On April 1st software testing firm, Codecov became aware of a security incident.

The company learned, that for over two months, Codecov’s Bash Uploader scripts used by hundreds or thousands of their customers had been altered with a malicious line of code that exfiltrated information in the environment variables present on the users’ CI/CD environments to an attacker’s IP address.

The flaw originated due to an error in the Docker image creation process, which, according to Codecov, “allowed the actor to extract the credential required to modify our Bash Uploader script.”

Codecov provides code coverage, testing, and stats to over 29,000 companies, and even has a handy GitHub app to integrate the tool right within your open-source software project.

As such, the security advisory released by Codecov strongly advised users to reset all of their credentials, tokens, or keys that were present in the environment variables in their CI processes that used Codecov uploaders.

Continue reading on Security Report for free.

The original post has been moved to Security Report due to multiple concerns about Medium expressed by many users [1, 2, 3].

What happens when the very antivirus designed to keep you and your organization safe becomes a threat vector for the attackers to exploit?

Yesterday, I broke the news story on Bleeping Computer about a remote code execution vulnerability which was recently discovered and disclosed by security researcher and blogger Wladimir Palant.

Palant explained how the vulnerability, CVE-2020–8102, impacted BitDefender versions up until the one released recently: “An automatic update to product version 24.0.20.116 or later fixes the issue,” stated the company in an advisory.

Vulnerability Identifier: CVE-2020–8102
Date disclosed: June 22nd, 2020
Impacted components: Bitdefender Safepay
CVSS Score: 8.8
CVSS 3 Metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The vulnerability when successfully exploited can let attackers execute remote code on a Bitdefender user’s machine from any malicious website they control!

Vulnerability origins

Like many leading antivirus products and in an effort to provide overall system security, BitDefender acts as a Man-in-the-Middle (MitM) proxy intercepting and inspecting encrypted HTTPS connections.

Most of these products have a component geared towards online security, referred to by Safe Browsing, Safe Search, Web Shield, etc.

The vulnerability stems from the fact how BitDefender handles SSL certificates. When an invalid SSL certificate is presented by a website, most modern browsers let the user decide: to accept the certificate at their risk, or to navigate away. Likewise, BitDefender in an effort to offer safer browsing experience to users, provides its customized version of such a webpage:

If a user still ignores HSTS warnings and continue to access the website at their own risk, that often poses no issues.

But, a key finding here, as Palant pointed out, is the URL itself within the address bar of the web browser remains constant. This causes Bitdefender Safepay to share security tokens between that (potentially malicious) page and any other website hosted on the same server and being accessed within Bitdefender’s Safepay virtual browsing environment.

Shared session tokens

Ideally these session tokens should not be shared between websites.

“The URL in the browser’s address bar doesn’t change. So as far as the browser is concerned, this error page originated at the web server and there is no reason why other web pages from the same server shouldn’t be able to access it. Whatever security tokens are contained within it, websites can read them out — an issue we’ve seen in Kaspersky products before,” Palant stated in his report.

Palant was able to verify this behavior by running a PoC. He setup a local web server and accessed it via Safepay. Initially, the server was designed to present a valid SSL certificate, but switching to an invalid one shortly after.

Once the certificate was switched to an invalid one, an AJAX request was made to download the SSL error page. Now, the same-origin policy in any web browser would naturally allow this request if it felt the same-origin was maintained, and so did Bitdefender Safepay.

“This allowed loading a malicious page in the browser, switching to an invalid certificate then and using XMLHttpRequest to download the resulting error page. This being a same-origin request, the browser will not stop you. In that page you would have the code behind the 'I understand the risks' link," Palant explained.

These “security tokens” are hardcoded values that don’t change during a session; which is alright, but the same tokens are shared between different websites due to this bug, which is a problem.

Additionally, Safe Search and Safe Banking features of the component don’t implement any further protections, “As it turns out, all functionality uses the same BDNDSS_B67EA559F21B487F861FDA8A44F01C50 and BDNDCA_BBACF84D61A04F9AA66019A14B035478 values, but Safe Search and Safe Banking don't implement any additional protection beyond that," said Palant.

Remote code execution

This means, if a victim is tricked into accessing an attacker-controlled website via Safepay, the attacker can now have visibility into these tokens. And because these tokens are shared between the “isolated” banking websites accessed during a session, the attacker now has the ability to compromise those sensitive websites running in the same Bitdefender Safepay browser session.

But it doesn’t stop here. the attacker-controlled site can abuse the same token functionality to execute arbitrary code remotely on the victim’s machine, via a crafted AJAX request.

In just one example, Palant demonstrated how an AJAX request with a “data:” URI could be used to instruct the victim’s machine to launch a command prompt window running “whoami”:

Bitdefender has issued an automatic security update in version 24.0.20.116 and above to patch this vulnerability.

