Threat Report
In this weekly threat report, we’ll cover three current events. Facebook loses 50 million auth tokens, a phishing campaign is evading AV to deploy remote access trojans, and a ten-year-old privilege escalation vulnerability has major Linux distributions scrambling to release.
Facebook loses control of auth tokens used for FB and every site you log into using Facebook SSO.
On Friday, September 29, Facebook announced an attacker exploited a vulnerability and potentially compromised up to 50 million users Facebook accounts. The vulnerability exposed user access tokens in the HTML of the site page. Facebook published a statement on this incident, which it later updated with further technical details describing the nature of the vulnerability as the combination of three unknown flaws in a feature known as ‘View As.’
The statement included the following:
“Earlier this week, we discovered that an external actor attacked our systems and exploited a vulnerability that exposed Facebook access tokens for people’s accounts in HTML when we rendered a particular component of the ‘View As’ feature. The vulnerability was the result of the interaction of three distinct bugs:
First: View As is a privacy feature that lets people see what their profile looks like to someone else. View As should be a view-only interface. However, for one type of composer (the box that lets you post content to Facebook) — specifically the version that enables people to wish their friends happy birthday — View As incorrectly provided the opportunity to post a video.
Second: A new version of our video uploader, introduced in July 2017, incorrectly generated an access token that had the permissions of the Facebook mobile app.
Third: When the video uploader appeared as part of View As, it generated the access token not for you as the viewer, but for the user that you were looking up.”
Fifty million users were potentially affected by this vulnerability. As a precaution, Facebook has reset the tokens. However, it does nothing to resolve the potential data an attacker may have stolen.
Facebook confirmed that these access tokens might have been used to login to third-party sites via Facebook’s SSO. According to a 2015 report by Gigya, Facebook had the largest share of all identity providers at a 64% share of social login. This aspect of the breach makes it particularly nasty and should remind everyone of the risk of centralized authentication and single sign-on.
Resources:
Phishing expedition dodges AV to land Adwind RAT
Security researchers from Cisco Talos with ReversingLabs have released a report regarding a new campaign dropping Adwind Trojan. This new phishing spam campaign spreads the Adwind 3.0 RAT which infects Windows, Mac OSX, and Linux operating systems. The spam email contains weaponized malicious “.csv” and “.xlt” file attachments to entice the user to open.
Adwind 3.0 has a set of new tools, especially an evasion technique by utilizing the Dynamic Data Exchange (DDE) code-injection technique. This DDE, which transfer data between applications, compromises Microsoft Excel. Microsoft Excel opens by default the two droppers found in this campaign, the “.csv” and “.xlt.” Researchers note that this is part of the obfuscation technique applied wherein signature-based anti-virus aren’t able to detect. Instead of identifying that it is a malicious file, it prompts that it is corrupted. If the user opens the file, it executes the dropper. It creates a Visual Basic script that uses bitsadmin tool, which loads the final Java archive payload that contains Adwind installer.
This kind of injection has been used for years, but the treat actor was able to customize it to have an extremely low detection ratio. Other functions of this RAT includes log keystrokes, take screenshots, take pictures, transfer files, or execute any other command from its C&C Server. Researchers have verified that the malware has been targeting mostly Turkey and Germany, but many malware samples have also been detected in the US, India, Vietnam, and Hong Kong. Researchers have noted that sandboxing and behavior-based detections should be able to detect and stop this spam campaign.
Resources:
Hashes:
- 93a482e554e2a37e6893fdd8cd92537c0ebc7363ac5fac44b7a4af4a2088ea24
- 0af2c5a46df16b98b9ab5af0ec455e98f6e1928c10ed8b6ffec69573498bdd8a
- 93280872f685f9c26d5f668ca1303f224a38d2b86ba707cdbb3d57427396e752
- 0a2f74a7787ae904e5a22a3c2b3acf0316c10b95fae08cced7ca5e2fcc7d9bf8
- 65220dae459432deb1b038dbcbf8a379519a1a797b7b72f6408f94733bc5a2c2
URLs:
- http://www[.]qakeyewoha[.]club/?from=@
- http://www[.]avrasyayapi[.]live/?from=@
- http://www[.]birlikholding[.]live/?from=@
- http://avrasyagrup[.]live
- http://www[.]erayinsaat[.]live/?from=@
- http://www[.]yeyamohofe[.]club/?from=@
Mutagen Astronomy (CVE-2018-14634) creates a deep impact on Red Hat, CentOS, and Debian
Risk managers better get that VRM and start checking on vendor patch levels. Security researchers from Qualys have discovered a vulnerability named Mutagen Astronomy (CVE-2018-14634) that affects Red Hat Enterprise Linux (RHEL), CentOS, and Debian users. The critical vulnerability can be used for Local Privilege Escalation (LPE)on 64-bit systems. An integer overflow triggers the vulnerability in the create_elf_tables() Linux kernel function. If exploited, it causes a buffer overflow that executes malicious code with root privileges. According to researchers, Mutagen Astronomy was present in the Linux kernel between July 19, 2007 (kernel commit: b6a2fea39318) and July 7, 2017 (kernel commit: da029c11e6b1). Researchers were able to publish two proof of concept (PoC)s for Mutagen Astronomy. The Red Hat Team has confirmed this vulnerability. Some releases have been patched while some are still vulnerable. If a fix has not been released for your version, a patch is available.
Resources:
We'd love to hear your thoughts. Find us on Twitter, LinkedIn or write in to hello@perchsecurity.com
Next: Threat Report Thursday September 28th 2018
Share this on:
Subscribe to our blog