks for corporations and government entities surrounding potential cyberattacks and necessitates the need for mitigation ...

 Source:  Rockwell Advises Disconnecting Internet-Facing ICS Devices Amid Cyber Threats (thehackernews.com) Rockwell Automation, a leading American provider of industrial automation technology, recently updated its customers via an urgent advisory, imploring all of them not to allow public internet access to their industrial control systems (ICS). The reasoning behind this advisory is the intent to safeguard such systems against the increasing threat of malicious cyber activities, such as those driven by APTs and nation-states.  This  comes at a time when geopolitical tensions have reached their highest levels in recent memory across the globe, and cyber is being seen by many as a relatively low-cost but high-reward tool to use against one's adversaries globally.  Consequently, the advisory emphasizes that by nature, ICS systems should never be configured to connect directly to the public internet in the first place, as doing so significantly increases the attac...

 Source:  Researchers Warn of Chinese-Aligned Hackers Targeting South China Sea Countries (thehackernews.com) Recently, cybersecurity researchers have been able to unmask a previously hidden threat group named Unfading Sea Haze.  Active since  2018, the shadowy group made a name for itself by targeting high-level organizations, specifically in countries  that border  the South China Sea.  Its victim list includes everything from military organizations to government and political entities, and according to research conducted on it by Bitdefender, the group appears to be aligned with Chinese state interests, representing a worrying trend in the increased proliferation of nation-backed cybercrime. To this day, Unfading Sea Haze has targeted eight victims, and its signature attack mechanisms revolve around exploiting poor credential hygiene along with inadequate patching practices.  Specific tactics used by the group include  the  leveraging...

 Source:  Windows 11 to Deprecate NTLM, Add AI-Powered App Controls and Security Defenses (thehackernews.com) Recently, Microsoft announced a security-related uphaul for Windows 11 that included the deprecation of their classic NT LAN Manager (NTLM) protocol in favor of the more secure Kerberos protocol. The expected ETA of this change  is set  for the second half of 2024, with the vulnerabilities of NTLM being the main driver behind its deprecation by Microsoft. Said vulnerabilities include but are not limited to its lack of support for modern cryptographic algorithms, such as AES and SHA-256,  along with  its susceptibility to relay attacks. Thus, its replacement by the Kerberos protocol will signify the end of an era  to a degree , as NTLM has been a Windows classic ever since the early 2000s.  However, Microsoft's security-related enhancements for Windows 11 didn't stop at the simple deprecation and replacement of insecure protocols, as it wen...

 Source:  BlackPlague Malware Steals Discord Token & Telegram Sessions (cybersecuritynews.com) With online messaging applications being a mainstay of modern interpersonal communications, it is no surprise that malicious actors would seek to exploit and compromise them to achieve their various objectives. With that in mind, the BlackPlauge malware is only the latest iteration of this trend, as it  was specifically engineered  to target the popular messaging and communications platforms Discord and Telegram. Stealing session data and user tokens is the name of the game for this version of the malware, and its sophisticated approach embodies a critical threat to the confidentiality and integrity of countless users of these communication platforms worldwide.  BlackPlague's approach leverages vulnerabilities found in the communications platforms themselves, from which it can then pivot and extract session data, user tokens, and similar sensitive information from ...

 Source:  Cybersecurity researchers spotlight a new ransomware threat – be careful where you upload files (msn.com) Recently, researchers in the field of cybersecurity have uncovered a new ransomware threat that exploits the file upload capabilities of modern web browsers like Google Chrome and Microsoft Edge. This novel threat perfectly encapsulates the critical importance surrounding the security of APIs, as they play a central role in the exploitation process. Through the File System Access API, which allows web applications to interact with local users' file systems, attackers can leverage it to maliciously access local files, encrypt them, and demand a ransom from their victims. However, the sad reality is that even when a payment  is made  successfully, attackers are under no obligation to restore end-user access and, more often than not, tend to simply take the money without performing the service advertised to their victim.  The origins of this threat em...

 Source:  Hackers Exploited GitHub and FileZilla to Deliver Banking Malware (cybersecuritynews.com) According to the Inskit Group at Recorded Future, activities by Russian-speaking threat actors originating from the Commonwealth of Independent States (CIS) have been uncovered as the primary source behind the spread of sophisticated banking malware through GitHub and FileZilla. Despite being known as relatively secure collaboration platforms, their exploitation to spread sophisticated malware and malicious payloads throughout the internet poses a significant threat to both personal and business security.  The methodology used by the attackers revolved around creating fake Github accounts and repositories that mimicked legitimate software offerings such as Bartender 5 and Pixelmator Pro. Subsequently, they opted to instead populate their spoofed repositories with malicious software such as Atomic MacOS Stealer (AMOS) and Vidar, which were designed to steal sensitive informa...

 Source:  Iranian MOIS-Linked Hackers Behind Destructive Attacks on Albania and Israel (thehackernews.com) Recent revelations have uncovered a worrying trend surrounding Iranian hackers linked to their Ministry of Intelligence and Security (MOIS), namely that they've been the main suspects behind destructive cyberattacks targeting Albania and Israel. These threat actors, also known as 'Void Manticore,' have been utilizing a wiper malware to target critical systems in both countries whilst self-identifying themselves as 'Homeland Justice' and 'Karma.' The threat actors' patterns also display a striking correlation with geopolitical events involving Israel, Albania, and Iran, as attacks targeting the latter victim country had been ongoing since July 2022, while attacks against the former had only begun in earnest following the Israel-Palestine war in October 2023.  Void Manticore's attacks have caused significant disruption, as they've been charact...