Yes, a fix has been released to safeguard affected users, but vulnerabilities like these pose a greater question: how secure are antivirus products themselves?
In spite of best intentions, such as providing a secure browsing environment, what happened here certainly wouldn’t sit well with Bitdefender users.

Unless one is super-duper sure when playing Man-in-the-Middle (MitM), it is probably best to leave encrypted connections alone: just as they were meant to be.

Originally published at https://securityreport.com on June 23, 2020.

A group that goes by the name Distributed Denial of Secrets (DDoSecrets) has published 269 GB worth of data with hundreds of documents, images and sensitive information from over 200 police departments.

The legitimacy of this data has been confirmed by the National Fusion Center Association (NFCA) to KrebsOnSecurity.

Originally released via a tweet on Juneteeenth (Jun 19th) 2020, the dump, according to DDoSecrets, contains “ten years of data from over 200 police departments, fusion centers and other law enforcement training and support resources. Among the hundreds of thousands of documents are police and FBI reports, bulletins, guides and more.”

However, of particular importance is the fact the dataset also exposes some highly personally identifiable information (PII), email addresses, phone numbers and financial data such as bank account numbers.

NFCA told KrebsOnSecurity that the data associated with BlueLeaks appears to have been obtained from a previous data breach at the web development company, Netsential.

“Preliminary analysis of the data contained in this leak suggests that Netsential, a web services company used by multiple fusion centers, law enforcement, and other government agencies across the United States, was the source of the compromise,” stated NFCA. “Netsential confirmed that this compromise was likely the result of a threat actor who leveraged a compromised Netsential customer user account and the web platform’s upload feature to introduce malicious content, allowing for the exfiltration of other Netsential customer data.”

The timestamps on some of the documents go all the way back to August 1996 and end at 2020 dates, making the leak cover ~24 years worth of data.

Given the recent events and BLM protests, and the timing of the data leak (Junteenth), the move by DDoSecrets seems in retaliation. However, experts are skeptical if exposing the 269 gig dump does anything to expose police misconduct. Rather, some fear, the exposed data may harm innocent victims, and ongoing investigations, as a current lawyer and former US Department of Homeland Security (DHS) assistant secretary of policy, Stewart Baker stated:

“With this volume of material, there are bound to be compromises of sensitive operations and maybe even human sources or undercover police, so I fear it will put lives at risk,” said Baker. “Every organized crime operation in the country will likely have searched for their own names before law enforcement knows what’s in the files, so the damage could be done quickly. I’d also be surprised if the files produce much scandal or evidence of police misconduct. That’s not the kind of work the fusion centers do.”

Some members of DDoSecrets, including Emma Best, have clarified some common misconceptions about their group made by Bahama’s Attorney General’s Office.

“DDoSecrets was formed December 2018, not December 2019. This was reported by the AP at the time and can be easily determined by looking at our website or simply Googling the issue The data isn’t from [January 2020]. Our members are openly listed on our site,” said Best.

The massive data dump is being reviewed by journalists and analysts for any bits of information that may reveal something interesting.

More information should become available in due course of time.

Originally published at https://securityreport.com on June 22, 2020.

In a recently released vulnerability disclosure from d4rkn3ss from VNPT ISC as well as Adam Nichols of GRIMM, we learn of an unpatched vulnerability impacting at least 79 NETGEAR router models that can let an attacker execute code with “root” privileges.

Nichols downloaded NETGEAR firmware from their website and began decompiling it using disassemblers and analysis tools like Hex-Rays.

The researcher was able to quickly figure out, browsing through the web server’s code in the firm, that certain variables, such as user_input were vulnerable to an overflow.

“After the call to read_content (the recv helper function), the parser does some error checking, combines the received content with any previously received content, and then looks for the strings name="mtenFWUpload" and "\r\n\r\n" in the user input," states the disclosure.

“If the user input contains these strings, the rest of the user input after these strings is passed to the abCheckBoardID function. Grepping the firmware's root file system, we can see that the string mtenFWUpload is referenced from the files www/UPG_upgrade.htm and www/Modem_upgrade.htm, and thus we can conclude that this is part of the router's upgrade functionality."

While most modern devices have protection technologies like “stack canaries”, ASLR and DEP to protect against code execution, should a buffer overflow exploit succeed, this isn’t the case for select NetGear models.

“In most modern software, this vulnerability would be unexploitable. Modern software typically contains stack cookies which would prevent exploitation. However, the R7000 does not use stack cookies. In fact, of all of the Netgear products which share a common codebase, only the D8500 firmware version 1.0.3.29 and the R6300v2 firmware versions 1.0.4.12–1.0.4.20 use stack cookies. However, later versions of the D8500 and R6300v2 stopped using stack cookies, making this vulnerability once again exploitable. This is just one more example of how SOHO device security has fallen behind as compared to other modern software.”

Nichols has provided a proof-of-concept (exploit) for the vulnerability.

