The Cybersecurity Express – 14 August, 2024

The platform hums with anticipation as you stand on the edge of the platform, the faint echo of a whistle signaling the approach of the Cybersecurity Express. The crisp air is filled with the energy of discovery, and as the sleek train glides into view, its doors slide open to reveal a world brimming with the latest cybersecurity insights and revelations. You can almost feel the electric buzz of information waiting to be uncovered.

As you step aboard, the conductor tips his hat with a knowing smile, hinting at the destinations ahead. Each stop promises a deep dive into critical security flaws, innovative defenses, and the ever-evolving strategies of those on the front lines of digital warfare. With a final glance at the station, you settle into your seat, ready for the journey—one that will take you through the twists and turns of today’s most pressing cybersecurity stories. The train begins to move, and the adventure into the heart of cybersecurity begins.

18-Year-Old Browser Vulnerability lurking on macOS and Linux Devices

Cybersecurity researchers have uncovered a significant vulnerability, dubbed “0.0.0.0 Day” that affects all major web browsers and poses a serious threat to macOS and Linux systems. This flaw, which has existed undetected since 2006, allows malicious websites to exploit how browsers handle network requests, potentially breaching local networks and compromising sensitive services running on users’ devices.

Researchers from Oligo, the Israeli application firm behind the discovery, explained that this vulnerability arises from inconsistent security implementations across different browsers and a lack of standardization. The critical flaw involves the misuse of the seemingly innocuous IP address 0.0.0.0, which can be weaponized by attackers to gain unauthorized access and even execute remote code on targeted systems outside the local network.

The vulnerability impacts popular browsers, including Google Chrome/Chromium, Mozilla Firefox, and Apple Safari. These browsers inadvertently allow external websites to communicate with local software on macOS and Linux machines using the 0.0.0.0 address instead of the more secure localhost/127.0.0.1. Notably, Windows devices are immune to this issue, as Microsoft has implemented measures to block the 0.0.0.0 IP address at the operating system level.

Oligo Security’s research highlighted that public websites using domains ending in “.com” could exploit this flaw to interact with services running on local networks. By dispatching specially crafted requests to the 0.0.0.0 address, attackers can bypass Private Network Access (PNA) protections, which are intended to prevent public websites from accessing endpoints within private networks. This bypass opens the door to unauthorized access and remote code execution.

The vulnerability also exposes applications that run on localhost and are reachable via the 0.0.0.0 address to significant risks. For instance, local Selenium Grid instances could be compromised by sending a POST request to 0.0.0.0:4444 with a crafted payload, leading to unintended and potentially dangerous consequences.

In response to these findings, which were disclosed in April 2024, major web browsers are expected to implement updates that block access to the 0.0.0.0 address entirely. This change aims to mitigate the risk by deprecating direct access to private network endpoints from public websites, thus strengthening the security posture of affected systems.

Avi Lumelsky, the lead researcher from Oligo Security, emphasized the importance of understanding the implications of this vulnerability. He pointed out that many services assume a constrained environment when using localhost, but this assumption can be faulty, leading to insecure server implementations. By exploiting this flaw, attackers can use public domains in conjunction with the “no-cors” mode to target services on localhost, potentially achieving arbitrary code execution with just a single HTTP request.

As the cybersecurity community reacts to this discovery, it serves as a stark reminder of the importance of continuous vigilance and the need for robust security standards across all platforms.

Security Flaws in Banking ATMs Expose Major Vulnerabilities

At the recent Defcon security conference, researcher Matt Burch revealed a concerning set of vulnerabilities in Diebold Nixdorf’s Vynamic Security Suite (VSS), a security solution widely deployed to protect ATMs. These flaws, if exploited, could allow attackers to bypass encryption and gain full control over an ATM, leading to potential financial theft and broader security breaches. Despite the availability of patches, there are concerns that many ATMs might remain vulnerable due to inconsistent patch deployment.

The vulnerabilities Burch uncovered are centered around VSS’s disk encryption functionality, which is critical for securing ATM hard drives. Unlike most ATM systems that use Microsoft’s BitLocker encryption, Diebold Nixdorf’s VSS incorporates a third-party integrity check during the boot process. This system operates in a dual-boot configuration, with both Linux and Windows partitions. The Linux partition runs a signature integrity check before the system boots into Windows for standard operation.

The core issue lies in the fact that the Linux partition responsible for these checks was not encrypted, leaving a significant security gap. Burch demonstrated that by manipulating the location of key validation files within this unencrypted Linux partition, an attacker could redirect code execution and gain control over the ATM. This type of attack would allow unauthorized access, potentially enabling attackers to withdraw funds or install malware undetected.

Diebold Nixdorf was first informed of these vulnerabilities by Burch in 2022, and the company responded by releasing patches to address the specific issues. However, as Burch continued to identify new variations of the vulnerabilities, additional patches were issued through 2023. The most substantial update came in April 2024 with the release of VSS version 4.4, which finally encrypts the Linux partition to close the exploit path Burch identified.

While these patches are crucial, Burch cautions that they may not be universally applied across all ATMs, particularly in environments where updating systems can be logistically challenging. This situation underscores the importance of timely patch deployment in maintaining the security of financial systems.

This discovery serves as a critical reminder of the need for robust encryption practices and regular security audits to ensure that vulnerabilities are promptly identified and addressed. As ATMs continue to be a target for sophisticated cybercriminals, maintaining and updating security systems is essential to prevent potentially devastating breaches.

