Author: Cyber Security Class

A high-severity vulnerability (CVE-2024-0762) has been discovered in the firmware (UEFI) of many popular PC models from major brands like Lenovo, Acer, Dell, and HP. This flaw could allow attackers to gain persistent, undetectable control over affected systems.

Understanding the Threat:

• UEFI Vulnerability: The flaw resides in the Phoenix SecureCore implementation of UEFI, a low-level firmware that boots your computer before the operating system takes over.
• Potential Impact: Attackers exploiting this vulnerability could potentially:
  • Gain Root Access: Infect the system at a very deep level, granting them complete control over the hardware.
  • Evade Security Measures: Bypass traditional antivirus and anti-malware software due to the deep-rooted nature of the infection.
  • Persistent Threat: Remain hidden even after a complete operating system reinstall.

Technical Breakdown (Simplified):

• Buffer Overflow: The vulnerability stems from improper memory allocation during a specific function call related to the Trusted Platform Module (TPM) configuration.
• Exploitation Method: By manipulating a variable size, attackers could potentially overflow a buffer and inject malicious code during the boot process.

Affected Devices and Patch Availability:

• Widespread Impact: Millions of PCs using Intel processors and Phoenix SecureCore firmware are potentially vulnerable. This includes various models from Lenovo, Acer, Dell, and HP.
• Patch Available: Phoenix Technologies released a patch in April 2024 to address this vulnerability.

Taking Action:

• Update Your UEFI Firmware: It’s crucial to update your UEFI firmware as soon as possible. Check your PC manufacturer’s website for specific instructions on how to update your firmware.
• Stay Informed: Monitor your PC manufacturer’s website for updates and ensure you have the latest firmware patch installed.
• Consider Additional Security Measures: Explore security solutions that offer advanced protection against firmware-level attacks, especially for high-risk systems.

Importance of Patching:

The critical nature of this vulnerability highlights the importance of keeping your firmware up-to-date. By patching this flaw promptly, you can significantly reduce the risk of having your system compromised by persistent malware lurking within the UEFI layer.

Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. Summitsystemsissp assumes no liability for the accuracy or consequences of using this information.

A critical vulnerability in Microsoft’s systems has been discovered that allows attackers to impersonate Microsoft corporate email accounts. This flaw could be exploited for large-scale phishing attacks, potentially compromising sensitive information or harming Microsoft’s reputation.

Details of the Vulnerability:

• Discovered by security researcher Vsevolod Kokorin (@Slonser).
• Allows anyone to forge Microsoft corporate email addresses, making phishing attempts appear legitimate.
• Technical details are not being publicly disclosed to prevent immediate exploitation.

I want to share my recent case:
> I found a vulnerability that allows sending a message from any user@domain
> We cannot reproduce it
> I send a video with the exploitation, a full PoC
> We cannot reproduce it
At this point, I decided to stop the communication with Microsoft. pic.twitter.com/mJDoHTn9Xv

— slonser (@slonser_) June 14, 2024

Timeline and Response:

• Kokorin reported the vulnerability to Microsoft but claims the company could not replicate the issue.
• Frustrated by the lack of response, Kokorin publicly disclosed the flaw on platform X (formerly Twitter).
• Microsoft has not yet responded to requests for comment.

Current Status and Recommendations:

• The vulnerability remains unpatched, raising concerns about potential ongoing exploitation.
• It is strongly recommended that Microsoft prioritize patching this critical flaw to protect its users and reputation.

Following Developments:

• We will continue to monitor the situation and report on any updates from Microsoft or the security community.

Actionable Steps for Users:

• While details are limited, be wary of any emails claiming to be from Microsoft, especially those with unusual urgency or requests for sensitive information.
• If unsure about an email’s legitimacy, contact the sender through a trusted channel to verify.
• Consider using email security solutions that can help detect phishing attempts.

By patching this vulnerability and raising awareness, Microsoft and its users can work together to mitigate the risk of email spoofing attacks.

Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. Summitsystemsissp assumes no liability for the accuracy or consequences of using this information.

Malicious “Fixes” Lurk Behind Fake Chrome, Word, and OneDrive Errors

Beware of a cunning malware campaign exploiting user trust in familiar software. Hackers are tricking victims into running malicious PowerShell scripts disguised as fixes for fake Google Chrome, Microsoft Word, and OneDrive errors.

Campaign Details:

• Multiple Threat Actors: This campaign involves a coordinated effort by multiple actors, including ClearFake, ClickFix, and TA571 (known for spam and ransomware attacks).
• Social Engineering Tactics: The attacks use website overlays displaying fake error messages that urge users to download and run a “fix” script via PowerShell.
• Varied Delivery Methods: The malicious script can be delivered through:
  • Compromised websites with JavaScript overlays
  • Booby-trapped HTML attachments resembling Word documents
  • Spam emails with malicious links

The ‘ClearFake’ attack chain
Source: Proofpoint

Here’s a breakdown of the different attack chains observed:

1. ClearFake’s Blockchain-Based Delivery:

• Users visit a compromised website that loads a malicious script hosted on the Binance Smart Chain.
• A fake Google Chrome error message appears, prompting the user to install a “root certificate” by copying and running a PowerShell script (as administrator).
• If executed, the script performs various checks and downloads additional payloads, including:
  • An information stealer
  • Tools to reset the DNS cache and clear clipboard content
• This attack targets users who might trust certificates as part of a secure connection.