The same vulnerability was also disclosed on Zero Day Initiative (ZDI) by d4rkn3ss from VNPT ISC and has been assigned the identifier, ZDI-CAN-9703 while a CVE assignment is pending.

While 79 models of NetGear routers remain unpatched, the disclosures of this vulnerability did not follow the standard guidelines, reads the ZDI advisory:

“Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the service to trusted machines. Only the clients and servers that have a legitimate procedural relationship with the service should be permitted to communicate with it. This could be accomplished in a number of ways, most notably with firewall rules/whitelisting.”

A list of 79 router models that are vulnerable is as follows:

AC1450
D6220
D6300
D6400
D7000v2
D8500
DC112A
DGN2200
DGN2200v4
DGN2200M
DGND3700
EX3700
EX3800
EX3920
EX6000
EX6100
EX6120
EX6130
EX6150
EX6200
EX6920
EX7000
LG2200D
MBM621
MBR624GU
MBR1200
MBR1515
MBR1516
MBRN3000
MVBR1210C
R4500
R6200
R6200v2
R6250
R6300
R6300v2
R6400
R6400v2
R6700
R6700v3
R6900
R6900P
R7000
R7000P
R7100LG
R7300
R7850
R7900
R8000
R8300
R8500
RS400
WGR614v8
WGR614v9
WGR614v10
WGT624v4
WN2500RP
WN2500RPv2
WN3000RP
WN3100RP
WN3500RP
WNCE3001
WNDR3300
WNDR3300v2
WNDR3400
WNDR3400v2
WNDR3400v3
WNDR3700v3
WNDR4000
WNDR4500
WNDR4500v2
WNR834Bv2
WNR1000v3
WNR2000v2
WNR3500
WNR3500v2
WNR3500L
WNR3500Lv2
XR300

At this time, it is not known when will a patch be released.

Originally published at https://securityreport.com on June 19, 2020.

In a new report published by ESET’s researchers, we learn of Operation In(ter)ception which heavily targeted aerospace and military organizations.

“To compromise their targets, the attackers used social engineering via LinkedIn, hiding behind the ruse of attractive, but bogus, job offers,” reads the report.

“Having established an initial foothold, the attackers deployed their custom, multistage malware, along with modified open-source tools. Besides malware, the adversaries made use of living off the land tactics, abusing legitimate tools and OS functions. Several techniques were used to avoid detection, including code signing, regular malware recompilation and impersonating legitimate software and companies.”

The name In(ter)ception comes from the Inception.dll file dropped by the malware behind these attacks.

It starts with ‘recruiting’

A typical attack scenario begins with a message from a LinkedIn person pretending to be an HR representative or recruiter from companies like Collins Aerospace (previously Rockwell Collins) and General Dynamics, which are major U.S. aerospace and defense companies.

The “job description” sent via LinkedIn messaging to the victim comprises an RAR archive, which further contains an “LNK” file. This LNK file has no purpose but to fire off a command prompt to download a remotely-hosted decoy PDF. After opening the “job description” PDF, the command prompt also initiates processes, such as WMIC.exe and a Task Scheduler activity, to conduct malicious tasks.

The Scheduled Task once created, is designed to run a remotely-fetched XSL script downloading payloads for execution during the following stages of the attack.

The attackers behind the campaign are believed to be Lazarus Group, the same North Korean group that had targeted Sony Pictures during the release of 2014 movie, The Interview.

The multi-step attack is also sophisticated in how it not only renames malicious files to conceal them but alters legitimate Windows tools as well.

“Interestingly, it was not just malicious files that were renamed — the attackers also manipulated the abused Windows utilities. They copied the utilities to a new folder (e.g. C:\NVIDIA) and renamed them (e.g. regsvr32.exe was renamed to NvDaemon.exe),” stated the report.

Further, the researchers observed that the malware was cryptographically signing its malicious components, possibly using stolen certificate keys.

“Second, the attackers digitally signed some components of their malware, namely the custom downloader and backdoor, and the dbxcli tool. The certificate was issued in October 2019 — while the attacks were active — to 16:20 Software, LLC. According to our research, 16:20 Software, LLC is an existing company based in Pennsylvania, USA, incorporated in May 2010.”

The malware could be also observed recompiling files several times during its execution.

The major purpose of this attack is to gather and exfiltrate sensitive files and to compromise business accounts. The captured data was seen being uploaded to cloud services, such as Dropbox. This was done using the dbxcli tool — a customised version of Dropbox client bundled with the malware.

The researchers aren’t entirely sure as to what exactly were the adversaries after. However, the understanding is their targets were businesses in an effort to extract technical and business secrets.

“Unfortunately, neither the malware analysis nor the investigation allowed us to gain insight into what files the Operation In(ter)ception attackers were after. However, the job titles of the employees targeted via LinkedIn suggest that the attackers were interested in technical and business-related information.”

ESET researchers’ detailed findings have been made available in both the blog post and a PDF research paper.

Originally published at https://securityreport.com on June 18, 2020.