Critical SAP Vulnerability Exposes Systems to Full Compromise

SAP has rolled out its August 2024 security patch package, addressing 17 vulnerabilities, including a critical authentication bypass flaw that could allow remote attackers to take full control of affected systems. The most severe of these vulnerabilities, tracked as CVE-2024-41730, is a “missing authentication check” bug in SAP BusinessObjects Business Intelligence Platform versions 430 and 440, which has been rated a Critical 9.8 on the CVSS v3.1 scale.

The flaw arises in scenarios where Single Sign-On (SSO) is enabled on Enterprise authentication. An attacker can exploit this by using a REST endpoint to obtain a logon token, which grants unauthorized access and potentially leads to complete system compromise. The result is a significant risk to confidentiality, integrity, and availability of the system, making it imperative for administrators to apply the patch immediately.

Another critical vulnerability addressed is CVE-2024-29415, a server-side request forgery (SSRF) flaw with a CVSS v3.1 Critical score of 9.1. This vulnerability affects applications built with SAP Build Apps older than version 4.11.130. The issue is rooted in a weakness within the ‘IP’ package for Node.js, which incorrectly identifies the loopback IP address ‘127.0.0.1’ as a public and globally routable address when expressed in octal representation. This flaw traces back to an incomplete fix for CVE-2023-42282, leaving some instances still vulnerable.

The update also includes patches for four high-severity vulnerabilities:

• CVE-2024-42374: An XML injection vulnerability in the SAP BEx Web Java Runtime Export Web Service affecting versions BI-BASE-E 7.5, BI-BASE-B 7.5, BI-IBC 7.5, BI-BASE-S 7.5, and BIWEBAPP 7.5.
• CVE-2023-30533: A prototype pollution flaw in SAP S/4 HANA, specifically within the Manage Supply Protection module, impacting library versions of SheetJS CE below 0.19.3.
• CVE-2024-34688: A Denial of Service (DOS) vulnerability in SAP NetWeaver AS Java, affecting the Meta Model Repository component version MMR_SERVER 7.5.
• CVE-2024-33003: An information disclosure vulnerability in SAP Commerce Cloud affecting multiple versions including HY_COM 1808, 1811, 1905, 2005, 2105, 2011, 2205, and COM_CLOUD 2211.

Given SAP’s prominence as the world’s largest ERP vendor, these vulnerabilities are particularly dangerous. Hackers continuously target SAP systems for flaws that could allow them to infiltrate highly valuable corporate networks.

In light of these risks, the US Cybersecurity and Infrastructure Security Agency (CISA) has repeatedly urged administrators to promptly apply SAP patches to safeguard against data theft, ransomware, and potential disruptions to mission-critical operations. This urgency is underscored by historical instances where unpatched SAP systems were exploited by threat actors to gain unauthorized access to corporate networks in at least 300 cases between June 2020 and March 2021.

Windows SmartScreen Zero-Day Exploited Since March

Microsoft has patched a critical vulnerability (CVE-2024-38213) in its Windows SmartScreen feature, which contained this zero-day since March 2024. The vulnerability allowed attackers to bypass SmartScreen protection, leaving users vulnerable to malicious software. SmartScreen, introduced with Windows 8, is designed to protect users by blocking potentially harmful files tagged with a Mark of the Web (MotW) label.

This flaw, despite requiring user interaction, posed a significant risk as it could be remotely exploited by unauthenticated attackers in low-complexity attacks. If successfully exploited, an attacker could bypass the SmartScreen warning and convince the user to execute malicious files.

The vulnerability was first identified in the wild by Trend Micro security researcher Peter Girnus, who reported the exploitation to Microsoft. Despite its critical nature, the flaw was patched only during the June 2024 Patch Tuesday, and the advisory was not included in either the June or July updates, raising concerns about disclosure practices.

The vulnerability, dubbed “copy2pwn,” was exploited by the DarkGate malware operators as part of a broader campaign to deliver malicious payloads disguised as legitimate software such as Apple iTunes and NVIDIA installers. This attack vector, particularly leveraging files from WebDAV shares during copy-and-paste operations, allowed attackers to bypass MotW protections and execute harmful code on the target system.

CVE-2024-38213 follows a series of related vulnerabilities, including CVE-2024-21412, which was itself a bypass for an earlier SmartScreen flaw (CVE-2023-36025). These vulnerabilities have been exploited by various cybercrime groups, including the financially motivated Water Hydra group, known for targeting trading platforms with the DarkMe remote access trojan (RAT).

Microsoft’s handling of SmartScreen vulnerabilities has come under scrutiny, especially after Elastic Security Labs reported a design flaw that has allowed attackers to launch programs without triggering security warnings since at least 2018. Microsoft has indicated that this issue “may be fixed” in a future Windows update.

As the security community continues to uncover and address these vulnerabilities, the importance of timely patching and transparency in security updates is underscored. Users are urged to stay vigilant, apply patches promptly, and remain cautious when handling files from untrusted sources.

In conclusion, the articles explored various critical cybersecurity topics, from vulnerabilities in widely-used platforms to the implications of newly discovered flaws. These discussions highlight the necessity for constant vigilance and proactive measures to safeguard systems against ever-evolving threats. Staying informed about the latest security updates and promptly applying patches is essential for minimizing risks. Thank you for joining us on this journey with the Cybersecurity Express. We appreciate your time and encourage you to return for more insightful content on protecting your digital world.