Remote Code Execution, Phishing, and More: Cato Research Labs Reviews January Security EventsFebruary 22, 2017
January started out with a bang as Check Point showed that pictures can be worth for more to hackers than just a 1,000 words. Embedding threats in images, though, wasn’t the only security story of significance last month. A number of other stories (and not of the political kind) also occupied the topics of conversation among researchers here at the Cato Research Labs.
ImageGate: Check Point uncovers a new method for distributing malware through images
Check Point researchers identified a new attack vector, named ImageGate, which embeds malware in image and graphic files. Furthermore, the researchers have discovered the hackers’ method of executing the malicious code within these images (source: Check Point blog).
The attack is very smooth. The attackers managed to trick both Facebook and LinkedIn filetype filters, delivering embedded malicious code that executes on the operating system. The attack is related to the massive malware campaign of Locky ransomware spread via social network channels that we discussed here. Facebook ended up aggressively blocking any Scalable Vector Graphics (SVG) files. Nice work by Check Point researchers for managing to upload a file with embedded malicious code and then change the filename to .hta
Buggy Domain Validation Forces GoDaddy To Revoke SSL Certificates
msm1267 quotes a report from Threatpost: GoDaddy has revoked, and begun the process of re-issuing, new SSL certificates for more than 6,000 customers after a bug was discovered in the registrar’s domain validation process (source: Slashdot).
On one hand, GoDaddy’s revoking that large number of web site certificates may seem like a very aggressive action. But GoDaddy engineers are probably aware that browsers do not validate certificates with CRLs by default as it may impact the browsing experience. So they decided to be on the safe side, in this case. Also, it’s surprising that GoDaddy was unable to trace back their logs and verify which websites were actually attacked.
Crime Doesn’t Pay. Shadow Brokers Close Up Shop After Failing to Sell Stolen NSA Hacking tools
Call it a victory for the good guys. The Shadow Brokers who previously stole and leaked a portion of NSA’s hacking tool-set closed up shop this month, a few days after trying to sell another package of hacking tools, “Equation Group Windows Warez.” The new tools included Windows exploits and antivirus bypass tools, stolen from the NSA-linked hacking unit, The Equation Group (source: The Hacker News). In a farewell message posted Thursday morning, group members said they were deleting their accounts and making an exit after their offers to release their entire cache of NSA hacking tools in exchange for a whopping 10,000 bitcoins (currently valued at more than $8.2 million) were rebuffed (source: Ars Technica)
The mysterious group that was with us since September has “retired.” Many of the tools they published affected firewall vendors and shows vulnerability of appliances. The Shadow Brokers may no longer be with us but from a technical perspective, but they leave a huge impact (as well as many questions about proper upgrades and patching) on the appliance industry.
Everyone Is Falling For This Frighteningly Effective Gmail Scam
Security researchers have identified a “highly effective” phishing scam that’s been fooling Google Gmail customers into divulging their login credentials. The scheme, which has been gaining popularity in the past few months and has reportedly been hitting other email services, involves a clever trick that can be difficult to detect (source: Fortune)
There’s still a buzz around the phishing scam that steals credentials from Gmail users. This one seems very effective, but frankly isn’t all that new. It’s been floating around at least since last June. Any enterprise with a properly-configured URL-filter or IPS (or subscribes to a service with one of those tools) can block the exfiltration site used in the attack.
Widely used WebEx plugin for Chrome will execute attack code—patch now!
Publicly known “magic string” lets any site run malicious code, no questions asked (source: Ars Technica).
Very impressive. Google researchers found a vulnerability in the Cisco Webex Chrome extension used by about 20 million users. The vulnerability lets any website execute arbitrary code on a client with the extension. Cisco has already released a patch, but companies will want to encourage users to reboot Chrome to upgrade their extensions. Meanwhile, they should consider applying a virtual patch.
Blocking these attachments will definitely reduce the attack surface, but won’t address the full problem. Attackers may still utilize other types of files (e.g. zipped, docs, pdf) to deliver attacks. Although these files are sandboxed, attackers can still rely on social engineering techniques to break out and run on the PC.