 Source:  From Document to Script: Insides of Darkgate's Campaign (forcepoint.com) A recent analysis by Forcepoint's X-labs has uncovered a worrying threat vector through which cyber threats can target users , namely  through commonly shared documents, namely those in XLSX, PDF, and HTML formats.  These are a natural choice for any attacker primarily because of their sheer ubiquity. They represent trustable file formats for the average end user, who typically would open one upon receiving it with no hesitation or second thoughts. However, the research by X-labs has uncovered a phishing campaign called DarkGate, which utilizes a sophisticated attack methodology in which phishing emails containing standard file formats are just the start of a process, which often culminates in remote code execution and the hijacking of user machines. Notably, the campaign's bait of choice to target users are emails that appear to be invoices from 'Intuit QuickBooks', containing a PDF ...

 Source:  New Wi-Fi Vulnerability Enables Network Eavesdropping via Downgrade Attacks (thehackernews.com) Cybersecurity researchers have recently uncovered a vulnerability that currently impacts one of the most ubiquitous means of internet connectivity, namely the IEEE 802.11 Wi-Fi standard. This vulnerability allows attackers to use downgrade attacks to eavesdrop on traffic traversing the network, which can have broad implications for the confidentiality, integrity, and availability of the data in networks that are targeted by such attacks. Officially known as SSID confusion and tracked by MITRE as CVE-2023-52424, its scope is comprehensive, as all operating systems and Wi-Fi clients are vulnerable to exploitation. Most notably, the usage of more or less advanced Wi-Fi encryption protocols makes little difference, as clients using WPA3, WEP, 802.11X/EAP, and AMPE protocols are all affected by the attack, irrespective of their technical differences.  Regarding its technic...

Source:  30+ Tesla Cars Hacked Globally Using Third-Party Software (cybersecuritynews.com) Following up on our most recent blog post regarding the threat posed by misconfigurations, a recent incident impacting Tesla places those findings under a brighter spotlight. Due to vulnerabilities caused by misconfigurations in TeslaLogger, a third-party software used for data logging, security researcher Harish SG uncovered that  its insecure default settings could be exploited  to gain unauthorized access. After Harish discovered the issue, it  was reported  to the platform's maintainer, who  is expected  to have taken actions to mitigate or resolve that risk.  It is essential to clarify that the vulnerability and potential remote access associated with it did not reside in Tesla's vehicles or in Tesla's infrastructure but rather stemmed from misconfigurations surrounding the use of default credentials and improper storage of API keys by TeslaLogger. Desp...

 Source:  SugarGh0st RAT Attack Organizations & Individuals in AI Research (cybersecuritynews.com) Proofpoint, an enterprise cybersecurity company that specializes in SaaS and products for email security, recently conducted research that identified the SugarGh0st Remote Access Trojan (RAT) as a targeted threat aimed at AI research organizations. Attributed to the UNK_SweetSpecter threat cluster, the attack has  been noted  to be highly targeted, as its victims include academia, private industry, and even government targets who are involved in AI efforts within the U.S.  The attack's modus operandi  is centered  around phishing emails that utilize AI-themed baits sent from a free email account, typically containing phishing material attached to them. These may vary but tend to include a zip archive file that encapsulates a JavaScript dropper embedded within an LNK shortcut file, which  is then deployed  upon the victim's triggeri...

As a passionate and driven cybersecurity enthusiast, I embarked on a side project to enhance my knowledge of cloud security and networking using AWS. This project involved setting up a secure network across two AWS regions using custom VPNs and NAT on EC2 instances. The hands-on experience not only deepened my understanding of AWS but also set me on a path towards better understanding the principles of cloud security as a whole. Objectives and Requirements Objective: Demonstrate configuring a secure network across two AWS regions using custom VPNs and NAT on EC2 instances. Requirements: Select two AWS cloud regions. Create a VPC in each region with distinct CIDR blocks. Configure a public and private subnet in each VPC. Deploy a VPN Gateway VM in the public subnet and a Private VM in the private subnet of each region. Establish a secure tunnel using VPN software between the VPN Gateway VMs. Configure the VPN Gateway VM to provide NAT functionality for the Private VM. Update route table...

  Source:  New XM Cyber Research: 80% of Exposures from Misconfigurations, Less Than 1% from CVEs (thehackernews.com) Research conducted by XM Cyber has uncovered that a whopping 80% of security exposures are due to misconfigurations, while a comparatively minuscule 1% are from Common Vulnerabilities and Exposures (CVEs). Their research, which has studied over 40 million exposures, underlines that more efforts should  be directed  toward properly configuring systems to reduce cyber risk.  Focusing solely on  CVEs  results is a flawed security posture, as misconfigured systems can pose a more substantial risk to critical assets than previously understood. They can create more challenging vulnerabilities, especially since they do not appear on typical vulnerability scans that target software versions rather than configurations. Furthermore, with traditional security measures typically  being  CVE-focused, the odds of misconfigurations slipping ...