Fake Google Chrome error
Source: Proofpoint

2. ClickFix Injects Fake Errors on Websites:

• Compromised websites are injected with code that creates an iframe overlay displaying a fake Google Chrome error message.
• Users are instructed to open PowerShell (as administrator) and paste a provided script, leading to malware infections.

Fake Microsoft Word error leads to malware
Source: Proofpoint

3. Email Phishing with Fake Word Document:

• Emails disguised as containing Word documents arrive with attachments.
• When opened, the attachment displays a fake error message asking users to install the “Word Online” extension to view the document.
• Two “fix” options are offered:
  • “How to fix”: copies a base64-encoded PowerShell command to the clipboard for manual execution.
  • “Auto-fix”: attempts to download a malicious file (MSI or VBS) disguised as a fix, leading to further infections.

Protecting Yourself:

• Never run scripts from untrusted sources, especially through PowerShell.
• Be wary of unexpected error messages, even from seemingly familiar apps.
• Verify the legitimacy of attachments and website links before opening them.
• Keep your software, including operating system and browser, updated with the latest security patches.
• Consider security solutions that can detect and block malicious PowerShell scripts.

By understanding these tactics, you can avoid falling victim to this deceptive campaign and safeguard your system from malware infections.

Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. Summitsystemsissp assumes no liability for the accuracy or consequences of using this information.

A US-led international law enforcement operation has successfully dismantled the 911 S5 botnet, believed to be the world’s largest ever. This global network of compromised devices, primarily targeting residential Windows computers, facilitated a vast array of criminal activities including cyberattacks, large-scale fraud, child exploitation, and more.

The Scope of 911 S5:

• Network of over 19 million compromised devices with IP addresses spanning the globe, including over 600,000 in the US alone.
• Offered access to these compromised devices for various criminal activities through a proxy service.

Alleged Mastermind and Charges:

• YunHe Wang, a 35-year-old Chinese national, was arrested and faces charges related to creating and operating 911 S5.
• Potential penalties include up to 65 years in prison if convicted on all charges.
• Wang is accused of generating nearly $99 million from selling access to compromised IP addresses between 2018 and 2022.

How Did It Work?

• Malware was distributed through seemingly legitimate applications like virtual private networks (VPNs) and pay-per-install services.
• Wang allegedly controlled a network of 150 servers, 76 of which were located in the US, for managing the botnet and selling access.
• These compromised devices were used as proxies, allowing criminals to mask their locations and activities.

Criminal Activities Facilitated by 911 S5:

• Theft of billions of dollars from financial institutions and government programs, including fraudulent claims during the COVID-19 pandemic.
• Cybercrime and online fraud.
• Stalking, bomb threats, and illegal exports.
• Transmission and possession of child exploitation materials.

Law Enforcement Response:

• A collaborative effort involving US, Singaporean, Thai, and German authorities disrupted 911 S5’s infrastructure.
• Over 23 domains and 70 servers were seized, effectively shutting down the botnet and its ability to target new victims.
• Approximately $30 million in assets were seized from connected residences, with potential for further forfeiture.

Significance of the Takedown:

The dismantling of 911 S5 represents a major victory for international law enforcement in disrupting a vast criminal network. This action serves as a deterrent to future cybercrime operations and protects individuals and organizations worldwide.

Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. Summitsystemsissp assumes no liability for the accuracy or consequences of using this information.

Security Alert: Two critical vulnerabilities found in Slider Revolution plugin threaten WordPress sites

A recent security audit has uncovered two significant vulnerabilities in Slider Revolution, a widely used premium plugin for WordPress boasting over 9 million active users. These vulnerabilities could compromise the security of WordPress websites, potentially allowing attackers to steal sensitive information and even gain full control of the site.

Understanding the Vulnerabilities:

1. Unauthenticated Stored XSS (CVE-2024-34444):
   • This vulnerability stemmed from the plugin’s inadequate handling of user input for slider parameters. Attackers could exploit this flaw to inject malicious scripts into the website with a single HTTP request, even without a valid user account. These scripts could then steal sensitive data like login credentials, session cookies, or other confidential information from unsuspecting users visiting the website.
2. Broken Access Control in REST API (CVE-2024-34443):
   • A flaw in the plugin’s REST API allowed unauthenticated users to update slider data. This, combined with the XSS vulnerability, could potentially allow attackers to achieve a more serious compromise, like gaining unauthorized access to the WordPress administration panel or even taking complete control of the website.

Patching and Best Practices:

The vulnerabilities have been addressed in recent updates of the Slider Revolution plugin:

• Unauthenticated Broken Access Control (CVE-2024-34444): Patched in version 6.7.0.
• Authenticated Stored XSS (CVE-2024-34443): Fully resolved in version 6.7.11 (the affected REST API endpoint was removed entirely, and proper input sanitization and output escaping were implemented).

Here are some additional recommendations for WordPress website owners:

• Update Immediately: It’s crucial to update the Slider Revolution plugin to version 6.7.11 (or later) as soon as possible to mitigate these vulnerabilities.
• Implement Escaping and Sanitization: Beyond patching, consider implementing thorough escaping and sanitization practices for all user input displayed on your website to prevent similar vulnerabilities in the future.
• Review REST API Permissions: If your website uses the Slider Revolution REST API, ensure proper permission checks are in place to restrict sensitive actions and processes to authenticated users.

By taking these steps, WordPress website owners can significantly improve their website’s security posture and protect themselves from these critical vulnerabilities in the Slider Revolution plugin.

Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. Summitsystemsissp assumes no liability for the accuracy or consequences of using this information.